Class: StixUserAccount

The User Account Object represents an instance of any type of user account, including but not limited to operating system, device, messaging service, and social media platform accounts.

URI: attack:StixUserAccount

 classDiagram
    class StixUserAccount
    click StixUserAccount href "../StixUserAccount/"
      StixCyberObservableObject <|-- StixUserAccount
        click StixCyberObservableObject href "../StixCyberObservableObject/"
      
      StixUserAccount : account_created
        
      StixUserAccount : account_expires
        
      StixUserAccount : account_first_login
        
      StixUserAccount : account_last_login
        
      StixUserAccount : account_login
        
      StixUserAccount : account_type
        
      StixUserAccount : can_escalate_privs
        
      StixUserAccount : credential
        
      StixUserAccount : credential_last_changed
        
      StixUserAccount : defanged
        
      StixUserAccount : display_name
        
      StixUserAccount : extensions
        
          
    
        
        
        StixUserAccount --> "0..1" StixUserAccountExtensions : extensions
        click StixUserAccountExtensions href "../StixUserAccountExtensions/"
    

        
      StixUserAccount : granular_markings
        
          
    
        
        
        StixUserAccount --> "1..*" StixGranularMarking : granular_markings
        click StixGranularMarking href "../StixGranularMarking/"
    

        
      StixUserAccount : id
        
      StixUserAccount : is_disabled
        
      StixUserAccount : is_privileged
        
      StixUserAccount : is_service_account
        
      StixUserAccount : object_marking_refs
        
          
    
        
        
        StixUserAccount --> "1..*" StixMarkingDefinition : object_marking_refs
        click StixMarkingDefinition href "../StixMarkingDefinition/"
    

        
      StixUserAccount : spec_version
        
          
    
        
        
        StixUserAccount --> "0..1" StixSpecVersion : spec_version
        click StixSpecVersion href "../StixSpecVersion/"
    

        
      StixUserAccount : type
        
      StixUserAccount : user_id
        
      

Inheritance

• StixObject
  • StixCyberObservableObject
    • StixUserAccount

Slots

Name	Cardinality and Range	Description	Inheritance
user_id	0..1 String	Specifies the identifier of the account	direct
credential	0..1 String	A cleartext credential, such as a hard-coded password that malware tries for …	direct
account_login	0..1 String	Specifies the account login string, used in cases where the user_id property …	direct
account_type	0..1 String or  StixAccountType	The type of the account, such as unix or ldap	direct
display_name	0..1 String	A name for display	direct
is_service_account	0..1 Boolean	Indicates that the account is associated with a network service or system pro…	direct
is_privileged	0..1 Boolean	Specifies that the account has elevated privileges (i	direct
can_escalate_privs	0..1 Boolean	Specifies that the account has the ability to escalate privileges (i	direct
is_disabled	0..1 Boolean	Specifies if the account is disabled	direct
account_created	0..1 StixTimestamp	Specifies when the account was created	direct
account_expires	0..1 StixTimestamp	Specifies the expiration date of the account	direct
credential_last_changed	0..1 StixTimestamp	Specifies when the account credential was last changed	direct
account_first_login	0..1 StixTimestamp	Specifies when the account was first accessed	direct
account_last_login	0..1 StixTimestamp	Specifies when the account was last accessed	direct
defanged	0..1 Boolean	Defines whether or not the data contained within the object has been defanged	StixCyberObservableObject
id	1 StixIdentifier	The identifier of the object: its STIX type, two hyphens and a UUID	StixObject
type	1 String	The STIX type name of the object, such as attack-pattern	StixObject
spec_version	0..1 StixSpecVersion	The version of the STIX specification used to represent the object	StixObject
object_marking_refs	1..* StixMarkingDefinition	References to the marking definitions that apply to the object	StixObject
granular_markings	1..* StixGranularMarking	The granular markings that apply to parts of the object	StixObject
extensions	0..1 StixUserAccountExtensions	The object’s extensions, as a dictionary keyed by extension name	StixObject

Expressions & Logic

Any Of

The class must satisfy at least one of:

• AnonymousClassExpression({ ‘slot_conditions’: {‘extensions’: SlotDefinition({‘name’: ‘extensions’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘user_id’: SlotDefinition({‘name’: ‘user_id’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘credential’: SlotDefinition({‘name’: ‘credential’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘account_login’: SlotDefinition({‘name’: ‘account_login’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘account_type’: SlotDefinition({‘name’: ‘account_type’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘display_name’: SlotDefinition({‘name’: ‘display_name’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘is_service_account’: SlotDefinition({‘name’: ‘is_service_account’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘is_privileged’: SlotDefinition({‘name’: ‘is_privileged’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘can_escalate_privs’: SlotDefinition({‘name’: ‘can_escalate_privs’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘is_disabled’: SlotDefinition({‘name’: ‘is_disabled’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘account_created’: SlotDefinition({‘name’: ‘account_created’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘account_expires’: SlotDefinition({‘name’: ‘account_expires’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘credential_last_changed’: SlotDefinition({‘name’: ‘credential_last_changed’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘account_first_login’: SlotDefinition({‘name’: ‘account_first_login’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘account_last_login’: SlotDefinition({‘name’: ‘account_last_login’, ‘required’: True})} })

Usages

used by	used in	type	used
StixEmailAddress	belongs_to_ref	range	StixUserAccount
StixProcess	creator_user_ref	range	StixUserAccount
StixWindowsRegistryKey	creator_user_ref	range	StixUserAccount

Identifier and Mapping Information

Annotations

property	value
stix_type	user-account

Schema Source

• from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type	Mapped Value
self	attack:StixUserAccount
native	attack:StixUserAccount
close	uco-observable:UserAccount

LinkML Source

Direct

name: StixUserAccount
annotations:
  stix_type:
    tag: stix_type
    value: user-account
description: The User Account Object represents an instance of any type of user account,
  including but not limited to operating system, device, messaging service, and social
  media platform accounts.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:UserAccount
is_a: StixCyberObservableObject
slots:
- user_id
- credential
- account_login
- account_type
- display_name
- is_service_account
- is_privileged
- can_escalate_privs
- is_disabled
- account_created
- account_expires
- credential_last_changed
- account_first_login
- account_last_login
slot_usage:
  id:
    name: id
    pattern: ^user-account--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: user-account
  extensions:
    name: extensions
    range: StixUserAccountExtensions
any_of:
- slot_conditions:
    extensions:
      name: extensions
      required: true
- slot_conditions:
    user_id:
      name: user_id
      required: true
- slot_conditions:
    credential:
      name: credential
      required: true
- slot_conditions:
    account_login:
      name: account_login
      required: true
- slot_conditions:
    account_type:
      name: account_type
      required: true
- slot_conditions:
    display_name:
      name: display_name
      required: true
- slot_conditions:
    is_service_account:
      name: is_service_account
      required: true
- slot_conditions:
    is_privileged:
      name: is_privileged
      required: true
- slot_conditions:
    can_escalate_privs:
      name: can_escalate_privs
      required: true
- slot_conditions:
    is_disabled:
      name: is_disabled
      required: true
- slot_conditions:
    account_created:
      name: account_created
      required: true
- slot_conditions:
    account_expires:
      name: account_expires
      required: true
- slot_conditions:
    credential_last_changed:
      name: credential_last_changed
      required: true
- slot_conditions:
    account_first_login:
      name: account_first_login
      required: true
- slot_conditions:
    account_last_login:
      name: account_last_login
      required: true

