Skip to content

Latest commit

 

History

History
399 lines (235 loc) · 14.2 KB

attack_pattern.md

File metadata and controls

399 lines (235 loc) · 14.2 KB
Raw

AttackPattern Object

AttackPattern Attack Patterns are a type of TTP that describe ways that adversaries attempt to compromise targets.

Property Type Description Required?
description MarkdownString A description of object, which may be detailed. ✓
id String Globally unique URI identifying this object. ✓
schema_version String CTIM schema version for this entity ✓
short_description MedStringString A single line, short summary of the object. ✓
title ShortStringString A short title for this object, used as primary display and reference value ✓
type AttackPatternTypeIdentifierString ✓
abstraction_level AttackPatternAbstractionsString The CAPEC abstraction level for patterns describing techniques to attack a system.
external_ids String List
external_references ExternalReference Object List A list of external references which refer to non-STIX information. This property MAY be used to provide one or more Attack Pattern identifiers, such as a CAPEC ID. When specifying a CAPEC ID, the source_name property of the external reference MUST be set to capec and the external_id property MUST be formatted as CAPEC-[id].
kill_chain_phases KillChainPhase Object List The list of Kill Chain Phases for which this Attack Pattern is used.
language ShortStringString The human language this object is specified in.
revision Integer A monotonically increasing revision, incremented each time the object is changed.
source MedStringString
source_uri String
timestamp Inst (Date) The time this object was created at, or last modified.
tlp TLPString Specification for how, and to whom, this object can be shared.
x_mitre_contributors ShortStringString List ATT&CK Technique.Contributors
x_mitre_data_sources ShortStringString List ATT&CK Technique.Data Sources
x_mitre_platforms ShortStringString List ATT&CK Technique.Platforms

Property abstraction_level ∷ AttackPatternAbstractionsString

The CAPEC abstraction level for patterns describing techniques to attack a system.

Property description ∷ MarkdownString

A description of object, which may be detailed.

  • This entry is required

    • Markdown Markdown string with at most 5000 characters

Property external_ids ∷ String List

  • This entry is optional
  • This entry's type is sequential (allows zero or more values)

Property external_references ∷ ExternalReference Object List

A list of external references which refer to non-STIX information. This property MAY be used to provide one or more Attack Pattern identifiers, such as a CAPEC ID. When specifying a CAPEC ID, the source_name property of the external reference MUST be set to capec and the external_id property MUST be formatted as CAPEC-[id].

  • This entry is optional
  • This entry's type is sequential (allows zero or more values)

Property id ∷ String

Globally unique URI identifying this object.

  • This entry is required

    • IDs are URIs, for example https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014 for a Judgement. This ID type compares to the STIX id field. The optional STIX idref field is not used.

Property kill_chain_phases ∷ KillChainPhase Object List

The list of Kill Chain Phases for which this Attack Pattern is used.

  • This entry is optional
  • This entry's type is sequential (allows zero or more values)

Property language ∷ ShortStringString

The human language this object is specified in.

  • This entry is optional

    • ShortString String with at most 1024 characters

Property revision ∷ Integer

A monotonically increasing revision, incremented each time the object is changed.

  • This entry is optional

    • Zero, or a positive integer

Property schema_version ∷ String

CTIM schema version for this entity

  • This entry is required

    • A semantic version matching the CTIM version against which this object should be valid.

Property short_description ∷ MedStringString

A single line, short summary of the object.

  • This entry is required

    • MedString String with at most 2048 characters

Property source ∷ MedStringString

  • This entry is optional

    • MedString String with at most 2048 characters

Property source_uri ∷ String

  • This entry is optional

    • A URI

Property timestamp ∷ Inst (Date)

The time this object was created at, or last modified.

  • This entry is optional

    • ISO8601 Timestamp Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the ISO8601 standard.

Property title ∷ ShortStringString

A short title for this object, used as primary display and reference value

  • This entry is required

    • ShortString String with at most 1024 characters

Property tlp ∷ TLPString

Specification for how, and to whom, this object can be shared.

