Skip to content
attack

Class: StixMalwareAnalysis

Malware Analysis captures the metadata and results of a particular analysis performed (static or dynamic) on the malware instance or family.

URI: attack:StixMalwareAnalysis

 classDiagram
    class StixMalwareAnalysis
    click StixMalwareAnalysis href "../StixMalwareAnalysis/"
      StixDomainObject <|-- StixMalwareAnalysis
        click StixDomainObject href "../StixDomainObject/"
      
      StixMalwareAnalysis : analysis_definition_version
        
      StixMalwareAnalysis : analysis_ended
        
      StixMalwareAnalysis : analysis_engine_version
        
      StixMalwareAnalysis : analysis_sco_refs
        
          
    
        
        
        StixMalwareAnalysis --> "1..*" StixCyberObservableObject : analysis_sco_refs
        click StixCyberObservableObject href "../StixCyberObservableObject/"
    

        
      StixMalwareAnalysis : analysis_started
        
      StixMalwareAnalysis : confidence
        
      StixMalwareAnalysis : configuration_version
        
      StixMalwareAnalysis : created
        
      StixMalwareAnalysis : created_by_ref
        
          
    
        
        
        StixMalwareAnalysis --> "0..1" StixIdentity : created_by_ref
        click StixIdentity href "../StixIdentity/"
    

        
      StixMalwareAnalysis : extensions
        
          
    
        
        
        StixMalwareAnalysis --> "0..1" StixExtensions : extensions
        click StixExtensions href "../StixExtensions/"
    

        
      StixMalwareAnalysis : external_references
        
          
    
        
        
        StixMalwareAnalysis --> "1..*" StixExternalReference : external_references
        click StixExternalReference href "../StixExternalReference/"
    

        
      StixMalwareAnalysis : granular_markings
        
          
    
        
        
        StixMalwareAnalysis --> "1..*" StixGranularMarking : granular_markings
        click StixGranularMarking href "../StixGranularMarking/"
    

        
      StixMalwareAnalysis : host_vm_ref
        
          
    
        
        
        StixMalwareAnalysis --> "0..1" StixSoftware : host_vm_ref
        click StixSoftware href "../StixSoftware/"
    

        
      StixMalwareAnalysis : id
        
      StixMalwareAnalysis : installed_software_refs
        
          
    
        
        
        StixMalwareAnalysis --> "1..*" StixSoftware : installed_software_refs
        click StixSoftware href "../StixSoftware/"
    

        
      StixMalwareAnalysis : labels
        
      StixMalwareAnalysis : lang
        
      StixMalwareAnalysis : modified
        
      StixMalwareAnalysis : modules
        
      StixMalwareAnalysis : object_marking_refs
        
          
    
        
        
        StixMalwareAnalysis --> "1..*" StixMarkingDefinition : object_marking_refs
        click StixMarkingDefinition href "../StixMarkingDefinition/"
    

        
      StixMalwareAnalysis : operating_system_ref
        
          
    
        
        
        StixMalwareAnalysis --> "0..1" StixSoftware : operating_system_ref
        click StixSoftware href "../StixSoftware/"
    

        
      StixMalwareAnalysis : product
        
      StixMalwareAnalysis : result
        
      StixMalwareAnalysis : result_name
        
      StixMalwareAnalysis : revoked
        
      StixMalwareAnalysis : sample_ref
        
          
    
        
        
        StixMalwareAnalysis --> "0..1" StixCyberObservableObject : sample_ref
        click StixCyberObservableObject href "../StixCyberObservableObject/"
    

        
      StixMalwareAnalysis : spec_version
        
          
    
        
        
        StixMalwareAnalysis --> "1" StixSpecVersion : spec_version
        click StixSpecVersion href "../StixSpecVersion/"
    

        
      StixMalwareAnalysis : submitted
        
      StixMalwareAnalysis : type
        
      StixMalwareAnalysis : version

Inheritance

Section titled “Inheritance”

