Collection
type: Class
disjoint with: Concept
disjoint with: Concept Scheme
definition: A meaningful collection of concepts.
scope note: Labelled collections can be used where you would like a set of concepts to be displayed under a 'node label' in the hierarchy.

Concept
type: Class
disjoint with: Concept Scheme
definition: An idea or notion; a unit of thought.

Concept Scheme
type: Class
definition: A set of concepts, optionally including statements about semantic relationships between those concepts.
example: Thesauri, classification schemes, subject heading lists, taxonomies, 'folksonomies', and other types of controlled vocabulary are all examples of concept schemes. Concept schemes are also embedded in glossaries and terminologies.
scope note: A concept scheme may be defined to include concepts from different sources.

Ordered Collection
type: Class
subclass of: Collection
definition: An ordered collection of concepts, where both the grouping and the ordering are meaningful.
scope note: Ordered collections can be used where you would like a set of concepts to be displayed in a specific order, and optionally under a 'node label'.

alternative label
type: AnnotationProperty
comment: The range of skos:altLabel is the class of RDF plain literals.
comment: skos:prefLabel, skos:altLabel and skos:hiddenLabel are pairwise disjoint properties.
sub property of: label
definition: An alternative lexical label for a resource.
example: Acronyms, abbreviations, spelling variants, and irregular plural/singular forms may be included among the alternative labels for a concept. Mis-spelled terms are normally included as hidden labels (see skos:hiddenLabel).

has broader match
type: ObjectProperty
sub property of: has broader
sub property of: is in mapping relation with
inverse of: has narrower match
definition: skos:broadMatch is used to state a hierarchical mapping link between two conceptual resources in different concept schemes.

has broader
type: ObjectProperty
comment: Broader concepts are typically rendered as parents in a concept hierarchy (tree).
sub property of: has broader transitive
definition: Relates a concept to a concept that is more general in meaning.
scope note: By convention, skos:broader is only used to assert an immediate (i.e. direct) hierarchical link between two conceptual resources.

has broader transitive
type: ObjectProperty
type: TransitiveProperty
sub property of: is in semantic relation with
inverse of: has narrower transitive
definition: skos:broaderTransitive is a transitive superproperty of skos:broader.
scope note: By convention, skos:broaderTransitive is not used to make assertions. Rather, the properties can be used to draw inferences about the transitive closure of the hierarchical relation, which is useful e.g. when implementing a simple query expansion algorithm in a search application.

change note
type: AnnotationProperty
sub property of: note
definition: A note about a modification to a concept.

has close match
type: ObjectProperty
type: SymmetricProperty
sub property of: is in mapping relation with
definition: skos:closeMatch is used to link two concepts that are sufficiently similar that they can be used interchangeably in some information retrieval applications. In order to avoid the possibility of "compound errors" when combining mappings across more than two concept schemes, skos:closeMatch is not declared to be a transitive property.

definition
type: AnnotationProperty
sub property of: note
definition: A statement or formal explanation of the meaning of a concept.

editorial note
type: AnnotationProperty
sub property of: note
definition: A note for an editor, translator or maintainer of the vocabulary.

has exact match
type: ObjectProperty
type: SymmetricProperty
type: TransitiveProperty
comment: skos:exactMatch is disjoint with each of the properties skos:broadMatch and skos:relatedMatch.
sub property of: has close match
definition: skos:exactMatch is used to link two concepts, indicating a high degree of confidence that the concepts can be used interchangeably across a wide range of information retrieval applications. skos:exactMatch is a transitive property, and is a sub-property of skos:closeMatch.

example
type: AnnotationProperty
sub property of: note
definition: An example of the use of a concept.

has top concept
type: ObjectProperty
domain: Concept Scheme
range: Concept
inverse of: is top concept in scheme
definition: Relates, by convention, a concept scheme to a concept which is topmost in the broader/narrower concept hierarchies for that scheme, providing an entry point to these hierarchies.

hidden label
type: AnnotationProperty
comment: The range of skos:hiddenLabel is the class of RDF plain literals.
comment: skos:prefLabel, skos:altLabel and skos:hiddenLabel are pairwise disjoint properties.
sub property of: label
definition: A lexical label for a resource that should be hidden when generating visual displays of the resource, but should still be accessible to free text search operations.

history note
type: AnnotationProperty
sub property of: note
definition: A note about the past state/use/meaning of a concept.

is in scheme
type: ObjectProperty
range: Concept Scheme
definition: Relates a resource (for example a concept) to a concept scheme in which it is included.
scope note: A concept may be a member of more than one concept scheme.

is in mapping relation with
type: ObjectProperty
comment: These concept mapping relations mirror semantic relations, and the data model defined below is similar (with the exception of skos:exactMatch) to the data model defined for semantic relations. A distinct vocabulary is provided for concept mapping relations, to provide a convenient way to differentiate links within a concept scheme from links between concept schemes. However, this pattern of usage is not a formal requirement of the SKOS data model, and relies on informal definitions of best practice.
sub property of: is in semantic relation with
definition: Relates two concepts coming, by convention, from different schemes, and that have comparable meanings

has member
type: ObjectProperty
domain: Collection
range: Class
  union of: Collection
  union of: Concept
definition: Relates a collection to one of its members.

has member list
type: ObjectProperty
type: FunctionalProperty
comment: For any resource, every item in the list given as the value of the skos:memberList property is also a value of the skos:member property.
domain: Ordered Collection
range: List
definition: Relates an ordered collection to the RDF list containing its members.

has narrower match
type: ObjectProperty
sub property of: is in mapping relation with
sub property of: has narrower
definition: skos:narrowMatch is used to state a hierarchical mapping link between two conceptual resources in different concept schemes.

has narrower
type: ObjectProperty
comment: Narrower concepts are typically rendered as children in a concept hierarchy (tree).
sub property of: has narrower transitive
inverse of: has broader
definition: Relates a concept to a concept that is more specific in meaning.
scope note: By convention, skos:broader is only used to assert an immediate (i.e. direct) hierarchical link between two conceptual resources.

has narrower transitive
type: ObjectProperty
type: TransitiveProperty
sub property of: is in semantic relation with
definition: skos:narrowerTransitive is a transitive superproperty of skos:narrower.
scope note: By convention, skos:narrowerTransitive is not used to make assertions. Rather, the properties can be used to draw inferences about the transitive closure of the hierarchical relation, which is useful e.g. when implementing a simple query expansion algorithm in a search application.

notation
type: DatatypeProperty
definition: A notation, also known as classification code, is a string of characters such as "T58.5" or "303.4833" used to uniquely identify a concept within the scope of a given concept scheme.
scope note: By convention, skos:notation is used with a typed literal in the object position of the triple.

note
type: AnnotationProperty
definition: A general note, for any purpose.
scope note: This property may be used directly, or as a super-property for more specific note types.

preferred label
type: AnnotationProperty
comment: A resource has no more than one value of skos:prefLabel per language tag, and no more than one value of skos:prefLabel without language tag.
comment: The range of skos:prefLabel is the class of RDF plain literals.
comment: skos:prefLabel, skos:altLabel and skos:hiddenLabel are pairwise disjoint properties.
sub property of: label
definition: The preferred lexical label for a resource, in a given language.

has related
type: ObjectProperty
type: SymmetricProperty
comment: skos:related is disjoint with skos:broaderTransitive
sub property of: is in semantic relation with
definition: Relates a concept to a concept with which there is an associative semantic relationship.

has related match
type: ObjectProperty
type: SymmetricProperty
sub property of: is in mapping relation with
sub property of: has related
definition: skos:relatedMatch is used to state an associative mapping link between two conceptual resources in different concept schemes.

scope note
type: AnnotationProperty
sub property of: note
definition: A note that helps to clarify the meaning and/or the use of a concept.

is in semantic relation with
type: ObjectProperty
domain: Concept
range: Concept
definition: Links a concept to a concept related by meaning.
scope note: This property should not be used directly, but as a super-property for all properties denoting a relationship of meaning between concepts.

is top concept in scheme
type: ObjectProperty
domain: Concept
range: Concept Scheme
sub property of: is in scheme
definition: Relates a concept to the concept scheme that it is a top level concept of.