  • This entry is optional

    • TLP TLP stands for Traffic Light Protocol, which indicates precisely how this resource is intended to be shared, replicated, copied, etc.
    • Default: green
    • Allowed Values:
      • amber
      • green
      • red
      • white

Property type ∷ AttackPatternTypeIdentifierString

  • This entry is required

    • Must equal: "attack-pattern"

Property x_mitre_contributors ∷ ShortStringString List

ATT&CK Technique.Contributors

  • This entry is optional

  • This entry's type is sequential (allows zero or more values)

    • ShortString String with at most 1024 characters

Property x_mitre_data_sources ∷ ShortStringString List

ATT&CK Technique.Data Sources

  • This entry is optional

  • This entry's type is sequential (allows zero or more values)

    • ShortString String with at most 1024 characters

Property x_mitre_platforms ∷ ShortStringString List

ATT&CK Technique.Platforms

  • This entry is optional

  • This entry's type is sequential (allows zero or more values)

    • ShortString String with at most 1024 characters

ExternalReference Object

ExternalReference External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.

Property Type Description Required?
source_name MedStringString The source within which the external-reference is defined (system, registry, organization, etc.) ✓
description MarkdownString
external_id String An identifier for the external reference content.
hashes String List Specifies a dictionary of hashes for the contents of the url.
url String A URL reference to an external resource

Property description ∷ MarkdownString

  • This entry is optional

    • Markdown Markdown string with at most 5000 characters

Property external_id ∷ String

An identifier for the external reference content.

  • This entry is optional

Property hashes ∷ String List

Specifies a dictionary of hashes for the contents of the url.

  • This entry is optional
  • This entry's type is sequential (allows zero or more values)

Property source_name ∷ MedStringString

The source within which the external-reference is defined (system, registry, organization, etc.)

  • This entry is required

    • MedString String with at most 2048 characters

Property url ∷ String

A URL reference to an external resource

  • This entry is optional

    • A URI

ExternalReference Object

ExternalReference External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.

Property Type Description Required?
source_name MedStringString The source within which the external-reference is defined (system, registry, organization, etc.) ✓
description MarkdownString
external_id String An identifier for the external reference content.
hashes String List Specifies a dictionary of hashes for the contents of the url.
url String A URL reference to an external resource

Property description ∷ MarkdownString

  • This entry is optional

    • Markdown Markdown string with at most 5000 characters

Property external_id ∷ String

An identifier for the external reference content.

  • This entry is optional

Property hashes ∷ String List

Specifies a dictionary of hashes for the contents of the url.

  • This entry is optional
  • This entry's type is sequential (allows zero or more values)

Property source_name ∷ MedStringString

The source within which the external-reference is defined (system, registry, organization, etc.)

  • This entry is required

    • MedString String with at most 2048 characters

Property url ∷ String

A URL reference to an external resource

  • This entry is optional

    • A URI

KillChainPhase Object

KillChainPhase The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.

Property Type Description Required?
kill_chain_name String The name of the kill chain. ✓
phase_name String The name of the phase in the kill chain. ✓

Property kill_chain_name ∷ String

The name of the kill chain.

  • This entry is required

    • SHOULD be all lowercase (where lowercase is defined by the locality conventions) and SHOULD use hyphens instead of spaces or underscores as word separators.
    • Must equal: "lockheed-martin-cyber-kill-chain"
    • Reference: Open Vocabulary

Property phase_name ∷ String

The name of the phase in the kill chain.

  • This entry is required

    • SHOULD be all lowercase (where lowercase is defined by the locality conventions) and SHOULD use hyphens instead of spaces or underscores as word separators.
    • Allowed Values:
      • actions-on-objective
      • command-and-control
      • delivery
      • exploitation
      • installation
      • reconnaissance
      • weaponization
    • Reference: Open Vocabulary