Slots

Section titled “Slots”
Name Cardinality and Range Description Inheritance
product 1
String		 The name of the analysis engine or product that was used for this analysis direct
version 0..1
String		 A version, as a string; each class says of what direct
configuration_version 0..1
String		 The version of the analysis product configuration that was used to perform th… direct
modules 1..*
String		 The particular analysis product modules that were used to perform the analysi… direct
analysis_engine_version 0..1
String		 The version of the analysis engine or product that was used to perform this a… direct
analysis_definition_version 0..1
String		 The version of the analysis definitions used by the analysis tool direct
submitted 0..1
StixTimestamp		 The date and time that this malware was first submitted for scanning or analy… direct
analysis_started 0..1
StixTimestamp		 The date and time that the malware analysis was initiated direct
analysis_ended 0..1
StixTimestamp		 The date and time that the malware analysis ended direct
result_name 0..1
String		 The classification result or name assigned to the malware instance by the sca… direct
result 0..1
String or 
StixMalwareResult		 The classification result as determined by the scanner or tool analysis proce… direct
host_vm_ref 0..1
StixSoftware		 A description of the virtual machine environment used to host the guest opera… direct
operating_system_ref 0..1
StixSoftware		 The operating system that was used to perform the dynamic analysis direct
installed_software_refs 1..*
StixSoftware		 Any non-standard software installed on the operating system used for the dyna… direct
analysis_sco_refs 1..*
StixCyberObservableObject		 The cyber-observable objects captured during the analysis direct
sample_ref 0..1
StixCyberObservableObject or 
StixFile or 
StixNetworkTraffic or 
StixArtifact		 Refers to the object this analysis was performed against direct
created_by_ref 0..1
StixIdentity		 A reference to the identity of the object’s creator StixCommonObject
created 1
StixTimestampMillis		 The time at which the object, or its first version, was created StixCommonObject
modified 1
StixTimestampMillis		 The time at which this version of the object was modified StixCommonObject
revoked 0..1
Boolean		 The revoked property indicates whether the object has been revoked StixCommonObject
labels 1..*
String		 The labels property specifies a set of terms used to describe this object StixCommonObject
confidence 0..1
Integer		 Identifies the confidence that the creator has in the correctness of their da… StixCommonObject
lang 0..1
String		 The language of the text content, as an RFC 5646 language code StixCommonObject
external_references 1..*
StixExternalReference		 References to non-STIX information about the object StixCommonObject
id 1
StixIdentifier		 The identifier of the object: its STIX type, two hyphens and a UUID StixObject
type 1
String		 The STIX type name of the object, such as attack-pattern StixObject
spec_version 1
StixSpecVersion		 The version of the STIX specification used to represent the object StixObject
object_marking_refs 1..*
StixMarkingDefinition		 References to the marking definitions that apply to the object StixObject
granular_markings 1..*
StixGranularMarking		 The granular markings that apply to parts of the object StixObject
extensions 0..1
StixExtensions		 The object’s extensions, as a dictionary keyed by extension name StixObject
Expressions & Logic

Any Of

Section titled “Any Of”

The class must satisfy at least one of:

  • AnonymousClassExpression({ ‘slot_conditions’: {‘result’: SlotDefinition({‘name’: ‘result’, ‘required’: True})} })
  • AnonymousClassExpression({ ‘slot_conditions’: {‘analysis_sco_refs’: SlotDefinition({‘name’: ‘analysis_sco_refs’, ‘required’: True})} })

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Annotations

Section titled “Annotations”
property value
stix_type malware-analysis

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self attack:StixMalwareAnalysis
native attack:StixMalwareAnalysis

LinkML Source

Section titled “LinkML Source”

Direct

Section titled “Direct”
name: StixMalwareAnalysis
annotations:
  stix_type:
    tag: stix_type
    value: malware-analysis
description: Malware Analysis captures the metadata and results of a particular analysis
  performed (static or dynamic) on the malware instance or family.
from_schema: https://w3id.org/lmodel/attack
is_a: StixDomainObject
slots:
- product
- version
- configuration_version
- modules
- analysis_engine_version
- analysis_definition_version
- submitted
- analysis_started
- analysis_ended
- result_name
- result
- host_vm_ref
- operating_system_ref
- installed_software_refs
- analysis_sco_refs
- sample_ref
slot_usage:
  id:
    name: id
    pattern: ^malware-analysis--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: malware-analysis
  product:
    name: product
    required: true
any_of:
- slot_conditions:
    result:
      name: result
      required: true
- slot_conditions:
    analysis_sco_refs:
      name: analysis_sco_refs
      required: true