STONES — STIX ONtology Expression System
type: Ontology
creator: Hohimer Intelligence Strategies LLC
description: An OWL 2 ontology modelling the STIX 2.1 specification. Provides a class hierarchy for all STIX Domain Objects (SDOs), Cyber Observable Objects (SCOs), Relationship Objects (SROs), Meta Objects, and structured sub-types, together with datatype and object properties covering all standard STIX properties.
license: MIT
label: STONES
imports: core
imports: datatype-properties#
imports: object-properties#
imports: vocabularies#
version IRI: https://cyberterrain.org/ns/stones/0.1.0
version info: 0.1.0

Alternate Data Stream
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  min cardinality: 1
  on property: name
definition: An NTFS Alternate Data Stream (ADS) attached to a file, identified by name with optional hashes and size.

Artifact Object
type: Class
subclass of: STIX Cyber Observable Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: artifact
    on property: stixType
definition: Represents a sequence of bytes, such as the content of a file, a raw stream of network traffic, or a data blob captured from memory. The content may be embedded directly via payload_bin or referenced via url.

Attack Pattern
type: Class
subclass of: STIX Domain Object
subclass of: Restriction
  min cardinality: 1
  on property: name
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: attack-pattern
    on property: stixType
definition: A type of Tactics, Techniques, and Procedures (TTP) that describes ways that adversaries attempt to compromise targets. Often maps to MITRE ATT&CK techniques.

Autonomous System Object
type: Class
subclass of: STIX Cyber Observable Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: autonomous-system
    on property: stixType
definition: Represents an Autonomous System (AS), a collection of IP routing prefixes under the control of a single administrative entity, identified by its AS number.

Campaign
type: Class
subclass of: STIX Domain Object
subclass of: Restriction
  min cardinality: 1
  on property: name
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: campaign
    on property: stixType
definition: A grouping of adversary behaviours and resources with a common objective pursued over a period of time. Campaigns may be attributed to intrusion sets or threat actors.

Course of Action
type: Class
subclass of: STIX Domain Object
subclass of: Restriction
  min cardinality: 1
  on property: name
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: course-of-action
    on property: stixType
definition: A recommendation for a specific measure to be taken in response to an attack. May describe automated responses, playbook steps, or manual mitigations.

Directory Object
type: Class
subclass of: STIX Cyber Observable Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: directory
    on property: stixType
definition: Represents a file system directory, conveying its path and timestamps. May reference the files and sub-directories it contains.

Domain Name Object
type: Class
subclass of: STIX Cyber Observable Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: domain-name
    on property: stixType
definition: Represents a network domain name. Can reference the IP addresses it resolves to.

Email Address Object
type: Class
subclass of: STIX Cyber Observable Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: email-addr
    on property: stixType
definition: Represents a single email address, optionally associating it with a display name and a user account.

Email Message Object
type: Class
subclass of: STIX Cyber Observable Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: email-message
    on property: stixType
definition: Represents an email message, including its headers, body, and any MIME parts.

Email MIME Part
type: Class
subclass of: STIX Sub-Type
definition: A single MIME part within a multipart email message, including its body content, content type, and content disposition.

Extension Definition Object
type: Class
subclass of: STIX Meta Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: extension-definition
    on property: stixType
definition: Defines a schema extension to STIX 2.1. Allows producers to add new properties or new object types in a structured, interoperable way.

External Reference
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  min cardinality: 1
  on property: sourceName
definition: A structured reference to non-STIX information, such as a CVE entry, MITRE ATT&CK technique, or external URL. Used to link STIX content to authoritative external sources.

File Object
type: Class
subclass of: STIX Cyber Observable Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: file
    on property: stixType
definition: Represents a file with its metadata and optional content reference. Supports extensions for archive files, NTFS streams, PE binaries, PDF documents, and raster images.

Granular Marking
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  min cardinality: 1
  on property: markingRef
subclass of: Restriction
  min cardinality: 1
  on property: selectors
definition: A property-level data handling marking that applies a marking definition to specific named fields of a STIX object, enabling fine-grained access control.

Grouping
type: Class
subclass of: STIX Domain Object
subclass of: Restriction
  min cardinality: 1
  on property: context
subclass of: Restriction
  min cardinality: 1
  on property: objectRefs
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: grouping
    on property: stixType
definition: Explicitly asserts that a set of STIX objects share a common context without implying the existence of a threat report. Useful for linking related objects without a formal report.

Hash Entry
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  min cardinality: 1
  on property: algorithm
subclass of: Restriction
  min cardinality: 1
  on property: hashValue
definition: A single cryptographic hash entry associating a hashing algorithm with its hex-encoded digest value. Used to represent entries in the STIX hashes dictionary.

IPv4 Address Object
type: Class
subclass of: STIX Cyber Observable Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: ipv4-addr
    on property: stixType
definition: Represents one or more IPv4 addresses expressed using CIDR notation.

IPv6 Address Object
type: Class
subclass of: STIX Cyber Observable Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: ipv6-addr
    on property: stixType
definition: Represents one or more IPv6 addresses expressed using CIDR notation.

Identity
type: Class
subclass of: STIX Domain Object
subclass of: Restriction
  min cardinality: 1
  on property: name
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: identity
    on property: stixType
definition: Actual individuals, organisations, or groups, as well as classes of individuals, organisations, systems, or groups. Used to represent victims, producers, or any other real-world actor.

Indicator
type: Class
subclass of: STIX Domain Object
subclass of: Restriction
  min cardinality: 1
  on property: indicatorTypes
subclass of: Restriction
  min cardinality: 1
  on property: patternType
subclass of: Restriction
  min cardinality: 1
  on property: pattern
subclass of: Restriction
  min cardinality: 1
  on property: validFrom
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: indicator
    on property: stixType
definition: Contains a pattern that can be used to detect suspicious or malicious cyber activity. Patterns are expressed using the STIX Patterning Language or another supported pattern language.

Infrastructure
type: Class
subclass of: STIX Domain Object
subclass of: Restriction
  min cardinality: 1
  on property: infrastructureTypes
subclass of: Restriction
  min cardinality: 1
  on property: name
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: infrastructure
    on property: stixType
definition: Represents systems, software services, or any group of resources used to conduct cyber operations. Infrastructure is used by threat actors and intrusion sets both offensively and defensively.

Intrusion Set
type: Class
subclass of: STIX Domain Object
subclass of: Restriction
  min cardinality: 1
  on property: name
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: intrusion-set
    on property: stixType
definition: A grouped set of adversarial behaviours and resources with common properties, believed to be orchestrated by a single organisation. Often represents a named APT group.

Kill Chain Phase
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  min cardinality: 1
  on property: killChainName
subclass of: Restriction
  min cardinality: 1
  on property: phaseName
definition: Represents a phase within a named kill chain framework, such as the MITRE ATT&CK or Lockheed Martin Cyber Kill Chain, used to categorise the stage of an attack.

Language Content Object
type: Class
subclass of: STIX Meta Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: language-content
    on property: stixType
definition: Provides translations of string properties of another STIX object into different languages. Allows internationalisation without modifying the original object.

Location
type: Class
subclass of: STIX Domain Object
subclass of: Restriction
  max cardinality: 1
  on property: region
subclass of: Restriction
  max cardinality: 1
  on property: country
subclass of: Restriction
  max cardinality: 1
  on property: latitude
subclass of: Restriction
  max cardinality: 1
  on property: longitude
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: location
    on property: stixType
definition: Represents a geographic location. May be as specific as a latitude/longitude coordinate or as broad as a continent. At least one of region, country, or latitude/longitude must be provided.

MAC Address Object
type: Class
subclass of: STIX Cyber Observable Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: mac-addr
    on property: stixType
definition: Represents a single MAC address expressed in lowercase IEEE 802 colon-hexadecimal notation.

Malware
type: Class
subclass of: STIX Domain Object
subclass of: Restriction
  min cardinality: 1
  on property: malwareTypes
subclass of: Restriction
  min cardinality: 1
  on property: isFamily
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: malware
    on property: stixType
definition: A type of TTP that represents malicious code. Captures both malware families (when is_family is true) and specific instances or samples.

Malware Analysis
type: Class
subclass of: STIX Domain Object
subclass of: Restriction
  min cardinality: 1
  on property: product
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: malware-analysis
    on property: stixType
definition: Captures the results of a malware analysis process, whether static or dynamic. Represents the output of a specific analysis run on a specific sample.

Marking Definition Object
type: Class
subclass of: STIX Meta Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: marking-definition
    on property: stixType
definition: Defines a data handling marking used to restrict or label how STIX data can be shared or handled, such as TLP markings. Referenced by object_marking_refs or granular_markings.

