malware.go

// Copyright 2020 Joakim Kennedy. All rights reserved. Use of
// this source code is governed by the included BSD license.

package stix2

// Malware is a type of TTP that represents malicious code. It generally refers
// to a program that is inserted into a system, usually covertly. The intent is
// to compromise the confidentiality, integrity, or availability of the
// victim's data, applications, or operating system (OS) or otherwise annoy or
// disrupt the victim.
//
// The Malware SDO characterizes, identifies, and categorizes malware instances
// and families from data that may be derived from analysis. This SDO captures
// detailed information about how the malware works and what it does. This SDO
// captures contextual data relevant to sharing Malware data without requiring
// the full analysis provided by the Malware Analysis SDO.
//
// The Indicator SDO provides intelligence producers with the ability to
// define, using the STIX Pattern Grammar in a standard way to identify and
// detect behaviors associated with malicious activities. Although the Malware
// SDO provides vital intelligence on a specific instance or malware family, it
// does not provide a standard grammar that the Indicator SDO provides to
// identify those properties in security detection systems designed to process
// the STIX Pattern grammar. We strongly encourage the use of STIX Indicators
// for the detection of actual malware, due to its use of the STIX Patterning
// language and the clear semantics that it provides.
type Malware struct {
	STIXDomainObject
	// Name is used to identify the malware instance or family, as specified by
	// the producer of the SDO. For a malware family the name MUST be defined.
	// If a name for a malware instance is not available, the SHA-256 hash
	// value or sample’s filename MAY be used instead.
	Name string `json:"name,omitempty"`
	// Description provides more details and context about the malware instance
	// or family, potentially including its purpose and its key
	// characteristics.
	Description string `json:"description,omitempty"`
	// Types is an open vocabulary that specifies a set of
	// categorizations for the malware being described.
	Types []string `json:"malware_types,omitempty"`
	// IsFamily tells whether the object represents a malware family (if true)
	// or a malware instance (if false).
	IsFamily bool `json:"is_family"`
	// Aliases are alternative names used to identify this malware or malware
	// family.
	Aliases []string `json:"aliases,omitempty"`
	// KillChainPhashe is a list of Kill Chain Phases for which this malware
	// can be used.
	KillChainPhase []*KillChainPhase `json:"kill_chain_phases,omitempty"`
	// FirstSeen is the time that the malware instance or family was first
	// seen.
	FirstSeen *Timestamp `json:"first_seen,omitempty"`
	// LastSeen is the time that the malware family or malware instance was
	// last seen.
	LastSeen *Timestamp `json:"last_seen,omitempty"`
	// OperatingSystems is operating system the malware family or malware instance is
	// executable on. This applies to virtualized operating systems as well
	// as those running on bare metal.
	//
	// The value of this property MUST be the identifier for a SCO software object.
	OperatingSystems []Identifier `json:"operating_system_refs,omitempty"`
	// Architecture is the processor architectures (e.g., x86, ARM, etc.) that
	// the malware instance or family is executable on.
	Architecture []string `json:"architecture_execution_envs,omitempty"`
	// Languages is the programming language(s) used to implement the malware
	// instance or family.
	Languages []string `json:"implementation_languages,omitempty"`
	// Capabilities specifies any capabilities identified for the malware
	// instance or family.
	Capabilities []string `json:"capabilities,omitempty"`
	// Samples pecifies a list of identifiers of the SCO file or artifact
	// objects associated with this malware instance(s) or family. If is_family
	// is false, then all samples listed in sample_refs MUST refer to the same
	// binary data.
	Samples []Identifier `json:"sample_refs,omitempty"`
}

func (o *Malware) MarshalJSON() ([]byte, error) {
	return marshalToJSONHelper(o)
}

// AddAuthoredBy describes that the malware instance or family was developed by
// the related threat actor or intrusion set.
func (c *Malware) AddAuthoredBy(id Identifier, opts ...STIXOption) (*Relationship, error) {
	if !IsValidIdentifier(id) || !id.ForTypes(TypeThreatActor, TypeIntrusionSet) {
		return nil, ErrInvalidParameter
	}
	return NewRelationship(RelationshipTypeAuthoredBy, c.ID, id, opts...)
}

