Skip to content
attack

Class: StixFile

The File Object represents the properties of a file.

URI: attack:StixFile

 classDiagram
    class StixFile
    click StixFile href "../StixFile/"
      StixCyberObservableObject <|-- StixFile
        click StixCyberObservableObject href "../StixCyberObservableObject/"
      
      StixFile : atime
        
      StixFile : contains_refs
        
          
    
        
        
        StixFile --> "1..*" StixCyberObservableObject : contains_refs
        click StixCyberObservableObject href "../StixCyberObservableObject/"
    

        
      StixFile : content_ref
        
          
    
        
        
        StixFile --> "0..1" StixArtifact : content_ref
        click StixArtifact href "../StixArtifact/"
    

        
      StixFile : ctime
        
      StixFile : defanged
        
      StixFile : extensions
        
          
    
        
        
        StixFile --> "0..1" StixFileExtensions : extensions
        click StixFileExtensions href "../StixFileExtensions/"
    

        
      StixFile : granular_markings
        
          
    
        
        
        StixFile --> "1..*" StixGranularMarking : granular_markings
        click StixGranularMarking href "../StixGranularMarking/"
    

        
      StixFile : hashes
        
          
    
        
        
        StixFile --> "0..1" StixHashes : hashes
        click StixHashes href "../StixHashes/"
    

        
      StixFile : id
        
      StixFile : magic_number_hex
        
      StixFile : mime_type
        
      StixFile : mtime
        
      StixFile : name
        
      StixFile : name_enc
        
      StixFile : object_marking_refs
        
          
    
        
        
        StixFile --> "1..*" StixMarkingDefinition : object_marking_refs
        click StixMarkingDefinition href "../StixMarkingDefinition/"
    

        
      StixFile : parent_directory_ref
        
          
    
        
        
        StixFile --> "0..1" StixDirectory : parent_directory_ref
        click StixDirectory href "../StixDirectory/"
    

        
      StixFile : size
        
      StixFile : spec_version
        
          
    
        
        
        StixFile --> "0..1" StixSpecVersion : spec_version
        click StixSpecVersion href "../StixSpecVersion/"
    

        
      StixFile : type

Inheritance

Section titled “Inheritance”

Slots

Section titled “Slots”
Name Cardinality and Range Description Inheritance
hashes 0..1
StixHashes		 A dictionary of hashes of the content, keyed by hash algorithm direct
size 0..1
Integer		 A size in bytes, as a non-negative integer direct
name 0..1
String		 A name that identifies the object direct
name_enc 0..1
String		 Specifies the observed encoding for the name of the file direct
magic_number_hex 0..1
StixHex		 Specifies the hexadecimal constant (‘magic number’) associated with a specifi… direct
mime_type 0..1
String		 The MIME type of the content, as the IANA Media Types registry names it direct
ctime 0..1
StixTimestamp		 The time at which the object was created direct
mtime 0..1
StixTimestamp		 The time at which the object was last written to direct
atime 0..1
StixTimestamp		 The time at which the object was last accessed direct
parent_directory_ref 0..1
StixDirectory		 Specifies the parent directory of the file, as a reference to a Directory Obj… direct
contains_refs 1..*
StixCyberObservableObject		 References to other cyber-observable objects that this one contains direct
content_ref 0..1
StixArtifact		 Specifies the content of the file, represented as an Artifact Object direct
defanged 0..1
Boolean		 Defines whether or not the data contained within the object has been defanged StixCyberObservableObject
id 1
StixIdentifier		 The identifier of the object: its STIX type, two hyphens and a UUID StixObject
type 1
String		 The STIX type name of the object, such as attack-pattern StixObject
spec_version 0..1
StixSpecVersion		 The version of the STIX specification used to represent the object StixObject
object_marking_refs 1..*
StixMarkingDefinition		 References to the marking definitions that apply to the object StixObject
granular_markings 1..*
StixGranularMarking		 The granular markings that apply to parts of the object StixObject
extensions 0..1
StixFileExtensions		 The object’s extensions, as a dictionary keyed by extension name StixObject
Expressions & Logic

Any Of

Section titled “Any Of”

The class must satisfy at least one of:

  • AnonymousClassExpression({ ‘slot_conditions’: {‘hashes’: SlotDefinition({‘name’: ‘hashes’, ‘required’: True})} })
  • AnonymousClassExpression({‘slot_conditions’: {‘name’: SlotDefinition({‘name’: ‘name’, ‘required’: True})}})

Usages

Section titled “Usages”
used by used in type used
AttackMalware sample_refs any_of[range] StixFile
StixDirectory contains_refs any_of[range] StixFile
StixProcess image_ref range StixFile
StixArchiveExtension contains_refs any_of[range] StixFile
StixWindowsServiceExtension service_dll_refs range StixFile
StixMimePart body_raw_ref any_of[range] StixFile
StixMalware sample_refs any_of[range] StixFile
StixMalwareAnalysis sample_ref any_of[range] StixFile

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Annotations

Section titled “Annotations”
property value
stix_type file

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self attack:StixFile
native attack:StixFile
close uco-observable:File

LinkML Source

Section titled “LinkML Source”

Direct

Section titled “Direct”
name: StixFile
annotations:
  stix_type:
    tag: stix_type
    value: file
description: The File Object represents the properties of a file.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:File
is_a: StixCyberObservableObject
slots:
- hashes
- size
- name
- name_enc
- magic_number_hex
- mime_type
- ctime
- mtime
- atime
- parent_directory_ref
- contains_refs
- content_ref
slot_usage:
  id:
    name: id
    pattern: ^file--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: file
  extensions:
    name: extensions
    range: StixFileExtensions
any_of:
- slot_conditions:
    hashes:
      name: hashes
      required: true
- slot_conditions:
    name:
      name: name
      required: true

