Introduction
Sandbox analysis of a Malware Instance
{
"type":"package",
"id":"package--773adac8-2316-42c6-6fbc-9cdef8876fc5",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-instance",
"id":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
"instance_object_refs": ["0"],
"name": {
"value":"Zeus 1.3",
"confidence":"medium"
},
"capabilities": [{"name":"anti-detection"}],
"analysis_metadata": [
{
"analysis_type":"in-depth",
"description": "ran sample through sandbox"
}
]
}
],
"observable_objects": {
"0": {
"type":"file",
"hashes":{"MD5":"4472ea40dc71e5bb701574ea215a81a1"},
"size":25536,
"name":"foo.dll"
}
}
}
Welcome to the Malware Attribute Enumeration and Characterization (MAEC™, pronounced “mike”) effort, a comprehensive language and data model for the exchange of malware data.
This page provides a basic outline of the MAEC 5.0 data model. For an introduction and conceptual overview of MAEC, please see the Core Concepts and Vocabularies specification documents. There's also a documentation website containing examples and further information.
This documentation is divided into seven sections:
Top-level Objects - MAEC top-level objects (TLOs) are the entities captured at the top level of a Package. Examples include the Malware Instance and the Behavior Objects.
MAEC Types - These MAEC 5.0 types are used by MAEC’s TLOs.
Relationships - Relationships are defined between pairs of MAEC TLOs.
Package - The Package is MAEC's standard output format.
Common Data Types - These common data types are used by MAEC TLOs and data types.
Cyber Observable Object Extensions - MAEC-specific extensions are defined for STIX Cyber Observable Objects used in the context of MAEC.
Vocabularies - Many of MAEC's TLOs and data types contain properties that may be defined by MAEC open vocabularies. Each open vocabulary provides a list of common and industry-accepted terms. The use of MAEC's vocabularies is recommended to increase compatibility, but custom values may also be used.
Top-level Objects
Behavior
Persistence Behavior comprising several Malware Actions:
{
"type":"package",
"id":"package--2d42dac8-c416-42c6-bc5c-7b6dcf576fc5",
"schema_version":"5.0",
"maec_objects":[
{
"type":"behavior",
"id":"behavior--2099d4c1-0e8a-49d2-8d32-f0427e1ff817",
"name":"persist-after-system-reboot",
"action_refs":[
"malware-action--c095f1ab-0847-4d89-92ef-010e6ed39c20",
"malware-action--80f3f63a-d5c9-4599-b9e4-2a2bd7210736"
],
"attributes":{
"persistence-scope" : "system wide"
},
"technique_refs":[
{
"source_name":"att&ck",
"description":"registry run keys/start folder",
"external_id":"t1060"
}
]
},
{
"type":"malware-action",
"id":"malware-action--c095f1ab-0847-4d89-92ef-010e6ed39c20",
"name":"create file",
"output_object_refs":[
"0"
]
},
{
"type":"malware-action",
"id":"malware-action--80f3f63a-d5c9-4599-b9e4-2a2bd7210736",
"name":"create registry key value",
"output_object_refs":[
"1"
]
}
],
"observable_objects":{
"0":{
"type":"file",
"hashes":{
"MD5":"4472ea40dc71e5bb701574ea215a81a1"
},
"size":25536,
"name":"foo.dll",
"parent_directory_ref":"2"
},
"1":{
"type":"windows-registry-key",
"key":"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
"values":[
{
"name":"Foo",
"value":"C:\\Windows\\System32\foo.dll"
}
]
},
"2":{
"type":"directory",
"path":"C:\\Windows\\System32"
}
}
}
Type Name: behavior
A Behavior corresponds to the specific purpose behind a particular snippet of code, as executed by a malware instance. Examples include keylogging, detecting a virtual machine, and installing a backdoor. Behaviors may be composed of one or more Malware Actions, thereby providing context to these Actions.
| Name | Type | Description |
|---|---|---|
| id (required) | identifier | Specifies a unique ID for the Behavior. |
| type (required) | string | The value of property field MUST be behavior . |
| name (required) | open-vocab | Captures the name of the Behavior. The values for this property SHOULD come from the behavior-ov open vocabulary. |
| description (optional) | string | Specifies a textual description of the Behavior. |
| timestamp (optional) | timestamp | Captures the local or relative time at which the Behavior occurred or was observed. |
| action_refs (optional) | list of type identifier | Captures Actions that serve as an implementation of the Behavior. Each list item specifies the unique ID of the Action being referenced. Each Action MUST be present in the current Package. The ordering of the references in the list denotes the sequential ordering of the Actions with respect to the Behavior; that is, Actions at the beginning of the list MUST have occurred before those later in the list. |
| technique_refs (optional) | list of type external-reference | References any techniques used to implement the Behavior; for example, DLL Search Order Hijacking. Each reference SHOULD point to a valid ATT&CK Technique or related entity. |
Relationships
Embedded Relationships
| Name | Valid Target(s) |
|---|---|
action_refs |
malware-action |
Common Relationships
related-to
Top-level Relationships
| Source | Name | Target | Description |
|---|---|---|---|
behavior |
dependent-on |
behavior |
Specifies that the behavior is dependent on the successful execution of another. |
behavior |
discovered-by |
software |
Specifies that the behavior was discovered by a particular tool, as a represented by a STIX Cyber Observable Software Object. |
Collection
Basic Collection of Malware Instances observed together:
{
"type":"package",
"id":"package--12fbdac8-c416-42c6-cc5c-7b84cf576fc5",
"schema_version":"5.0",
"maec_objects": [
{
"type":"collection",
"id":"collection--739df9c1-93ab-49d2-73f0-f0427e1ff817",
"association_type":"observed together",
"entity_refs": [
"malware-instance--4c46cb42-8e83-4bbb-acf8-e09c1311093b",
"malware-instance--f19859bf-26e4-415e-a1be-41c0486d406d",
"malware-instance--4a58d70a-9d25-4c80-a114-28036705d026"
]
}
]
}
Type Name: collection
A Collection captures a set of MAEC entities (e.g., Malware Instances, Behaviors, etc.) or STIX Cyber Observables that are related or associated in some way.
| Name | Type | Description |
|---|---|---|
| type (required) | string | The value of this property MUST be collection . |
| id (required) | identifier | Specifies a unique ID for the Collection. |
| description (optional) | string | Specifies a textual description of the Collection. |
| association_type (optional) | open-vocab | Specifies how the contents of the Collection are associated. The values for this property SHOULD come from the entity-association-ov vocabulary. |
| entity_refs (optional) | list of type identifier | Specifies a set of one or more MAEC entities that are contained in the Collection. Each item specifies the unique ID of the entity being referenced. All entities MUST be present in the current Package. This property is mutually exclusive with regard to the observable_refs property and both properties MUST NOT be present in the same Collection. |
| observable_refs (optional) | list of type object-ref | Specifies a set of one or more STIX Cyber Observable Objects that are contained in the Collection. All Cyber Observable Objects MUST be present in the current Package. This property is mutually exclusive with regard to the entity_refs property and both properties MUST NOT be present in the same Collection. |
Requirements
One of entity_refs or observable_refs MUST be included when using this object.
Relationships
Embedded Relationships
| Name | Valid Target(s) |
|---|---|
entity_refs |
behavior , collection , malware-action , malware-family , malware-instance , relationship |
observable_refs |
artifact , autonomous-system , directory , domain-name , email-addr , email-message , file , ipv4-addr , ipv6-addr , mac-addr , mutex , network-traffic , process , software , url , user-account , windows-registry-key , x509-certificate |
Common Relationships
related-to
Malware Action
Basic "Create File" Action
{
"type":"package",
"id":"package--7892dac8-c416-35c6-bc5c-7b6dcf576f91",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-action",
"id":"malware-action--c095f1ab-0847-4d89-92ef-010e6ed39c20",
"name":"create file",
"is_successful":true,
"output_object_refs": ["4"],
"timestamp": "2016-01-20T12:31:12.12345Z"
}
],
"observable_objects": {
"4": {
"type":"file",
"hashes":{"MD5":"4472ea40dc71e5bb701574ea215a81a1"},
"size":25536,
"name":"foo.dll"
}
}
}
Read Registry Key Value Action with Implementation
{
"type":"package",
"id":"package--0072dac8-c416-35c6-bc5c-7b6dcf576def",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-action",
"id":"malware-action--e754b078-4185-4eba-a06c-7b2b6c6bd0a5",
"name":"read registry key value",
"input_object_refs": ["3"],
"implementation": {"api_function_name" : "RegQueryValueEx"},
"timestamp": "2016-01-20T12:31:12.12345Z"
}
],
"observable_objects": {
"3": {
"type":"windows-registry-key",
"key":"hkey_local_machine\\system\\bar\\foo",
"values": [
{
"name":"Foo",
"data":"qwerty",
"data_type":"REG_SZ"
}
]
}
}
}
Type Name: malware-action
A Malware Action represents an abstraction on a system-level API call (or similar entity) called by the malware instance during its execution, and thereby corresponds to the lowest-level dynamic operation of the malware instance. Actions do not contain any associated context as to why they were performed, as this level of detail and abstraction is documented by Behaviors. Examples of Actions include the creation of a particular file on disk and the opening of a port. Actions are commonly captured and reported by dynamic malware analysis tools (i.e., sandboxes).
| Name | Type | Description |
|---|---|---|
| type (required) | string | The value of this property MUST be malware-action . |
| id (required) | identifier | Specifies a unique ID for the Malware Action. |
| name (required) | open-vocab | Captures the name of the Malware Action. The values for this property SHOULD come from the malware-action-ov vocabulary. |
| description (optional) | string | Captures a basic textual description of the Malware Action. |
| is_successful (optional) | boolean | Specifies whether the Malware Action was successful in its execution. |
| timestamp (optional) | timestamp | Captures the local or relative time(s) at which the Malware Action occurred or was observed. |
| input_object_refs (optional) | list of type object-ref | References STIX Observable Objects used as input(s) to the Malware Action. The Object(s) referenced MUST be specified in the observable_objects property of the Package. |
| output_object_refs (optional) | list of type object-ref | References STIX Observable Objects resulting as output(s) from the Malware Action. The Object(s) referenced MUST be specified in the observable_objects property of the Package. |
| api_call (optional) | api-call | Captures attributes of the specific API call that was used to implement the Malware Action. |
Relationships
Embedded Relationships
| Name | Valid Target(s) |
|---|---|
input_object_refs |
artifact , autonomous-system , directory , domain-name , email-addr , email-message , file , ipv4-addr , ipv6-addr , mac-addr , mutex , network-traffic , process , software , url , user-account , windows-registry-key , x509-certificate |
output_object_refs |
artifact , autonomous-system , directory , domain-name , email-addr , email-message , file , ipv4-addr , ipv6-addr , mac-addr , mutex , network-traffic , process , software , url , user-account , windows-registry-key , x509-certificate |
Common Relationships
related-to
Top-level Relationships
| Source | Name | Target | Description |
|---|---|---|---|
malware-action |
dependent-on |
malware-action |
Specifies that the action is dependent on the successful execution of another. |
malware-action |
discovered-by |
software |
Specifies that the action was discovered by a particular tool, as a represented by a STIX Cyber Observable Software Object. |
Malware Family
Basic Malware Family:
{
"type":"package",
"id":"package--f53adac8-c416-42c6-6fbc-7b6ef8876fc5",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-family",
"id":"malware-family--df91014d-0c2e-4e01-b8a5-d8c32bb038e6",
"name": {
"value":"Zeus",
"confidence":90
}
}
]
}
Expanded Malware Family:
{
"type":"package",
"id":"package--b73adac8-3416-66c6-6fbc-096ef8876fc5",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-family",
"id":"malware-family--df91014d-0c2e-4e01-b8a5-d8c32bb038e6",
"name": {
"value":"Zeus",
"confidence":90
},
"aliases": [
{
"value":"ZBot",
"source":"McAfee",
"confidence":80
}
],
"labels": ["bot", "downloader", "trojan"],
"common_capabilities": [
{
"name":"persistence",
"refined_capabilities":[{"name":"continuous execution"}]
}
],
"common_behavior_refs": ["behavior--ac15b814-868b-43fd-a89b-91e463293f2b"]
},
{
"type":"malware-instance",
"id":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
"instance_object_refs": ["0"],
"name": {
"value":"Zeus 1.3",
"confidence":80
}
},
{
"type":"behavior",
"id":"behavior--ac15b814-868b-43fd-a89b-91e463293f2b",
"name":"persist after system reboot"
}
],
"observable_objects": {
"0": {
"type":"file",
"hashes": {"MD5":"4472ea40dc71e5bb701574ea215a81a1"},
"size":25536,
"name":"foo.dll"
}
},
"relationships": [
{
"type":"relationship",
"id":"relationship--74ae7da8-784d-4a00-aad1-e40c65c78b98",
"source_ref":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
"target_ref":"malware-family--df91014d-0c2e-4e01-b8a5-d8c32bb038e6",
"relationship_type":"variant-of"
}
]
}
Type Name: malware-family
A Malware Family is a set of malware instances that are related by common authorship and/or lineage. Malware Families are often named and may have components such as strings that are common across all members of the family.
