identifier for the kill chain instance.” In fact, the verb “specifies” could have been replaced by any number of alternatives: “defines,” “describes,” “contains,” “references,” etc. However, we thought that a wide variety of verb phrases might confuse a reader of a specification document because the meaning of each verb could be interpreted slightly differently. On the other hand, we didn’t want to use a single, generic verb, such as “describes,” because although the different verb choices may or may not be meaningful from an implementation standpoint, a distinction could be useful to those interested in the modeling aspect of STIX. Consequently, we have chosen to use the three verbs, defined as follows, in class and property descriptions: Verb STIX Definition captures Used to record and preserve information without implying anything about the structure of a class or property. Often used for properties that encompass general content. This is the least precise of the three verbs. Examples: The Source property characterizes the source of the sighting information. Examples of details captured include identitifying characteristics, time-related attributes, and a list of the tools used to collect the information. The Description property captures a textual description of the Indicator. characterizes Describes the distinctive nature or features of a class or property. Often used to describe classes and properties that themselves comprise one or more other properties. Examples: The Confidence property characterizes the level of confidence in the accuracy of the overall content captured in the Incident. The ActivityType class characterizes basic information about an activity a defender might use in response to a Campaign. specifies Used to clearly and precisely identify particular instances or values associated with a property. Often used for properties that are defined by a controlled vocabulary or enumeration; typically used for properties that take on only a single value. Example: The version property specifies the version identifier of the STIX Campaign data model used to capture the information associated with the Campaign. Terminology The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in [RFC2119]. Normative References [RFC2119] Bradner, S., “Key words for use in RFCs to Indicate Requirement Levels”, BCP 14, RFC 2119, March 1997. .
Short_Description stixCommon: StructuredTextType 0..* The Short_Description property captures a textual description of the TTP. This property is secondary and should only be used if the Description property is already populated and another, shorter description is available. Intended_Effect stixCommon: StatementType 0..* The Intended_Effect property characterizes the suspected intended effect of the TTP, which includes a Value property that specifies the type of the effect. Examples of potential types include theft, disruption, and unauthorized access (these specific values are only provided to help explain the Value property: they are neither recommended values nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an externally-defined vocabulary or leveraging a formally defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in the Value property is ‘IntendedEffectVocab-1.0’ (which is different than the default vocabulary provided for the StatementType class). Behavior BehaviorType 0..1 The Behavior property characterizes of adversarial behavior by capturing the attack patterns, malware, and/or exploits that the adversary may leverage. Resources ResourceType 0..1 The Resources property characterizes adversarial resources by capturing the tools, infrastructure, or personas that the adversary may leverage. Victim_Targeting VictimTargetingType 0..1 The Victim_Targeting property characterizes the sort of victims that an adversary may target including details of identity, systems, and/or information targeted. Exploit_Targets ExploitTargetsType 0..1 The Exploit_Targets property specifies a set of one or more Exploit Targets potentially targeted by the TTP. Related_TTPs RelatedTTPsType 0..1 The Related_TTPs property specifies a set of one or more other TTPs related to this TTP. Kill_Chain_Phases stixCommon: KillChainPhasesReferenceType 0..1 A cyber kill chain is a phase-based model to describe the stages of an attack, and a cyber kill chain phase is an individual phase within a kill chain definition. The Kill_Chain_Phases property
The UML diagram corresponding to the BehaviorType class is shown in Figure 32. Figure 32. UML diagram of the BehaviorType class The property given in Table 33 corresponds to the UML diagram shown in Figure 32, and the associated classes defining the property types are discussed in Sections 3.2.1 through 3.2.3. Table 33. Properties of the BehaviorType class Name Type Multiplicity Description Attack_Patterns AttackPatternsType 0..1 The Attack_Patterns property specifies a set of one or more attack patterns that an adversary may leverage. Malware MalwareType 0..1 The Malware property specifies a set of one or more instances of malware that an adversary may leverage. Exploits ExploitsType 0..1 The Exploits property specifies a set of one or more exploits that an adversary may leverage. AttackPatternsType Class The AttackPatternsType specifies a set of one or more attack patterns that an adversary may leverage. The property of the AttackPatternsType class is shown in Table 34. Table 34. Properties of the AttackPatternsType class Name Type Multiplicity Description Attack_Pattern AttackPatternType 1..* The Attack_Pattern property specifies a single Attack Pattern that an adversary may leverage.
formatting is supported via the structuring_format property of the StructuredTextType class. Short_Description stixCommon:StructuredTextType 0..* The Short_Description property captures a short textual description of the attack pattern. This property is secondary and should only be used if the Description property is already populated and another, shorter description is available. MalwareType Class The MalwareType class characterizes a set of one or more malware instances that an adversary may leverage. The property of the MalwareType class is shown in Table 36. Table 36. Properties of the MalwareType class Name Type Multiplicity Description Malware_Instance MalwareInstanceType 1..* The Malware_Instance property characterizes a single malware instance that an adversary may leverage. MalwareInstanceType Class The MalwareInstanceType class characterizes a malware instance through the capture of basic information such as the type, name, and description of the malware. A malware instance may characterize anything from a specific malware sample to an entire family. The MalwareInstanceType class is intended to be extended as appropriate to enable the structured description of a malware instance. STIX v1.2.1 defines a default extension to the MalwareInstanceType class to leverage the Malware Attribute Enumeration and Classification (MAEC) data model. The UML diagram corresponding to the MalwareInstanceType class is shown in Figure 34. Please see for extension-related details. Figure 34. UML diagram of the MalwareInstanceType The property table given in Table 37 corresponds to the UML diagram given in Figure 34. Table 37. Properties of the MalwareInstanceType class
Description property is already populated and another, shorter description is available. ExploitsType Class The ExploitsType class specifies a set of one or more exploits that an adversary may leverage. The property of the ExploitsType is shown in Table 38. Table 38. Properties of the ExploitsType class Name Type Multiplicity Description Exploit ExploitType 1..* The Exploit property specifies a single exploit that an adversary may leverage. ExploitType Class The ExploitType class characterizes an individual exploit instance through the capture of basic information such as the title and description of the exploit. The ExploitType class is intended to be extended to enable the structured description of an exploit instance. However, no extension is provided by STIX v 1.2; producers wanting to represent structured exploit instance information are encouraged to develop such an extension. The properties of the ExploitType class are shown in Table 39. Table 39. Properties of the ExploitType class Name Type Multiplicity Description id basicDataTypes:BasicString 0..1 The id property specifies a globally unique identifier for the exploit instance. basicDataTypes:BasicString 0..1 The idref property specifies an identifier reference to an exploit instance specified elsewhere. When the idref property is used, the id property MUST NOT also be specified and the other properties of the ExploitType class SHOULD NOT hold any content.