Induced

Section titled “Induced”
name: StixMalwareAnalysis
annotations:
  stix_type:
    tag: stix_type
    value: malware-analysis
description: Malware Analysis captures the metadata and results of a particular analysis
  performed (static or dynamic) on the malware instance or family.
from_schema: https://w3id.org/lmodel/attack
is_a: StixDomainObject
slot_usage:
  id:
    name: id
    pattern: ^malware-analysis--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: malware-analysis
  product:
    name: product
    required: true
attributes:
  product:
    name: product
    description: The name of the analysis engine or product that was used for this
      analysis.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:product
    owner: StixMalwareAnalysis
    domain_of:
    - StixMalwareAnalysis
    range: string
    required: true
  version:
    name: version
    description: A version, as a string; each class says of what.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:version
    owner: StixMalwareAnalysis
    domain_of:
    - StixExtensionDefinition
    - StixSoftware
    - StixX509Certificate
    - StixPdfExtension
    - StixMalwareAnalysis
    range: string
  configuration_version:
    name: configuration_version
    description: The version of the analysis product configuration that was used to
      perform this analysis.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:configuration_version
    owner: StixMalwareAnalysis
    domain_of:
    - StixMalwareAnalysis
    range: string
  modules:
    name: modules
    description: The particular analysis product modules that were used to perform
      the analysis.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:modules
    owner: StixMalwareAnalysis
    domain_of:
    - StixMalwareAnalysis
    range: string
    multivalued: true
    minimum_cardinality: 1
  analysis_engine_version:
    name: analysis_engine_version
    description: The version of the analysis engine or product that was used to perform
      this analysis.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:analysis_engine_version
    owner: StixMalwareAnalysis
    domain_of:
    - StixMalwareAnalysis
    range: string
  analysis_definition_version:
    name: analysis_definition_version
    description: The version of the analysis definitions used by the analysis tool.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:analysis_definition_version
    owner: StixMalwareAnalysis
    domain_of:
    - StixMalwareAnalysis
    range: string
  submitted:
    name: submitted
    description: The date and time that this malware was first submitted for scanning
      or analysis.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:submitted
    owner: StixMalwareAnalysis
    domain_of:
    - StixMalwareAnalysis
    range: stix_timestamp
  analysis_started:
    name: analysis_started
    description: The date and time that the malware analysis was initiated.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:analysis_started
    owner: StixMalwareAnalysis
    domain_of:
    - StixMalwareAnalysis
    range: stix_timestamp
  analysis_ended:
    name: analysis_ended
    description: The date and time that the malware analysis ended.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:analysis_ended
    owner: StixMalwareAnalysis
    domain_of:
    - StixMalwareAnalysis
    range: stix_timestamp
  result_name:
    name: result_name
    description: The classification result or name assigned to the malware instance
      by the scanner tool.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:result_name
    owner: StixMalwareAnalysis
    domain_of:
    - StixMalwareAnalysis
    range: string
  result:
    name: result
    description: The classification result as determined by the scanner or tool analysis
      process.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:result
    owner: StixMalwareAnalysis
    domain_of:
    - StixMalwareAnalysis
    range: string
    any_of:
    - range: StixMalwareResult
    - range: string
  host_vm_ref:
    name: host_vm_ref
    description: A description of the virtual machine environment used to host the
      guest operating system (if applicable) that was used for the dynamic analysis
      of the malware instance or family.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:host_vm_ref
    owner: StixMalwareAnalysis
    domain_of:
    - StixMalwareAnalysis
    range: StixSoftware
    pattern: ^software--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  operating_system_ref:
    name: operating_system_ref
    description: The operating system that was used to perform the dynamic analysis.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:operating_system_ref
    owner: StixMalwareAnalysis
    domain_of:
    - StixMalwareAnalysis
    range: StixSoftware
    pattern: ^software--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  installed_software_refs:
    name: installed_software_refs
    description: Any non-standard software installed on the operating system used
      for the dynamic analysis of the malware instance or family.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:installed_software_refs
    owner: StixMalwareAnalysis
    domain_of:
    - StixMalwareAnalysis
    range: StixSoftware
    multivalued: true
    pattern: ^software--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  analysis_sco_refs:
    name: analysis_sco_refs
    description: The cyber-observable objects captured during the analysis.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:analysis_sco_refs