| Name | Type | Description |
|---|---|---|
| type (required) | string | The value of this property MUST be malware-family . |
| id (required) | identifier | Specifies a unique ID for the Malware Family. |
| name (required) | name | Captures the name of the Malware Family, as specified by the producer of the MAEC Package. |
| aliases (optional) | list of type name | Captures aliases for the Malware Family. For cases where the alias comes from an external source, the name of the source SHOULD be provided. |
| labels (optional) | list of type open-vocab | Specifies one or more commonly accepted labels to describe the members of the Malware Family, e.g. “worm.” The values for this property SHOULD come from the malware-label-ov vocabulary. |
| description (optional) | string | Captures a basic, textual description of the Malware Family. |
| field_data (required) | field-data | Specifies field data about the Malware Family, such as first seen and last seen dates, as well as delivery vectors. |
| common_strings (optional) | list of type string | Specifies any strings common to all members of the Malware Family. |
| common_capabilities (optional) | list of type object-ref | Specifies any Capabilities common to all members of the Malware Family. |
| common_code_refs (optional) | list of type capability | References code snippets that are shared between all of the members of the Malware Family. The Object(s) referenced MUST be of STIX Cyber Observable type artifact and MUST be specified in the observable_objects property of the Package. |
| common_behavior_refs (optional) | list of type identifier | Specifies a set of one or more Behaviors that are common to all of the members of the Malware Family. Each item specifies the unique ID of the Behavior being referenced; accordingly, each referenced item MUST be of type behavior . |
| references (optional) | list of type external-reference | Captures external references to the Malware Family. |
Relationships
Embedded Relationships
| Name | Valid Target(s) |
|---|---|
common_code_refs |
artifact |
common_behavior_refs |
behavior |
Common Relationships
related-to
Top-level Relationships
| Source | Name | Target | Description |
|---|---|---|---|
malware-family |
dropped-by |
malware-family |
Indicates that the source malware family is dropped by the target malware family. |
malware-family |
derived-from |
malware-family |
Indicates that the code base of the source malware family is a derived from the code base of the target malware family. |
Malware Instance
Basic Malware Instance
{
"type":"package",
"id":"package--773adac8-2316-42c6-6fbc-9cdef8876fc5",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-instance",
"id":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
"instance_object_refs": ["0"],
"name": {
"value":"Zeus 1.3",
"confidence":50
},
"capabilities": [{"name":"anti-detection"}],
"analysis_metadata": [
{
"analysis_type":"in-depth",
"description": "ran sample through sandbox"
}
]
}
],
"observable_objects": {
"0": {
"type":"file",
"hashes":{"MD5":"4472ea40dc71e5bb701574ea215a81a1"},
"size":25536,
"name":"foo.dll"
}
}
}
Malware Instance with Malware Actions
{
"id": "package--3a7b331e-906f-42c0-bfd5-c2cd04076834",
"type": "package",
"schema_version": "5.0",
"maec_objects": [
{
"type": "malware-instance",
"id": "malware-instance--1d43c77c-21a0-4a10-9a9a-8c0fdfd280b8",
"instance_object_refs": ["0"],
"dynamic_features": {
"action_refs": [
"malware-action--935a718f-863e-49fb-89b8-d65dc0e70e53",
"malware-action--75514819-ea94-4684-8107-68ee63315fc4"
]
}
},
{
"type": "malware-action",
"id": "malware-action--935a718f-863e-49fb-89b8-d65dc0e70e53",
"name": "create-file",
"is_successful": true,
"output_object_refs": ["0"]
},
{
"type": "malware-action",
"id": "malware-action--75514819-ea94-4684-8107-68ee63315fc4",
"name": "write-to-process-memory",
"is_successful": true,
"input_object_refs": ["0"],
"output_object_refs": ["1"]
}
],
"observable_objects": {
"0": {
"type": "file",
"size": 196608,
"hashes": {
"MD5": "4EC0027BEF4D7E1786A04D021FA8A67F"
},
"parent_directory_ref": "2"
},
"1": {
"type": "file",
"name": "msvcr.dll",
"parent_directory_ref": "parent_directory_ref1"
},
"2": {
"type": "directory",
"path": "C:\\Documents and Settings\\user\\Local Settings\\Application\\Data"
},
"3": {
"type": "process",
"name": "explorer.exe",
"cwd": "C:\\Windows\\"
}
}
}
Type Name: malware-instance
A Malware Instance can be thought of as a single member of a Malware Family that is typically packaged as a binary. This type allows for the characterization of the binaries associated with a Malware Instance along with any corresponding analyses, associated Capabilities, Behaviors, and Actions, and relationships to other Malware Instances.
| Name | Type | Description |
|---|---|---|
| type (required) | string | The value of this property MUST be malware-instance . |
| id (required) | identifier | Specifies a unique ID for the Malware Instance. |
| instance_object_refs (required) | list of type object-ref | References the Cyber Observable Objects that characterize the packaged code (typically a binary) associated with the Malware Instance Object. For most use cases, the object referenced SHOULD be of STIX Cyber Observable type file . Objects referenced MUST be specified in the observable_objects property of the Package. For cases where multiple STIX Observable File Objects are referenced by this property, each Object MUST have the same hash value (via the hashes property) but MAY have different file names (via the name property). |
| name (optional) | name | Captures the name of the Malware Instance, as specified by the producer of the MAEC Package. |
| aliases (optional) | list of type name | Captures any aliases for the name of the Malware Instance, as reported by sources other than the producer of the MAEC document (e.g., AV vendors). |
| labels (optional) | list of type open-vocab | Specifies one or more commonly accepted labels to describe the Malware Instance, e.g. “trojan.” The values for this property SHOULD come from the malware-label-ov vocabulary. |
| description (optional) | string | Captures a basic, textual description of the Malware Instance. |
| field_data (optional) | field-data | Specifies field data about the Malware Instance, such as first seen and last seen dates, as well as delivery vectors. |
| os_execution_envs (optional) | list of type open-vocab | Specifies the operating systems that the Malware Instance executes on. The values for this property SHOULD come from the operating-system-ov vocabulary. |
| architecture_execution_envs (optional) | list of type open-vocab | Specifies the processor architectures that the Malware Instance executes on. The values for this property SHOULD come from the processor-architecture-ov vocabulary. |
| capabilities (optional) | list of type capability | Specifies a set of one or more Capabilities possessed by the Malware Instance. |
| os_features (optional) | list of type open-vocab | Specifies any operating system-specific features used by the Malware Instance. Each item in the list specifies a single feature. The values for this property SHOULD come from the os-features-ov vocabulary. |
| dynamic_features (optional) | dynamic-features | Captures features associated with the semantics of the code executed by the Malware Instance, such as Malware Actions and Behaviors. |
| static_features (optional) | static-features | Captures features associated with the binary that aren’t related to the semantics of the executed code, such as strings and packer information. |
| analysis_metadata (optional) | list of type analysis-metadata | Captures metadata associated with the analyses performed on the Malware Instance, such as the tools that were used. |
| triggered_signatures (optional) | list of type signature-metadata | Captures metadata associated with any signatures or rules (e.g., YARA) that were triggered during the analysis of the malware instance. |
Relationships
Embedded Relationships
| Name | Valid Target(s) |
|---|---|
instance_object_refs |
file |
Common Relationships
related-to
Top-level Relationships
| Source | Name | Target | Description |
|---|---|---|---|
malware-instance |
ancestor-of |
malware-instance |
Indicates that the source malware instance is an ancestor of the target malware instance. |
malware-instance |
downloaded-by |
malware-family , malware-instance |
Indicates that the source malware instance is downloaded by the target malware instance or family. |
malware-instance |
dropped-by |
malware-family , malware-instance |
Indicates that the source malware instance is dropped by the target malware instance or family. |
malware-instance |
derived-from |
malware-family , malware-instance |
Indicates that the code base of the source malware instance is a derived from the code base of the target malware instance or family. |
malware-instance |
extracted-from |
malware-instance |
Indicates that the source malware instance is extracted from the target malware instance. |
malware-instance |
has-distance |
malware-instance |
Indicates that the source malware instance has some distance (with respect to similarity) to the target malware instance. |
malware-instance |
has-distance |
malware-family , malware-instance |
Indicates that the source malware instance is installed by the target malware instance or family. |
malware-instance |
variant-of |
malware-family , malware-instance |
Indicates that the source malware instance is a variant of the target malware instance or family. |
MAEC Types
API Call
Malware Action with parameter constants
{
"type":"package",
"id":"package--7892dac8-c416-35c6-bc5c-7b6dcf576f91",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-action",
"id":"malware-action--c095f1ab-0847-4d89-92ef-010e6ed39c20",
"name":"delete file",
"output_object_refs": ["3"],
"api_call": {
"address":"040089aa",
"return_value":"0400f258",
"parameters": {
"lpFileName":"C:\\Temp\\badfile.pptx",
"dwDesiredAccess":"GENERIC_WRITE",
"dwShareMode":"FILE_SHARE_READ",
"lpSecurityAttributes":"NULL",
"dwCreationDisposition":"CREATE_NEW",
"dwFlagsAndAttributes":"FILE_ATTRIBUTE_NORMAL",
"hTemplateFile":"00000000"
},
"function_name":"CreateFileEx"
}
}
]
}
Malware Action with parameter literals
{
"type":"package",
"id":"package--6e8a76ff-9ffa-419e-8ad4-8a165e86f171",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-action",
"id":"malware-action--2dc56470-bef0-4a32-910f-760a5d62be2b",
"name":"delete file",
"input_object_refs": ["1"],
"api_call": {
"address":"040089aa",
"return_value":"1",
"parameters": {
"lpFileName":"C:\\Temp\\badfile.pptx",
"dwDesiredAccess":"40000000",
"dwShareMode":"0x00000001",
"lpSecurityAttributes":"0",
"dwCreationDisposition":"1",
"dwFlagsAndAttributes":"128",
"hTemplateFile":"00000000"
},
"function_name":"DeleteFile"
}
}
]
}
Type Name: api-call
The api-call
type serves as a method for characterizing API Calls, as implementations of Malware Actions.
| Name | Type | Description |
|---|---|---|
| address (optional) | hex | Captures the hexadecimal address of the API call in the binary. |
| return_value (optional) | string | Captures the return value of the API call. |
| parameters (optional) | dictionary | Captures a list of function parameters. Each key in the dictionary MUST be a string that captures the exact name of the parameter, and each corresponding key value MUST be a string that captures the corresponding parameter value. For parameter values that can be represented by a constant, e.g., GENERIC_WRITE, the constant rather than the literal SHOULD be used. For cases where the parameter cannot be represented by a constant, the literal (as reported by the tool producing the data) MUST be used. |
| function_name (required) | string | Captures the full name of the API function called, e.g., CreateFileEx . |
Analysis Metadata
Analysis Metadata
{
"type":"package",
"id":"package--7892dac8-c416-35c6-bc5c-7b6dcf576f91",
"schema_version":"5.0",
"maec_objects":[
{
"type":"malware-instance",
"id":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
"instance_object_refs":[
"0"
],
"name":{
"value":"MalwareB.1.1",
"confidence":80
},
"analysis_metadata":[
{
"is_automated":false,
"start_time":"2017-02-05T12:15:00Z",
"end_time":"2017-02-05T12:20:00Z",
"last_update_time":"2017-02-05T12:20:00Z",
"confidence":75,
"analysts":[
"John Doe",
"Jane Doe"
],
"analysis_type":"dynamic",
"analysis_environment":{
"operating-system":"2",
"host-vm":"3",
"installed-software":[
"4",
"5"
]
},
"comments":[
"The decryption key is: Infected---key+-34512",
"Analysis required increase of default timeout value"
],
"tool_refs":[
"1"
],
"description":"Basic automated sandbox analysis.",
"conclusion":"malicious"
}
]
}
],
"observable_objects":{
"0":{
"type":"file",
"hashes":{
"MD5":"4472ea40dc71e5bb701574ea215a81a1"
},
"size":25536
},
"1":{
"type":"software",
"name":"Cuckoo Sandbox",
"version":"2.0"
},
"2":{
"type":"software",
"name":"Windows 7",
"vendor":"Microsoft"
},
"3":{
"type":"software",
"name":"Virtualbox",
"version":"5.0.40",
"vendor":"Oracle"
},
"4":{
"type":"software",
"name":"Office 2010",
"vendor":"Microsoft",
"version":"14.0.4"
},
"5":{
"type":"software",
"name":"Java",
"vendor":"Oracle",
"version":"1.8.0_40"
}
}
}
Type Name: analysis-metadata
The analysis-metadata
type captures metadata associated with the analyses performed on a malware instance, such as the tools used and the analysts who performed the analysis.
| Name | Type | Description |
|---|---|---|
| is_automated (required) | boolean | Captures whether the analysis was fully automated (i.e., no human analyst in the loop). If this property is set to true , the analysts property MUST NOT be included. |
| start_time (optional) | timestamp | Captures the date/time that the analysis was started. |
| end_time (optional) | timestamp | Captures the date/time that the analysis was completed. |
| last_update_time (optional) | timestamp | Captures the date/time that the analysis was last updated. |
| confidence (optional) | integer | Captures the relative measure of confidence in the accuracy of the analysis results. The confidence value MUST be a number in the range of 0-100. |
| analysts (optional) | list of type string | Captures the names of analysts who performed the analysis. |
| analysis_type (required) | open-vocab | Captures the type of analysis performed. The value for this property SHOULD come from the analysis-type-ov vocabulary. |
| comments (optional) | list of type string | Captures comments regarding the analysis that was performed. A comment SHOULD be attributable to a specific analyst and SHOULD reflect particular insights of the author that are significant from an analysis standpoint. |
| tool_refs (optional) | list of type object-ref | References the tools used in the analysis of the Malware Instance. The objects referenced MUST be of STIX Cyber Observable type software and MUST be specified in the observable_objects property of the Package. |
| analysis_environment (optional) | dictionary | Captures any metadata, such as the host virtual machine, associated with the analysis environment used to perform the dynamic analysis of the Malware Instance. Each key in the dictionary SHOULD come from the analysis-environment-ov, and each corresponding key value SHOULD be a valid object-ref or list of object-ref . This property MUST NOT be included if analysis_type is set to a value of static . |
| description (optional) | string | Captures a textual description of the analysis performed. |
| conclusion (optional) | open-vocab | Captures the conclusion of the analysis, such as whether the binary was found to be malicious. The value for this property SHOULD come from the analysis-conclusion-ov vocabulary. |
| references (optional) | list of type external-reference | Captures any references to reports or other data sources pertaining to the analysis. |
Binary Obfuscation
Binary Obfuscation
{
"type":"package",
"id":"package--2d42dac8-c416-42c6-bc5c-7b6dcf576fc5",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-instance",
"id":"malware-instance--19863c16-503e-493f-8841-16c68e39c26e",
"instance_object_refs": ["0"],
"static_features": {
"obfuscation_methods": [
{
"method":"packing",
"layer_order":1,
"packer_name":"UPX"
},
{
"method":"encryption",
"layer_order":2,
"encryption_algorithm":"XOR"
}
]
}
}
]
}
Type Name: binary-obfuscation
The binary-obfuscation
type captures metadata on the methods that a binary may be obfuscated with, such as executable packers or XOR encryption. This includes obfuscation of the entire binary as well as its constituent pieces, such as strings.
