Skip to content
attack

Slot: sample_refs

The sample_refs property specifies a list of identifiers of the SCO file or artifact objects associated with this malware instance(s) or family.

URI: stix:sample_refs

Applicable Classes

Section titled “Applicable Classes”
Name Description Modifies Slot
StixMalware Malicious code: a program inserted into a system, usually covertly, to compro… no
AttackMalware Malware: commercial, custom or open-source software an adversary uses for mal… no

Properties

Section titled “Properties”

Type and Range

Section titled “Type and Range”
Property Value
Range StixCyberObservableObject or 
StixFile or 
StixArtifact
Domain Of StixMalware
Slot URI stix:sample_refs

Cardinality and Requirements

Section titled “Cardinality and Requirements”
Property Value
Multivalued Yes
Minimum Cardinality 1

Value Constraints

Section titled “Value Constraints”
Property Value
Regex Pattern `^(file
Expressions & Logic

Any Of

Section titled “Any Of”

Value must satisfy at least one of:

  • AnonymousSlotExpression({‘range’: ‘StixFile’})
  • AnonymousSlotExpression({‘range’: ‘StixArtifact’})

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self stix:sample_refs
native attack:sample_refs

LinkML Source

Section titled “LinkML Source”
name: sample_refs
description: The sample_refs property specifies a list of identifiers of the SCO file
  or artifact objects associated with this malware instance(s) or family.
from_schema: https://w3id.org/lmodel/attack
rank: 1000
slot_uri: stix:sample_refs
domain_of:
- StixMalware
range: StixCyberObservableObject
multivalued: true
pattern: ^(file|artifact)--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
minimum_cardinality: 1
any_of:
- range: StixFile
- range: StixArtifact