// AddBeaconsTo describes that the malware instance or family beacons to data
// to the related Infrastructure.
func (c *Malware) AddBeaconsTo(id Identifier, opts ...STIXOption) (*Relationship, error) {
	if !IsValidIdentifier(id) || !id.ForType(TypeInfrastructure) {
		return nil, ErrInvalidParameter
	}
	return NewRelationship(RelationshipTypeBeaconsTo, c.ID, id, opts...)
}

// AddExfiltratesTo describes that the malware instance or family exfiltrates
// data to the related Infrastructure.
func (c *Malware) AddExfiltratesTo(id Identifier, opts ...STIXOption) (*Relationship, error) {
	if !IsValidIdentifier(id) || !id.ForType(TypeInfrastructure) {
		return nil, ErrInvalidParameter
	}
	return NewRelationship(RelationshipTypeExfiltratesTo, c.ID, id, opts...)
}

// AddCommunicatesWith documents that this malware instance (or family)
// communicates with (beacons to, connects to, or exfiltrated data to) the
// defined network addressable resource.
func (c *Malware) AddCommunicatesWith(id Identifier, opts ...STIXOption) (*Relationship, error) {
	if !IsValidIdentifier(id) || !id.ForTypes(TypeIPv4Addr, TypeIPv6Addr, TypeDomainName, TypeURL) {
		return nil, ErrInvalidParameter
	}
	return NewRelationship(RelationshipTypeCommunicatesWith, c.ID, id, opts...)
}

// AddControls documents hat this malware instance (or family) can control
// other malware which may be resident on the same system on which it is
// executing. Note that this is not meant to imply or state that the malware
// instance or family drops other malware (which is covered by the drops
// relationship). Rather, it is meant to state that the malware instance or
// family is able to subvert or control other malware to achieve its goals.
func (c *Malware) AddControls(id Identifier, opts ...STIXOption) (*Relationship, error) {
	if !IsValidIdentifier(id) || !id.ForType(TypeMalware) {
		return nil, ErrInvalidParameter
	}
	return NewRelationship(RelationshipTypeControls, c.ID, id, opts...)
}

// AddDownloads documents that this malware instance (or family) downloads
// another malware instance, tool or file. This is especially common with
// “first-stage” malware instances such as downloaders and droppers.
func (c *Malware) AddDownloads(id Identifier, opts ...STIXOption) (*Relationship, error) {
	if !IsValidIdentifier(id) || !id.ForTypes(TypeMalware, TypeTool, TypeFile) {
		return nil, ErrInvalidParameter
	}
	return NewRelationship(RelationshipTypeDownloads, c.ID, id, opts...)
}

// AddDrops documents that this malware instance (or family) drops another
// malware instance, tool or file. This is especially common with “first-stage”
// malware instances such as downloaders and droppers.
func (c *Malware) AddDrops(id Identifier, opts ...STIXOption) (*Relationship, error) {
	if !IsValidIdentifier(id) || !id.ForTypes(TypeMalware, TypeTool, TypeFile) {
		return nil, ErrInvalidParameter
	}
	return NewRelationship(RelationshipTypeDrops, c.ID, id, opts...)
}

// AddExploits documents hat this malware instance or family exploits or
// attempts to exploit a particular vulnerability.
func (c *Malware) AddExploits(id Identifier, opts ...STIXOption) (*Relationship, error) {
	if !IsValidIdentifier(id) || !id.ForType(TypeVulnerability) {
		return nil, ErrInvalidParameter
	}
	return NewRelationship(RelationshipTypeExploits, c.ID, id, opts...)
}

// AddOriginatesFrom documents that this malware instance or family originates
// from a particular location.
func (c *Malware) AddOriginatesFrom(id Identifier, opts ...STIXOption) (*Relationship, error) {
	if !IsValidIdentifier(id) || !id.ForType(TypeLocation) {
		return nil, ErrInvalidParameter
	}
	return NewRelationship(RelationshipTypeOriginatesFrom, c.ID, id, opts...)
}