| Name | Type | Description |
|---|---|---|
| method (required) | open-vocab | Captures the method used to obfuscate the binary. The value for this property SHOULD come from the obfuscation-method-ov vocabulary. |
| layer_order (optional) | integer | Captures the ordering of the obfuscation method with respect to other obfuscation methods (if known), as a positive integer. For example, if a binary was packed and then XOR encrypted, the layer_order property of the packing layer would equal 1 and the layer_order property of the XOR encryption layer would equal 2 . |
| encryption_algorithm (optional) | open-vocab | Captures the name of the encryption algorithm used by the obfuscation method (if applicable). The values for this property SHOULD come from the STIX encryption-algo-ov vocabulary. |
| packer_name (optional) | string | Specifies the name of the packer (if applicable). |
| packer_version (optional) | string | Specifies the version of the packer (if applicable). |
| packer_entry_point (optional) | hex | Specifies the entry point address of the packer (if applicable). |
| packer_signature (optional) | string | Specifies the matching signature detected for the packer (if applicable). |
Capability
Capability
{
"type":"package",
"id":"package--2d42dac8-c416-42c6-bc5c-7b6dcf576fc5",
"schema_version":"5.0",
"maec_objects":[
{
"type":"malware-instance",
"id":"malware-instance--19863c16-503e-493f-8841-16c68e39c26e",
"instance_object_refs":[
"0"
],
"labels":[
"mass-mailer",
"worm"
],
"capabilities":[
{
"name":"persistence",
"refined_capabilities":[
{
"name":"continuous-execution"
},
{
"name":"system-re-infection"
}
],
"description":"The instance persists after a system reboot.",
"attributes":{
"persistence-scope":[
"self",
"other malware/components"
],
"technique":"creates registry key"
},
"behavior_refs":[
"behavior--1",
"behavior--2"
],
"references":[
{
"source_name":"ATT&CK",
"description":"Persistence",
"url":"https://attack.mitre.org/wiki/Persistence"
}
]
}
]
}
]
}
Type Name: capability
The capability
type captures details of a Capability implemented by a malware instance. A Capability corresponds to a high-level ability that a malware instance possesses, such as persistence or anti-behavioral analysis. Malware Instances and Families may share Capabilities; however, the associated Behaviors implementing the Capabilities will often differ. Therefore, Capabilities are defined inline to Malware Instances and Malware Families rather than as top level objects that are subsequently referenced.
| Name | Type | Description |
|---|---|---|
| name (required) | open-vocab | Captures the name of the Capability. The values for this property SHOULD come from the capability-ov vocabulary. When used as part of a refined Capability, the values for this property SHOULD come from the refined-capability-ov vocabulary. |
| refined_capabilities (optional) | list of type capability | Captures a refinement of the Capability, recursively using capability type. |
| description (optional) | string | Captures a textual description of the Capability. |
| attributes (optional) | dictionary | Captures attributes of the Capability as key/value pairs. Each key in the dictionary MUST be a string that captures the name of the attribute and SHOULD come from the common-attribute-ov vocabulary. Each corresponding key value MUST be a string or list of strings that captures the corresponding attribute values. |
| behavior_refs (optional) | list of type identifier | Captures the IDs of Behaviors that implement the Capability. Each referenced entity MUST be of type behavior and each Behavior MUST be present in the current Package. |
| references (optional) | list of type external-reference | Captures external references to ATT&CK Tactics and other entities that may be associated with the Capability. |
Dynamic Features
Dynamic Features
{
"type":"package",
"id": "package--2d42dac8-c416-42c6-bc5c-7b6dcf576fc5",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-instance",
"id":"malware-instance--19863c16-503e-493f-8841-16c68e39c26e",
"instance_object_refs": ["0"],
"dynamic_features": {
"behavior_refs": ["behavior--1", "behavior--2"],
"action_refs": ["malware-action--1", "malware-action--2"],
"network_traffic_refs": ["4"],
"process_tree": [
{
"process_ref":"1",
"ordinal_position":0
}
]
}
},
{
"type":"behavior",
"id":"behavior--1",
"name":"persist after system reboot",
"description":"System reboot persistence via registry startup",
"action_refs": ["malware-action--1"]
}
],
"observable_objects": {
"0": {
"type": "file",
"hashes": {"MD5": "66e2ea40dc71d5ba701574ea215a81f1"}
},
"1": {
"type": "process",
"pid": "1234"
},
"2": {
"type": "process",
"pid": "2345"
},
"3": {
"type": "domain-name",
"value": "example.com"
},
"4": {
"type": "network-traffic",
"dst_ref": "0",
"protocols": [
"ipv4",
"tcp",
"http"
]
}
}
}
Type Name: dynamic-features
The dynamic-features
type captures the dynamic features (i.e., those associated with the semantics of the executed code, of a malware instance).
Requirements:
- At least one of behavior_refs or action_refs or network_traffic_refs or process_tree MUST be included when using this type.
| Name | Type | Description |
|---|---|---|
| behavior_refs (optional) | list of type identifier | Captures the IDs of Behaviors exhibited by the Malware Instance. Each referenced entity MUST be of type behavior . |
| action_refs (optional) | list of type identifier | Captures the IDs of Actions discovered for the Malware Instance. Each referenced entity MUST be of type malware-action . This property is intended for capturing Actions that are discovered through static analysis, reverse engineering, or other methods and therefore MUST NOT be used to reference any of the Actions that are included in the process_tree property. As such, the Actions referenced by this property are mutually exclusive with respect to the Actions referenced by the process_tree property. |
| network_traffic_refs (optional) | list of type object-ref | Captures any network traffic recorded for the Malware Instance. The Object(s) referenced MUST be of STIX Cyber Observable type network-traffic OR artifact (for including binaries of captured traffic such as PCAPs) and MUST be specified in the observable_objects property of the Package. |
| process_tree (optional) | list of type process-tree-node | Captures the Process Tree observed during the execution of the Malware Instance. This property may also capture Actions that are executed by a process and captured by dynamic analysis/sandboxing and therefore MUST NOT be used to reference any of the Actions that are included in the action_refs property. As such, the Actions referenced by this property are mutually exclusive with respect to the Actions referenced by the action_refs property. |
Field Data
Field Data
{
"type":"package",
"id":"package--6864e55f-5f5f-451a-843e-8c66913ae116",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-family",
"id":"malware-family--8ff5814d-0c2e-5601-b8a5-d0032bb03847",
"name": {
"value": "Cryptolocker",
"confidence": 85
},
"field_data": {
"delivery_vectors":["trojanized-link", "downloader"],
"first_seen":"2013-09-05T00:00:00Z",
"last_seen":"2017-01-05T00:00:00Z"
}
}
]
}
Type Name: field-data
The field-data
type captures field data, such as the time that the malware instance or family was first observed, associated with a malware instance or family.
Requirements:
- At least one of delivery_vectors or first_seen or last_seen MUST be included when using this type.
| Name | Type | Description |
|---|---|---|
| delivery_vectors (optional) | list of type open-vocab | Captures the vectors used to distribute/deploy the Malware Instance. The values for this property SHOULD come from the delivery-vector-ov vocabulary. |
| first_seen (optional) | timestamp | Captures the date/time that the malware instance was first seen by the producer of the Malware Instance Object. |
| last_seen (optional) | timestamp | Captures the date/time that the malware instance was last seen by producer of the Malware Instance Object. |
Malware Development Environment
Malware Development Environment
{
"type":"package",
"id":"package--2f5d32d0-2f41-48a1-b272-fa5f0390dbd3",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-instance",
"id":"malware-instance--90153d4d-092e-1601-b8a5-11312bb0388d",
"instance_object_refs":["0"],
"name": {
"value": "RansomW.cb",
"confidence": 20
},
"static_features": [
{
"development_environment": [
{
"tool_refs": ["4"]
}
]
}
]
}
],
"observable_objects": {
"0": {
"type": "file",
"hashes": {"MD5": "66e2ea40dc71d5ba701574ea215a81f1"}
},
"4": {
"type":"software",
"name":"gcc"
}
}
}
Type Name: malware-development-environment
The malware-development-environment
captures details of the development environment used in developing the malware instance, such as information on any tools that were used.
Requirements:
- At least one of tool_refs or debugging_file_refs MUST be included when using this type.
| Name | Type | Description |
|---|---|---|
| tool_refs (optional) | list of type object-ref | References the tools used in the development of the malware instance. The Objects referenced MUST be of STIX Cyber Observable type software and MUST be specified in the observable_objects property of the Package. |
| debugging_file_refs (optional) | list of type object-ref | References debugging files associated with the malware instance, such as PDB files. The Objects referenced MUST be of STIX Cyber Observable type file and MUST be specified in the observable_objects property of the Package. |
Name
Name
{
"type":"package",
"id":"package--d7b38d7d-f587-4556-a786-0cd2ee10bf5d",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-instance",
"id":"malware-instance--90153d4d-092e-1601-b8a5-11312bb0388d",
"name": {
"value": "Conficker.A",
"source": {
"source_name": "Conficker Threat Intel",
"description": "Analysis details of Conficker by Amanda Analyst",
"url": "http://www.example.com/threat-report.pdf"
},
"confidence": 80
}
}
]
}
Type Name: name
The name
type captures the name of a Malware Instance, Malware Family, or alias, as well as the source and relative confidence in the name.
| Name | Type | Description |
|---|---|---|
| value (required) | string | Captures the name of the malware instance, family, or alias. |
| source (optional) | external-reference | Captures the internal or external source of the value property (i.e., the name). |
| confidence (optional) | integer | Captures the relative confidence in the accuracy of the assigned name. The confidence value MUST be a number in the range of 0-100. |
Process Tree Node
Process Tree Node
{
"type":"package",
"id": "package--2d42dac8-c416-42c6-bc5c-7b6dcf576fc5",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-instance",
"id":"malware-instance--19863c16-503e-493f-8841-16c68e39c26e",
"instance_object_refs": ["0"],
"dynamic_features": {
"behavior_refs": ["behavior--1", "behavior--2"],
"process_tree": [
{
"process_ref":"1",
"ordinal_position":0
}
]
}
}
],
"observable_objects": {
"0": {
"type": "file",
"hashes": {"MD5": "66e2ea40dc71d5ba701574ea215a81f1"}
},
"1": {
"type": "process",
"pid": 1234
},
"2": {
"type": "process",
"pid": 2345
},
"3": {
"type": "process",
"pid": 5678
}
}
}
Type Name: process-tree-node
The process-tree-node
type captures a single node in a process tree, as recorded for a Malware Instance.
| Name | Type | Description |
|---|---|---|
| process_ref (required) | object-ref | References the Process Object, contained in the Package, which represents the process and its relevant metadata. The Object referenced MUST be of STIX Cyber Observable type process and MUST be specified in the observable_objects property of the Package. |
| parent_action_ref (optional) | identifier | Captures the ID of the Action that created or injected the process. The referenced entity MUST be of type malware-action . |
| ordinal_position (optional) | integer | Captures the ordinal position of the process with respect to the other processes spawned or injected by the malware. This value MUST be a non-negative integer. For specifying the root process of the process tree, a value of 0 MUST be used. |
| initiated_action_refs (optional) | list of type identifier | Captures the IDs of the Actions initiated by the process. Each referenced entity MUST be of type malware-action . |
Relationship Distance
Relationship Distance
{
"type":"package",
"id":"package--0987dac8-2316-52c6-6fbc-074ef8876fdd",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-instance",
"id":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
"instance_object_refs": ["0"]
},
{
"type":"malware-instance",
"id":"malware-instance--bacd8340-83bd-94ad-0111-f029304ced90",
"instance_object_refs": ["1"]
}
],
"observable_objects": {
"0": {
"type":"file",
"hashes": {"MD5":"4472ea40dc71e5bb701574ea215a81a1"}
},
"1": {
"type":"file",
"hashes": {"MD5":"39C8E9953FE8EA40FF1C59876E0E2F28"}
}
},
"relationships": [
{
"type":"relationship",
"id":"relationship--ffc99c9c-8765-4a36-b416-65dde178b008",
"source_ref":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
"target_ref":"malware-instance--bacd8340-83bd-94ad-0111-f029304ced90",
"relationship_type":"has-distance",
"metadata": {
"distance": {
"distance_score":0.92,
"algorithm_name":"clusterAlgorithm-abc",
"algorithm_version":"6.1",
"metadata":{"foo":"bar"}
}
}
}
]
}
Type Name: relationship-distance
The relationship-distance
type captures a distance score and associated metadata between the source and target in a MAEC relationship.
| Name | Type | Description |
|---|---|---|
| distance_score (required) | float | Captures the distance score between the source and target in the relationship. This is most commonly represented as a floating point value between zero and one (with a higher value representing a greater distance). |
| algorithm_name (optional) | string | Captures the name of the algorithm or tool used in calculating the distance score specified in the distance_score property. |
| algorithm_version (optional) | string | Captures the version of the algorithm or tool used in calculating the distance score specified in the distance_score property. |
| metadata (optional) | dictionary | Specifies a dictionary of additional metadata around the distance score, as a set of key/value pairs. Dictionary keys and their corresponding values MUST be of type string . |
Signature Metadata
Signature Metadata
{
"type":"package",
"id":"package--2d42dac8-c416-42c6-bc5c-7b6dcf576fc5",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-instance",
"id":"malware-instance--19863c16-503e-493f-8841-16c68e39c26e",
"instance_object_refs": ["0"],
"triggered_signatures": [
{
"signature_type":"yara",
"description":"Ransomware",
"author":"John Doe",
"reference":{
"url": "http://foo.bar"
},
"severity":"9.0"
},
{
"signature_type":"cuckoo",
"description":"Anti-sandbox sleep",
"author":"Jane Doe",
"reference":{
"url":"http://bar.foo"
},
"severity":"5.0"
}
]
}
]
}
Type Name: signature-metadata
The signature-metadata
type captures metadata associated with a signature (for example, a YARA rule) that may have been triggered during the analysis of a malware instance.
