Short_Description stixCommon: StructuredTextType 0..* The Short_Description property captures a short textual description of the TTP. This property is secondary and should only be used if the Description property is already populated and another, shorter description is available. Intended_Effect stixCommon: StatementType 0..* The Intended_Effect property characterizes the suspected intended effect of the TTP, includes a Value property that specifies the type of the effect. Examples of potential types include theft, disruption, and unauthorized access (these specific values are only provided to help explain the Value property: they are neither recommended values nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an externally-defined vocabulary or leveraging a formally defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in the Value property is ‘IntendedEffectVocab-1.0’ (which is different than the default vocabulary provided for the StatementType class). Behavior BehaviorType 0..1 The Behavior property characterizes forms of adversarial behavior by capturing the attack patterns, malware, and/or exploits that the adversary may leverage. Resources ResourceType 0..1 The Resources property characterizes adversarial resources by capturing the tools, infrastructure, or personas that the adversary may leverage. Victim_Targeting VictimTargetingType 0..1 The Victim_Targeting property characterizes the sort of victims that an adversary may target including details of identity, systems, and/or information types targeted. Exploit_Targets ExploitTargetsType 0..1 The Exploit_Targets property specifies a set of one or more Exploit Targets potentially targeted by the TTP. Related_TTPs RelatedTTPsType 0..1 The Related_TTPs property specifies a set of one or more other TTPs related to this TTP. Kill_Chain_Phases stixCommon: KillChainPhasesReferenceType 0..1 A cyber kill chain is a phase-based model to describe the stages of an attack, and a cyber kill chain phase is an individual phase within a kill chain definition. The Kill_Chain_Phases property
The UML diagram corresponding to the BehaviorType class is shown in Figure 32. Figure . UML diagram of the BehaviorType class The property given in Table 33 corresponds to the UML diagram shown in Figure 32, and the associated classes defining the property types are discussed in Sections 3.2.1 through 3.2.3. Table . Properties of the BehaviorType class Name Type Multiplicity Description Attack_Patterns AttackPatternsType 0..1 The Attack_Patterns property specifies a set of one or more attack patterns that an adversary may leverage. Malware MalwareType 0..1 The Malware property specifies a set of one or more instances of malware that an adversary may leverage. Exploits ExploitsType 0..1 The Exploits property specifies a set of one or more exploits that an adversary may leverage. AttackPatternsType Class The AttackPatternsType class specifies a set of one or more attack patterns that an adversary may leverage. The property of the AttackPatternsType class is shown in Table 34. Table . Properties of the AttackPatternsType class Name Type Multiplicity Description Attack_Pattern AttackPatternType 1..* The Attack_Pattern property specifies a single Attack Pattern that an adversary may leverage.
formatting is supported via the structuring_format property of the StructuredTextType class. Short_Description stixCommon:StructuredTextType 0..* The Short_Description property captures a short textual description of the attack pattern. This property is secondary and should only be used if the Description property is already populated and another, shorter description is available. MalwareType Class The MalwareType class characterizes a set of one or more malware instances that an adversary may leverage. The property of the MalwareType is shown in Table 36. Table . Properties of the MalwareType class Name Type Multiplicity Description Malware_Instance MalwareInstanceType 1..* The Malware_Instance property characterizes a single malware instance that an adversary may leverage. MalwareInstanceType Class The MalwareInstanceType class characterizes a malware instance through the capture of basic information such as the type, name, and description of the malware. A malware instance may characterize anything from a specific malware sample to an entire family. The MalwareInstanceType class is intended to be extended as appropriate to enable the structured description of a malware instance. STIX v1.2.1 defines a default extension to the MalwareInstanceType class to leverage the Malware Attribute Enumeration and Classification (MAEC) data model. The UML diagram corresponding to the MalwareInstanceType is shown in Figure 34. Please see for extension-related details. Figure . UML diagram of the MalwareInstanceType class The property table given in Table 37 corresponds to the UML diagram given in Figure 34. Table . Properties of the MalwareInstanceType class
id basicDataTypes: BasicString 0..1 The id property specifies a globally unique identifier for the infrastructure. idref basicDataTypes: BasicString 0..1 The idref property specifies an identifier reference to an infrastructure specified elsewhere. When the idref property is used, the id property MUST NOT also be specified and the other properties of the InfrastructureType class SHOULD NOT hold any content. Title basicDataTypes: BasicString 0..1 The Title property captures a title for the infrastructure and reflects what the content producer thinks the infrastructure as a whole should be called. The Title property is typically used by humans to reference a particular infrastructure; however, it is not suggested for correlation. Type stixCommon: VocabularyStringType 0..* The Type property specifies the type of infrastructure being characterized. Examples of potential types include anonymization, domain registration, and hosting (these specific values are only provided to help explain the property: they are neither recommended values nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an externally-defined vocabulary or leveraging a formally defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in the property is ‘AttackerInfrastructureTypeVocab-1.0.’ Description stixCommon: StructuredTextType 0..* The Description property captures a textual description of the infrastructure. Any length is permitted. Optional formatting is supported via the structuring_format property of the StructuredTextType class. Short_Description stixCommon: StructuredTextType 0..* The Short_Description property captures a textual description of the infrastructure. This property is secondary and should only be used if the Description property is already populated and another, shorter description is available.