// AddTargets documents that a malware instance or family is being used to
// target an Identity, Infrastructure, or Location. For malware families, this
// can be used to capture the full set of identities, infrastructures, or
// locations targeted by the family.
func (c *Malware) AddTargets(id Identifier, opts ...STIXOption) (*Relationship, error) {
	if !IsValidIdentifier(id) || !id.ForTypes(TypeLocation, TypeIdentity, TypeInfrastructure, TypeVulnerability) {
		return nil, ErrInvalidParameter
	}
	return NewRelationship(RelationshipTypeTargets, c.ID, id, opts...)
}

// AddUses documents that this malware instance or family uses the attack
// pattern, infrastructure, malware, or tool to achieve its objectives.
func (c *Malware) AddUses(id Identifier, opts ...STIXOption) (*Relationship, error) {
	if !IsValidIdentifier(id) || !id.ForTypes(TypeAttackPattern, TypeMalware, TypeInfrastructure, TypeTool) {
		return nil, ErrInvalidParameter
	}
	return NewRelationship(RelationshipTypeUses, c.ID, id, opts...)
}

// AddVariantOf documents that one malware instance or family is a variant of
// another malware instance or family. Only the following uses of this
// relationship are valid: Malware instance → Malware family: a Malware
// instance is a variant of a Malware family. For example, a particular Zeus
// version 2 sample is a variant of the broader Zeus family. Malware family →
// Malware family: a Malware family is a variant of another Malware family. For
// example, the Gameover Zeus family is a variant of the broader Zeus family.
// Malware instance → Malware instance: a Malware instance is a variant of
// another Malware instance. For example, a particular Cryptolocker instance
// that is based on an another Cryptolocker instance with minor changes.
// Malware family → Malware instance: this relationship MUST NOT be used as it
// is not semantically valid.
func (c *Malware) AddVariantOf(id Identifier, opts ...STIXOption) (*Relationship, error) {
	if !IsValidIdentifier(id) || !id.ForType(TypeMalware) {
		return nil, ErrInvalidParameter
	}
	return NewRelationship(RelationshipTypeVariantOf, c.ID, id, opts...)
}

// NewMalware creates a new Malware object.
func NewMalware(family bool, opts ...STIXOption) (*Malware, error) {
	base := newSTIXDomainObject(TypeMalware)
	obj := &Malware{
		STIXDomainObject: base,
		IsFamily:         family,
	}

	err := applyOptions(obj, opts)
	// Validate family name.
	if family && obj.Name == "" {
		return nil, ErrInvalidProperty
	}
	return obj, err
}