Requirements:
- In addition to signature_type, at least one of the name or description properties MUST be included when using this type.
| Name | Type | Description |
|---|---|---|
| signature_type (optional) | string | Captures the type of the signature, i.e., the language or platform it is written for. For example, “snort”, for the Snort network intrusion detection system (NIDS). The name of the language or platform SHOULD be in lowercase, with any whitespace replaced with dashes (i.e., “-”). |
| name (optional) | string | Captures the name provided for the signature (if applicable). |
| description (optional) | string | Captures a textual description of the signature. |
| author (optional) | string | Captures the name of the author of the signature. |
| reference (optional) | external-reference | Captures an external reference associated with the signature. |
| severity (optional) | string | Captures a measure of severity associated with the detection of the signature. |
| external_id (optional) | string | Captures an external identifier associated with the signature. |
Static Features
Static Features
{
"type":"package",
"id":"package--b7be50bd-6348-4226-bef9-4c3510f698f7",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-instance",
"id":"malware-instance--90153d4d-092e-1601-b8a5-11312bb0388d",
"name": {
"value": "Malcode.13",
"confidence": 50
},
"static_features": {
"strings": ["This string is key.", "This is another string in the instance"],
"obfuscation_methods": [
{
"method":"packing",
"ordering":1,
"packer_name":"UPX"
},
{
"method":"encryption",
"ordering":1,
"encryption_algorithm":"XOR"
}
],
"configuration_parameters": [
{
"name":"magic-number",
"value":"0x674dfe60abee3234"
},
{
"name":"directory",
"value":"C:\\Users\\<username>\\Desktop"
}
],
"development_environment": {
"tool_refs": ["4"],
"debugging_file_refs": ["6"]
}
}
}
]
}
Type Name: static-features
The static-features
type captures features associated with a malware instance (a binary file) not related to the semantics of the code.
Requirements:
- At least one of strings or obfuscation_methods or certificates or file_headers or configuration_parameters or development_environment properties MUST be included when using this type.
| Name | Type | Description |
|---|---|---|
| strings (optional) | list of type string | Captures any strings that were extracted from the malware instance. |
| obfuscation_methods (optional) | list of type binary-obfuscation | Captures metadata associated with methods used to obfuscate the malware instance (e.g., packers, encryptors). |
| certificates (optional) | list of type object-ref | References any software certificates used to sign the malware instance. The Objects referenced MUST be of STIX Cyber Observable type x509-certificate and MUST be specified in the observable_objects property of the Package. |
| file_headers (optional) | list of type object-ref | References any file headers (e.g., PE file headers) extracted from the malware instance. The Objects referenced MUST be of STIX Cyber Observable type file and MUST be specified in the observable_objects property of the Package. |
| configuration_parameters (optional) | dictionary | Captures any configuration parameters specified for the malware instance. Each key in the dictionary MUST be of type string and SHOULD come from the malware-configuration-parameter-ov vocabulary, which is based on the data reported by the Malware Configuration Parser (MWCP) tool developed by the Department of Defense Cyber Crime Center (DC3). Each corresponding key value MUST also be of type string , and should capture the actual value of the configuration parameter. |
| development_environment (optional) | malware-development-environment | Captures details of the development environment used to create the malware instance. |
Relationships
Relationship between Malware Instances ("downloaded-by")
{
"type":"package",
"id":"package--0987dac8-2316-52c6-6fbc-074ef8876fdd",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-instance",
"id":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
"instance_object_refs": ["0"]
},
{
"type":"malware-instance",
"id":"malware-instance--bacd8340-83bd-94ad-0111-f029304ced90",
"instance_object_refs": ["1"]
}
],
"observable_objects": {
"0": {
"type":"file",
"hashes": {"MD5":"4472ea40dc71e5bb701574ea215a81a1"}
},
"1": {
"type":"file",
"hashes": {"MD5":"39C8E9953FE8EA40FF1C59876E0E2F28"}
}
},
"relationships": [
{
"type":"relationship",
"id":"relationship--dcc7d8d4-91c0-412a-8d09-a030ab19e0f1",
"source_ref":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
"target_ref":"malware-instance--bacd8340-83bd-94ad-0111-f029304ced90",
"relationship_type":"downloaded-by"
}
]
}
Relationship between Malware Instances ("has-distance")
{
"type":"package",
"id":"package--dbd7a6ae-9dfc-48a2-9e6e-bf85f0c8613b",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-instance",
"id":"malware-instance--c90945ec-ea66-4c61-9bd4-72e66aeb464e",
"instance_object_refs": ["0"]
},
{
"type":"malware-instance",
"id":"malware-instance--ce40a5c7-f3af-4b64-90e2-2884194192ab",
"instance_object_refs": ["1"]
}
],
"observable_objects": {
"0": {
"type":"file",
"hashes": {"MD5":"aafdea40dc71e5bb701574ea215a81a1"}
},
"1": {
"type":"file",
"hashes": {"MD5":"3ABCE9953FE8EA40FF1C59876E0E2F28"}
}
},
"relationships": [
{
"type":"relationship",
"id":"relationship--0bc99c9c-8765-4a36-b416-bbdde178b5a4",
"source_ref":"malware-instance--c90945ec-ea66-4c61-9bd4-72e66aeb464e",
"target_ref":"malware-instance--ce40a5c7-f3af-4b64-90e2-2884194192ab",
"relationship_type":"has-distance",
"metadata":{"distance":{"distance_score":"0.35",
"algorithm_name":"FooDist"}}
}
]
}
Type Name: relationship
The Relationship Object captures relationships between two entities in a MAEC Package. If MAEC TLOs are considered "nodes" or "vertices" in the graph, the Relationship Object represent "edges". Explicit relationships between MAEC Top Level Objects are provided above in the MAEC specification. Note that MAEC relationships cannot be the source or target of another relationship.
MAEC defines many relationship types to link together some TLOs. These relationships are contained in the "Relationships" table under each TLO definition. Relationship types defined in the specification SHOULD be used to ensure consistency. An example of a specification-defined relationship is that a malware-instance
is downloaded-by
a malware-instance
. That relationship type is listed in the Relationships section of the Malware Instance TLO definition.
MAEC also allows relationships from any TLO to any TLO that have not been defined in the specification. These relationships MAY use the generic related-to
relationship type or MAY use a custom relationship type. As an example, a user might want to link malware-instance
directly to a collection
. They can do so using related-to
to say that the Malware is related to the Collection but not describe how, or they could use has-common-artifacts
(a custom name they determined) to indicate more detail.
| Name | Type | Description |
|---|---|---|
| type (required) | string | The value of this property MUST be relationship . |
| id (required) | identifier | Specifies a unique ID for the Relationship. |
| source_ref (required) | identifier | Specifies a reference to the ID of the entity in the MAEC document that corresponds to the source in the source-target relationship. The referenced entity MUST be present in the current Package. |
| target_ref (required) | identifier | Specifies a reference to the ID of the entity in the MAEC document that corresponds to the target in the source-target relationship. The referenced entity MUST be present in the current Package. |
| timestamp (optional) | timestamp | Specifies a timestamp that states when the relationship was created. |
| relationship_type (required) | string | Specifies the type of relationship being expressed. This value SHOULD be an exact value listed in the relationships for the source and target top-level object, but MAY be any string. The value of this field MUST be in ASCII and is limited to characters a–z (lowercase ASCII), 0–9, and dash (-). |
| metadata (optional) | dictionary | Specifies a dictionary of additional metadata around the relationship. Standard dictionary keys include distance , which is used for capturing any distance-related metadata. The corresponding value for this key MUST be an object of type relationship-distance . Custom entries in the dictionary MAY also be included. Each custom entry MUST have a key of type string and the key MUST be in ASCII and is limited to characters a–z (lowercase ASCII), 0–9, and dash (-). Each custom entry MUST have a key value that is a valid common datatype. |
Common Relationships
Each MAEC top-level object has its own set of relationship types that are specified in the definition of that TLO. The following common relationship types are defined for all TLOs.
| Relationship Type | Source | Target | Description |
|---|---|---|---|
related-to |
<MAEC Object> |
<MAEC Object> |
Asserts a non-specific relationship between two TLOs. This relationship can be used when none of the other predefined relationships are appropriate. |
Relationship Summary
This relationship summary is provided as a convenience. If there is a discrepancy between this table and the relationships defined with each of the TLOs, then the relationships defined with the TLOs MUST be viewed as authoritative.
| Source | Relationship Type | Target |
|---|---|---|
behavior |
dependent-on |
behavior |
behavior |
discovered-by |
software |
malware-action |
dependent-on |
malware-action |
malware-action |
discovered-by |
software |
malware-family |
dropped-by |
malware-family |
malware-family |
derived-from |
malware-family |
malware-instance |
ancestor-of |
malware-instance |
malware-instance |
has-distance |
malware-instance |
malware-instance |
installed-by |
malware-family |
malware-instance |
installed-by |
malware-instance |
malware-instance |
derived-from |
malware-family |
malware-instance |
derived-from |
malware-instance |
malware-instance |
variant-of |
malware-family |
malware-instance |
variant-of |
malware-instance |
malware-instance |
downloaded-by |
malware-family |
malware-instance |
downloaded-by |
malware-instance |
malware-instance |
dropped-by |
malware-family |
malware-instance |
dropped-by |
malware-instance |
malware-instance |
extracted-from |
malware-instance |
Package
Package
{
"type":"package",
"id":"package--0987dac8-2316-52c6-6fbc-074ef8876fdd",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-instance",
"id":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
"instance_object_refs": ["0"]
},
{
"type":"malware-instance",
"id":"malware-instance--bacd8340-83bd-94ad-0111-f029304ced90",
"instance_object_refs": ["1"]
}
],
"observable_objects": {
"0": {
"type":"file",
"hashes": {"MD5":"4472ea40dc71e5bb701574ea215a81a1"}
},
"1": {
"type":"file",
"hashes": {"MD5":"39C8E9953FE8EA40FF1C59876E0E2F28"}
}
},
"relationships": [
{
"type":"relationship",
"source_ref":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
"target_ref":"malware-instance--bacd8340-83bd-94ad-0111-f029304ced90",
"relationship_type":"downloaded-by"
}
]
}
Type Name: package
The package
is the standard output format that can be used to capture one or more Malware Instances or Malware Families and the entities associated with them: Capabilities, Behaviors, Actions, Cyber Observable Objects, and Collections and Relationships.
| Name | Type | Description |
|---|---|---|
| type (required) | string | The value of this property MUST be package . |
| id (required) | identifier | Specifies the ID for the Package. |
| schema_version (required) | string | Specifies the version of the MAEC specification used to represent the content in this Package. The value of this property MUST be 5.0 . |
| maec_objects (required) | list of type <MAEC Object> | Specifies MAEC Objects. Objects in this list MUST be valid MAEC Top-level Objects. |
| observable_objects (optional) | stix-observable-objects | Specifies a dictionary of STIX Cyber Observable Objects relevant to the MAEC Package. This dictionary MUST contain all Cyber Observable Objects associated with the MAEC Package, including those that are referenced by other Cyber Observable Objects. |
| relationships (optional) | list of type relationship | Specifies a set of one or more MAEC Relationships. Each entry in this list MUST be of type relationship. |
STIX Cyber Observable Object Extensions
AV Classification
The following are MAEC-specific extensions defined for STIX Cyber Observable Objects used in the context of MAEC.
