Skip to content
attack

Class: StixArtifact

An array of bytes, carried as base64 in payload_bin, or a link to a file-like payload.

URI: attack:StixArtifact

 classDiagram
    class StixArtifact
    click StixArtifact href "../StixArtifact/"
      StixCyberObservableObject <|-- StixArtifact
        click StixCyberObservableObject href "../StixCyberObservableObject/"
      
      StixArtifact : decryption_key
        
      StixArtifact : defanged
        
      StixArtifact : encryption_algorithm
        
          
    
        
        
        StixArtifact --> "0..1" StixEncryptionAlgorithm : encryption_algorithm
        click StixEncryptionAlgorithm href "../StixEncryptionAlgorithm/"
    

        
      StixArtifact : extensions
        
          
    
        
        
        StixArtifact --> "0..1" StixExtensions : extensions
        click StixExtensions href "../StixExtensions/"
    

        
      StixArtifact : granular_markings
        
          
    
        
        
        StixArtifact --> "1..*" StixGranularMarking : granular_markings
        click StixGranularMarking href "../StixGranularMarking/"
    

        
      StixArtifact : hashes
        
          
    
        
        
        StixArtifact --> "0..1" StixHashes : hashes
        click StixHashes href "../StixHashes/"
    

        
      StixArtifact : id
        
      StixArtifact : mime_type
        
      StixArtifact : object_marking_refs
        
          
    
        
        
        StixArtifact --> "1..*" StixMarkingDefinition : object_marking_refs
        click StixMarkingDefinition href "../StixMarkingDefinition/"
    

        
      StixArtifact : payload_bin
        
      StixArtifact : spec_version
        
          
    
        
        
        StixArtifact --> "0..1" StixSpecVersion : spec_version
        click StixSpecVersion href "../StixSpecVersion/"
    

        
      StixArtifact : type
        
      StixArtifact : url

Inheritance

Section titled “Inheritance”

Slots

Section titled “Slots”
Name Cardinality and Range Description Inheritance
mime_type 0..1
String		 The MIME type of the content, as the IANA Media Types registry names it direct
payload_bin 0..1
StixBinary		 Specifies the binary data contained in the artifact as a base64-encoded strin… direct
url 0..1
Uri		 A URL direct
hashes 0..1
StixHashes		 A dictionary of hashes of the content, keyed by hash algorithm direct
encryption_algorithm 0..1
StixEncryptionAlgorithm		 If the artifact is encrypted, specifies the type of encryption algorithm the … direct
decryption_key 0..1
String		 Specifies the decryption key for the encrypted binary data (either via payloa… direct
defanged 0..1
Boolean		 Defines whether or not the data contained within the object has been defanged StixCyberObservableObject
id 1
StixIdentifier		 The identifier of the object: its STIX type, two hyphens and a UUID StixObject
type 1
String		 The STIX type name of the object, such as attack-pattern StixObject
spec_version 0..1
StixSpecVersion		 The version of the STIX specification used to represent the object StixObject
object_marking_refs 1..*
StixMarkingDefinition		 References to the marking definitions that apply to the object StixObject
granular_markings 1..*
StixGranularMarking		 The granular markings that apply to parts of the object StixObject
extensions 0..1
StixExtensions		 The object’s extensions, as a dictionary keyed by extension name StixObject
Expressions & Logic

Any Of

Section titled “Any Of”

The class must satisfy at least one of:

  • AnonymousClassExpression({ ‘slot_conditions’: {‘payload_bin’: SlotDefinition({‘name’: ‘payload_bin’, ‘required’: True})} })
  • AnonymousClassExpression({‘slot_conditions’: {‘url’: SlotDefinition({‘name’: ‘url’, ‘required’: True})}})

Usages

Section titled “Usages”
used by used in type used
AttackMalware sample_refs any_of[range] StixArtifact
StixEmailMessage raw_email_ref range StixArtifact
StixFile content_ref range StixArtifact
StixNetworkTraffic src_payload_ref range StixArtifact
StixNetworkTraffic dst_payload_ref range StixArtifact
StixHttpRequestExtension message_body_data_ref range StixArtifact
StixMimePart body_raw_ref any_of[range] StixArtifact
StixMalware sample_refs any_of[range] StixArtifact
StixMalwareAnalysis sample_ref any_of[range] StixArtifact

Rules

Section titled “Rules”

Rule Applied Preconditions Postconditions Elseconditions
slot_conditions {'payload_bin': {'value_presence': 'PRESENT'}} {'url': {'value_presence': 'ABSENT'}}

Section titled “”
Rule Applied Preconditions Postconditions Elseconditions
slot_conditions {'url': {'value_presence': 'PRESENT'}} {'hashes': {'required': True}}

Section titled “”
Rule Applied Preconditions Postconditions Elseconditions
slot_conditions {'decryption_key': {'value_presence': 'PRESENT'}} {'encryption_algorithm': {'required': True}}

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Annotations

Section titled “Annotations”
property value
stix_type artifact

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self attack:StixArtifact
native attack:StixArtifact

LinkML Source

Section titled “LinkML Source”