Mutex Object
type: Class
subclass of: STIX Cyber Observable Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: mutex
    on property: stixType
definition: Represents a named mutual-exclusion object, commonly created or checked by malware to prevent multiple concurrent instances from running.

Network Traffic Object
type: Class
subclass of: STIX Cyber Observable Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: network-traffic
    on property: stixType
definition: Represents an arbitrary network traffic flow between source and destination endpoints. Supports extensions for HTTP, ICMP, socket, and TCP specifics.

Note
type: Class
subclass of: STIX Domain Object
subclass of: Restriction
  min cardinality: 1
  on property: objectRefs
subclass of: Restriction
  min cardinality: 1
  on property: content
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: note
    on property: stixType
definition: Conveys informational text to provide further context and/or to assess the accuracy of existing STIX information. Similar to a comment or annotation on other STIX objects.

Observed Data
type: Class
subclass of: STIX Domain Object
subclass of: Restriction
  min cardinality: 1
  on property: objectRefs
subclass of: Restriction
  min cardinality: 1
  on property: firstObserved
subclass of: Restriction
  min cardinality: 1
  on property: lastObserved
subclass of: Restriction
  min cardinality: 1
  on property: numberObserved
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: observed-data
    on property: stixType
definition: Conveys information observed on systems and networks, wrapping one or more SCO references together with observation metadata such as first and last observed timestamps.

Opinion
type: Class
subclass of: STIX Domain Object
subclass of: Restriction
  min cardinality: 1
  on property: objectRefs
subclass of: Restriction
  min cardinality: 1
  on property: opinion
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: opinion
    on property: stixType
definition: An assessment of the correctness of information in one or more STIX objects. Allows analysts to express agreement or disagreement with existing intelligence.

Process Object
type: Class
subclass of: STIX Cyber Observable Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: process
    on property: stixType
definition: Represents a running or terminated process on a host. Supports extensions for Windows-specific process and service attributes.

Relationship
type: Class
subclass of: STIX Relationship Object
subclass of: Restriction
  min cardinality: 1
  on property: sourceRef
subclass of: Restriction
  min cardinality: 1
  on property: targetRef
subclass of: Restriction
  min cardinality: 1
  on property: relationshipType
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: relationship
    on property: stixType
definition: A directed link between two STIX Core Objects. The semantics of the link are defined by the relationship_type property.

Report
type: Class
subclass of: STIX Domain Object
subclass of: Restriction
  min cardinality: 1
  on property: objectRefs
subclass of: Restriction
  min cardinality: 1
  on property: reportTypes
subclass of: Restriction
  min cardinality: 1
  on property: name
subclass of: Restriction
  min cardinality: 1
  on property: published
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: report
    on property: stixType
definition: A collection of threat intelligence focused on one or more topics, such as a description of a threat actor, malware, or attack technique. Used to package related STIX content.

Sighting
type: Class
subclass of: STIX Relationship Object
subclass of: Restriction
  min cardinality: 1
  on property: sightingOfRef
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: sighting
    on property: stixType
definition: Records that a STIX object such as an indicator, malware, tool, or threat actor was seen. Wraps observation metadata around a reference to the sighted object.

Software Object
type: Class
subclass of: STIX Cyber Observable Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: software
    on property: stixType
definition: Represents a software product, including commercial applications, operating systems, libraries, and utilities.

STIX Bundle
type: Class
subclass of: STIX Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: bundle
    on property: stixType
definition: A collection of arbitrary STIX objects used as a transport container. Bundles are not Core Objects, carry no modified timestamp, and cannot be referenced by identifier.

STIX Core Object
type: Class
subclass of: STIX Object
subclass of: Restriction
  min cardinality: 1
  on property: created
subclass of: Restriction
  min cardinality: 1
  on property: modified
definition: Abstract class for STIX Core Objects, comprising SDOs, SCOs, and SROs. Core objects carry a type-qualified identifier and created/modified timestamps, and may be referenced by other objects.

STIX Cyber Observable Object
type: Class
subclass of: STIX Core Object
definition: Abstract class for STIX Cyber Observable Objects (SCOs), which represent technical observations such as IP addresses, files, network traffic, and processes.

STIX Domain Object
type: Class
subclass of: STIX Core Object
definition: Abstract class for STIX Domain Objects (SDOs), which represent modelled cyber threat intelligence concepts such as malware, campaigns, threat actors, and vulnerabilities.

STIX Meta Object
type: Class
subclass of: STIX Object
definition: Abstract class for STIX Meta Objects, which provide supporting infrastructure for the STIX ecosystem, including data markings, language translations, and extension definitions.

STIX Object
type: Class
subclass of: Restriction
  min cardinality: 1
  on property: specVersion
subclass of: Restriction
  min cardinality: 1
  on property: stixId
subclass of: Restriction
  min cardinality: 1
  on property: stixType
disjoint with: STIX Sub-Type
has key: stixId
definition: The top-level abstract class for all STIX objects, encompassing STIX Core Objects (SDOs, SCOs, SROs), Meta Objects, and Bundles.

STIX Relationship Object
type: Class
subclass of: STIX Core Object
definition: Abstract class for STIX Relationship Objects (SROs), which link Core Objects to express directed relationships and sightings between them.

STIX Sub-Type
type: Class
definition: Abstract class for structured sub-types defined by the STIX 2.1 specification that are embedded as property values within STIX objects. Instances are not STIX objects: they carry no identifier, type, spec_version, created, or modified properties and cannot be referenced by identifier from other objects. Subclasses include ExternalReference, GranularMarking, KillChainPhase, HashEntry, EmailMimePart, AlternateDataStream, WindowsPeSection, WindowsRegistryValue, and X509V3Extensions.

Threat Actor
type: Class
subclass of: STIX Domain Object
subclass of: Restriction
  min cardinality: 1
  on property: threatActorTypes
subclass of: Restriction
  min cardinality: 1
  on property: name
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: threat-actor
    on property: stixType
definition: Actual individuals, groups, or organisations believed to be operating with malicious intent. Unlike Identity, a ThreatActor carries adversarial connotations.

Tool
type: Class
subclass of: STIX Domain Object
subclass of: Restriction
  min cardinality: 1
  on property: toolTypes
subclass of: Restriction
  min cardinality: 1
  on property: name
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: tool
    on property: stixType
definition: Legitimate software that can be used by threat actors to perform attacks. Distinguishable from malware by being designed for benign purposes but repurposed maliciously.

URL Object
type: Class
subclass of: STIX Cyber Observable Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: url
    on property: stixType
definition: Represents a Uniform Resource Locator conforming to RFC 3986.

User Account Object
type: Class
subclass of: STIX Cyber Observable Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: user-account
    on property: stixType
definition: Represents a user account on a system or service, including local OS accounts, cloud accounts, and social media accounts. Supports a unix-account extension for POSIX attributes.

Vulnerability
type: Class
subclass of: STIX Domain Object
subclass of: Restriction
  min cardinality: 1
  on property: name
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: vulnerability
    on property: stixType
definition: A mistake in software that can be directly used by a threat actor to gain access to a system or network. Typically identified by a CVE number via an external reference.

Windows PE Section
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  min cardinality: 1
  on property: name
definition: A single section entry within a Windows PE (Portable Executable) binary, described by its name, size, and optional entropy value.

Windows Registry Key Object
type: Class
subclass of: STIX Cyber Observable Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: windows-registry-key
    on property: stixType
definition: Represents a Windows Registry key with its full path, value entries, modification timestamp, and creator.

Windows Registry Value
type: Class
subclass of: STIX Sub-Type
subclass of: Restriction
  min cardinality: 1
  on property: name
definition: A single value entry within a Windows Registry key, comprising a name, a data string, and a registry data type.

X.509 Certificate Object
type: Class
subclass of: STIX Cyber Observable Object
equivalent class: Class
  intersection of: STIX Object
  intersection of: Restriction
    has value: x509-certificate
    on property: stixType
definition: Represents an X.509 digital certificate, capturing its subject, issuer, validity window, public key details, and optional v3 extensions.