Induced

name: StixUserAccount
annotations:
  stix_type:
    tag: stix_type
    value: user-account
description: The User Account Object represents an instance of any type of user account,
  including but not limited to operating system, device, messaging service, and social
  media platform accounts.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:UserAccount
is_a: StixCyberObservableObject
slot_usage:
  id:
    name: id
    pattern: ^user-account--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: user-account
  extensions:
    name: extensions
    range: StixUserAccountExtensions
attributes:
  user_id:
    name: user_id
    description: Specifies the identifier of the account.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:user_id
    owner: StixUserAccount
    domain_of:
    - StixUserAccount
    range: string
  credential:
    name: credential
    description: A cleartext credential, such as a hard-coded password that malware
      tries for lateral movement.
    comments:
    - Meant for metadata from malware analysis, not for sharing personal information.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:credential
    owner: StixUserAccount
    domain_of:
    - StixUserAccount
    range: string
  account_login:
    name: account_login
    description: Specifies the account login string, used in cases where the user_id
      property specifies something other than what a user would type when they login.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:account_login
    owner: StixUserAccount
    domain_of:
    - StixUserAccount
    range: string
  account_type:
    name: account_type
    description: The type of the account, such as unix or ldap.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:account_type
    owner: StixUserAccount
    domain_of:
    - StixUserAccount
    range: string
    any_of:
    - range: StixAccountType
    - range: string
  display_name:
    name: display_name
    description: A name for display.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:display_name
    owner: StixUserAccount
    domain_of:
    - StixEmailAddress
    - StixUserAccount
    - StixWindowsServiceExtension
    range: string
  is_service_account:
    name: is_service_account
    description: Indicates that the account is associated with a network service or
      system process (daemon), not a specific individual.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:is_service_account
    owner: StixUserAccount
    domain_of:
    - StixUserAccount
    range: boolean
  is_privileged:
    name: is_privileged
    description: Specifies that the account has elevated privileges (i.e., in the
      case of root on Unix or the Windows Administrator account).
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:is_privileged
    owner: StixUserAccount
    domain_of:
    - StixUserAccount
    range: boolean
  can_escalate_privs:
    name: can_escalate_privs
    description: Specifies that the account has the ability to escalate privileges
      (i.e., in the case of sudo on Unix or a Windows Domain Admin account).
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:can_escalate_privs
    owner: StixUserAccount
    domain_of:
    - StixUserAccount
    range: boolean
  is_disabled:
    name: is_disabled
    description: Specifies if the account is disabled.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:is_disabled
    owner: StixUserAccount
    domain_of:
    - StixUserAccount
    range: boolean
  account_created:
    name: account_created
    description: Specifies when the account was created.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:account_created
    owner: StixUserAccount
    domain_of:
    - StixUserAccount
    range: stix_timestamp
  account_expires:
    name: account_expires
    description: Specifies the expiration date of the account.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:account_expires
    owner: StixUserAccount
    domain_of:
    - StixUserAccount
    range: stix_timestamp
  credential_last_changed:
    name: credential_last_changed
    description: Specifies when the account credential was last changed.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:credential_last_changed
    owner: StixUserAccount
    domain_of:
    - StixUserAccount
    range: stix_timestamp
  account_first_login:
    name: account_first_login
    description: Specifies when the account was first accessed.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:account_first_login
    owner: StixUserAccount
    domain_of:
    - StixUserAccount
    range: stix_timestamp
  account_last_login:
    name: account_last_login
    description: Specifies when the account was last accessed.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:account_last_login
    owner: StixUserAccount
    domain_of:
    - StixUserAccount
    range: stix_timestamp
  defanged:
    name: defanged
    description: Defines whether or not the data contained within the object has been
      defanged.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:defanged
    owner: StixUserAccount
    domain_of:
    - StixCyberObservableObject
    range: boolean
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: StixUserAccount
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
    pattern: ^user-account--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: StixUserAccount
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
    equals_string: user-account
  spec_version:
    name: spec_version
    description: The version of the STIX specification used to represent the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:spec_version
    owner: StixUserAccount
    domain_of:
    - StixObject
    range: StixSpecVersion
  object_marking_refs:
    name: object_marking_refs
    description: References to the marking definitions that apply to the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectMarking
    rank: 1000
    slot_uri: stix:object_marking_refs
    owner: StixUserAccount
    domain_of:
    - StixObject
    range: StixMarkingDefinition
    multivalued: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  granular_markings:
    name: granular_markings
    description: The granular markings that apply to parts of the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:granular_markings
    owner: StixUserAccount
    domain_of:
    - StixObject
    range: StixGranularMarking
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  extensions:
    name: extensions
    description: The object's extensions, as a dictionary keyed by extension name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:extensions
    owner: StixUserAccount
    domain_of:
    - StixObject
    range: StixUserAccountExtensions
    inlined: true
any_of:
- slot_conditions:
    extensions:
      name: extensions
      required: true
- slot_conditions:
    user_id:
      name: user_id
      required: true
- slot_conditions:
    credential:
      name: credential
      required: true
- slot_conditions:
    account_login:
      name: account_login
      required: true
- slot_conditions:
    account_type:
      name: account_type
      required: true
- slot_conditions:
    display_name:
      name: display_name
      required: true
- slot_conditions:
    is_service_account:
      name: is_service_account
      required: true
- slot_conditions:
    is_privileged:
      name: is_privileged
      required: true
- slot_conditions:
    can_escalate_privs:
      name: can_escalate_privs
      required: true
- slot_conditions:
    is_disabled:
      name: is_disabled
      required: true
- slot_conditions:
    account_created:
      name: account_created
      required: true
- slot_conditions:
    account_expires:
      name: account_expires
      required: true
- slot_conditions:
    credential_last_changed:
      name: credential_last_changed
      required: true
- slot_conditions:
    account_first_login:
      name: account_first_login
      required: true
- slot_conditions:
    account_last_login:
      name: account_last_login
      required: true