const (
	// MalwareTypeAdware is any software that is funded by advertising. Adware
	// may also gather sensitive user information from a system.
	MalwareTypeAdware = "adware"
	// MalwareTypeBackdoor is a malicious program that allows an attacker to
	// perform actions on a remote system, such as transferring files,
	// acquiring passwords, or executing arbitrary commands.
	MalwareTypeBackdoor = "backdoor"
	// MalwareTypeBot is a program that resides on an infected system,
	// communicating with and forming part of a botnet. The bot may be
	// implanted by a worm or Trojan, which opens a backdoor. The bot then
	// monitors the backdoor for further instructions.
	MalwareTypeBot = "bot"
	// MalwareTypeBootkit is a malicious program which targets the Master Boot
	// Record of the target computer.
	MalwareTypeBootkit = "bootkit"
	// MalwareTypeDDoS is a program that is used to perform a distributed
	// denial of service attack.
	MalwareTypeDDoS = "ddos"
	// MalwareTypeDownloader is a small trojan file programmed to download and
	// execute other files, usually more complex malware.
	MalwareTypeDownloader = "downloader"
	// MalwareTypeDropper is a type of trojan that deposits an enclosed payload
	// (generally, other malware) onto the target computer.
	MalwareTypeDropper = "dropper"
	// MalwareTypeExploitKit is a software toolkit to target common
	// vulnerabilities.
	MalwareTypeExploitKit = "exploit-kit"
	// MalwareTypeKeylogger is a type of malware that surreptitiously monitors
	// keystrokes and either records them for later retrieval or sends them
	// back to a central collection point.
	MalwareTypeKeylogger = "keylogger"
	// MalwareTypeRansomware is a type of malware that encrypts files on a
	// victim's system, demanding payment of ransom in return for the access
	// codes required to unlock files.
	MalwareTypeRansomware = "ransomware"
	// MalwareTypeRemoteAccessTrojan is a remote access trojan program (or
	// RAT), is a trojan horse capable of controlling a machine through
	// commands issued by a remote attacker.
	MalwareTypeRemoteAccessTrojan = "remote-access-trojan"
	// MalwareTypeResourceExploitation is a type of malware that steals a
	// system's resources (e.g., CPU cycles), such as a malicious bitcoin
	// miner.
	MalwareTypeResourceExploitation = "resource-exploitation"
	// MalwareTypeRogueSecuritySoftware is a fake security product that demands
	// money to clean phony infections.
	MalwareTypeRogueSecuritySoftware = "rogue-security-software"
	// MalwareTypeRootkit is a type of malware that hides its files or
	// processes from normal methods of monitoring in order to conceal its
	// presence and activities. Rootkits can operate at a number of levels,
	// from the application level — simply replacing or adjusting the settings
	// of system software to prevent the display of certain information —
	// through hooking certain functions or inserting modules or drivers into
	// the operating system kernel, to the deeper level of firmware or
	// virtualization rootkits, which are activated before the operating system
	// and thus even harder to detect while the system is running.
	MalwareTypeRootkit = "rootkit"
	// MalwareTypeScreenCapture is a type of malware used to capture images
	// from the target systems screen, used for exfiltration and command and
	// control.
	MalwareTypeScreenCapture = "screen-capture"
	// MalwareTypeSpyware is a software that gathers information on a user's
	// system without their knowledge and sends it to another party. Spyware is
	// generally used to track activities for the purpose of delivering
	// advertising.
	MalwareTypeSpyware = "spyware"
	// MalwareTypeTrojan is any malicious computer program which is used to
	// hack into a computer by misleading users of its true intent.
	MalwareTypeTrojan = "trojan"
	// MalwareTypeUnknown is used if not enough information available to
	// determine the type of malware.
	MalwareTypeUnknown = "unknown"
	// MalwareTypeVirus is a malicious computer program that replicates by
	// reproducing itself or infecting other programs by modifying them.
	MalwareTypeVirus = "virus"
	// MalwareTypeWebshell is a malicious script used by an attacker with the
	//intent to escalate and maintain persistent access on an already
	//compromised web application.
	MalwareTypeWebshell = "webshell"
	// MalwareTypeWiper is a piece of malware whose primary aim is to delete
	// files or entire disks on a machine.
	MalwareTypeWiper = "wiper"
	// MalwareTypeWorm is a self-replicating, self-contained program that
	// usually executes itself without user intervention.
	MalwareTypeWorm = "worm"
)

