Class: StixAlternateDataStream

An NTFS alternate data stream of a file.

URI: attack:StixAlternateDataStream

 classDiagram
    class StixAlternateDataStream
    click StixAlternateDataStream href "../StixAlternateDataStream/"
      StixAlternateDataStream : hashes
        
          
    
        
        
        StixAlternateDataStream --> "0..1" StixHashes : hashes
        click StixHashes href "../StixHashes/"
    

        
      StixAlternateDataStream : name
        
      StixAlternateDataStream : size
        
      

Slots

Name	Cardinality and Range	Description	Inheritance
name	1 String	A name that identifies the object	direct
hashes	0..1 StixHashes	A dictionary of hashes of the content, keyed by hash algorithm	direct
size	0..1 Integer	A size in bytes, as a non-negative integer	direct

Usages

used by	used in	type	used
StixNtfsExtension	alternate_data_streams	range	StixAlternateDataStream

Identifier and Mapping Information

Schema Source

• from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type	Mapped Value
self	attack:StixAlternateDataStream
native	attack:StixAlternateDataStream
close	uco-observable:AlternateDataStream

LinkML Source

Direct

name: StixAlternateDataStream
description: An NTFS alternate data stream of a file.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:AlternateDataStream
slots:
- name
- hashes
- size
slot_usage:
  name:
    name: name
    required: true

Induced

name: StixAlternateDataStream
description: An NTFS alternate data stream of a file.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:AlternateDataStream
slot_usage:
  name:
    name: name
    required: true
attributes:
  name:
    name: name
    description: A name that identifies the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:name
    rank: 1000
    slot_uri: stix:name
    owner: StixAlternateDataStream
    domain_of:
    - AttackTactic
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelatedAsset
    - AttackLogSource
    - AttackLogSourceReference
    - StixIdentity
    - StixMarkingDefinition
    - StixExtensionDefinition
    - StixAutonomousSystem
    - StixFile
    - StixMutex
    - StixSoftware
    - StixAlternateDataStream
    - StixWindowsPeSection
    - StixWindowsRegistryValue
    - StixAttackPattern
    - StixCampaign
    - StixCourseOfAction
    - StixGrouping
    - StixIncident
    - StixIndicator
    - StixInfrastructure
    - StixIntrusionSet
    - StixLocation
    - StixMalware
    - StixReport
    - StixThreatActor
    - StixTool
    - StixVulnerability
    range: string
    required: true
  hashes:
    name: hashes
    description: A dictionary of hashes of the content, keyed by hash algorithm.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:hashes
    owner: StixAlternateDataStream
    domain_of:
    - StixExternalReference
    - StixArtifact
    - StixFile
    - StixX509Certificate
    - StixAlternateDataStream
    - StixWindowsPeSection
    - StixWindowsPeOptionalHeader
    range: StixHashes
    inlined: true
  size:
    name: size
    description: A size in bytes, as a non-negative integer.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:size
    owner: StixAlternateDataStream
    domain_of:
    - StixFile
    - StixAlternateDataStream
    - StixWindowsPeSection
    range: integer
    minimum_value: 0