Skip to content
attack

Class: StixMalware

Malicious code: a program inserted into a system, usually covertly, to compromise its data, applications or operating system, or to disrupt its owner.

URI: attack:StixMalware

 classDiagram
    class StixMalware
    click StixMalware href "../StixMalware/"
      StixDomainObject <|-- StixMalware
        click StixDomainObject href "../StixDomainObject/"
      

      StixMalware <|-- AttackMalware
        click AttackMalware href "../AttackMalware/"
      

      StixMalware : aliases
        
      StixMalware : architecture_execution_envs
        
      StixMalware : capabilities
        
      StixMalware : confidence
        
      StixMalware : created
        
      StixMalware : created_by_ref
        
          
    
        
        
        StixMalware --> "0..1" StixIdentity : created_by_ref
        click StixIdentity href "../StixIdentity/"
    

        
      StixMalware : description
        
      StixMalware : extensions
        
          
    
        
        
        StixMalware --> "0..1" StixExtensions : extensions
        click StixExtensions href "../StixExtensions/"
    

        
      StixMalware : external_references
        
          
    
        
        
        StixMalware --> "1..*" StixExternalReference : external_references
        click StixExternalReference href "../StixExternalReference/"
    

        
      StixMalware : first_seen
        
      StixMalware : granular_markings
        
          
    
        
        
        StixMalware --> "1..*" StixGranularMarking : granular_markings
        click StixGranularMarking href "../StixGranularMarking/"
    

        
      StixMalware : id
        
      StixMalware : implementation_languages
        
      StixMalware : is_family
        
      StixMalware : kill_chain_phases
        
          
    
        
        
        StixMalware --> "1..*" StixKillChainPhase : kill_chain_phases
        click StixKillChainPhase href "../StixKillChainPhase/"
    

        
      StixMalware : labels
        
      StixMalware : lang
        
      StixMalware : last_seen
        
      StixMalware : malware_types
        
      StixMalware : modified
        
      StixMalware : name
        
      StixMalware : object_marking_refs
        
          
    
        
        
        StixMalware --> "1..*" StixMarkingDefinition : object_marking_refs
        click StixMarkingDefinition href "../StixMarkingDefinition/"
    

        
      StixMalware : operating_system_refs
        
          
    
        
        
        StixMalware --> "1..*" StixSoftware : operating_system_refs
        click StixSoftware href "../StixSoftware/"
    

        
      StixMalware : revoked
        
      StixMalware : sample_refs
        
          
    
        
        
        StixMalware --> "1..*" StixCyberObservableObject : sample_refs
        click StixCyberObservableObject href "../StixCyberObservableObject/"
    

        
      StixMalware : spec_version
        
          
    
        
        
        StixMalware --> "1" StixSpecVersion : spec_version
        click StixSpecVersion href "../StixSpecVersion/"
    

        
      StixMalware : type

Inheritance

Section titled “Inheritance”

Slots

Section titled “Slots”
Name Cardinality and Range Description Inheritance
aliases 1..*
String		 Other names by which the object is known direct
first_seen 0..1
StixTimestamp		 The time at which the object was first seen direct
last_seen 0..1
StixTimestamp		 The time at which the object was last seen direct
operating_system_refs 1..*
StixSoftware		 The operating systems that the malware family or malware instance is executab… direct
architecture_execution_envs 1..*
String or 
StixProcessorArchitecture		 The processor architectures, such as x86 or ARM, that the malware runs on direct
implementation_languages 1..*
String or 
StixImplementationLanguage		 The programming languages used to write the malware instance or family direct
capabilities 1..*
String or 
StixMalwareCapability		 The capabilities identified in the malware instance or family direct
sample_refs 1..*
StixCyberObservableObject or 
StixFile or 
StixArtifact		 The sample_refs property specifies a list of identifiers of the SCO file or a… direct
malware_types 1..*
String or 
StixMalwareType		 The kinds of malware, such as ransomware direct
name 0..1
String		 A name that identifies the object direct
description 0..1
String		 A description of the object, which may be long direct
kill_chain_phases 1..*
StixKillChainPhase		 The kill chain phases to which the object corresponds direct
is_family 1
Boolean		 Whether the object represents a malware family (if true) or a malware instanc… direct
created_by_ref 0..1
StixIdentity		 A reference to the identity of the object’s creator StixCommonObject
created 1
StixTimestampMillis		 The time at which the object, or its first version, was created StixCommonObject
modified 1
StixTimestampMillis		 The time at which this version of the object was modified StixCommonObject
revoked 0..1
Boolean		 The revoked property indicates whether the object has been revoked StixCommonObject
labels 1..*
String		 The labels property specifies a set of terms used to describe this object StixCommonObject
confidence 0..1
Integer		 Identifies the confidence that the creator has in the correctness of their da… StixCommonObject
lang 0..1
String		 The language of the text content, as an RFC 5646 language code StixCommonObject
external_references 1..*
StixExternalReference		 References to non-STIX information about the object StixCommonObject
id 1
StixIdentifier		 The identifier of the object: its STIX type, two hyphens and a UUID StixObject
type 1
String		 The STIX type name of the object, such as attack-pattern StixObject
spec_version 1
StixSpecVersion		 The version of the STIX specification used to represent the object StixObject
object_marking_refs 1..*
StixMarkingDefinition		 References to the marking definitions that apply to the object StixObject
granular_markings 1..*
StixGranularMarking		 The granular markings that apply to parts of the object StixObject
extensions 0..1
StixExtensions		 The object’s extensions, as a dictionary keyed by extension name StixObject