AV Classification
{
"type":"package",
"id":"package--e2ea70f1-02af-4560-8712-34e1d138393e",
"schema_version":"5.0",
"observable_objects": {
"0": {
"type":"file",
"name":"a92e5b2bae.exe",
"hashes": {"MD5":"a92e5b2bae0b4b3a3d81c85610b95cd4"},
"extensions": {
"x-maec-avclass": [
{
"scan_date":"2010-05-15T03:38:44Z",
"is_detected":false,
"av_name":"Security Essentials",
"av_vendor":"Microsoft",
"av_engine_version":"4.2.3",
"av_definition_version":"032415-0011"
},
{
"scan_date":"2010-05-18T12:43:12Z",
"is_detected":true,
"classification_name":"Trojan.Zeus",
"av_vendor":"McAfee"
}
]
}
}
}
}
Type Name: x-maec-avclass
The x-maec-avclass
extension captures information on anti-virus (AV) tool classifications for a particular file. Note that unlike other extensions, the base type of this extension is list
, with each entry in the list (of type dictionary
) representing a single AV classification. This custom extension MUST only be used in conjunction with the STIX Cyber Observable File Object.
| Name | Type | Description |
|---|---|---|
| scan_date (required) | timestamp | Captures the date and time of the scan. This property can be used to track how scans change over time. |
| submission_date (optional) | timestamp | Captures the date and time that the binary was submitted for scanning. |
| is_detected (optional) | boolean | Captures whether the AV tool specified in the x-maec-avclass extension has detected the malware instance. |
| classification_name (optional) | string | Captures the classification assigned to the malware instance by the AV tool. |
| av_name (optional) | string | Captures the name of the AV tool that generated the classification. |
| av_vendor (optional) | string | Captures the name of the vendor of the AV tool that generated the classification. |
| av_version (optional) | string | Captures the version of the AV tool that generated the classification. |
| av_engine_version (optional) | string | Captures the version of the AV engine used by the AV tool that generated the classification. |
| av_definition_version (optional) | string | Captures the version of the AV definitions used by the AV tool that generated the classification. |
Common Data Types
Boolean
Boolean
{
...
"is_encoded": true,
...
}
Type Name: boolean
A boolean
data type has two possible values: true
or false
.
The JSON MTI serialization uses the JSON boolean type, which is a literal (unquoted) true
or false
.
Dictionary
Dictionary
{
...
"attributes": {
"file type":"pdf",
"encryption algorithm":"rc4"
}
...
}
Type Name: dictionary
The dictionary
data type captures an arbitrary set of key/value pairs.
Requirements:
Dictionary keys:
- MUST be unique in each dictionary.
- MUST be in ASCII.
- MUST be limited to the characters a-z (lowercase ASCII), A-Z (uppercase ASCII), numerals 0-9, hyphen (-), and underscore (_).
- SHOULD be no longer than 30 ASCII characters in length.
- MUST have a minimum length of 3 ASCII characters.
- MUST be no longer than 256 ASCII characters in length.
- SHOULD be lowercase.
Dictionary values:
- MUST be valid common data types.
External Reference
External-reference #1
{
...
"references": [
{
"source_name": "ACME Threat Intel",
"description": "Threat report",
"url": "http://www.example.com/threat-report.pdf"
}
]
...
}
External-reference #2
{
...
"references": [
{"url":"https://collaborate.mitre.org/maec/index.php/Behavior:45"},
{"url":"https://collaborate.mitre.org/maec/index.php/Behavior:45/13"}
]
...
}
Type Name: external-reference
The external-reference
data type describes pointers to information represented outside of MAEC. For example, a Malware Instance object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
The JSON MTI serialization uses the JSON object type when representing external-reference.
Requirements: In addition to the source_name property, at least one of the description, url, or external_id properties MUST be present.
| Name | Type | Description |
|---|---|---|
| source_name (required) | string | The source within which the external-reference is defined (system, registry, organization, etc.). |
| description (optional) | string | A human readable description. |
| url (optional) | string | A URL reference to an external resource. |
| external_id (optional) | string | An identifier for the external reference content. |
Float
Float
{
...
"distance": 8.321,
...
}
Type Name: float
The float
data type represents an IEEE 754 double-precision number (e.g., a number with a fractional part). However, because the values ±Infinity and NaN are not representable in JSON, they are not valid values in MAEC.
In the JSON MTI serialization, floating point values are represented by the JSON number type.
Hexadecimal
Hexadecimal
{
...
"file_offset":"0400af88"
...
}
Type Name: hex
The hex
data type encodes an array of octets (8-bit bytes) as hexadecimal. The string MUST consist of an even number of hexadecimal characters, which are the digits '0' through '9' and the letters 'a' through 'f'.
Identifier
Identifier
{
...
"behaviors": [
{
"type": "behavior",
"id": "behavior--c2f01ec8-42ff-403e-9e76-b4e8a1ffe1b8",
"name": "persist after system reboot"
}
]
...
}
Type Name: identifier
The identifier
data type universally and uniquely identifies a MAEC Top Level Object, Relationship Object, or Package. Identifiers (IDs) MUST follow the form object-type--UUIDv4
, where object-type
is the exact value (all type names are lowercase strings, by definition) from the type property of the object being identified or referenced and where the UUIDv4
is an RFC 4122-compliant Version 4 UUID. The UUID MUST be generated according to the algorithm(s) defined in RFC 4122, Section 4.4 (Version 4 UUID).
The JSON MTI serialization uses the JSON string type when representing identifier
.
Integer
Integer
{
...
"count": 8,
...
}
Type Name: integer
The integer data type represents a number without any fractional or decimal part. Unless otherwise specified, all integers MUST be capable of being represented as a signed 64-bit value ([-(2**63)+1, (2**63)-1]). Additional restrictions MAY be placed on the type as described where it is used.
In the JSON MTI serialization, integers are represented by the JSON number type.
List
List
{
...
"action_refs": [
"malware-action--c095f1ab-0847-4d89-92ef-010e6ed39c20",
"malware-action--80f3f63a-d5c9-4599-b9e4-2a2bd7210736",
"malware-action--5643f634-fff9-4b39-34a4-76fed73d0dd6"
],
...
}
Type Name: list
The list
data type defines an ordered sequence of values. The phrasing “list
of type <type>
” is used to indicate that all values within the list MUST conform to the specific type. For instance, list
of type integer
means that all values of the list must be of the integer
type. This specification does not specify the maximum number of allowed values in a list, however every instance of a list MUST have at least one value. Specific MAEC object properties may define more restrictive upper and/or lower bounds for the length of the list.
Empty lists are prohibited in MAEC and MUST NOT be used as a substitute for omitting the property if it is optional. If the property is required, the list MUST be present and MUST have at least one value.
The JSON MTI serialization uses the JSON array type, which is an ordered list of zero or more values.
Object Reference
Object Reference - illustrates the referencing of a malware binary (represented as a STIX Cyber Observable File Object) by a Malware Instance.
{
"type":"package",
"id":"package--7892dac8-c416-35c6-bc5c-7b6dcf576f91",
"schema_version":"5.0",
"maec_objects": [
{
"type":"malware-instance",
"id":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
"instance_object_refs": ["0"]
}
],
"observable_objects": {
"0": {
"type":"file",
"hashes":{"MD5":"4472ea40dc71e5bb701574ea215a81a1"},
"size":25536
}
}
}
Type Name: object-ref
The object-ref
data type specifies a reference to a STIX Observable Object captured in the MAEC Package observable_objects property (stix-observable-objects
). The reference MUST be valid within the scope of the local Package and MUST reference a STIX Cyber Observable of one of the following types:
- artifact
- autonomous-system
- directory
- domain-name
- email-addr
- email-message
- file
- ipv4-addr
- ipv6-addr
- mac-addr
- network-traffic
- process
- software
- url
- user-account
- windows-registry-key
- x509-certificate
Observable Objects
Observable Object - illustrates the capture of a STIX Network Traffic Object and an associated IPv4 Address Object.
{
"0": {
"type": "ipv4-addr",
"value": "<IP_ADDRESS>"
},
"1": {
"type": "network-traffic",
"dst_ref": "0"
}
}
Type Name: stix-observable-objects
The stix-observable-objects
data type is a dictionary (see the dictionary
data type) where the keys are used as references to the values, which are STIX Observable Objects. Each key in the dictionary SHOULD be a non-negative monotonically increasing integer, starting at the value 0 and incrementing by 1, and represented as a string within the JSON MTI serialization. However, implementers MAY elect to use an alternate key format.
Open Vocabulary
Example using a value from an open vocabulary
json { ... "structural_features": { "name":"code-compression", ... } ... }
Example using a custom value
json { ... "structural_features": { "name":"some-odd-code-obfuscation", ... } ... }
Type Name: open-vocab
The open-vocab
data type is represented as a string
. For properties that use this type, there will be a list of suggested values to define the property (see Vocabularies). The value of the property SHOULD be chosen from the open vocabulary but MAY be any other string
value. Values that are not from the open vocabulary SHOULD be all lowercase (where lowercase is defined by the locality conventions) and SHOULD use hyphens instead of spaces or underscores as word separators.
A consumer that receives MAEC content with one or more open-vocab terms not defined in the open vocabulary MAY ignore those values.
The JSON MTI serialization uses the JSON string type when representing open-vocab
.
String
String
{
...
"name":"add-windows-hook",
...
}
Type Name: string
The string
data type represents a finite-length string of valid characters from the Unicode coded character set. Unicode incorporates ASCII and the characters of many other international character sets.
The JSON MTI serialization uses the JSON string type, which mandates the UTF-8 encoding for supporting Unicode.
Timestamp
Timestamp
{
...
"submission_date": "2016-01-20T12:31:12.12345Z",
...
}
Type Name: timestamp
The timestamp
data type defines how timestamps are represented in MAEC.
The JSON MTI serialization uses the JSON string type when representing timestamp
.
Requirements:
- A timestamp property MUST be a valid RFC 3339-formatted timestamp using the format
YYYY-MM-DDTHH:mm:ss[.s+]Z
where the “s+” represents 1 or more sub-second values. The brackets denote that subsecond precision is optional, and that if no digits are provided, the decimal place MUST NOT be present. - A timestamp MUST be represented in the UTC timezone and MUST use the “Z” designation to indicate this.
Vocabularies
Analysis Conclusions
Vocabulary Name: analysis-conclusion-ov
The Analysis Conclusion vocabulary is used by the following object/property:
- Malware Instance --> analysis_metadata --> conclusion
This vocabulary is an enumeration of conclusions resulting from the analysis of a malware instance.
| Value | Description |
|---|---|
| benign | As a conclusion of the analysis, the malware instance was determined to be benign. |
| malicious | As a conclusion of the analysis, the malware instance was determined to be malicious. |
| suspicious | As a conclusion of the analysis, the malware instance was determined to be suspicious. |
| indeterminate | The conclusion of the analysis was indeterminate. |
Analysis Environment
Vocabulary Name: analysis-environment-ov
The Analysis Environment vocabulary is currently used by the following object/property:
- Malware Instance --> analysis_metadata --> analysis_environment
This vocabulary is an enumeration of properties associated with the environment used in malware analysis.
| Value | Description |
|---|---|
| operating-system | The operating system used for the dynamic analysis of the malware instance. This applies to virtualized operating systems as well as those running on bare metal. The corresponding value for this entry MUST be of type object-ref and the referenced STIX Cyber Observable Object MUST be of type software . |
| host-vm | The virtual machine used to host the guest operating system (if applicable) used for the the dynamic analysis of the malware instance. If this value is not included in conjunction with operating-system , this means that the dynamic analysis was performed on bare metal (i.e., without virtualization). The corresponding value for this entry MUST be of type object-ref and the referenced STIX Cyber Observable Object MUST be of type software . |
| installed-software | Any non-standard software installed on the operating system (specified through the operating-system value) used for the dynamic analysis of the malware instance. The corresponding value for this entry MUST be of type list and each STIX Cyber Observable Object(s) referenced in the list MUST be of type software . |
Analysis Types
Vocabulary Name: analysis-type-ov
The Analysis Type open vocabulary is used by the following object/property:
- Malware Instance --> analysis_metadata --> analysis_type
This vocabulary is an enumeration of malware analysis types.
| Value | Description |
|---|---|
| static | Static malware analysis, achieved by inspecting but not executing the malware instance. For example, inspection can be done by studying memory dumps captured after the instance is run. |
| dynamic | Dynamic malware analysis, achieved by executing the malware instance (e.g., in a sandbox) and recording its behavior. |
| combination | A combination of dynamic and static malware analysis, achieved by both inspecting and executing the malware instance. |
Behaviors
Vocabulary Name: behavior-ov
The Behavior open vocabulary is used in the following object/property:
- Behavior --> name
This vocabulary is a non-exhaustive enumeration of malware behaviors.