const (
	// MalwareCapabilitiesAccessesRemoteMachines indicates that the malware
	// instance or family is able to access one or more remote machines.
	MalwareCapabilitiesAccessesRemoteMachines = "accesses-remote-machines"
	// MalwareCapabilitiesAntiDebugging indicates that the malware instance or
	// family is able to prevent itself from being debugged and/or from being
	// run in a debugger or is able to make debugging more difficult.
	MalwareCapabilitiesAntiDebugging = "anti-debugging"
	// MalwareCapabilitiesAntiDisassembly indicates that the malware instance
	// or family is able to prevent itself from being disassembled or make
	// disassembly more difficult.
	MalwareCapabilitiesAntiDisassembly = "anti-disassembly"
	// MalwareCapabilitiesAntiEmulation indicates that the malware instance or
	// family is able to prevent its execution inside of an emulator or is able
	// to make emulation more difficult.
	MalwareCapabilitiesAntiEmulation = "anti-emulation"
	// MalwareCapabilitiesAntiMemoryForensics indicates that the malware
	// instance or family is able to prevent or make memory forensics more
	// difficult.
	MalwareCapabilitiesAntiMemoryForensics = "anti-memory-forensics"
	// MalwareCapabilitiesAntiSandbox indicates that the malware instance or
	// family is able to prevent sandbox-based behavioral analysis or make it
	// more difficult.
	MalwareCapabilitiesAntiSandbox = "anti-sandbox"
	// MalwareCapabilitiesAntiVM indicates that the malware instance or family
	// is able to prevent virtual machine (VM) based behavioral analysis or
	// make it more difficult.
	MalwareCapabilitiesAntiVM = "anti-vm"
	// MalwareCapabilitiesCapturesInputPeripherals indicates that the malware
	// instance or family is able to capture data from a system's input
	// peripheral devices, such as a keyboard or mouse. This includes things
	// like keylogging.
	MalwareCapabilitiesCapturesInputPeripherals = "captures-input-peripherals"
	// MalwareCapabilitiesCapturesOutputPeripherals indicates that the malware
	// instance or family captures data sent to a system's output peripherals,
	// such as a display. Examples include things like screen scraping.
	MalwareCapabilitiesCapturesOutputPeripherals = "captures-output-peripherals"
	// MalwareCapabilitiesCapturesSystemStateData indicates that the malware
	// instance or family is able to capture information about a system's state
	// (e.g., data currently in its RAM).
	MalwareCapabilitiesCapturesSystemStateData = "captures-system-state-data"
	// MalwareCapabilitiesCleansTracesOfInfection indicates that the malware
	// instance or family is able to clean traces of its infection (e.g., file
	// system artifacts) from a system.
	MalwareCapabilitiesCleansTracesOfInfection = "cleans-traces-of-infection"
	// MalwareCapabilitiesCommitsFraud indicates that the malware instance or
	// family commits fraud, such as click fraud (for example).
	MalwareCapabilitiesCommitsFraud = "commits-fraud"
	// MalwareCapabilitiesCommunicatesWithC2 indicates that the malware
	// instance or family is able to communicate (i.e., send or receive data)
	// with a command and control (C2) server.
	MalwareCapabilitiesCommunicatesWithC2 = "communicates-with-c2"
	// MalwareCapabilitiesCompromisesDataAvailability indicates that the
	// malware instance or family is able to compromise the availability of
	// data on the local system on which it is executing and/or one or more
	// remote systems. For example, encrypting data on disk, as done by
	// ransomware.
	MalwareCapabilitiesCompromisesDataAvailability = "compromises-data-availability"
	// MalwareCapabilitiesCompromisesDataIntegrity indicates that the malware
	// instance or family is able to compromise the integrity of some data that
	// resides on (e.g., in the case of files) or is received/transmitted
	// (e.g., in the case of network traffic) by the system on which it is
	// executing.
	MalwareCapabilitiesCompromisesDataIntegrity = "compromises-data-integrity"
	// MalwareCapabilitiesCompromisesSystemAvailability indicates that the
	// malware instance or family is able to consume system resources for its
	// malicious purposes, such as password cracking or participating in a DDoS
	// botnet, thereby compromising the availability of the local system and/or
	// one or more remote systems.
	MalwareCapabilitiesCompromisesSystemAvailability = "compromises-system-availability"
	// MalwareCapabilitiesControlsLocalMachine indicates that the malware
	// instance or family is able to control the machine on which it is
	// executing (e.g., RATs).
	MalwareCapabilitiesControlsLocalMachine = "controls-local-machine"
	// MalwareCapabilitiesDegradesSecuritySoftware indicates that the malware
	// instance or family is able to bypass or disable security programs or
	// operating system security features on a system (including mobile
	// devices), either by stopping them from executing or by making changes to
	// their code or configuration parameters. For example, malware that blocks
	// the local machine from accessing the websites of security vendors.
	MalwareCapabilitiesDegradesSecuritySoftware = "degrades-security-software"
