CodeTypeType Data Type The CodeTypeType data type specifies the type of code. Its core value SHOULD be a literal found in the CodeTypeEnum enumeration. It extends the BaseObjectPropertyType data type, in order to permit complex (i.e., regular-expression based) specifications. CodeSegmentXORType Data Type Used to encapsulate a segment of code that has been XORed with a pattern in order to avoid tripping anti-virus detection. The UML diagram corresponding to the CodeSegmentXORType class is shown in Figure 32. Figure . UML diagram of the CodeSegmentXORType data type The property table of the CodeSegmentXORType class is given in Table 32. . Properties of the CodeSegmentXORType class Name Type Multiplicity Description xor_pattern basicDataTypes:HexBinary 0..1 The xor_pattern property contains a 16-hexadecimal-character hex string, represents the pattern that the Code_Segment_XOR field should be XORed with in order to recover the actual code. The default value is 55AA55AA55AA55BB, as specified by IETF RFC 5901. CodePurposeType Data Type The CodePurposeType data type specifies the intended purposes of the code. Its core value SHOULD be a literal found in the CodePurposeEnum enumeration. It extends the BaseObjectPropertyType data type, in order to permit complex (i.e., regular-expression based) specifications.
CodeLanguageType Data Type The CodeLanguageType data type specifies the language of code. Its core value SHOULD be a literal from the CodeLanguageEnum enumeration. It extends the BaseObjectPropertyType data type, in order to permit complex (i.e., regular-expression based) specifications. ProcessorTypeType Data Type The ProcessorTypeType data type specifies the relevant processor families. Its core value SHOULD be a literal from the ProcessorTypeEnum enumeration. It extends the BaseObjectPropertyType data type, in order to permit complex (i.e., regular-expression based) specifications. TargetedPlatformsType Class The TargetedPlatformsType class contains a list of the targeted platforms. The property table of the TargetedPlatformsType class is given in Table 33. Table . Properties of the TargetedPlatformsType class Name Type Multiplicity Description Targeted_Platform cyboxCommon: PlatformSpecificationType 1..* The Targeted_Platform property specifies a particular platform that this code is targeted for. CodeTypeEnum Enumeration The literals of the CodeTypeEnum enumeration are given in Table 34. Table . Literals of the CodeTypeEnum enumeration Enumeration Literal Description Source_Code The code represented is in the form of source code.
Acknowledgments The following individuals have participated in the creation of this specification and are gratefully acknowledged. Aetna David Crawford AIT Austrian Institute of Technology Roman Fiedler Florian Skopik Australia and New Zealand Banking Group (ANZ Bank) Dean Thompson Blue Coat Systems, Inc. Owen Johnson Bret Jordan Century Link Cory Kennedy CIRCL Alexandre Dulaunoy Andras Iklody Raphaël Vinot Citrix Systems Joey Peloquin Dell Will Urbanski Jeff Williams DTCC Dan Brown Gordon Hundley Chris Koutras EMC Robert Griffin Jeff Odom Ravi Sharda Financial Services Information Sharing and Analysis Center (FS-ISAC) David Eilken Chris Ricard Fortinet Inc. Gavin Chow Kenichi Terashita Airbus SAS Eschweiler Marcos Orallo Anomali Ryan Clough Wei Huang Hugh Njemanze Katie Pelusi Aaron Shelmire Trost Bank of America Alexander Foley Center for Internet Security (CIS) Sarah Kelley Check Point Software Technologies Ron Davidson Systems Syam Appala Ted Bedwell David McGrew Pavan Reddy Omar Santos Jyoti Verma Threat Intelligence Network, Inc. (CTIN) Doug DePeppe Jane Ginn Ben Othman DHS Office of Cybersecurity and Communications (CS&C) Richard Struse Marlon Taylor EclecticIQ Marko Dragoljevic Joep Gommers Sergey Polzunov Rutger Prins