| Value | Description |
|---|---|
| access-premium-service | Accesses a premium service, such as a premium SMS service. |
| autonomous-remote-infection | Infects a remote machine autonomously, without the involvement of any end user (e.g., through the exploitation of a remote procedure call vulnerability). |
| block-security-websites | Prevents access from the system on which the malware instance is executing to one or more security vendor or security-related websites. |
| capture-camera-input | Captures data from a system's camera, including from embedded cameras (i.e. on mobile devices) and/or attached webcams. |
| capture-file-system-data | Captures data from a file system. |
| capture-gps-data | Captures GPS data from the system on which the malware instance is executing. |
| capture-keyboard-input | Captures data from the keyboard attached to the system on which the malware instance is running. |
| capture-microphone-input | Capture data from a system's microphone, including from embedded microphones (i.e. on mobile devices) and those that may be attached externally. |
| capture-mouse-input | Captures data from a system's mouse. |
| capture-printer-output | Captures data sent to a system's printer, either locally or remotely. |
| capture-system-memory | Captures data from a system's RAM. |
| capture-system-network-traffic | Captures network traffic from the system on which the malware instance is executing. |
| capture-system-screenshot | Captures images of what is currently being displayed on a system's screen, either locally (i.e. on a display) or remotely via a remote desktop protocol. |
| capture-touchscreen-input | Captures data from a system's touchscreen. |
| check-for-payload | Queries a command and control server to check whether a new payload is available for download. |
| check-language | Checks the language of the host system on which it executes. |
| click-fraud | Simulates legitimate user clicks on website advertisements for the purpose of revenue generation. |
| compare-host-fingerprints | Compares a previously computed host fingerprint to one computed for the current system on which the malware instance is executing, to determine if the malware instance is still executing on the same system. |
| compromise-remote-machine | Gains control of a remote machine through compromise, e.g., by exploiting a particular vulnerability. |
| control-local-machine-via-remote-command | Controls the machine on which the malware instance is executing, through one or more remotely sent commands. |
| control-malware-via-remote-command | Executes commands issued to the malware instance from a remote source such as a command and control server, for the purpose of controlling its behavior. |
| crack-passwords | Consumes system resources for the purpose of password cracking. |
| defeat-call-graph-generation | Defeats accurate call graph generation during disassembly of the malware instance. |
| defeat-emulator | Defeats or prevents the execution of the malware instance in an emulator. |
| defeat-flow-oriented-disassembler | Defeats disassembly of the malware instance in a flow-oriented (recursive traversal) disassembler. |
| defeat-linear-disassembler | Prevents the disassembly of the malware instance in a linear disassembler. |
| degrade-security-program | Degrades one or more security programs running on a system, either by stopping them from executing or by making changes to their code or configuration parameters. |
| denial-of-service | Causes the local machine on which the malware instance is executing and/or a remote network resource to be unavailable. |
| destroy-hardware | Physically destroys a piece of hardware, e.g., by causing it to overheat. |
| detect-debugging | Detects whether the malware instance is being executed inside of a debugger. |
| detect-emulator | Detects whether the malware instance is being executed inside of an emulator. |
| detect-installed-analysis-tools | Indicates that the malware instance attempts to detect whether certain analysis tools are present on the system on which it is executing. |
| detect-installed-av-tools | Indicates that the malware instance attempts to detect whether certain anti-virus tools are present on the system on which it is executing. |
| detect-sandbox-environment | Detects whether the malware instance is being executed in a sandbox environment. |
| detect-vm-environment | Detects whether the malware instance is being executed in a virtual machine (VM). |
| determine-host-ip-address | Determines the IP address of the host system on which the malware instance is executing. |
| disable-access-rights-checking | Bypasses, disables, or modifies access tokens or access control lists, thereby enabling the malware instance to read, write, or execute a file with one or more of these controls set. |
| disable-firewall | Evades or disables the host-based firewall running on the system on which the malware instance is executing. |
| disable-kernel-patch-protection | Bypasses or disables kernel patch protection mechanisms such as Windows' PatchGuard, enabling the malware instance to operate at the same level as the operating system kernel and kernel mode drivers (KMD). |
| disable-os-security-alerts | Disables operating system (OS) security alert messages that could lead to identification and/or notification of the presence of the malware instance. |
| disable-privilege-limiting | Bypasses or disables mechanisms that limit the privileges that can be granted to a user or entity. |
| disable-service-pack-patch-installation | Disables the system's ability to install service packs and/or patches. |
| disable-system-file-overwrite-protection | Disables system file overwrite protection mechanisms such as Windows file protection, thereby enabling system files to be modified or replaced. |
| disable-update-services-daemons | Disables system update services or daemons that may be already be running on the system on which the malware instance is executing. |
| disable-user-account-control | Bypasses or disables Windows' user account control (UAC), enabling the malware instance and/or its component to execute with elevated privileges. |
| drop-retrieve-debug-log-file | Generates and retrieves a log file of errors relating to the execution of the malware instance. |
| elevate-privilege | Elevates the privilege level under which the malware instance is executing. |
| encrypt-data | Encrypts data that will be exfiltrated. |
| encrypt-files | Encrypts one or more files on the system on which the malware instance is executing, to make them unavailable for use by the users of the system. |
| encrypt-self | Encrypts the executing code (in memory) that belongs to the malware instance. |
| erase-data | Destroys data stored on a disk or in memory by erasure. |
| evade-static-heuristic | Evades a static anti-virus heuristic. For example, an heuristic engine can try to figure out if a file are using a dual extension (e.g: invoice.doc.exe) and determine the file as being malicious. |
| execute-before-external-to-kernel-hypervisor | Executes some or all of the malware instance's code before or external to the system's kernel or hypervisor (e.g., through the BIOS). |
| execute-non-main-cpu-code | Executes some or all of the code of the malware instance on a secondary, non-CPU processor (e.g., a GPU). |
| execute-stealthy-code | Executes code in a hidden manner (e.g., by injecting it into a benign process). |
| exfiltrate-data-via-covert channel | Exfiltrates data using a covert channel, such as a DNS tunnel or NTP. |
| exfiltrate-data-via- -dumpster-dive | Exfiltrates data via dumpster dive - i.e, encoded data printed by malware is viewed as garbage and thrown away to then be physically picked up. |
| exfiltrate-data-via-fax | Exfiltrates data using a fax system. |
| exfiltrate-data-via-network | Exfiltrates data through the computer network connected to the system on which the malware instance is executing. |
| exfiltrate-data-via-physical-media | Exfiltrates data by writing it to physical media (e.g., to a USB flash drive). |
| exfiltrate-data-via-voip-phone | Exfiltrates data (encoded as audio) using a phone system, such as through voice over IP (VoIP). |
| feed-misinformation-during-physical-memory-acquisition | Reports inaccurate data when the contents of the physical memory of the system on which the malware instance is executing is retrieved. |
| file-system-instantiation | Indicates that the malware instance instantiates itself on the file system of the machine that it is infecting, in one or more locations. |
| fingerprint-host | Creates a unique fingerprint for the system on which the malware instance is executing, e.g., based on the applications that are installed on the system. |
| generate-c2-domain-names | Generates the domain name of the command and control server to which the malware connects to. |
| hide-arbitrary-virtual-memory | Hides arbitrary segments of virtual memory belonging to the malware instance in order to prevent their retrieval. |
| hide-data-in-other-formats | Hides data that will be exfiltrated in other formats (e.g., image files). |
| hide-file-system-artifacts | Hides one or more file system artifacts (e.g., files and/or directories) associated with the malware instance. |
| hide-kernel-modules | Hides the usage of any kernel modules by the malware instance. |
| hide-network-traffic | Hides network traffic associated with the malware instance. |
| hide-open-network-ports | Hides one or more open network ports associated with the malware instance. |
| hide-processes | Hides one or more of the processes in which the malware instance is executing. |
| hide-registry-artifacts | Hides one or more Windows registry artifacts (e.g., keys and/or values) associated with the malware instance. |
| hide-services | Hides any system services that the malware instance creates or injects itself into. |
| hide-threads | Hides one or more threads that belong to the malware instance. |
| hide-userspace-libraries | Hides the usage of userspace libraries by the malware instance. |
| identify-file | Identifies one or more files on a local, removable, and/or network drive for infection. |
| identify-os | Identifies the operating system under which the malware instance is executing. |
| identify-target-machines | Identifies one or more machines to be targeted for infection via some remote means (e.g., via email or the network). |
| impersonate-user | Impersonates another user in order to operate within a different security context. |
| install-backdoor | Installs a backdoor on the system on which the malware instance is executing, capable of providing covert remote access to the system. |
| install-legitimate-software | Installs legitimate (i.e. non-malware) software on the same system on which the malware instance is executing. |
| install-secondary-malware | Installs another, different malware instance on the system on which the malware instance is executing. |
| install-secondary-module | Installs a secondary module (typically related to the malware instance itself) on the same system on which the malware instance is executing. |
| intercept-manipulate-network-traffic | Intercepts and/or manipulates network traffic going to or originating from the system on which the malware instance is executing. |
| inventory-security-products | Creates an inventory of the security products installed or running on a system. |
| inventory-system-applications | Inventories the applications installed on the system on which the malware instance is executing. |
| inventory-victims | Keeps an inventory of the victims that are remotely infected by the malware instance. |
| limit-application-type-version | Limits the type or version of an application that runs on a system in order to ensure that the malware instance is able to continue executing. |
| log-activity | Logs the activity of the malware instance. |
| manipulate-file-system-data | Manipulates data stored on the file system of the system on which the malware instance is executing in order to compromise its integrity. |
| map-local-network | Maps the layout of the local network environment in which the malware instance is executing. |
| mine-for-cryptocurrency | Consumes system resources for cryptocurrency (e.g., Bitcoin, Litecoin, etc.) mining. |
| modify-file | Modifies a file in some other manner than writing code to it, such as packing it (in terms of binary executable packing). |
| modify-security-software-configuration | Modifies the configuration of one or more instances of security software (e.g., anti-virus) running on a system in order to negatively impact their usefulness and ability to detect the malware instance. |
| move-data-to-staging-server | Moves data to be exfiltrated to a particular server, to prepare it for exfiltration. |
| obfuscate-artifact-properties | Hides the properties of one or more artifacts associated with the malware instance (e.g., by altering file system timestamps). |
| overload-sandbox | Overloads a sandbox (e.g., by generating a flood of meaningless behavioral data). |
| package-data | Packages data for exfiltration, e.g., by adding it to an archive file. |
| persist-after-hardware-changes | Continues the execution of the malware instance after hardware changes to the system on which it is executing have been made, such as replacement of the hard drive on which the operating system was residing. |
| persist-after-os-changes | Continues the execution of the malware instance after the operating system under which it is executing is modified, such as being installed or reinstalled. |
| persist-after-system-reboot | Continues the execution of the malware instance after a system reboot. |
| prevent-api-unhooking | Prevents the API hooks installed by the malware instance from being removed. |
| prevent-concurrent-execution | Checks to see if it is already running on a system, in order to prevent multiple instances of the malware running concurrently. |
| prevent-debugging | Prevents the execution of the malware instance in a debugger. |
| prevent-file-access | Prevents access to the file system, including to specific files and/or directories associated with the malware instance. |
| prevent-file-deletion | Prevents files and/or directories associated with the malware instance from being deleted from a system. |
| prevent-memory-access | Prevents access to system memory where the malware instance may be storing code or data. |
| prevent-native-api-hooking | Prevents other software from hooking native system APIs. |
| prevent-physical-memory-acquisition | Prevents the contents of the physical memory of the system on which the malware instance is executing from being retrieved. |
| prevent-registry-access | Prevents access to the Windows registry, including to the entire registry and/or to particular registry keys/values. |
| prevent-registry-deletion | Prevent Windows registry keys and/or values associated with the malware instance from being deleted from a system. |
| prevent-security-software- -from-executing | Prevents one or more instances of security software from executing on a system. |
| re-instantiate-self | Re-establishes the malware instance on the system after it is initially detected and partially removed. |
| remove-self | Removes the malware instance from the system on which it is executing. |
| remove-sms-warning-messages | Captures the message body of incoming SMS messages and aborts displaying messages that meets a certain criteria. |
| remove-system-artifacts | Removes artifacts associated with the malware instance (e.g., files, directories, Windows registry keys, etc.) from the system on which it is executing. |
| request-email-address-list | Requests the current list of email addresses, for sending email spam messages to, from the command and control server. |
| request-email-template | Requests the current template, for use in generating email spam messages, from the command and control server. |
| search-for-remote-machines | Searches for one or more remote machines to target. |
| send-beacon | Sends 'beacon' data to a command and control server, indicating that the malware instance is still active on the host system and able to communicate. |
| send-email-message | Sends an email message from the system on which the malware instance is executing to one or more recipients, most commonly for the purpose of spamming. |
| send-system-information | Sends data regarding the system on which it is executing to a command and control server. |
| social-engineering-based-remote-infection | Infects remote machines via some method that involves social engineering (e.g., sending an email with a malicious attachment). |
| steal-browser-cache | Steals a user's browser cache. |
| steal-browser-cookies | Steals one or more browser cookies stored on the system on which the malware instance is executing. |
| steal-browser-history | Steals a user's browser history. |
| steal-contact-list-data | Steals a user's contact list. |
| steal-cryptocurrency-data | Steals cryptocurrency data that may be stored on a system (e.g., Bitcoin wallets). |
| steal-database-content | Steals content from a database that the malware instance may be able to access. |
| steal-dialed-phone-numbers | Steals the list of phone numbers that a user has dialed (i.e. on a mobile device). |
| steal-digital-certificates | Steals one or more digital private keys that may be present on the system on which the malware instance is executing, to then use to hijack the corresponding digital certificates, e.g., those used in public-key infrastructure (PKI). |
| steal-documents | Steals document files (e.g., PDF) stored on a system. |
| steal-email-data | Steals a user's email data. |
| steal-images | Seals image files that may be stored on a system. |
| steal-password-hashes | Steals password hashes. |
| steal-pki-key | Steals one or more public key infrastructure (PKI) keys. |
| steal-referrer-urls | Steals HTTP referrer information (URL of the webpage that linked to the resource being requested). |
| steal-serial-numbers | Steals serial numbers stored on a system. |
| steal-sms-database | Steals a user's short message service (SMS) (text messaging) database (i.e. on a mobile device). |
| steal-web-network-credential | Steals usernames, passwords, or other forms of web (e.g., for logging into a website) and/or network credentials. |
| stop-execution-of-security-software | Stops the execution of one or more instances of security software that may already be executing on a system. |
| suicide-exit | Terminates the execution of the malware instance based on some trigger condition or value. |
| test-for-firewall | Tests whether the network environment in which the malware instance is executing contains a hardware or software firewall. |
| test-for-internet-connectivity | Tests whether the network environment in which the malware instance is executing is connected to the internet. |
| test-for-network-drives | Tests for network drives that may be present in the network environment in which the malware instance is executing. |
| test-for-proxy | Tests whether the network environment in which the malware instance is executing contains a hardware or software proxy. |
| test-smtp-connection | Tests whether an outgoing SMTP connection can be made from the system on which the malware instance is executing to some SMTP server, by sending a test SMTP transaction. |
| update-configuration | Updates the configuration of the malware instance using data received from a command and control server. |
| validate-data | Validates the integrity of data received from a command and control server. |
| write-code-into-file | Writes code into one or more files. |
Capabilities
Vocabulary Name: capability-ov
The Malware Capability open vocabulary is used in the following object/property:
- Capability --> name
| Value | Description |
|---|---|
| anti-behavioral-analysis | Indicates that the malware instance or family is able to prevent behavioral analysis or make it more difficult. |
| anti-code-analysis | Indicates that the malware instance or family is able to prevent code analysis or make it more difficult. |
| anti-detection | Indicates that the malware instance or family is able to prevent itself and its components from being detected on a system. |
| anti-removal | Indicates that the malware instance or family is able to prevent itself and its components from being removed from a system. |
| availability-violation | Indicates that the malware instance or family is able to compromise the availability of a system or some aspect of the system. |
| collection | Indicates that the malware instance or family is able to capture information from a system related to user or system activity (e.g., from a system's peripheral devices). |
| command-and-control | Indicates that the malware instance or family is able to receive and/or execute remotely submitted commands. |
| data-theft | Indicates that the malware instance or family is able to steal data from the system on which it executes. This includes data stored in some form, e.g. in a file, as well as data that may be entered into some application such as a web-browser. |
| destruction | Indicates that the malware instance or family is able to destroy some aspect of a system. |
| discovery | Indicates that the malware instance or family is able to probe its host system or network environment; most often this is done to support other Capabilities and their Objectives. |
| exfiltration | Indicates that the malware instance or family is able to exfiltrate stolen data or perform tasks related to the exfiltration of stolen data. |
| fraud | Indicates that the malware instance or family is able to defraud a user or a system. |
| infection-propagation | Indicates that the malware instance or family is able to propagate through the infection of a machine or is able to infect a file after executing on a system. The malware instance may infect actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email). This Capability does not encompass any aspects of the initial infection that is done independently of the malware instance itself. |
| integrity-violation | Indicates that the malware instance or family is able to compromise the integrity of a system. |
| machine-access-control | Indicates that the malware instance or family is able to access or control one or more remote machines and/or the machine on which it is executing. |
| persistence | Indicates that the malware instance or family is able to persist and remain on a system regardless of system events. |
| privilege-escalation | Indicates that the malware instance or family is able to elevate the privileges under which it executes. |
| secondary-operation | Indicates that the malware instance or family is able to achieve secondary objectives in conjunction with or after achieving its primary objectives. |
| security-degradation | Indicates that the malware instance or family is able to bypass or disable security features and/or controls. |
Common Attributes
Vocabulary Name: common-attribute-ov
The Common Attribute open vocabulary is used in the following objects/properties:
- Capability --> attributes
- Behavior --> attributes
This vocabulary is a non-exhaustive enumeration of common attributes associated with Capabilities or Behaviors of a Malware Instance or Malware Family.