	// MalwareCapabilitiesDegradesSystemUpdates indicates that the malware
	// instance or family is able to disable the downloading and installation
	// of system updates and patches.
	MalwareCapabilitiesDegradesSystemUpdates = "degrades-system-updates"
	// MalwareCapabilitiesDeterminesC2Server indicates that the malware
	// instance or family is able to identify one or more command and control
	// (C2) servers with which to communicate (e.g., DGA).
	MalwareCapabilitiesDeterminesC2Server = "determines-c2-server"
	// MalwareCapabilitiesEmailsSpam indicates that the malware instance or
	// family is able to send spam email messages.
	MalwareCapabilitiesEmailsSpam = "emails-spam"
	// MalwareCapabilitiesEscalatesPrivileges indicates that the malware
	// instance or family is able to escalate the privileges under which it is
	// executing.
	MalwareCapabilitiesEscalatesPrivileges = "escalates-privileges"
	// MalwareCapabilitiesEvadesAV indicates that the malware instance or
	// family is able to evade detection by antivirus tools.
	MalwareCapabilitiesEvadesAV = "evades-av"
	// MalwareCapabilitiesExfiltratesData indicates that the malware instance
	// or family is able to gather, prepare, (possibly obfuscate) data and
	// transmit it to exfiltration points.
	MalwareCapabilitiesExfiltratesData = "exfiltrates-data"
	// MalwareCapabilitiesFingerprintsHost indicates that the malware instance
	// or family is able to fingerprint or probe the configuration of the host
	// system on which it is executing for the purpose of altering its behavior
	// based on this environment.
	MalwareCapabilitiesFingerprintsHost = "fingerprints-host"
	// MalwareCapabilitiesHidesArtifacts indicates that the malware instance or
	// family is able to hide its artifacts, such as files and open ports.
	MalwareCapabilitiesHidesArtifacts = "hides-artifacts"
	// MalwareCapabilitiesHidesExecutingCode indicates that the malware
	// instance or family is able to hide its code by compromising the
	// bootloader, kernel modules, hypervisor, etc.
	MalwareCapabilitiesHidesExecutingCode = "hides-executing-code"
	// MalwareCapabilitiesInfectsFiles indicates that the malware instance or
	// family is able to infect one or more files on the system on which it
	// executes. For example, malware which injects a malicious payload into
	// all PDFs on a host as a means of propagation.
	MalwareCapabilitiesInfectsFiles = "infects-files"
	// MalwareCapabilitiesInfectsRemoteMachines indicates that the malware
	// instance or family is able to self-propagate to a remote machine or
	// infect a remote machine with malware that is different than itself.
	MalwareCapabilitiesInfectsRemoteMachines = "infects-remote-machines"
	// MalwareCapabilitiesInstallsOtherComponents indicates that the malware
	// instance or family is able to install additional components. This
	// encompasses the dropping/downloading of other malicious components such
	// as libraries, other malware, and tools.
	MalwareCapabilitiesInstallsOtherComponents = "installs-other-components"
	// MalwareCapabilitiesPersistsAfterSystemReboot indicates that the malware
	// instance or family is able to continue executing after the reboot of the
	// system on which it is resident.
	MalwareCapabilitiesPersistsAfterSystemReboot = "persists-after-system-reboot"
	// MalwareCapabilitiesPreventsArtifactAccess indicates that the malware
	// instance or family is able to prevent its artifacts (e.g., files,
	// registry keys, etc.) from being accessed.
	MalwareCapabilitiesPreventsArtifactAccess = "prevents-artifact-access"
	// MalwareCapabilitiesPreventsArtifactDeletion indicates that the malware
	// instance or family is able to prevent its artifacts (e.g., files,
	// registry keys, etc.) from being deleted.
	MalwareCapabilitiesPreventsArtifactDeletion = "prevents-artifact-deletion"
	// MalwareCapabilitiesProbesNetworkEnvironment indicates that the malware
	// instance or family is able to probe the properties of its network
	// environment, e.g. to determine whether it funnels traffic through a
	// proxy.
	MalwareCapabilitiesProbesNetworkEnvironment = "probes-network-environment"
	// MalwareCapabilitiesSelfModifies indicates that the malware instance or
	// family is able to modify itself.
	MalwareCapabilitiesSelfModifies = "self-modifies"
	// MalwareCapabilitiesStealsAuthenticationCredentials indicates that the
	// malware instance is able to steal authentication credentials.
	MalwareCapabilitiesStealsAuthenticationCredentials = "steals-authentication-credentials"
	// MalwareCapabilitiesViolatesSystemOperationalIntegrity indicates that the
	// malware instance or family is able to compromise the operational
	// integrity of the system on which it is executing and/or one or more
	// remote systems, e.g., by causing them to operate beyond their set of
	// specified operational parameters. For example, malware that causes the
	// CPU fan on the machine that it is executing to spin at a higher than
	// normal speed.
	MalwareCapabilitiesViolatesSystemOperationalIntegrity = "violates-system-operational-integrity"
)