Fujitsu Limited Neil Edwards Frederick Hirsch Ryusuke Masuoka Daisuke Murabayashi Google Inc. Mark Risher Hitachi, Ltd. Noguchi Akihito Sawada Masato Terada iboss, Inc. Paul Martini Individual Jerome Athias Brown Elysa Jones Sanjiv Kalkar Bar Lockwood Terry MacDonald Alex Pinto Intel Corporation Tim Casey Kent Landfield JPMorgan Bank, N.A. Terrence Driscoll David Laurance LookingGlass Thomson Lee Vorthman Mitre Corporation Greg Back Jonathan Baker Sean Barnum Desiree Beck Nicole Gong Jacobsen Ivan Kirillov Richard Piazza Jon Salwen Charles Schmidt Andrei Sîrghi Raymon van der Velde eSentire, Inc. Jacob Gajek FireEye, Inc. Phillip Boles Pavan Gorakav Anuj Shyamal Pandya Paul Patrick Scott Shreve Fox-IT Sarah Brown Georgetown University Eric Burger Hewlett Packard Enterprise (HPE) Tomas Sander IBM Peter Allor Eldan Ben-Haim Sandra Hernandez Keirstead John Morris Rusu Ron Williams IID Chris Richardson Integrated Networking Technologies, Inc. Patrick Maroney Hopkins University Applied Physics Laboratory Karin Marr Julie Modlin Mark Moss Pamela Smith Kaiser Permanente Russell Culpepper Beth Pumo Lumeta Corporation Brandon Hoffman MTG Management Consultants, LLC. James Cabral
Emmanuelle Vargas-Gonzalez John Wunder National Council of ISACs (NCI) Scott Algeier Denise Anderson Josh Poster NEC Corporation Takahiro Kakumaru American Energy Standards Board David Darnell Object Management Group Cory Casanave Palo Alto Networks Vishaal Hariprasad Queralt, Inc. John Tolbert Resilient Systems, Inc. Ted Julian Securonix Igor Baikalov Siemens AG Bernd Grobauer Soltra John Anderson Aishwarya Asok Peter Ayasse Jeff Beekman Michael Butt Cynthia Camacho Aharon Chernin Mark Clancy Brady Cotton Trey Darley Mark Davidson Paul Dion Daniel Dye Robert Hutto Raymond Keckler Ali Khan Chris Kiehl Clayton Long National Security Agency Mike Boyle Jessica Fitzgerald-McKay New Context Services, Inc. John-Mark Gurney Christian Hunt Moler Daniel Riedel Andrew Storms OASIS James Bryce Clark Robin Cover Chet Ensign Open Identity Exchange Don Thibeau PhishMe Inc. Josh Larkins Raytheon Company-SAS Daniel Wyschogrod Retail Cyber Intelligence Sharing Center Engle Semper Fortis Solutions Joseph Brand Splunk Inc. Cedric LeRoux Brian Luger Kathy Wang TELUS Greg Reaume Alan Threat Intelligence Pty Ltd Tyron Miller Andrew van der ThreatConnect, Inc. Wade Baker Cole Iliff Andrew Pendergast Ben Schmoker Jason Spies TruSTAR Technology Roblee
Michael Pepin Natalie Suarez David Waters Benjamin Yates Symantec Corp. Curtis Kostrosky The Boeing Company Crystal Hayes ThreatQuotient, Inc. Ryan U.S. Bank Mark Angel Brad Butts Brian Fay Mona Magathan Yevgen Sautin US Department of Defense (DoD) Bohling Eoghan Casey Gary Katz Jeffrey Mates VeriSign Robert Coderre Kyle Maxwell Eric Osterweil United Kingdom Cabinet Office Iain Brown Adam Cooper Mike McLellan Chris O’Brien James Penman Howard Staple Chris Taylor Laurie Thomson Alastair Treharne Julian White Bethany Yates US Department of Homeland Security Evette Maynard-Noel Justin Stekervetz ViaSat, Inc. Lee Chieffalo Wilson Figueroa Andrew May Yaana Technologies, LLC Anthony Rutkowski The authors would also like to thank the larger CybOX Community for its input and help in reviewing this document.