| Value | Description |
|---|---|
| applicable-platform | Captures the name of a targeted platform. |
| archive-type | Captures the name of a file archive format used. |
| autonomy | Captures the level of autonomy used. |
| backdoor-type | Captures the type of backdoor used. |
| cryptocurrency-type | Captures a cryptocurrency targeted. |
| encryption-algorithm | Captures the encryption algorithm used. |
| erasure-scope | Captures the scope of the erasure performed. |
| file-infection-type | Captures the method that an executable infector uses to infect a file. |
| file-modification-type | Captures how a malware file modifies itself to avoid detection. |
| file-type | Captures the type of file format used for storing data to be exfiltrated. |
| frequency | "Captures the frequency with which a C2 Server sends and receives data. |
| infection-targeting | "Captures the type of targeting employed, e.g., whether the targeted machines are randomly selected, or chosen from some particular set. |
| network-protocol | "Captures the name of the network protocol used in command and control communications. |
| port-number | Captures the port number used in command and control communications. |
| persistence-scope | Captures the scope of persistence employed. |
| propagation-scope | "Captures the scope of the infection or propagation performed, i. |
| targeted-application | Captures the names of any targeted applications. |
| targeted-file-architecture type | Captures the types of file architectures targeted. |
| targeted-file-type | Captures the types of files targeted. |
| targeted-program | Captures the names of any targeted programs. |
| targeted-sandbox | Captures the names of any sandboxes targeted. |
| targeted-vm | Captures the names of any virtual machines (VM) targeted. |
| targeted-website | Captures the domain names of any targeted websites. |
| technique | Captures the name of the technique used. |
| trigger-type | Captures the trigger used to wake or terminate the malware instance. |
| user-privilege-escalation type | Captures the type of user privilege escalation employed. |
| vulnerability-id-cve | Captures the Common Vulnerabilities and Exposures (CVE) vulnerability identifier being referenced. |
| vulnerability-id-osvdb | Captures the vulnerability identifier of the Open Source Vulnerability Database (OSVDB) entry being referenced. |
Delivery Vectors
Vocabulary Name: delivery-vector-ov
The Delivery Vector open vocabulary is used in the following objects/properties:
- Malware Instance --> field_data --> delivery_vectors
- Malware Family --> field_data --> delivery_vectors
This vocabulary is a non-exhaustive enumeration of vectors used to deliver malware.
| Value | Description |
|---|---|
| active-attacker | The malware instance or family was delivered via an active attacker. |
| auto-executing-media | The malware instance or family was delivered via media that automatically executes. |
| downloader | The malware instance or family was delivered via downloader. |
| dropper | The malware instance or family was delivered via dropper. |
| email-attachment | The malware instance or family was delivered via email attachment. |
| exploit-kit-landing-page | The malware instance or family was delivered via an exploit kit landing page. |
| fake-website | The malware instance or family was delivered via a fake website. |
| janitor-attack | The malware instance or family was delivered via a janitor attack. |
| malicious-iframes | The malware instance or family was delivered via malicious iframes. |
| malvertising | The malware instance or family was delivered via malvertising. |
| media-baiting | The malware instance or family was delivered via media baiting. |
| pharming | The malware instance or family was delivered via pharming. |
| phishing | The malware instance or family was delivered via phishing. |
| trojanized-link | The malware instance or family was delivered via a trojanized link. |
| trojanized-software | The malware instance or family was delivered via trojanized software. |
| usb-cable-syncing | The malware instance or family was delivered via usb cable syncing. |
| watering-hole | The malware instance or family was delivered via a watering hole. |
Entity Associations
Vocabulary Name: entity-association-ov
The Entity Association open vocabulary is used in the following object/property:
- Collection --> association_type
This vocabulary is an non-exhaustive enumeration of entity association types relevant to MAEC entities and STIX Cyber Observables.
| Value | Description |
|---|---|
| file-system-entities | The collection contains Cyber Observable Objects that correspond to file system entities. |
| network-entities | The collection contains Cyber Observable Objects that correspond to network entities. |
| process-entities | The collection contains Cyber Observable Objects that correspond to process entities. |
| memory-entities | The collection contains Cyber Observable Objects that correspond to memory entities. |
| ipc-entities | The collection contains Cyber Observable Objects that correspond to inter-process communication (IPC) entities. |
| device-entities | The collection contains Cyber Observable Objects that correspond to device entities. |
| registry-entities | The collection contains Cyber Observable Objects that correspond to registry entities. |
| service-entities | The collection contains Cyber Observable Objects that correspond to service entities. |
| potential-indicators | The collection contains entities that serve as potential indicators. |
| same-malware-family | The collection contains that Malware Instances are from the same malware family. |
| clustered-together | The collection contains Malware Instances that have been clustered together by some method such as a scoring algorithm. |
| observed-together | The collection contains Malware Instances that have been observed together. |
| same-malware-toolkit | The collection contains Malware Instances that are derived from the same malware toolkit. |
Malware Actions
Vocabulary Name: malware-action-ov
The Malware Action open vocabulary is used in the following object/property:
- Malware Action --> name
This vocabulary is a non-exhaustive enumeration of Actions that may be performed by a Malware Instance.
| Value | Description |
|---|---|
| accept-socket-connection | The action of accepting a socket connection. |
| add-connection-to-network-share | The action of adding a connection to a network share. |
| add-network-share | The action of adding a new network share on a server. |
| add-scheduled-task | The action of adding a scheduled task to a system. |
| add-system-call-hook | The action of adding a new system call hook. |
| add-user-to-group | The action of adding an existing user to a group. |
| add-user | The action of adding a new user. |
| add-windows-hook | The action of adding a new Windows application-defined hook procedure. |
| allocate-process-virtual-memory | The action of allocating a virtual memory region in an existing process. |
| bind-address-to-socket | The action of binding a socket address to a socket. |
| call-library-function | The action of calling a function exported by a library. |
| change-password | The action of changing a user’s password. |
| check-for-kernel-debugger | The action of checking for the presence of a kernel debugger. |
| check-for-remote-debugger | The action of checking for the presence of a remote debugger. |
| close-file | The action of closing an existing file previously opened for reading or writing. |
| close-port | The action of closing a network port. |
| close-registry-key | The action of closing a handle to an existing registry key. |
| close-socket | The action of closing a socket. |
| connect-to-ftp-server | The action of connecting to an ftp server. |
| connect-to-ip-address | The action of connecting to an IP address. |
| connect-to-irc-server | The action of connecting to an IRC server. |
| connect-to-named-pipe | The action of connecting to a named pipe. |
| connect-to-network-share | The action of connecting to a network share. |
| connect-to-socket-address | The action of connecting to a socket address. |
| connect-to-socket | "The action of connecting to a socket, which consists of an IP address and port number. |
| connect-to-url | The action of connecting to a URL. |
| copy-file | The action of copying a file from one location to another. |
| create-critical-section | The action of creating a new critical section. |
| create-dialog-box | The action of creating a new dialog box. |
| create-directory | The action of creating a new directory. |
| create-event | The action of creating a new event. |
| create-file-alternate-data-stream | The action of creating a new file alternate data stream in a file. |
| create-file-mapping | The action of creating a new file mapping object. |
| create-file-symbolic-link | The action of creating a new symbolic link to a file. |
| create-file | The action of creating a new file. |
| create-mailslot | The action of creating a new mailslot. |
| create-mutex | The action of creating a new mutex. |
| create-named-pipe | The action of creating a new named pipe. |
| create-process-as-user | The action of creating a new process as a particular user. |
| create-process | The action of creating a new process. |
| create-registry-key-value | The action of creating a new registry key value. |
| create-registry-key | The action of creating a new registry key. |
| create-remote-thread-in-process | The action of creating a new thread that runs in the virtual address space of another process. |
| create-semaphore | The action of creating a new named semaphore. |
| create-service | The action of creating a new service. |
| create-socket | The action of creating a new socket. |
| create-thread | The action of creating a new thread. |
| create-window | The action of creating a new window. |
| delete-critical-section | The action of deleting a critical section object. |
| delete-directory | The action of deleting a directory on a filesystem. |
| delete-event | The action of deleting a named event object. |
| delete-file | The action of deleting a file. |
| delete-mutex | The action of deleting a named mutex. |
| delete-named-pipe | The action of deleting a named pipe. |
| delete-network-share | The action of deleting a network share on a server. |
| delete-registry-key-value | The action of deleting a named value under an existing registry key. |
| delete-registry-key | The action of deleting a registry key. |
| delete-semaphore | The action of deleting a named semaphore. |
| delete-service | The action of deleting a service. |
| delete-user | The action of deleting a user. |
| disconnect-from-ftp-server | The action of disconnecting from a FTP server. |
| disconnect-from-ip | The action of disconnecting from a previously established connection to an IP address. |
| disconnect-from-irc-server | The action of disconnecting from an IRC server. |
| disconnect-from-named-pipe | The action of disconnecting from a named pipe. |
| disconnect-from-network-share | The action of disconnecting from a network share. |
| disconnect-from-socket | The action of disconnecting from a socket. |
| download-file | The action of downloading a file from a remote location. |
| enumerate-libraries | The action of enumerating the libraries used by a process. |
| enumerate-network-shares | The action of enumerating the available shared resources on a server. |
| enumerate-processes | The action of enumerating all of the running processes on a system. |
| enumerate-registry-key-subkeys | The action of enumerating the registry key subkeys under a registry key. |
| enumerate-registry-key-values | The action of enumerating the named values under a registry key. |
| enumerate-services | The action of enumerating a specific set of services on a system. |
| enumerate-system-handles | The action of enumerating all open handles on a system. |
| enumerate-threads | The action of enumerating all threads in the calling process. |
| enumerate-users | The action of enumerating all users. |
| enumerate-windows | The action of enumerating all open windows. |
| execute-file | The action of executing a file. |
| find-file | The action of searching for a file. |
| find-window | The action of searching for a window. |
| flush-process-instruction-cache | The action of flushing the instruction cache of a process. |
| free-library | The action of freeing a library previously loaded into the address space of the calling process. |
| free-process-virtual-memory | The action of freeing virtual memory regions from a process. |
| get-disk-attributes | "The action of querying the attributes of a disk, such as the amount of available free space. |
| get-disk-type | The action of getting the disk type. |
| get-elapsed-system-up-time | The action of getting the elapsed up-time for a system. |
| get-file-or-directory-attributes | The action of getting the attributes of a file or directory. |
| get-function-address | The action of getting the address of an exported function or variable from a library. |
| get-host-by-address | The action of getting information on a host from a local or remote host database by its IP address. |
| get-host-by-name | The action of getting information on a host from a local or remote host database by its name. |
| get-netbios-name | The action of getting the NetBIOS name of a system. |
| get-process-current-directory | The action of getting the current directory of a process. |
| get-process-environment-variable | The action of setting an environment variable used by a process. |
| get-process-startupinfo | The action of getting the STARTUPINFO struct associated with a process. |
| get-registry-key-attributes | The action of getting the attributes of a registry key. |
| get-system-global-flags | The action of getting the enabled global flags on a system. |
| get-system-host-name | The action of getting the hostname of a system. |
| get-system-local-time | The action of getting the local time of a system. |
| get-system-time | "The action of getting the system time of a system, represented in Coordinated Universal Time (UTC). |
| get-thread-context | The action of getting the context structure (containing process-specific register data) of a thread. |
| get-thread-username | The action of getting the name or ID of the user associated with a thread. |
| get-user-attributes | The action of getting the attributes of a user. |
| get-username | The action of getting the username of the currently logged in user of a system. |
| get-windows-directory | The action of getting the Windows installation directory on a system. |
| get-windows-system-directory | The action of getting the Windows \System or \System32 directory on a system. |
| get-temporary-files-directory | The action of getting the temporary file directory on a system. |
| impersonate-process | The action of a thread in the calling process impersonating the security context of another process. |
| invoke-user-privilege | The action of invoking a privilege given to an existing user. |
| join-irc-channel | The action of joining a channel on an IRC server. |
| kill-process | The action of killing a process. |
| kill-thread | The action of killing a thread in the virtual address space of the calling process. |
| kill-window | The action of killing a window. |
| leave-irc-channel | The action of leaving a channel on an IRC server. |
| enumerate-disks | The action of listing all disks available on a system. |
| listen-on-port | The action of listening on a specific port. |
| listen-on-socket | The action of listening on a socket. |
| load-and-call-driver | The action of loading a driver into a system and then calling the loaded driver. |
| load-driver | The action of loading a driver into a system. |