X.509 v3 Extensions
type: Class
subclass of: STIX Sub-Type
definition: The set of X.509 version 3 extension fields present in a digital certificate, such as key usage, subject alternative names, and CRL distribution points.

abstract
type: DatatypeProperty
comment: (STIX: abstract)
domain: Note
range: string
definition: Brief summary of the note.

accountCreated
type: DatatypeProperty
comment: (STIX: account_created)
domain: User Account Object
range: dateTime
definition: Timestamp when this account was created.

accountExpires
type: DatatypeProperty
comment: (STIX: account_expires)
domain: User Account Object
range: dateTime
definition: Timestamp when this account expires.

accountFirstLogin
type: DatatypeProperty
comment: (STIX: account_first_login)
domain: User Account Object
range: dateTime
definition: Timestamp of the first login for this account.

accountLastLogin
type: DatatypeProperty
comment: (STIX: account_last_login)
domain: User Account Object
range: dateTime
definition: Timestamp of the most recent login for this account.

accountLogin
type: DatatypeProperty
comment: (STIX: account_login)
domain: User Account Object
range: string
definition: Login name if different from userId.

accountType
type: ObjectProperty
comment: (STIX: account_type)
domain: User Account Object
range: AccountTypeVocabulary
definition: Type of user account (account-type-ov): facebook, ldap, nis, openid, radius, skype, tacacs, twitter, unix, windows-domain, windows-local.

addressFamily
type: ObjectProperty
comment: (STIX: address_family)
range: NetworkSocketAddressFamilyEnumeration
definition: Address family of this socket (network-socket-address-family-enum): AF_UNSPEC, AF_INET, AF_INET6, AF_IPX, AF_APPLETALK, AF_NETBIOS, AF_IRDA, AF_BTH.

administrativeArea
type: DatatypeProperty
comment: (STIX: administrative_area)
domain: Location
range: string
definition: State, province, or region within a country.

algorithm
type: ObjectProperty
comment: (STIX: hashes dictionary key)
domain: Hash Entry
range: HashingAlgorithmVocabulary
definition: The hashing algorithm used for this hash entry (hashing-algorithm-ov).

aliases
type: DatatypeProperty
comment: (STIX: aliases)
range: string
definition: Alternative names for this object. Multiple aliases are expressed as multiple triples.

alternateDataStreams
type: ObjectProperty
comment: (STIX: alternate_data_streams)
range: Alternate Data Stream
definition: NTFS Alternate Data Streams present on this file. Each entry is a stones:AlternateDataStream individual.

analysisDefinitionVersion
type: DatatypeProperty
comment: (STIX: analysis_definition_version)
domain: Malware Analysis
range: string
definition: Version of the analysis definitions or signatures.

analysisEnded
type: DatatypeProperty
comment: (STIX: analysis_ended)
domain: Malware Analysis
range: dateTime
definition: Timestamp when analysis concluded.

analysisEngineVersion
type: DatatypeProperty
comment: (STIX: analysis_engine_version)
domain: Malware Analysis
range: string
definition: Version of the analysis engine.

analysisScoRefs
type: ObjectProperty
comment: (STIX: analysis_sco_refs)
domain: Malware Analysis
range: STIX Cyber Observable Object
definition: References to SCOs generated or observed as a result of this analysis.

analysisStarted
type: DatatypeProperty
comment: (STIX: analysis_started)
domain: Malware Analysis
range: dateTime
definition: Timestamp when analysis began.

architectureExecutionEnvs
type: ObjectProperty
comment: (STIX: architecture_execution_envs)
domain: Malware
range: ProcessorArchitectureVocabulary
definition: Processor architectures this malware can execute on (processor-architecture-ov). Multiple values as multiple triples.

aslrEnabled
type: DatatypeProperty
comment: (STIX: windows-process-ext.aslr_enabled)
range: boolean
definition: True if Address Space Layout Randomisation (ASLR) is enabled for this process.

atime
type: DatatypeProperty
comment: (STIX: atime)
range: dateTime
definition: Last-accessed timestamp of a file system object.

authorityInfoAccess
type: DatatypeProperty
comment: (STIX: x509-v3-extensions-type.authority_info_access)
domain: X.509 v3 Extensions
range: string
definition: X.509 v3 authority information access extension.

authorityKeyIdentifier
type: DatatypeProperty
comment: (STIX: x509-v3-extensions-type.authority_key_identifier)
domain: X.509 v3 Extensions
range: string
definition: X.509 v3 authority key identifier.

authors
type: DatatypeProperty
comment: (STIX: authors)
range: string
definition: Names of the authors of a note or opinion. Multiple values are expressed as multiple triples.

avResult
type: DatatypeProperty
comment: (STIX: av_result)
domain: Malware Analysis
range: string
definition: Raw classification string from an antivirus engine, e.g. 'Trojan.GenericKD'.

basicConstraints
type: DatatypeProperty
comment: (STIX: x509-v3-extensions-type.basic_constraints)
domain: X.509 v3 Extensions
range: string
definition: X.509 v3 basic constraints extension value.

bccRefs
type: ObjectProperty
comment: (STIX: bcc_refs)
domain: Email Message Object
range: Email Address Object
definition: References to email-addr SCOs in the Bcc: header.

belongsToRef
type: ObjectProperty
comment: (STIX: belongs_to_ref)
domain: Email Address Object
range: User Account Object
definition: Reference to the user-account SCO that owns this email address.

belongsToRefs
type: ObjectProperty
comment: (STIX: belongs_to_refs)
range: Autonomous System Object
definition: References to autonomous-system SCOs that own this IP address.

bitsPerPixel
type: DatatypeProperty
comment: (STIX: raster-image-ext.bits_per_pixel)
range: integer
definition: Colour depth of the image in bits per pixel.

body
type: DatatypeProperty
comment: (STIX: body)
range: string
definition: Plain-text body of an email message or a MIME part.

bodyMultipart
type: ObjectProperty
comment: (STIX: body_multipart)
domain: Email Message Object
range: Email MIME Part
definition: MIME parts of a multipart email message. Each part is a stones:EmailMimePart individual.

bodyRawRef
type: ObjectProperty
comment: (STIX: body_raw_ref)
domain: Email MIME Part
range: STIX Cyber Observable Object
definition: Reference to an artifact or file SCO containing the raw bytes of this MIME part.

canEscalatePrivs
type: DatatypeProperty
comment: (STIX: can_escalate_privs)
domain: User Account Object
range: boolean
definition: True if this account can escalate its own privileges.

capabilities
type: ObjectProperty
comment: (STIX: capabilities)
domain: Malware
range: MalwareCapabilitesVocabulary
definition: Functional capabilities exhibited by this malware (malware-capabilities-ov). Multiple values as multiple triples.

ccRefs
type: ObjectProperty
comment: (STIX: cc_refs)
domain: Email Message Object
range: Email Address Object
definition: References to email-addr SCOs in the Cc: header.

certificatePolicies
type: DatatypeProperty
comment: (STIX: x509-v3-extensions-type.certificate_policies)
domain: X.509 v3 Extensions
range: string
definition: X.509 v3 certificate policies extension.

characteristicsHex
type: DatatypeProperty
comment: (STIX: characteristics_hex)
range: hexBinary
definition: Characteristics flags from the PE COFF header as hex.

childRefs
type: ObjectProperty
comment: (STIX: child_refs)
domain: Process Object
range: Process Object
definition: References to child process SCOs spawned by this process.

city
type: DatatypeProperty
comment: (STIX: city)
domain: Location
range: string
definition: City name.

commandLine
type: DatatypeProperty
comment: (STIX: command_line)
domain: Process Object
range: string
definition: Full command line string used to launch this process.

comment
type: DatatypeProperty
comment: (STIX: archive-ext.comment)
range: string
definition: Comment field embedded in an archive file.

confidence
type: DatatypeProperty
comment: (STIX: confidence)
domain: STIX Object
range: integer
definition: Producer's confidence in the accuracy of this data, from 0 (no confidence) to 100 (fully confident).

configurationVersion
type: DatatypeProperty
comment: (STIX: configuration_version)
domain: Malware Analysis
range: string
definition: Version of the analysis tool configuration.

contactInformation
type: DatatypeProperty
comment: (STIX: contact_information)
domain: Identity
range: string
definition: Contact details such as email address or phone number.

containsRefs
type: ObjectProperty
comment: (STIX: contains_refs)
range: STIX Cyber Observable Object
definition: References to file or directory SCOs contained within this directory or archive.

content
type: DatatypeProperty
comment: (STIX: content)
domain: Note
range: string
definition: Full body text of the note.

contentDisposition
type: DatatypeProperty
comment: (STIX: content_disposition)
domain: Email MIME Part
range: string
definition: Content-Disposition header value for an email MIME part.

contentRef
type: ObjectProperty
comment: (STIX: content_ref)
domain: File Object
range: Artifact Object
definition: Reference to the artifact SCO that holds the content of this file.