Induced

Section titled “Induced”
name: StixFile
annotations:
  stix_type:
    tag: stix_type
    value: file
description: The File Object represents the properties of a file.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:File
is_a: StixCyberObservableObject
slot_usage:
  id:
    name: id
    pattern: ^file--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: file
  extensions:
    name: extensions
    range: StixFileExtensions
attributes:
  hashes:
    name: hashes
    description: A dictionary of hashes of the content, keyed by hash algorithm.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:hashes
    owner: StixFile
    domain_of:
    - StixExternalReference
    - StixArtifact
    - StixFile
    - StixX509Certificate
    - StixAlternateDataStream
    - StixWindowsPeSection
    - StixWindowsPeOptionalHeader
    range: StixHashes
    inlined: true
  size:
    name: size
    description: A size in bytes, as a non-negative integer.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:size
    owner: StixFile
    domain_of:
    - StixFile
    - StixAlternateDataStream
    - StixWindowsPeSection
    range: integer
    minimum_value: 0
  name:
    name: name
    description: A name that identifies the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:name
    rank: 1000
    slot_uri: stix:name
    owner: StixFile
    domain_of:
    - AttackTactic
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelatedAsset
    - AttackLogSource
    - AttackLogSourceReference
    - StixIdentity
    - StixMarkingDefinition
    - StixExtensionDefinition
    - StixAutonomousSystem
    - StixFile
    - StixMutex
    - StixSoftware
    - StixAlternateDataStream
    - StixWindowsPeSection
    - StixWindowsRegistryValue
    - StixAttackPattern
    - StixCampaign
    - StixCourseOfAction
    - StixGrouping
    - StixIncident
    - StixIndicator
    - StixInfrastructure
    - StixIntrusionSet
    - StixLocation
    - StixMalware
    - StixReport
    - StixThreatActor
    - StixTool
    - StixVulnerability
    range: string
  name_enc:
    name: name_enc
    description: Specifies the observed encoding for the name of the file.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:name_enc
    owner: StixFile
    domain_of:
    - StixFile
    range: string
    pattern: ^[a-zA-Z0-9/\.+_:-]{2,250}$
  magic_number_hex:
    name: magic_number_hex
    description: Specifies the hexadecimal constant ('magic number') associated with
      a specific file format that corresponds to the file, if applicable.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:magic_number_hex
    owner: StixFile
    domain_of:
    - StixFile
    range: stix_hex
  mime_type:
    name: mime_type
    description: The MIME type of the content, as the IANA Media Types registry names
      it.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:mime_type
    owner: StixFile
    domain_of:
    - StixArtifact
    - StixFile
    range: string
  ctime:
    name: ctime
    description: The time at which the object was created.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:ctime
    owner: StixFile
    domain_of:
    - StixDirectory
    - StixFile
    range: stix_timestamp
  mtime:
    name: mtime
    description: The time at which the object was last written to.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:mtime
    owner: StixFile
    domain_of:
    - StixDirectory
    - StixFile
    range: stix_timestamp
  atime:
    name: atime
    description: The time at which the object was last accessed.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:atime
    owner: StixFile
    domain_of:
    - StixDirectory
    - StixFile
    range: stix_timestamp
  parent_directory_ref:
    name: parent_directory_ref
    description: Specifies the parent directory of the file, as a reference to a Directory
      Object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:parent_directory_ref
    owner: StixFile
    domain_of:
    - StixFile
    range: StixDirectory
    pattern: ^directory--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  contains_refs:
    name: contains_refs
    description: References to other cyber-observable objects that this one contains.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:contains_refs
    owner: StixFile
    domain_of:
    - StixDirectory
    - StixFile
    - StixArchiveExtension
    range: StixCyberObservableObject
    multivalued: true
    pattern: ^(?!(attack-pattern|campaign|course-of-action|grouping|identity|incident|indicator|infrastructure|intrusion-set|location|malware|malware-analysis|note|observed-data|opinion|report|threat-actor|tool|vulnerability|relationship|sighting|bundle|marking-definition|language-content|extension-definition)--)[a-z][a-z0-9-]+[a-z0-9]--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  content_ref:
    name: content_ref
    description: Specifies the content of the file, represented as an Artifact Object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:content_ref
    owner: StixFile
    domain_of:
    - StixFile
    range: StixArtifact
    pattern: ^artifact--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  defanged:
    name: defanged
    description: Defines whether or not the data contained within the object has been
      defanged.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:defanged
    owner: StixFile
    domain_of:
    - StixCyberObservableObject
    range: boolean
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: StixFile
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
    pattern: ^file--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: StixFile
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
    equals_string: file
  spec_version:
    name: spec_version
    description: The version of the STIX specification used to represent the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:spec_version
    owner: StixFile
    domain_of:
    - StixObject
    range: StixSpecVersion
  object_marking_refs:
    name: object_marking_refs
    description: References to the marking definitions that apply to the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectMarking
    rank: 1000
    slot_uri: stix:object_marking_refs
    owner: StixFile
    domain_of:
    - StixObject
    range: StixMarkingDefinition
    multivalued: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  granular_markings:
    name: granular_markings
    description: The granular markings that apply to parts of the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:granular_markings
    owner: StixFile
    domain_of:
    - StixObject
    range: StixGranularMarking
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  extensions:
    name: extensions
    description: The object's extensions, as a dictionary keyed by extension name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:extensions
    owner: StixFile
    domain_of:
    - StixObject
    range: StixFileExtensions
    inlined: true
any_of:
- slot_conditions:
    hashes:
      name: hashes
      required: true
- slot_conditions:
    name:
      name: name
      required: true