specifies a set of one or more kill chain phases (from one or more kill chains defined elsewhere) for which the TTP is asserted to be representative. The kill chain property is further defined in the STIX Common specification document. Information_Source stixCommon: InformationSourceType 0..1 The Information_Source property characterizes the source of the TTP information. Examples of details captured include identitifying characteristics, time-related attributes, and a list of the tools used to collect the information. Kill_Chains stixCommon:KillChainsType 0..1 A cyber kill chain is a phase-based model to describe the stages of an attack. The Kill_Chains property specifies a set of one or more specific kill chain definitions. The kill chain property is further defined in the STIX Common specification document. Handling marking:MarkingType 0..1 The Handling property specifies data handling markings for the properties of this TTP. The marking is limited to the TTP and the content is contains. Note that data handling markings can also be specified at a higher level. Related_Packages stixCommon: RelatedPackagesRefsType 0..1 The Related_Packages property specifies a set of one or more Packages for which the TTP may be relevant. TTPVersionType Enumeration The TTPVersionType enumeration is an inventory of all versions of the TTP data model for STIX Version 1.2.1. The enumeration literals are given in Table 32. Table . Literals of the TTPVersionType enumeration Enumeration Literal Description stix-1.2.1 TTP data model for STIX v1.2.1 BehaviorType Class The BehaviorType class characterizes adversarial behavior by capturing details of cyber attack patterns, malware or exploits that the adversary may leverage.
AttackPatternType Class The AttackPatternType class characterizes an individual attack pattern through the capture of information such as a textual description and a Common Attack Pattern Enumeration and Classification (CAPEC) reference. The AttackPatternType class is intended to be extended as appropriate to enable the structured description of an attack pattern. STIX v1.2.1 defines a default extension to the AttackPatternType class to leverage the Common Attack Pattern Enumeration and Classification (CAPEC) data model. The UML diagram corresponding to the SuggestedCOAsType class is shown in Figure 33. Please see for extension-related details. Figure . UML diagram of the AttackPatternType class The property table given in Table 35 corresponds to the UML diagram given in Figure 33. Table . Properties of the AttackPatternType class Name Type Multiplicity Description id basicDataTypes:QualifiedName 0..1 The id property specifies a globally unique identifier for the attack pattern. idref basicDataTypes:QualifiedName 0..1 The idref property specifies an identifier reference to an attack pattern specified elsewhere. When the idref property is used, the id property MUST NOT also be specified and the other properties of the AttackPatternType class SHOULD NOT hold any content. capec_id basicDataTypes:CAPEC_ID 0..1 The capec_id property specifies a particular attack pattern (via identifier) in the Common Attack Pattern Enumeration and Classification (CAPEC) registry. Title basicDataTypes:BasicString 0..1 The Title property captures a title for the attack pattern and reflects what the content producer thinks the attack pattern as a whole should be called. The Title property is typically used by humans to reference a particular attack pattern; however, it is not suggested for correlation. Description stixCommon:StructuredTextType 0..* The Description property captures a textual description of the attack pattern. Any length is permitted. Optional
basicDataTypes:BasicString 0..1 The Title property captures a title for the exploit instance and reflects what the content producer thinks the exploit instance as a whole should be called. The Title property is typically used by humans to reference a particular exploit instance; however, it is not suggested for correlation. Description stixCommon:StructuredTextType 0..* The Description property captures a textual description of the exploit instance. Any length is permitted. Optional formatting is supported via the structuring_format property of the StructuredTextType class. Short_Description stixCommon:StructuredTextType 0..* The Short_Description property captures a short textual description of the exploit instance. This property is secondary and should only be used if the Description property is already populated and another, shorter description is available. ResourceType Class The ResourceType class characterizes resources the adversary may leverage. The UML diagram corresponding to the ResourceType is shown in Figure 35. Figure . UML diagram of the ResourceType class The property table given in Table 310 corresponds to the UML diagram given in Figure 35. Table . Properties of the ResourceType class Name Type Multiplicity Description Tools ToolsType 0..1 The Tools property specifies a set of one or more tools that an adversary may leverage. Infrastructure InfrastructureType 0..1 The Infrastructure property characterizes infrastructure that an adversary may leverage.
id basicDataTypes: BasicString 0..1 The id property specifies a globally unique identifier for the infrastructure. idref basicDataTypes: BasicString 0..1 The idref property specifies an identifier reference to an infrastructure specified elsewhere. When the idref property is used, the id property MUST NOT also be specified and the other properties of the InfrastructureType class SHOULD NOT hold any content. Title basicDataTypes: BasicString 0..1 The Title property captures a title for the infrastructure and reflects what the content producer thinks the infrastructure as a whole should be called. The Title property is typically used by humans to reference a particular infrastructure; however, it is not suggested for correlation. Type stixCommon: VocabularyStringType 0..* The Type property specifies the type of infrastructure being characterized. Examples of potential types include anonymization, domain registration, and hosting (these specific values are only provided to help explain the property: they are neither recommended values nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an externally-defined vocabulary or leveraging a formally defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in the property is ‘AttackerInfrastructureTypeVocab-1.0.’ Description stixCommon: StructuredTextType 0..* The Description property captures a textual description of the infrastructure. Any length is permitted. Optional formatting is supported via the structuring_format property of the StructuredTextType class. Short_Description stixCommon: StructuredTextType 0..* The Short_Description property captures a short textual description of the infrastructure. This property is secondary and should only be used if the Description property is already populated and another, shorter description is available.
Observable_Characterization cybox:ObservablesType 0..1 The Observable_Characterization property characterizes the adversarial infrastructure through specification of a structured cyber Observables pattern. PersonasType Class The PersonasType class specifies a set of one or more personas that an adversary may leverage. The property of the PersonasType class is shown in Table 313. Table . Properties of the PersonasType class Name Type Multiplicity Description Persona stixCommon:IdentityType 1..* The Persona property characterizes a persona identity potentially used in malicious activity. Personas are typically used to masquerade as another party. For situations calling for more than a simple name, the underlying class may be extended using a more complete structure such as the CIQIdentity3.0InstanceType subclass as defined in . VictimTargetingType Class The VictimTargetingType class characterizes victim targeting information by capturing information about the people, organizations, systems and/or data potentially targeted by the adversary. The UML diagram corresponding to the VictimTargetingType class is shown in Figure 36. Figure . UML diagram of the VictimTargetingType class The property given in Table 314 corresponds to the UML diagram given in Figure 36. Table . Properties of the VictimTargetingType class Name Type Multiplicity Description