contentType
type: DatatypeProperty
comment: (STIX: content_type)
range: string
definition: Value of the Content-Type header (email-message, email MIME part).

context
type: ObjectProperty
comment: (STIX: context)
domain: Grouping
range: GroupingContextVocabulary
definition: Shared context that motivates this grouping (grouping-context-ov).

count
type: DatatypeProperty
comment: (STIX: count)
domain: Sighting
range: integer
definition: Number of times the sighted object was observed. MUST be >= 0.

country
type: DatatypeProperty
comment: (STIX: country)
domain: Location
range: string
definition: ISO 3166-1 alpha-2 country code, e.g. 'US', 'GB'.

cpe
type: DatatypeProperty
comment: (STIX: cpe)
domain: Software Object
range: string
definition: NVD CPE 2.3 URI binding identifier for this software.

created
type: DatatypeProperty
comment: (STIX: created)
domain: STIX Core Object
range: dateTime
definition: Timestamp when this object was created.

createdByRef
type: ObjectProperty
comment: (STIX: created_by_ref)
domain: STIX Core Object
range: Identity
definition: Reference to the Identity SDO that created this STIX object.

createdTime
type: DatatypeProperty
comment: (STIX: created_time)
domain: Process Object
range: dateTime
definition: Timestamp when the process was created.

creatorUserRef
type: ObjectProperty
comment: (STIX: creator_user_ref)
range: User Account Object
definition: Reference to the user-account SCO of the user who created this process or registry key.

credential
type: DatatypeProperty
comment: (STIX: credential)
domain: User Account Object
range: string
definition: Clear-text credential associated with this account. Handle with care.

credentialLastChanged
type: DatatypeProperty
comment: (STIX: credential_last_changed)
domain: User Account Object
range: dateTime
definition: Timestamp when the account credentials were last changed.

crlDistributionPoints
type: DatatypeProperty
comment: (STIX: x509-v3-extensions-type.crl_distribution_points)
domain: X.509 v3 Extensions
range: string
definition: X.509 v3 CRL distribution points extension.

ctime
type: DatatypeProperty
comment: (STIX: ctime)
range: dateTime
definition: Creation timestamp of a file system object.

cwd
type: DatatypeProperty
comment: (STIX: cwd)
domain: Process Object
range: string
definition: Current working directory of the process.

data
type: DatatypeProperty
comment: (STIX: data)
domain: Windows Registry Value
range: string
definition: Data stored in this Windows registry value.

dataType
type: ObjectProperty
comment: (STIX: data_type)
domain: Windows Registry Value
range: WindowsRegistryDatatypeEnumeration
definition: Data type of this Windows registry value (windows-registry-datatype-enum): REG_NONE, REG_SZ, REG_EXPAND_SZ, REG_BINARY, REG_DWORD, etc.

date
type: DatatypeProperty
comment: (STIX: date)
domain: Email Message Object
range: dateTime
definition: Date and time the email was sent as recorded in the Date header.

decryptionKey
type: DatatypeProperty
comment: (STIX: decryption_key)
domain: Artifact Object
range: string
definition: Decryption key for this artifact when it is encrypted.

defanged
type: DatatypeProperty
comment: (STIX: defanged)
domain: STIX Cyber Observable Object
range: boolean
definition: If true, the observable has been defanged, e.g. '198[.]51[.]100[.]0' in place of '198.51.100.0'.

definitionType
type: DatatypeProperty
comment: (STIX: definition_type)
domain: Marking Definition Object
range: string
definition: Type of marking definition: 'tlp' or 'statement'.

depEnabled
type: DatatypeProperty
comment: (STIX: windows-process-ext.dep_enabled)
range: boolean
definition: True if Data Execution Prevention (DEP) is enabled for this process.

description
type: DatatypeProperty
comment: (STIX: description)
range: string
definition: Human-readable description providing additional detail.

descriptions
type: DatatypeProperty
comment: (STIX: windows-service-ext.descriptions)
range: string
definition: Description strings for a Windows service. Multiple values as multiple triples.

displayName
type: DatatypeProperty
comment: (STIX: display_name)
range: string
definition: Human-readable display name (email-addr, user-account, windows-service-ext).

dstByteCount
type: DatatypeProperty
comment: (STIX: dst_byte_count)
domain: Network Traffic Object
range: integer
definition: Total bytes sent from destination to source.

dstFlagsHex
type: DatatypeProperty
comment: (STIX: tcp-ext.dst_flags_hex)
range: hexBinary
definition: TCP flags set on packets from the destination endpoint as hex.

dstPackets
type: DatatypeProperty
comment: (STIX: dst_packets)
domain: Network Traffic Object
range: integer
definition: Number of packets sent from destination to source.

dstPayloadRef
type: ObjectProperty
comment: (STIX: dst_payload_ref)
domain: Network Traffic Object
range: Artifact Object
definition: Reference to the artifact SCO containing the destination-to-source payload bytes.

dstPort
type: DatatypeProperty
comment: (STIX: dst_port)
domain: Network Traffic Object
range: integer
definition: Destination port number (0–65535).

dstRef
type: ObjectProperty
comment: (STIX: dst_ref)
domain: Network Traffic Object
range: STIX Cyber Observable Object
definition: Reference to the destination address SCO for this network traffic flow.

encapsulatedByRef
type: ObjectProperty
comment: (STIX: encapsulated_by_ref)
domain: Network Traffic Object
range: Network Traffic Object
definition: Reference to the network-traffic SCO that encapsulates (wraps) this flow.

encapsulatesRefs
type: ObjectProperty
comment: (STIX: encapsulates_refs)
domain: Network Traffic Object
range: Network Traffic Object
definition: References to network-traffic SCOs encapsulated within this flow, e.g. inner tunnelled protocols.

encryptionAlgorithm
type: ObjectProperty
comment: (STIX: encryption_algorithm)
domain: Artifact Object
range: EncryptionAlgorithmEnumeration
definition: Encryption algorithm applied to this artifact (encryption-algorithm-enum). Required when decryptionKey is present.

end
type: DatatypeProperty
comment: (STIX: end)
domain: Network Traffic Object
range: dateTime
definition: Timestamp when this network traffic flow ended.

entropy
type: DatatypeProperty
comment: (STIX: windows-pe-section-type.entropy)
domain: Windows PE Section
range: float
definition: Calculated entropy of this PE section.

explanation
type: DatatypeProperty
comment: (STIX: explanation)
domain: Opinion
range: string
definition: Explanation of why this opinion was formed.

extendedKeyUsage
type: DatatypeProperty
comment: (STIX: x509-v3-extensions-type.extended_key_usage)
domain: X.509 v3 Extensions
range: string
definition: X.509 v3 extended key usage extension value.

extensionProperties
type: DatatypeProperty
comment: (STIX: extension_properties)
domain: Extension Definition Object
range: string
definition: Names of new top-level properties introduced by a toplevel-property-extension. Multiple values as multiple triples.

extensionTypes
type: ObjectProperty
comment: (STIX: extension_types)
domain: Extension Definition Object
range: ExtensionTypesEnumeration
definition: How this extension definition is used (extension-types-enum): new-sdo, new-sco, new-sro, property-extension, toplevel-property-extension. Multiple values as multiple triples.

externalId
type: DatatypeProperty
comment: (STIX: external_id)
domain: External Reference
range: string
definition: Identifier in the external system, e.g. 'T1059', 'CVE-2021-44228'.

externalReferences
type: ObjectProperty
comment: (STIX: external_references)
domain: STIX Core Object
range: External Reference
definition: References to non-STIX information sources such as CVEs, ATT&CK techniques, or URLs.

fileHeaderHashes
type: ObjectProperty
comment: (STIX: file_header_hashes)
range: Hash Entry
definition: Hashes of the PE file header, expressed as HashEntry individuals.

firstObserved
type: DatatypeProperty
comment: (STIX: first_observed)
domain: Observed Data
range: dateTime
definition: Earliest timestamp at which this observation occurred.

firstSeen
type: DatatypeProperty
comment: (STIX: first_seen)
range: dateTime
definition: Timestamp when this object was first observed or seen.

fromRef
type: ObjectProperty
comment: (STIX: from_ref)
domain: Email Message Object
range: Email Address Object
definition: Reference to the email-addr SCO in the From: header.

gid
type: DatatypeProperty
comment: (STIX: unix-account-ext.gid)
domain: User Account Object
range: integer
definition: Primary numeric UNIX group ID (GID).