Direct

Section titled “Direct”
name: StixArtifact
annotations:
  stix_type:
    tag: stix_type
    value: artifact
description: An array of bytes, carried as base64 in payload_bin, or a link to a file-like
  payload.
from_schema: https://w3id.org/lmodel/attack
is_a: StixCyberObservableObject
slots:
- mime_type
- payload_bin
- url
- hashes
- encryption_algorithm
- decryption_key
slot_usage:
  id:
    name: id
    pattern: ^artifact--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: artifact
  mime_type:
    name: mime_type
    pattern: ^(application|audio|font|image|message|model|multipart|text|video)/[a-zA-Z0-9.+_-]+
rules:
- preconditions:
    slot_conditions:
      payload_bin:
        name: payload_bin
        value_presence: PRESENT
  postconditions:
    slot_conditions:
      url:
        name: url
        value_presence: ABSENT
  description: payload_bin and url exclude each other.
- preconditions:
    slot_conditions:
      url:
        name: url
        value_presence: PRESENT
  postconditions:
    slot_conditions:
      hashes:
        name: hashes
        required: true
  description: An artifact given by url carries its hashes.
- preconditions:
    slot_conditions:
      decryption_key:
        name: decryption_key
        value_presence: PRESENT
  postconditions:
    slot_conditions:
      encryption_algorithm:
        name: encryption_algorithm
        required: true
  description: A decryption key needs an encryption algorithm.
any_of:
- slot_conditions:
    payload_bin:
      name: payload_bin
      required: true
- slot_conditions:
    url:
      name: url
      required: true

Induced

Section titled “Induced”
name: StixArtifact
annotations:
  stix_type:
    tag: stix_type
    value: artifact
description: An array of bytes, carried as base64 in payload_bin, or a link to a file-like
  payload.
from_schema: https://w3id.org/lmodel/attack
is_a: StixCyberObservableObject
slot_usage:
  id:
    name: id
    pattern: ^artifact--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: artifact
  mime_type:
    name: mime_type
    pattern: ^(application|audio|font|image|message|model|multipart|text|video)/[a-zA-Z0-9.+_-]+
attributes:
  mime_type:
    name: mime_type
    description: The MIME type of the content, as the IANA Media Types registry names
      it.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:mime_type
    owner: StixArtifact
    domain_of:
    - StixArtifact
    - StixFile
    range: string
    pattern: ^(application|audio|font|image|message|model|multipart|text|video)/[a-zA-Z0-9.+_-]+
  payload_bin:
    name: payload_bin
    description: Specifies the binary data contained in the artifact as a base64-encoded
      string.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:payload_bin
    owner: StixArtifact
    domain_of:
    - StixArtifact
    range: stix_binary
  url:
    name: url
    description: A URL.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:url
    owner: StixArtifact
    domain_of:
    - StixExternalReference
    - StixArtifact
    range: uri
  hashes:
    name: hashes
    description: A dictionary of hashes of the content, keyed by hash algorithm.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:hashes
    owner: StixArtifact
    domain_of:
    - StixExternalReference
    - StixArtifact
    - StixFile
    - StixX509Certificate
    - StixAlternateDataStream
    - StixWindowsPeSection
    - StixWindowsPeOptionalHeader
    range: StixHashes
    inlined: true
  encryption_algorithm:
    name: encryption_algorithm
    description: If the artifact is encrypted, specifies the type of encryption algorithm
      the binary data (either via payload_bin or url) is encoded in.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:encryption_algorithm
    owner: StixArtifact
    domain_of:
    - StixArtifact
    range: StixEncryptionAlgorithm
  decryption_key:
    name: decryption_key
    description: Specifies the decryption key for the encrypted binary data (either
      via payload_bin or url).
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:decryption_key
    owner: StixArtifact
    domain_of:
    - StixArtifact
    range: string
  defanged:
    name: defanged
    description: Defines whether or not the data contained within the object has been
      defanged.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:defanged
    owner: StixArtifact
    domain_of:
    - StixCyberObservableObject
    range: boolean
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: StixArtifact
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
    pattern: ^artifact--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: StixArtifact
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
    equals_string: artifact
  spec_version:
    name: spec_version
    description: The version of the STIX specification used to represent the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:spec_version
    owner: StixArtifact
    domain_of:
    - StixObject
    range: StixSpecVersion
  object_marking_refs:
    name: object_marking_refs
    description: References to the marking definitions that apply to the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectMarking
    rank: 1000
    slot_uri: stix:object_marking_refs
    owner: StixArtifact
    domain_of:
    - StixObject
    range: StixMarkingDefinition
    multivalued: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  granular_markings:
    name: granular_markings
    description: The granular markings that apply to parts of the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:granular_markings
    owner: StixArtifact
    domain_of:
    - StixObject
    range: StixGranularMarking
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  extensions:
    name: extensions
    description: The object's extensions, as a dictionary keyed by extension name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:extensions
    owner: StixArtifact
    domain_of:
    - StixObject
    range: StixExtensions
    inlined: true
rules:
- preconditions:
    slot_conditions:
      payload_bin:
        name: payload_bin
        value_presence: PRESENT
  postconditions:
    slot_conditions:
      url:
        name: url
        value_presence: ABSENT
  description: payload_bin and url exclude each other.
- preconditions:
    slot_conditions:
      url:
        name: url
        value_presence: PRESENT
  postconditions:
    slot_conditions:
      hashes:
        name: hashes
        required: true
  description: An artifact given by url carries its hashes.
- preconditions:
    slot_conditions:
      decryption_key:
        name: decryption_key
        value_presence: PRESENT
  postconditions:
    slot_conditions:
      encryption_algorithm:
        name: encryption_algorithm
        required: true
  description: A decryption key needs an encryption algorithm.
any_of:
- slot_conditions:
    payload_bin:
      name: payload_bin
      required: true
- slot_conditions:
    url:
      name: url
      required: true