captures Used to record and preserve information without implying anything about the structure of a class or property. Often used for properties that encompass general content. This is the least precise of the three verbs. Examples: The Observable_Source property characterizes the source of the Observable information. Examples of details captured include identifying characteristics, attributes, and a list of the used to collect the information. The Description property captures a textual description of the Action. characterizes Describes the distinctive nature or features of a class or property. Often used to describe classes and properties that themselves comprise one or more other properties. Examples: The Action property characterizes a cyber observable Action. The Obfuscation_Technique property characterizes a technique an attacker could potentially leverage to obfuscate the Observable. specifies Used to clearly and precisely identify particular instances or values associated with a property. Often used for properties that are defined by a controlled vocabulary or enumeration; typically used for properties that take on only a single value. Example: The cybox_major_version property specifies the major version of the CybOX Language used for the set of Observables. Terminology The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in [RFC2119]. Normative References [RFC2119] Bradner, S., “Key words for use in RFCs to Indicate Requirement Levels”, BCP 14, RFC 2119, March 1997. .
Magic_Number cyboxCommon: HexBinaryObjectPropertyType 0..1 The Magic_Number property specifies the particular magic number (typically a hexadecimal constant used to identify a file format) corresponding to the file, if applicable. File_Format cyboxCommon: StringObjectPropertyType 0..1 The File_Format property specifies the particular file format of the file, most typically specified by a tool such as the UNIX file command. Hashes cyboxCommon: HashListType 0..1 The Hashes property specifies any hashes of the file. Digital_Signatures cyboxCommon: DigitalSignaturesType 0..1 The Digital_Signatures property captures one or more digital signatures for the file. Modified_Time cyboxCommon: DateTimeObjectPropertyType 0..1 The Modified_Time property specifies the date/time the file was last modified. Accessed_Time cyboxCommon: DateTimeObjectPropertyType 0..1 The Accessed_Time property specifies the date/time the file was last accessed. Created_Time cyboxCommon: DateTimeObjectPropertyType 0..1 The Created_Time property specifies the date/time the file was created. File_Attributes_List FileAttributeType 0..1 The File_Attributes_List property specifies the particular special attributes set for the file. Since this is a platform-specific Object property, it is defined here as an abstract type and then implemented in any platform specific derived file objects. Permissions FilePermissionsType 0..1 The Permissions property specifies that particular permissions that a file may have. this is a
Compression_Version cyboxCommon: StringObjectPropertyType 0..1 The Compression_Version property specifies the version of the compression method used to compress the file. Compression_Comment cyboxCommon: StringObjectPropertyType 0..1 The Compression_Comment property specifies the comment string associated with the compressed file. FilePathType The FilePathType class specifies the path to the file, not including the device. Whether the path is relative or fully-qualified can be specified via the 'fully_qualified' property. The property of the FilePathType class is given in Table 32. . Properties of the FilePathType class Name Type Multiplicity Description fully_qualified basicDataTypes:Boolean 0..1 The fully_qualified property specifies whether the path is fully qualified. FileAttributeType Class The FileAttributeType class specifies attribute(s) of a file. Since this is a platform-specific Object property, it is defined here as an abstract type. FilePermissionsType Class The FilePermissionsType class specifies a permission of a file. Since this is a platform-specific Object property, it is defined here as an abstract type and then implemented in any platform specific derived file objects.
Entry_Point cyboxCommon: HexBinaryObjectPropertyType 0..1 The Entry_Point property specifies the entry point address of the packer, if applicable. Signature cyboxCommon: StringObjectPropertyType 0..1 The Signature property specifies the matching signature detected for the packer, if applicable. Type PackerClassType 0..1 The Type property specifies the type of packer being characterized. Detected_Entrypoint_Signatures EntryPointSignatureListType 0..1 The Detected_Entrypoint_Signatures property specifies the entrypoint signatures that were detected for the packer. EP_Jump_Codes EPJumpCodeType 0..1 The EP_Jump_Codes property characterizes the entry point jump codes of the packer. PackerClassType Data Type The PackerCassType data type specifies the packer class. Its core value SHOULD be a literal from the PackerClassEnum enumeration. It extends the BaseObjectPropertyType data type, in order to permit complex (i.e., regular-expression based) specifications. EPJumpCodeType Class The EPJumpCodeType class specifies an entry-point jump code used by a packer. The property table of the EPJumpCodeType class is given in Table 35. Table . Properties of the EPJumpCodeType class Name Type Multiplicity Description
Name cyboxCommon:StringObjectPropertyType 0..1 The Name property specifies the signature name. Type DetectedTypeEnum 0..1 The Type property specifies the type of entry point detected (e.g., packer, compiled file). SymLinksListType The SymLinksListType class specifies a list of symbolic links. The property table of the SymLinksListType class is given in Table 38. Table . Properties of the SymLinksListType class Name Type Multiplicity Description Sym_Link cyboxCommon: StringObjectPropertyType 1..* The Sym_Link property specifies a single symbolic link. Enumeration The literals of the DetectedTypeEnum enumeration are given in Table 39. Table . Literals of the DetectedTypeEnum enumeration Enumeration Literal Description None Specifies a type other than those listed. Compiler Specifies an executable that acts as a compiler.