goals
type: DatatypeProperty
comment: (STIX: goals)
range: string
definition: High-level goals of this intrusion set or threat actor, e.g. 'financial gain'. Multiple values are expressed as multiple triples.

granularMarkings
type: ObjectProperty
comment: (STIX: granular_markings)
domain: STIX Core Object
range: Granular Marking
definition: Property-level data-handling markings targeting specific fields of this object.

groupName
type: DatatypeProperty
comment: (STIX: windows-service-ext.group_name)
range: string
definition: Load ordering group for this Windows service.

groups
type: DatatypeProperty
comment: (STIX: unix-account-ext.groups)
domain: User Account Object
range: string
definition: Names of UNIX groups this account belongs to. Multiple values as multiple triples.

hashValue
type: DatatypeProperty
comment: (STIX: hashes dictionary value)
domain: Hash Entry
range: string
definition: Hex-encoded hash digest value.

hashes
type: ObjectProperty
comment: (STIX: hashes)
range: Hash Entry
definition: Cryptographic hashes of an artifact, file, certificate, or other content, expressed as a set of HashEntry individuals.

homeDir
type: DatatypeProperty
comment: (STIX: unix-account-ext.home_dir)
domain: User Account Object
range: string
definition: Home directory path for this UNIX account.

hostVmRef
type: ObjectProperty
comment: (STIX: host_vm_ref)
domain: Malware Analysis
range: Software Object
definition: Reference to the software SCO describing the virtual machine used for analysis.

icmpCodeHex
type: DatatypeProperty
comment: (STIX: icmp-ext.icmp_code_hex)
range: hexBinary
definition: ICMP code field as a hex value.

icmpTypeHex
type: DatatypeProperty
comment: (STIX: icmp-ext.icmp_type_hex)
range: hexBinary
definition: ICMP type field as a hex value.

identityClass
type: ObjectProperty
comment: (STIX: identity_class)
domain: Identity
range: IdentityClassVocabulary
definition: Type of entity represented by this identity (identity-class-ov): individual, group, system, organization, class, unknown.

imageHeight
type: DatatypeProperty
comment: (STIX: raster-image-ext.image_height)
range: integer
definition: Image height in pixels.

imageRef
type: ObjectProperty
comment: (STIX: image_ref)
domain: Process Object
range: File Object
definition: Reference to the file SCO of the executable image that was launched to create this process.

imageWidth
type: DatatypeProperty
comment: (STIX: raster-image-ext.image_width)
range: integer
definition: Image width in pixels.

imphash
type: DatatypeProperty
comment: (STIX: imphash)
range: string
definition: Import hash (imphash) of the PE binary.

implementationLanguages
type: ObjectProperty
comment: (STIX: implementation_languages)
domain: Malware
range: ImplementationLanguageVocabulary
definition: Programming languages used to implement this malware (implementation-language-ov). Multiple values as multiple triples.

indicatorTypes
type: ObjectProperty
comment: (STIX: indicator_types)
domain: Indicator
range: IndicatorTypeVocabulary
definition: Categories of this indicator (indicator-type-ov): anomalous-activity, anonymization, benign, compromised, malicious-activity, attribution, unknown.

infrastructureTypes
type: ObjectProperty
comment: (STIX: infrastructure_types)
domain: Infrastructure
range: InfrastuctureTypeVocabulary
definition: Functional categories of this infrastructure (infrastructure-type-ov).

inhibitAnyPolicy
type: DatatypeProperty
comment: (STIX: x509-v3-extensions-type.inhibit_any_policy)
domain: X.509 v3 Extensions
range: string
definition: X.509 v3 inhibit any policy extension.

installedSoftwareRefs
type: ObjectProperty
comment: (STIX: installed_software_refs)
domain: Malware Analysis
range: Software Object
definition: References to software SCOs installed in the analysis environment.

integrityLevel
type: ObjectProperty
comment: (STIX: integrity_level)
range: WindowsIntegrityLevelEnumeration
definition: Windows integrity level of this process (windows-integrity-level-enum): low, medium, high, system.

isActive
type: DatatypeProperty
comment: (STIX: is_active)
domain: Network Traffic Object
range: boolean
definition: True if this network traffic flow was still active when it was observed.

isBlocking
type: DatatypeProperty
comment: (STIX: socket-ext.is_blocking)
range: boolean
definition: True if this socket is in blocking mode.

isDisabled
type: DatatypeProperty
comment: (STIX: is_disabled)
domain: User Account Object
range: boolean
definition: True if this account is currently disabled.

isFamily
type: DatatypeProperty
comment: (STIX: is_family)
domain: Malware
range: boolean
definition: True if this represents a malware family; false for a specific instance or sample.

isHidden
type: DatatypeProperty
comment: (STIX: is_hidden)
domain: Process Object
range: boolean
definition: If true, this process is hidden from normal process enumeration.

isListening
type: DatatypeProperty
comment: (STIX: socket-ext.is_listening)
range: boolean
definition: True if this socket is in a listening state.

isMultipart
type: DatatypeProperty
comment: (STIX: is_multipart)
domain: Email Message Object
range: boolean
definition: True if this email uses multipart MIME (bodyMultipart is populated); false if body contains the single plain-text body.

isOptimized
type: DatatypeProperty
comment: (STIX: pdf-ext.is_optimized)
range: boolean
definition: True if the PDF is linearized (optimised for fast web viewing).

isPrivileged
type: DatatypeProperty
comment: (STIX: is_privileged)
domain: User Account Object
range: boolean
definition: True if this account has elevated privileges.

isSelfSigned
type: DatatypeProperty
comment: (STIX: is_self_signed)
domain: X.509 Certificate Object
range: boolean
definition: True if this certificate is self-signed.

isServiceAccount
type: DatatypeProperty
comment: (STIX: is_service_account)
domain: User Account Object
range: boolean
definition: True if this is a service or system account rather than a user account.

issuer
type: DatatypeProperty
comment: (STIX: issuer)
domain: X.509 Certificate Object
range: string
definition: Distinguished Name of the certificate issuer.

issuerAlternativeName
type: DatatypeProperty
comment: (STIX: x509-v3-extensions-type.issuer_alternative_name)
domain: X.509 v3 Extensions
range: string
definition: X.509 v3 issuer alternative name extension.

key
type: DatatypeProperty
comment: (STIX: key)
domain: Windows Registry Key Object
range: string
definition: Full Windows Registry key path, e.g. 'HKEY_LOCAL_MACHINE\Software\...'.

keyUsage
type: DatatypeProperty
comment: (STIX: x509-v3-extensions-type.key_usage)
domain: X.509 v3 Extensions
range: string
definition: X.509 v3 key usage extension value.

killChainName
type: DatatypeProperty
comment: (STIX: kill_chain_name)
domain: Kill Chain Phase
range: string
definition: Name of the kill chain framework, e.g. 'mitre-attack', 'lockheed-martin-cyber-kill-chain'.

killChainPhases
type: ObjectProperty
comment: (STIX: kill_chain_phases)
range: Kill Chain Phase
definition: Kill chain phase(s) associated with this attack-pattern, indicator, infrastructure, malware, or tool.

labels
type: DatatypeProperty
comment: (STIX: labels)
domain: STIX Object
range: string
definition: Free-form string terms applying to this object. Multiple labels are expressed as multiple triples.

lang
type: DatatypeProperty
comment: (STIX: lang)
range: string
definition: BCP 47 language tag for the human-readable content of this object, e.g. 'en', 'fr'. Also used in GranularMarking.

languages
type: DatatypeProperty
comment: (STIX: languages)
domain: Software Object
range: string
definition: BCP 47 language tags for languages supported by this software. Multiple values as multiple triples.

lastObserved
type: DatatypeProperty
comment: (STIX: last_observed)
domain: Observed Data
range: dateTime
definition: Latest timestamp at which this observation occurred. MUST be >= firstObserved.

lastSeen
type: DatatypeProperty
comment: (STIX: last_seen)
range: dateTime
definition: Timestamp when this object was last observed or seen. MUST be >= firstSeen.

latitude
type: DatatypeProperty
comment: (STIX: latitude)
domain: Location
range: float
definition: Latitude in decimal degrees, range -90 to 90. Required when longitude is present.

longitude
type: DatatypeProperty
comment: (STIX: longitude)
domain: Location
range: float
definition: Longitude in decimal degrees, range -180 to 180. Required when latitude is present.