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Annotations

Section titled “Annotations”
property value
stix_type malware

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self attack:StixMalware
native attack:StixMalware

LinkML Source

Section titled “LinkML Source”

Direct

Section titled “Direct”
name: StixMalware
annotations:
  stix_type:
    tag: stix_type
    value: malware
description: 'Malicious code: a program inserted into a system, usually covertly,
  to compromise its data, applications or operating system, or to disrupt its owner.'
from_schema: https://w3id.org/lmodel/attack
is_a: StixDomainObject
slots:
- aliases
- first_seen
- last_seen
- operating_system_refs
- architecture_execution_envs
- implementation_languages
- capabilities
- sample_refs
- malware_types
- name
- description
- kill_chain_phases
- is_family
slot_usage:
  id:
    name: id
    pattern: ^malware--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: malware
  is_family:
    name: is_family
    required: true

Induced

Section titled “Induced”
name: StixMalware
annotations:
  stix_type:
    tag: stix_type
    value: malware
description: 'Malicious code: a program inserted into a system, usually covertly,
  to compromise its data, applications or operating system, or to disrupt its owner.'
from_schema: https://w3id.org/lmodel/attack
is_a: StixDomainObject
slot_usage:
  id:
    name: id
    pattern: ^malware--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: malware
  is_family:
    name: is_family
    required: true
attributes:
  aliases:
    name: aliases
    description: Other names by which the object is known.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:aliases
    owner: StixMalware
    domain_of:
    - StixAttackPattern
    - StixCampaign
    - StixInfrastructure
    - StixIntrusionSet
    - StixMalware
    - StixThreatActor
    - StixTool
    range: string
    multivalued: true
    minimum_cardinality: 1
  first_seen:
    name: first_seen
    description: The time at which the object was first seen.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:first_seen
    owner: StixMalware
    domain_of:
    - StixCampaign
    - StixInfrastructure
    - StixIntrusionSet
    - StixMalware
    - StixThreatActor
    - StixSighting
    range: stix_timestamp
  last_seen:
    name: last_seen
    description: The time at which the object was last seen.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:last_seen
    owner: StixMalware
    domain_of:
    - StixCampaign
    - StixInfrastructure
    - StixIntrusionSet
    - StixMalware
    - StixThreatActor
    - StixSighting
    range: stix_timestamp
  operating_system_refs:
    name: operating_system_refs
    description: The operating systems that the malware family or malware instance
      is executable on.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:operating_system_refs
    owner: StixMalware
    domain_of:
    - StixMalware
    range: StixSoftware
    multivalued: true
    pattern: ^software--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  architecture_execution_envs:
    name: architecture_execution_envs
    description: The processor architectures, such as x86 or ARM, that the malware
      runs on.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:architecture_execution_envs
    owner: StixMalware
    domain_of:
    - StixMalware
    range: string
    multivalued: true
    minimum_cardinality: 1
    any_of:
    - range: StixProcessorArchitecture
    - range: string
  implementation_languages:
    name: implementation_languages
    description: The programming languages used to write the malware instance or family.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:implementation_languages
    owner: StixMalware
    domain_of:
    - StixMalware
    range: string
    multivalued: true
    minimum_cardinality: 1
    any_of:
    - range: StixImplementationLanguage
    - range: string
  capabilities:
    name: capabilities
    description: The capabilities identified in the malware instance or family.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:capabilities
    owner: StixMalware
    domain_of:
    - StixMalware
    range: string
    multivalued: true
    minimum_cardinality: 1
    any_of:
    - range: StixMalwareCapability
    - range: string
  sample_refs:
    name: sample_refs
    description: The sample_refs property specifies a list of identifiers of the SCO
      file or artifact objects associated with this malware instance(s) or family.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:sample_refs
    owner: StixMalware
    domain_of:
    - StixMalware
    range: StixCyberObservableObject
    multivalued: true
    pattern: ^(file|artifact)--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
    any_of:
    - range: StixFile
    - range: StixArtifact
  malware_types:
    name: malware_types
    description: The kinds of malware, such as ransomware.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:malware_types
    owner: StixMalware
    domain_of:
    - StixMalware
    range: string
    multivalued: true
    minimum_cardinality: 1
    any_of:
    - range: StixMalwareType
    - range: string
  name:
    name: name
    description: A name that identifies the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:name
    rank: 1000
    slot_uri: stix:name
    owner: StixMalware
    domain_of:
    - AttackTactic
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelatedAsset
    - AttackLogSource
    - AttackLogSourceReference
    - StixIdentity
    - StixMarkingDefinition
    - StixExtensionDefinition
    - StixAutonomousSystem
    - StixFile
    - StixMutex
    - StixSoftware
    - StixAlternateDataStream
    - StixWindowsPeSection
    - StixWindowsRegistryValue
    - StixAttackPattern
    - StixCampaign
    - StixCourseOfAction
    - StixGrouping
    - StixIncident
    - StixIndicator
    - StixInfrastructure