    owner: StixMalwareAnalysis
    domain_of:
    - StixMalwareAnalysis
    range: StixCyberObservableObject
    multivalued: true
    pattern: ^(?!(attack-pattern|campaign|course-of-action|grouping|identity|incident|indicator|infrastructure|intrusion-set|location|malware|malware-analysis|note|observed-data|opinion|report|threat-actor|tool|vulnerability|relationship|sighting|bundle|marking-definition|language-content|extension-definition)--)[a-z][a-z0-9-]+[a-z0-9]--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  sample_ref:
    name: sample_ref
    description: Refers to the object this analysis was performed against.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:sample_ref
    owner: StixMalwareAnalysis
    domain_of:
    - StixMalwareAnalysis
    range: StixCyberObservableObject
    pattern: ^(file|network-traffic|artifact)--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    any_of:
    - range: StixFile
    - range: StixNetworkTraffic
    - range: StixArtifact
  created_by_ref:
    name: created_by_ref
    description: A reference to the identity of the object's creator.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:createdBy
    rank: 1000
    slot_uri: stix:created_by_ref
    owner: StixMalwareAnalysis
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: StixIdentity
    pattern: ^identity--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  created:
    name: created
    description: The time at which the object, or its first version, was created.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectCreatedTime
    rank: 1000
    slot_uri: stix:created
    owner: StixMalwareAnalysis
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: stix_timestamp_millis
    required: true
  modified:
    name: modified
    description: The time at which this version of the object was modified.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:modifiedTime
    rank: 1000
    slot_uri: stix:modified
    owner: StixMalwareAnalysis
    domain_of:
    - StixCommonObject
    range: stix_timestamp_millis
    required: true
  revoked:
    name: revoked
    description: The revoked property indicates whether the object has been revoked.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:revoked
    owner: StixMalwareAnalysis
    domain_of:
    - StixCommonObject
    range: boolean
  labels:
    name: labels
    description: The labels property specifies a set of terms used to describe this
      object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:tag
    rank: 1000
    slot_uri: stix:labels
    owner: StixMalwareAnalysis
    domain_of:
    - StixCommonObject
    range: string
    multivalued: true
    minimum_cardinality: 1
  confidence:
    name: confidence
    description: Identifies the confidence that the creator has in the correctness
      of their data.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:confidence
    rank: 1000
    slot_uri: stix:confidence
    owner: StixMalwareAnalysis
    domain_of:
    - StixCommonObject
    range: integer
    minimum_value: 0
    maximum_value: 100
  lang:
    name: lang
    description: The language of the text content, as an RFC 5646 language code.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:lang
    owner: StixMalwareAnalysis
    domain_of:
    - StixCommonObject
    - StixGranularMarking
    range: string
  external_references:
    name: external_references
    description: References to non-STIX information about the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:externalReference
    rank: 1000
    slot_uri: stix:external_references
    owner: StixMalwareAnalysis
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: StixExternalReference
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: StixMalwareAnalysis
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
    pattern: ^malware-analysis--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: StixMalwareAnalysis
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
    equals_string: malware-analysis
  spec_version:
    name: spec_version
    description: The version of the STIX specification used to represent the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:spec_version
    owner: StixMalwareAnalysis
    domain_of:
    - StixObject
    range: StixSpecVersion
    required: true
  object_marking_refs:
    name: object_marking_refs
    description: References to the marking definitions that apply to the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectMarking
    rank: 1000
    slot_uri: stix:object_marking_refs
    owner: StixMalwareAnalysis
    domain_of:
    - StixObject
    range: StixMarkingDefinition
    multivalued: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  granular_markings:
    name: granular_markings
    description: The granular markings that apply to parts of the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:granular_markings
    owner: StixMalwareAnalysis
    domain_of:
    - StixObject
    range: StixGranularMarking
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  extensions:
    name: extensions
    description: The object's extensions, as a dictionary keyed by extension name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:extensions
    owner: StixMalwareAnalysis
    domain_of:
    - StixObject
    range: StixExtensions
    inlined: true
any_of:
- slot_conditions:
    result:
      name: result
      required: true
- slot_conditions:
    analysis_sco_refs:
      name: analysis_sco_refs
      required: true