machineHex
type: DatatypeProperty
comment: (STIX: machine_hex)
range: hexBinary
definition: Machine type from the COFF header as a hex value.

magicNumberHex
type: DatatypeProperty
comment: (STIX: magic_number_hex)
domain: File Object
range: hexBinary
definition: Magic bytes (file signature) as a hex string.

malwareTypes
type: ObjectProperty
comment: (STIX: malware_types)
domain: Malware
range: MalwareTypeVocabulary
definition: Functional categories of this malware (malware-type-ov). Multiple values as multiple triples.

markingRef
type: ObjectProperty
comment: (STIX: granular-marking.marking_ref)
domain: Granular Marking
range: Marking Definition Object
definition: Reference to the MarkingDefinition applied by this granular marking entry.

messageBodyLength
type: DatatypeProperty
comment: (STIX: http-request-ext.message_body_length)
range: integer
definition: Length of the HTTP message body in bytes.

messageBodyRef
type: ObjectProperty
comment: (STIX: http-request-ext.message_body_ref)
range: Artifact Object
definition: Reference to the artifact SCO containing the HTTP message body.

messageId
type: DatatypeProperty
comment: (STIX: message_id)
domain: Email Message Object
range: string
definition: Value of the Message-ID header.

mimeType
type: DatatypeProperty
comment: (STIX: mime_type)
range: string
definition: IANA MIME type of the content (artifact, file).

modified
type: DatatypeProperty
comment: (STIX: modified)
domain: STIX Core Object
range: dateTime
definition: Timestamp when this object was last modified. MUST be >= created.

modifiedTime
type: DatatypeProperty
comment: (STIX: modified_time)
domain: Windows Registry Key Object
range: dateTime
definition: Last modification timestamp of this registry key.

modules
type: DatatypeProperty
comment: (STIX: modules)
domain: Malware Analysis
range: string
definition: Names of analysis modules or plugins used. Multiple values as multiple triples.

mtime
type: DatatypeProperty
comment: (STIX: mtime)
range: dateTime
definition: Last-modified timestamp of a file system object.

name
type: DatatypeProperty
comment: (STIX: name)
range: string
definition: Human-readable name. Used across SDOs, SCOs, and sub-objects.

nameConstraints
type: DatatypeProperty
comment: (STIX: x509-v3-extensions-type.name_constraints)
domain: X.509 v3 Extensions
range: string
definition: X.509 v3 name constraints extension value.

nameEnc
type: DatatypeProperty
comment: (STIX: name_enc)
domain: File Object
range: string
definition: Character encoding of the file name when non-ASCII characters are present.

number
type: DatatypeProperty
comment: (STIX: number)
domain: Autonomous System Object
range: integer
definition: Autonomous System number (ASN).

numberObserved
type: DatatypeProperty
comment: (STIX: number_observed)
domain: Observed Data
range: integer
definition: Number of times the observation occurred. MUST be >= 1.

numberOfSections
type: DatatypeProperty
comment: (STIX: number_of_sections)
range: integer
definition: Number of sections in the PE binary.

numberOfSubkeys
type: DatatypeProperty
comment: (STIX: number_of_subkeys)
domain: Windows Registry Key Object
range: integer
definition: Number of subkeys under this registry key.

numberOfSymbols
type: DatatypeProperty
comment: (STIX: number_of_symbols)
range: integer
definition: Number of entries in the COFF symbol table.

objectMarkingRefs
type: ObjectProperty
comment: (STIX: object_marking_refs)
domain: STIX Core Object
range: Marking Definition Object
definition: References to MarkingDefinition objects that apply data-handling markings to this entire object.

objectModified
type: DatatypeProperty
comment: (STIX: object_modified)
domain: Language Content Object
range: dateTime
definition: The modified timestamp of the STIX object being translated. Used to pin a translation to a specific version.

objectRef
type: ObjectProperty
comment: (STIX: object_ref)
domain: Language Content Object
range: STIX Object
definition: Reference to the STIX object whose string properties are being translated by this language-content object.

objectRefs
type: ObjectProperty
comment: (STIX: object_refs)
range: STIX Object
definition: References to STIX objects included in or annotated by this grouping, report, note, opinion, or observed-data. For observed-data the referenced objects MUST be SCOs.

objective
type: DatatypeProperty
comment: (STIX: objective)
domain: Campaign
range: string
definition: Primary goal or objective of the campaign.

objects
type: ObjectProperty
comment: (STIX: objects)
domain: STIX Bundle
range: STIX Object
definition: STIX objects (SDOs, SCOs, SROs, meta-objects) carried in this bundle.

observedDataRefs
type: ObjectProperty
comment: (STIX: observed_data_refs)
domain: Sighting
range: Observed Data
definition: References to ObservedData SDOs that provide evidence supporting this sighting.

openedConnectionRefs
type: ObjectProperty
comment: (STIX: opened_connection_refs)
domain: Process Object
range: Network Traffic Object
definition: References to network-traffic SCOs representing connections this process has opened.

operatingSystemRef
type: ObjectProperty
comment: (STIX: operating_system_ref)
domain: Malware Analysis
range: Software Object
definition: Reference to the software SCO describing the operating system used for analysis.

operatingSystemRefs
type: ObjectProperty
comment: (STIX: operating_system_refs)
domain: Malware
range: Software Object
definition: References to software SCOs describing the operating systems this malware targets or runs on.

opinion
type: ObjectProperty
comment: (STIX: opinion)
domain: Opinion
range: OpinionEnumeration
definition: Level of agreement expressed by this opinion (opinion-enum): strongly-disagree, disagree, neutral, agree, strongly-agree.

parentDirectoryRef
type: ObjectProperty
comment: (STIX: parent_directory_ref)
domain: File Object
range: Directory Object
definition: Reference to the directory SCO that contains this file.

parentRef
type: ObjectProperty
comment: (STIX: parent_ref)
domain: Process Object
range: Process Object
definition: Reference to the parent process SCO of this process.

path
type: DatatypeProperty
comment: (STIX: path)
range: string
definition: Absolute file system path (directory, file).

pathEnc
type: DatatypeProperty
comment: (STIX: path_enc)
range: string
definition: Character encoding used for the path property when the path contains non-ASCII characters.

pattern
type: DatatypeProperty
comment: (STIX: pattern)
domain: Indicator
range: string
definition: Detection pattern expression, e.g. a STIX patterning language expression.

patternType
type: ObjectProperty
comment: (STIX: pattern_type)
domain: Indicator
range: PatternTypeVocabulary
definition: Pattern language used by this indicator (pattern-type-ov): stix, pcre, sigma, snort, suricata, yara.

patternVersion
type: DatatypeProperty
comment: (STIX: pattern_version)
domain: Indicator
range: string
definition: Version of the pattern language, e.g. the STIX patterning language version.

payloadBin
type: DatatypeProperty
comment: (STIX: payload_bin)
domain: Artifact Object
range: base64Binary
definition: Artifact byte content encoded as base64. Mutually exclusive with url.

pdfid0
type: DatatypeProperty
comment: (STIX: pdf-ext.pdfid0)
range: string
definition: First PDF file identifier string from the PDF trailer.

pdfid1
type: DatatypeProperty
comment: (STIX: pdf-ext.pdfid1)
range: string
definition: Second PDF file identifier string from the PDF trailer.

peType
type: ObjectProperty
comment: (STIX: pe_type)
range: WindowsPEBinaryVocabulary
definition: PE binary subtype (windows-pebinary-type-ov): exe, dll, or sys.

personalMotivations
type: ObjectProperty
comment: (STIX: personal_motivations)
domain: Threat Actor
range: AttackMotivationVocabulary
definition: Personal motivations of this threat actor, distinct from organisational motivations (attack-motivation-ov). Multiple values as multiple triples.

phaseName
type: DatatypeProperty
comment: (STIX: phase_name)
domain: Kill Chain Phase
range: string
definition: Phase within the kill chain, e.g. 'execution', 'persistence', 'lateral-movement'.

pid
type: DatatypeProperty
comment: (STIX: pid)
domain: Process Object
range: integer
definition: Process ID (PID).

pointerToSymbolTableHex
type: DatatypeProperty
comment: (STIX: pointer_to_symbol_table_hex)
range: hexBinary
definition: File offset of the COFF symbol table as hex.

policyConstraints
type: DatatypeProperty
comment: (STIX: x509-v3-extensions-type.policy_constraints)
domain: X.509 v3 Extensions
range: string
definition: X.509 v3 policy constraints extension value.