const (
	// ArchitectureAlpha specifies the Alpha architecture.
	ArchitectureAlpha = "alpha"
	// ArchitectureArm specifies the ARM architecture.
	ArchitectureArm = "arm"
	// ArchitectureIA64 specifies the 64-bit IA (Itanium) architecture.
	ArchitectureIA64 = "ia-64"
	// ArchitectureMIPS specifies the MIPS architecture.
	ArchitectureMIPS = "mips"
	// ArchitecturePowerPC specifies the PowerPC architecture.
	ArchitecturePowerPC = "powerpc"
	// ArchitectureSPARC specifies the SPARC architecture.
	ArchitectureSPARC = "sparc"
	// ArchitectureX86 specifies the 32-bit x86 architecture.
	ArchitectureX86 = "x86"
	// ArchitectureX8664 specifies the 64-bit x86 architecture.
	ArchitectureX8664 = "x86-64"
)

const (
	// ImplementationLanguageApplescript specifies the AppleScript programming
	// language.
	ImplementationLanguageApplescript = "applescript"
	// ImplementationLanguageBash specifies the Bash programming language.
	ImplementationLanguageBash = "bash"
	// ImplementationLanguageC specifies the C programming language.
	ImplementationLanguageC = "c"
	// ImplementationLanguageCpp specifies the C++ programming language.
	ImplementationLanguageCpp = "c++"
	// ImplementationLanguageCsharp specifies the C# programming language.
	ImplementationLanguageCsharp = "c#"
	// ImplementationLanguageGo specifies the Go (sometimes referred to as
	// golang) programming language.
	ImplementationLanguageGo = "go"
	// ImplementationLanguageJava specifies the JAVA programming language.
	ImplementationLanguageJava = "java"
	// ImplementationLanguageJavascript specifies the JavaScript programming
	// language.
	ImplementationLanguageJavascript = "javascript"
	// ImplementationLanguageLua specifies the Lua programming language.
	ImplementationLanguageLua = "lua"
	// ImplementationLanguageObjectiveC specifies the Objective-C programming
	// language.
	ImplementationLanguageObjectiveC = "objective-c"
	// ImplementationLanguagePerl specifies the Perl programming language.
	ImplementationLanguagePerl = "perl"
	// ImplementationLanguagePHP specifies the PHP programming language.
	ImplementationLanguagePHP = "php"
	// ImplementationLanguagePowershell specifies the Windows Powershell
	// programming language.
	ImplementationLanguagePowershell = "powershell"
	// ImplementationLanguagePython specifies the Python programming language.
	ImplementationLanguagePython = "python"
	// ImplementationLanguageRuby specifies the Ruby programming language.
	ImplementationLanguageRuby = "ruby"
	// ImplementationLanguageScala specifies the Scala programming language.
	ImplementationLanguageScala = "scala"
	// ImplementationLanguageSwift specifies the Swift programming language.
	ImplementationLanguageSwift = "swift"
	// ImplementationLanguageTypeScript specifies the TypeScript programming
	// language.
	ImplementationLanguageTypeScript = "typescript"
	// ImplementationLanguageVisualBasic specifies the Visual Basic programming
	// language.
	ImplementationLanguageVisualBasic = "visual-basic"
	// ImplementationLanguageX8632 specifies the x86 32-bit Assembly
	// programming language.
	ImplementationLanguageX8632 = "x86-32"
	// ImplementationLanguageX8664 specifies the x86 64-bit Assembly
	// programming language.
	ImplementationLanguageX8664 = "x86-64"
)