Packer Specifies an executable that acts as a packer. Installer Specifies an executable that acts as an installer. Enumeration The literals of the PackerClassEnum enumeration are given in Table 310. Table . Literals of the PackerClassEnum enumeration Enumeration Literal Description Archiver Indicates that the packer is an archiver. Installer Indicates that the packer is an installer. Self-Extracting Archiver Indicates that the packer is a self-extracting archiver. Crypter Indicates that the packer is a crypter. Packer Indicates a packer. Protector Indicates that the packer is a protector. Bundler Indicates that the packer is a bundler. Indicates a different type of packer from the ones listed.
Fujitsu Limited Neil Edwards Frederick Hirsch Ryusuke Masuoka Daisuke Murabayashi Google Inc. Mark Risher Hitachi, Ltd. Kazuo Noguchi Akihito Sawada Masato Terada iboss, Inc. Paul Martini Individual Jerome Athias Peter Brown Elysa Jones Sanjiv Kalkar Bar Lockwood Terry MacDonald Alex Pinto Intel Corporation Tim Casey Kent Landfield JPMorgan Chase Bank, N.A. Terrence Driscoll David Laurance LookingGlass Allan Thomson Lee Vorthman Mitre Corporation Greg Back Jonathan Baker Sean Barnum Desiree Beck Nicole Gong Jacobsen Ivan Kirillov Richard Piazza Jon Salwen Charles Schmidt Andrei Sîrghi Raymon van der Velde eSentire, Inc. Jacob Gajek FireEye, Inc. Phillip Boles Pavan Gorakav Anuj Kumar Shyamal Pandya Paul Patrick Scott Shreve Fox-IT Sarah Brown Georgetown University Eric Burger Hewlett Packard Enterprise (HPE) Tomas Sander IBM Peter Allor Eldan Ben-Haim Sandra Hernandez Jason Keirstead John Morris Laura Rusu Ron Williams IID Chris Richardson Integrated Networking Technologies, Inc. Patrick Maroney Johns Hopkins University Applied Physics Laboratory Karin Marr Julie Modlin Mark Moss Pamela Smith Kaiser Permanente Russell Culpepper Beth Pumo Lumeta Corporation Brandon Hoffman MTG Management Consultants, LLC. James Cabral
Emmanuelle Vargas-Gonzalez John Wunder National Council of ISACs (NCI) Scott Algeier Denise Anderson Josh Poster NEC Corporation Takahiro Kakumaru North American Energy Standards Board David Darnell Object Management Cory Casanave Palo Alto Networks Vishaal Hariprasad Queralt, Inc. John Tolbert Resilient Systems, Inc. Ted Julian Securonix Igor Baikalov Siemens AG Bernd Grobauer Soltra John Anderson Aishwarya Asok Kumar Peter Ayasse Jeff Beekman Michael Butt Cynthia Camacho Aharon Chernin Mark Clancy Brady Cotton Trey Darley Mark Davidson Paul Dion Daniel Dye Robert Hutto Raymond Keckler Ali Khan Chris Kiehl Clayton Long National Security Agency Mike Boyle Jessica Fitzgerald-McKay New Context Services, Inc. John-Mark Gurney Christian Hunt James Moler Daniel Riedel Andrew Storms OASIS James Bryce Clark Robin Cover Chet Ensign Open Identity Exchange Don Thibeau PhishMe Inc. Josh Larkins Raytheon Company-SAS Daniel Wyschogrod Retail Intelligence Sharing Center Brian Engle Semper Fortis Solutions Joseph Splunk Inc. Cedric LeRoux Brian Luger Kathy Wang TELUS Greg Reaume Alan Steer Threat Intelligence Pty Ltd Tyron Miller Andrew van der Stock ThreatConnect, Inc. Wade Baker Cole Iliff Andrew Pendergast Ben Schmoker Jason Spies TruSTAR Technology Chris Roblee
Michael Pepin Natalie Suarez David Waters Benjamin Yates Symantec Corp. Curtis Kostrosky The Boeing Company Crystal ThreatQuotient, Inc. Ryan Trost U.S. Bank Mark Angel Brad Butts Brian Fay Mona Magathan Yevgen Sautin US Department of Defense (DoD) James Bohling Eoghan Casey Gary Katz Jeffrey Mates VeriSign Robert Coderre Kyle Maxwell Eric Osterweil United Kingdom Cabinet Office Iain Brown Adam Cooper Mike McLellan Chris O’Brien James Penman Howard Staple Chris Taylor Laurie Thomson Alastair Treharne Julian White Bethany Yates US Department of Homeland Security Evette Maynard-Noel Justin Stekervetz ViaSat, Inc. Lee Chieffalo Wilson Figueroa Andrew May Yaana Technologies, LLC Anthony Rutkowski The authors would also like to thank the larger CybOX Community for its input and help in reviewing this document.