| load-library | The action of loading a library into the address space of the calling process. |
| lock-file | The action of locking a file. |
| logon-as-user | The action of logging on as a specific user. |
| map-file-into-process | The action of mapping a file into the address space of the calling process. |
| map-library-into-process | The action of mapping a library into the address space of the calling process. |
| modify-process-virtual-memory-protection | The action of modifying the protection on a memory region in the virtual address space of a process. |
| modify-registry-key-value | The action of modifying a named value of a registry key. |
| modify-registry-key | The action of modifying a registry key. |
| modify-service-configuration | The action of modifying the configuration parameters of a service. |
| monitor-directory | The action of monitoring a directory on the filesystem for changes. |
| monitor-disk | The action of monitoring a disk for changes. |
| monitor-registry-key | The action of monitoring a registry key for changes. |
| mount-disk | The action of mounting a file system to a mounting point. |
| move-file | The action of moving a file from one location to another. |
| open-critical-section | The action of opening a critical section object. |
| open-event | The action of opening a named event object. |
| open-file-mapping | The action of opening a file mapping object. |
| open-directory | The action of opening a directory. |
| open-file | The action of opening a file for reading or writing. |
| open-mutex | The action of opening a named mutex. |
| open-port | The action of opening a network port. |
| open-process | The action of opening a process. |
| open-registry-key | The action of opening a registry key. |
| open-semaphore | The action of opening a named semaphore. |
| open-service | The action of opening a service. |
| queue-apc-in-thread | The action of queuing a new Asynchronized Procedure Call (APC) in the context of a thread. |
| read-from-file | The action of reading from a file. |
| read-from-mailslot | The action of reading some data from a named mailslot. |
| read-from-named-pipe | The action of reading data from a named pipe. |
| read-from-process-memory | The action of reading from a memory region of a process. |
| read-registry-key-value | The action of reading a named value of a registry key. |
| receive-data-on-socket | The action of receiving data on a socket. |
| receive-http-response | The action of receiving an HTTP server response for a prior HTTP request. |
| receive-irc-private-message | The action of receiving a private message from another user on an IRC server. |
| receive-network-packet | The action of receiving a packet on a network. |
| release-critical-section | The action of releasing a critical section object. |
| release-mutex | The action of releasing ownership of a named mutex. |
| release-semaphore | The action of releasing ownership of a named semaphore. |
| remove-user-from-group | The action of removing a user from a group. |
| rename-file | The action of renaming a file on a file system. |
| reset-event | The action of resetting a named event object to the non-signaled state. |
| revert-thread-to-self | The action of reverting a thread to its own security context. |
| send-control-code-to-file | The action of sending a control code to a file. |
| send-control-code-to-service | The action of sending a control code to a service. |
| send-data-on-socket | The action of sending data on a connected socket. |
| send-data-to-address-on-socket | The action of sending data to a specified IP address on an unconnected socket. |
| send-dns-query | The action of sending a DNS query. |
| send-email-message | The action of sending an email message. |
| send-ftp-command | The action of of sending a command on an FTP server connection. |
| send-http-connect-request | The action of sending an HTTP CONNECT client request to a server. |
| send-http-delete-request | The action of sending an HTTP DELETE client request. |
| send-http-get-request | The action of sending an HTTP GET client request. |
| send-http-head-request | The action of sending an HTTP HEAD client request. |
| send-http-options-request | The action of sending an HTTP OPTIONS client request. |
| send-http-patch-request | The action of sending an HTTP PATCH client request. |
| send-http-post-request | The action of sending an HTTP HEAD client request. |
| send-http-put-request | The action of sending an HTTP PUT client request. |
| send-http-trace-request | The action of sending an HTTP TRACE client request. |
| send-icmp-request | The action of sending an ICMP request. |
| send-irc-private-message | The action of sending a private message to another user on an IRC server. |
| send-network-packet | The action of sending a packet on a network. |
| send-reverse-dns-lookup | The action of sending a reverse DNS lookup. |
| set-file-or-directory-attributes | The action of setting some attributes on a file or directory. |
| set-irc-nickname | The action of setting an IRC nickname on an IRC server. |
| set-netbios-name | The action of setting the NetBIOS name of a system. |
| set-process-current-directory | The action of setting the current directory of a process. |
| set-process-environment-variable | The action of setting an environment variable used by a process. |
| set-system-global-flags | The action of setting a system’s global flags. |
| set-system-host-name | The action of setting a system’s hostname. |
| set-system-local-time | The action of setting a system’s local time. |
| set-system-time | "The action of setting a system’s time, represented in UTC. |
| set-thread-context | The action of setting the context structure (containing process-specific register data) for a thread. |
| show-window | The action of showing a window. |
| shutdown-system | The action of shutting down a system. |
| sleep-process | The action of sleeping a process for some period of time. |
| sleep-system | The action of sleeping a system for some period of time. |
| start-service | The action of starting a service. |
| stop-service | The action of stopping a service. |
| unload-driver | The action of unloading a driver from a system. |
| unlock-file | The action of unlocking a file. |
| unmap-file-from-process | The action of unmapping a file from the address space of the calling process. |
| unmount-disk | The action of unmounting a file system from a mounting point. |
| upload-file | The action of uploading a file to a remote location. |
| write-to-file | The action of writing data to a file. |
| write-to-mailslot | The action of writing data to a named mailslot. |
| write-to-named-pipe | The action of writing data to a named pipe. |
| write-to-process-memory | The action of writing to a memory region of an existing process. |
Malware-Configuration-Parameters
Vocabulary Name: malware-configuration-parameter-ov
The Malware Configuration Parameters open vocabulary is used in the following object/property:
- Malware Instance --> static_features --> configuration_parameters
This vocabulary is a non-exhaustive enumeration of malware configuration parameter names.
| Value | Description |
|---|---|
| filename | Captures the name of a file (e.g., a binary downloaded, embedded binary). |
| group-id | Captures an identifier of a collection of malware instances. |
| id | Captures an identifier of a malware instance. |
| installation-path | Captures a location on disk where the malware instance is installed, copied, or moved. |
| magic-number | Captures a file signature used to identify or validate content of the malware instance. |
| mutex | Captures a unique mutex value associated with the malware instance. |
| c2-ip-address | Captures an IP address used by the malware instance for command and control. |
| c2-domain | Captures a domain name used by the malware instance for command and control. |
| c2-url | Captures a URL used by the malware instance for command and control. |
| directory | Captures the name of a directory used by the malware instance. |
| filepath | Captures a file path (directory + file name) used by the malware instance. |
| injection-process | Captures a process into which malware instance is injected. Usually this is a process name but it may take other forms such as a filename of the executable. |
| interval | Captures the time malware instance waits between beacons or other activity, in seconds. |
| key | Captures an encryption, encoding, or obfuscation key used by the malware instance. By convention, when these represent binary data, they should be bare hex encoded with no other markup. Base64 or similar custom dictionaries are stored as is. |
| password | Captures a password used by the malware instance. |
| useragent | Captures a software identifier used by the malware instance. |
| version | Captures the version of the malware instance. To the degree possible this should be based directly on artifacts from the malware. |
Malware Labels
Vocabulary Name: malware-label-ov
The malware label vocabulary is currently used in the following objects/properties:
- Malware Instance --> labels
- Malware Family --> labels
This vocabulary is a non-exhaustive enumeration of common malware labels.
| Value | Description |
|---|---|
| adware | Any software that is funded by advertising. Adware may also gather sensitive user information from a system. |
| appender | File-infecting malware that places its code at the end of the files it infects, adjusting the file's entry point to cause its code to be executed before that in the original file. |
| backdoor | Malware which, once running on a system, opens a communication vector to the outside so the computer can be accessed remotely by an attacker. |
| boot-sector-virus | Malware that infects the master boot record of a storage device. |
| bot | Malware that resides on an infected system, communicating with and forming part of a botnet. The bot may be implanted by a worm or trojan, which opens a backdoor. The bot then monitors the backdoor for further instructions. |
| cavity-filler | A type of file-infecting virus that seeks unused space within the files it infects, inserting its code into these gaps to avoid changing the size of the file and thus not alerting integrity-checking software to its presence. |
| clicker | A trojan that makes a system visit a specific web page, often very frequently and usually with the aim of increasing the traffic recorded by the site and thus increasing revenue from advertising. Clickers may also be used to carry out DDoS attacks. |
| companion-virus | A virus that takes the place of a particular file on a system instead of injecting code into it. |
| data-diddler | A type of malware that makes small, random changes to data, such as data in a spreadsheet, to render the data contained in a document inaccurate and in some cases worthless. |
| ddos | A tool used to perform a distributed denial of service attack. |
| downloader | Malware programmed to download and execute other files, usually more complex malware. |
| dropper | A type of Trojan that deposits an enclosed payload onto a destination host computer by loading itself into memory, extracting the malicious payload, and then writing it to the file system. |
| exploit-kit | A software toolkit to target common vulnerabilities. |
| file-infector-virus | A virus that infects a system by inserting itself somewhere in existing files; this is the classic form of virus. |
| file-less | Malware that is file-less, i.e., executes through some other mechanism such as Powershell. |
| fork-bomb | A simple form of malware, a type of rabbit which launches more copies of itself. Once a fork bomb is executed, it will attempt to run several identical processes, which will do the same, the number growing exponentially until the system resources are overwhelmed by the number of identical processes running, which may in some cases bring the system down and cause a denial of service. |
| greyware | Software that, while not definitely malicious, has a suspicious or potentially unwanted aspect. |
| implant | Code inserted into an existing program using a code patcher or other tool. |
| keylogger | A type of program implanted on a system to monitor the keys pressed and thus record any sensitive data, such as passwords, entered by the user. |
| kleptographic-worm | A worm that encrypts information assets on compromised systems so they can only be decrypted by the worm's author, also known as information-stealing worm. |
| macro-virus | A virus that uses a macro language, for example in Microsoft Office documents. |
| malware-as-a-service | Malware that is sold or produced as a service. |
| mass-mailer | A worm that uses email to propagate across the internet. |
| metamorphic-virus | A virus that changes its own code with each infection. |
| mid-infector | A type of file-infecting virus which places its code in the middle of files it infects. It may move a section of the original code to the end of the file, or simply push the code aside to make space for its own code. |
| mobile-code | Either code received from remote, possibly untrusted systems, but executed on a local system; or software transferred between systems (e.g across a network) and executed on a local system without explicit installation or execution by the recipient. |
| multipartite-virus | Malware that infects boot records, boot sectors, and files. |
| parental-control | A program that monitors or limits machine usage. Such programs can run undetected and can transmit monitoring information to another machine. |
| password-stealer | A type of trojan designed to steal passwords, personal data and details, or other sensitive information from an infected system. |
| polymorphic-virus | A type of virus that encrypts its code differently with each infection (or with each generation of infections). |
| premium-dialer-smser | A type of malware whose primary aim is to dial (or send SMS messages to) premium rate numbers. |
| prepender | A file-infecting virus that inserts code at the beginning of the files it infects. |
| ransomware | Malware that encrypts files on a victim's system, demanding payment of ransom in return for the access codes required to unlock files. |
| remote-access-trojan | A remote access trojan program (or RAT), is a trojan horse capable of controlling a machine through commands issued by a remote attacker. |
| resource-exploiter | A type of malware that steals a system's resources (e.g., CPU cycles), such as a bitcoin miner. |
| rogue-security-software | A fake security product that demands money to clean phony infections. |
| rootkit | A method of hiding files or processes from normal methods of monitoring; often used by malware to conceal its presence and activities. |
| scareware | A program that reports false or significantly misleading information on the presence of security risks, threats, or system issues on the target computer. |
| screen-capture | A type of malware used to capture images from the target systems screen, used for exfiltration and command and control. |
| security-assessment-tool | A program that can be used to gather information for unauthorized access to computer systems. |
| shellcode | Either a small piece of code that activates a command-line interface to a system that can be used to disable security measures, open a backdoor, or download further malicious code; or a small piece of code that opens a system up for exploitation, sometimes by not necessarily involving a command-line shell. |
| spyware | Software that gathers information and passes it to a third-party without adequate permission from the owner of the data. It may also refer to software that makes changes to a system or any of its component software, or which makes use of system resources without the full understanding and consent of the system owner. |