    - StixIntrusionSet
    - StixLocation
    - StixMalware
    - StixReport
    - StixThreatActor
    - StixTool
    - StixVulnerability
    range: string
  description:
    name: description
    description: A description of the object, which may be long.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:description
    rank: 1000
    slot_uri: stix:description
    owner: StixMalware
    domain_of:
    - AttackTactic
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackAnalytic
    - AttackRelatedAsset
    - AttackMutableElement
    - StixIdentity
    - StixExtensionDefinition
    - StixExternalReference
    - StixAttackPattern
    - StixCampaign
    - StixCourseOfAction
    - StixGrouping
    - StixIncident
    - StixIndicator
    - StixInfrastructure
    - StixIntrusionSet
    - StixLocation
    - StixMalware
    - StixReport
    - StixThreatActor
    - StixTool
    - StixVulnerability
    - StixRelationship
    - StixSighting
    range: string
  kill_chain_phases:
    name: kill_chain_phases
    description: The kill chain phases to which the object corresponds.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:kill_chain_phases
    owner: StixMalware
    domain_of:
    - StixAttackPattern
    - StixIndicator
    - StixInfrastructure
    - StixMalware
    - StixTool
    range: StixKillChainPhase
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  is_family:
    name: is_family
    description: Whether the object represents a malware family (if true) or a malware
      instance (if false).
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:is_family
    owner: StixMalware
    domain_of:
    - StixMalware
    range: boolean
    required: true
  created_by_ref:
    name: created_by_ref
    description: A reference to the identity of the object's creator.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:createdBy
    rank: 1000
    slot_uri: stix:created_by_ref
    owner: StixMalware
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: StixIdentity
    pattern: ^identity--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  created:
    name: created
    description: The time at which the object, or its first version, was created.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectCreatedTime
    rank: 1000
    slot_uri: stix:created
    owner: StixMalware
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: stix_timestamp_millis
    required: true
  modified:
    name: modified
    description: The time at which this version of the object was modified.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:modifiedTime
    rank: 1000
    slot_uri: stix:modified
    owner: StixMalware
    domain_of:
    - StixCommonObject
    range: stix_timestamp_millis
    required: true
  revoked:
    name: revoked
    description: The revoked property indicates whether the object has been revoked.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:revoked
    owner: StixMalware
    domain_of:
    - StixCommonObject
    range: boolean
  labels:
    name: labels
    description: The labels property specifies a set of terms used to describe this
      object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:tag
    rank: 1000
    slot_uri: stix:labels
    owner: StixMalware
    domain_of:
    - StixCommonObject
    range: string
    multivalued: true
    minimum_cardinality: 1
  confidence:
    name: confidence
    description: Identifies the confidence that the creator has in the correctness
      of their data.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:confidence
    rank: 1000
    slot_uri: stix:confidence
    owner: StixMalware
    domain_of:
    - StixCommonObject
    range: integer
    minimum_value: 0
    maximum_value: 100
  lang:
    name: lang
    description: The language of the text content, as an RFC 5646 language code.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:lang
    owner: StixMalware
    domain_of:
    - StixCommonObject
    - StixGranularMarking
    range: string
  external_references:
    name: external_references
    description: References to non-STIX information about the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:externalReference
    rank: 1000
    slot_uri: stix:external_references
    owner: StixMalware
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: StixExternalReference
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: StixMalware
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
    pattern: ^malware--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: StixMalware
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
    equals_string: malware
  spec_version:
    name: spec_version
    description: The version of the STIX specification used to represent the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:spec_version
    owner: StixMalware
    domain_of:
    - StixObject
    range: StixSpecVersion
    required: true
  object_marking_refs:
    name: object_marking_refs
    description: References to the marking definitions that apply to the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectMarking
    rank: 1000
    slot_uri: stix:object_marking_refs
    owner: StixMalware
    domain_of:
    - StixObject
    range: StixMarkingDefinition
    multivalued: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  granular_markings:
    name: granular_markings
    description: The granular markings that apply to parts of the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:granular_markings
    owner: StixMalware
    domain_of:
    - StixObject
    range: StixGranularMarking
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  extensions:
    name: extensions
    description: The object's extensions, as a dictionary keyed by extension name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:extensions
    owner: StixMalware
    domain_of:
    - StixObject
    range: StixExtensions
    inlined: true