Class: StixNtfsExtension

The NTFS file extension specifies a default extension for capturing properties specific to the storage of the file on the NTFS file system.

URI: attack:StixNtfsExtension

 classDiagram
    class StixNtfsExtension
    click StixNtfsExtension href "../StixNtfsExtension/"
      StixNtfsExtension : alternate_data_streams
        
          
    
        
        
        StixNtfsExtension --> "1..*" StixAlternateDataStream : alternate_data_streams
        click StixAlternateDataStream href "../StixAlternateDataStream/"
    

        
      StixNtfsExtension : sid
        
      

Slots

Name	Cardinality and Range	Description	Inheritance
sid	0..1 String	Specifies the security ID (SID) value assigned to the file	direct
alternate_data_streams	1..* StixAlternateDataStream	Specifies a list of NTFS alternate data streams that exist for the file	direct

Expressions & Logic

Any Of

The class must satisfy at least one of:

• AnonymousClassExpression({‘slot_conditions’: {‘sid’: SlotDefinition({‘name’: ‘sid’, ‘required’: True})}})
• AnonymousClassExpression({ ‘slot_conditions’: {‘alternate_data_streams’: SlotDefinition({‘name’: ‘alternate_data_streams’, ‘required’: True})} })

Identifier and Mapping Information

Annotations

property	value
stix_extension_name	ntfs-ext

Schema Source

• from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type	Mapped Value
self	attack:StixNtfsExtension
native	attack:StixNtfsExtension
close	uco-observable:NTFSFileFacet

LinkML Source

Direct

name: StixNtfsExtension
annotations:
  stix_extension_name:
    tag: stix_extension_name
    value: ntfs-ext
description: The NTFS file extension specifies a default extension for capturing properties
  specific to the storage of the file on the NTFS file system.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:NTFSFileFacet
slots:
- sid
- alternate_data_streams
any_of:
- slot_conditions:
    sid:
      name: sid
      required: true
- slot_conditions:
    alternate_data_streams:
      name: alternate_data_streams
      required: true

Induced

name: StixNtfsExtension
annotations:
  stix_extension_name:
    tag: stix_extension_name
    value: ntfs-ext
description: The NTFS file extension specifies a default extension for capturing properties
  specific to the storage of the file on the NTFS file system.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:NTFSFileFacet
attributes:
  sid:
    name: sid
    description: Specifies the security ID (SID) value assigned to the file.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:sid
    owner: StixNtfsExtension
    domain_of:
    - StixNtfsExtension
    range: string
  alternate_data_streams:
    name: alternate_data_streams
    description: Specifies a list of NTFS alternate data streams that exist for the
      file.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:alternate_data_streams
    owner: StixNtfsExtension
    domain_of:
    - StixNtfsExtension
    range: StixAlternateDataStream
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
any_of:
- slot_conditions:
    sid:
      name: sid
      required: true
- slot_conditions:
    alternate_data_streams:
      name: alternate_data_streams
      required: true