policyMappings
type: DatatypeProperty
comment: (STIX: x509-v3-extensions-type.policy_mappings)
domain: X.509 v3 Extensions
range: string
definition: X.509 v3 policy mappings extension.

postalCode
type: DatatypeProperty
comment: (STIX: postal_code)
domain: Location
range: string
definition: Postal or ZIP code.

precision
type: DatatypeProperty
comment: (STIX: precision)
domain: Location
range: float
definition: Radius of accuracy in metres around the latitude/longitude point.

primaryMotivation
type: ObjectProperty
comment: (STIX: primary_motivation)
range: AttackMotivationVocabulary
definition: Primary motivation driving this intrusion set or threat actor (attack-motivation-ov).

priority
type: DatatypeProperty
comment: (STIX: windows-process-ext.priority)
range: string
definition: Scheduling priority string for this Windows process, e.g. 'HIGH_PRIORITY_CLASS'.

privateKeyUsagePeriodNotAfter
type: DatatypeProperty
comment: (STIX: x509-v3-extensions-type.private_key_usage_period_not_after)
domain: X.509 v3 Extensions
range: dateTime
definition: End of the private key usage period.

privateKeyUsagePeriodNotBefore
type: DatatypeProperty
comment: (STIX: x509-v3-extensions-type.private_key_usage_period_not_before)
domain: X.509 v3 Extensions
range: dateTime
definition: Start of the private key usage period.

product
type: DatatypeProperty
comment: (STIX: product)
domain: Malware Analysis
range: string
definition: Name of the analysis tool used, e.g. 'Cuckoo', 'VirusTotal'.

protocols
type: DatatypeProperty
comment: (STIX: protocols)
domain: Network Traffic Object
range: string
definition: Ordered list of protocols from lowest to highest layer, e.g. 'ipv4', 'tcp', 'http'. Multiple values as multiple triples.

published
type: DatatypeProperty
comment: (STIX: published)
domain: Report
range: dateTime
definition: Date and time this report was published.

rawEmailRef
type: ObjectProperty
comment: (STIX: raw_email_ref)
domain: Email Message Object
range: Artifact Object
definition: Reference to the artifact SCO containing the full raw email bytes.

receivedLines
type: DatatypeProperty
comment: (STIX: received_lines)
domain: Email Message Object
range: string
definition: Received: header values in the order received. Multiple values as multiple triples.

region
type: ObjectProperty
comment: (STIX: region)
domain: Location
range: RegionVocabulary
definition: UN M.49 macro-geographical region (region-ov).

relationshipType
type: DatatypeProperty
comment: (STIX: relationship_type)
domain: Relationship
range: string
definition: Semantic type of this relationship, e.g. 'uses', 'targets', 'indicates'.

reportTypes
type: ObjectProperty
comment: (STIX: report_types)
domain: Report
range: ReportTypeVocabulary
definition: Categories of intelligence covered by this report (report-type-ov). Multiple values as multiple triples.

requestMethod
type: DatatypeProperty
comment: (STIX: http-request-ext.request_method)
range: string
definition: HTTP method, e.g. 'GET', 'POST'.

requestValue
type: DatatypeProperty
comment: (STIX: http-request-ext.request_value)
range: string
definition: HTTP request URI path, e.g. '/index.html?q=1'.

requestVersion
type: DatatypeProperty
comment: (STIX: http-request-ext.request_version)
range: string
definition: HTTP version string, e.g. 'HTTP/1.1'.

resolvesToRefs
type: ObjectProperty
comment: (STIX: resolves_to_refs)
range: STIX Cyber Observable Object
definition: For domain-name: references to ipv4-addr, ipv6-addr, or domain-name SCOs this domain resolves to. For ipv4-addr or ipv6-addr: references to mac-addr SCOs.

resourceLevel
type: ObjectProperty
comment: (STIX: resource_level)
range: AttackResourceLevelVocabulary
definition: Resource level available to this intrusion set or threat actor (attack-resource-level-ov): individual, club, contest, team, organization, government.

result
type: ObjectProperty
comment: (STIX: result)
domain: Malware Analysis
range: MalwareResultVocabulary
definition: Analysis verdict for this malware analysis (malware-result-ov): malicious, suspicious, benign, unknown.

resultName
type: DatatypeProperty
comment: (STIX: result_name)
domain: Malware Analysis
range: string
definition: Classification name from the analysis product.

revoked
type: DatatypeProperty
comment: (STIX: revoked)
domain: STIX Object
range: boolean
definition: If true, this object has been revoked and should no longer be considered accurate.

rir
type: DatatypeProperty
comment: (STIX: rir)
domain: Autonomous System Object
range: string
definition: Regional Internet Registry that assigned this ASN, e.g. 'ARIN', 'RIPE'.

roles
type: DatatypeProperty
comment: (STIX: roles)
domain: Identity
range: string
definition: Free-form roles this identity plays, e.g. 'analyst'. For threat-actor roles see the object property stones:threatActorRoles.

sampleRefs
type: ObjectProperty
comment: (STIX: sample_refs)
domain: Malware
range: STIX Cyber Observable Object
definition: References to file or artifact SCOs that are samples of this malware.

schema
type: DatatypeProperty
comment: (STIX: schema)
domain: Extension Definition Object
range: string
definition: URL pointing to, or the raw content of, the JSON Schema defining this extension.

secondaryMotivations
type: ObjectProperty
comment: (STIX: secondary_motivations)
range: AttackMotivationVocabulary
definition: Additional motivations beyond the primary motivation (attack-motivation-ov). Multiple values as multiple triples.

sections
type: ObjectProperty
comment: (STIX: sections)
range: Windows PE Section
definition: PE section entries for this binary. Each entry is a stones:WindowsPeSection individual.

sectors
type: ObjectProperty
comment: (STIX: sectors)
domain: Identity
range: IndustrySectorVocabulary
definition: Industry sectors this identity operates in (industry-sector-ov). Multiple values as multiple triples.

selectors
type: DatatypeProperty
comment: (STIX: selectors)
domain: Granular Marking
range: string
definition: JSON property path selectors identifying the properties this marking applies to, e.g. 'name', 'description'. Multiple values as multiple triples.

senderRef
type: ObjectProperty
comment: (STIX: sender_ref)
domain: Email Message Object
range: Email Address Object
definition: Reference to the email-addr SCO in the Sender: header.

serialNumber
type: DatatypeProperty
comment: (STIX: serial_number)
domain: X.509 Certificate Object
range: string
definition: Serial number assigned to this certificate by the issuer.

serviceDllRefs
type: ObjectProperty
comment: (STIX: service_dll_refs)
range: File Object
definition: References to file SCOs for DLLs loaded by this Windows service.

serviceName
type: DatatypeProperty
comment: (STIX: windows-service-ext.service_name)
range: string
definition: Windows service name as used in the Service Control Manager.

serviceStatus
type: ObjectProperty
comment: (STIX: service_status)
range: WindowsServiceStatusEnumeration
definition: Current status of this Windows service (windows-service-status-enum): SERVICE_RUNNING, SERVICE_STOPPED, SERVICE_PAUSED, etc.

serviceType
type: ObjectProperty
comment: (STIX: service_type)
range: WindowsServiceTypeEnumeration
definition: Windows service type (windows-service-type-enum): SERVICE_KERNEL_DRIVER, SERVICE_FILE_SYSTEM_DRIVER, SERVICE_WIN32_OWN_PROCESS, SERVICE_WIN32_SHARE_PROCESS.

shell
type: DatatypeProperty
comment: (STIX: unix-account-ext.shell)
domain: User Account Object
range: string
definition: Login shell path for this UNIX account, e.g. '/bin/bash'.

sid
type: DatatypeProperty
comment: (STIX: sid / owner_sid)
range: string
definition: Windows Security Identifier (SID) of the file owner (ntfs-ext) or process owner (windows-process-ext).

sightingOfRef
type: ObjectProperty
comment: (STIX: sighting_of_ref)
domain: Sighting
range: STIX Core Object
definition: Reference to the STIX Core Object that was sighted. Typically an indicator, malware, campaign, threat-actor, intrusion-set, tool, attack-pattern, or infrastructure.

signatureAlgorithm
type: DatatypeProperty
comment: (STIX: signature_algorithm)
domain: X.509 Certificate Object
range: string
definition: Algorithm used to sign this certificate, e.g. 'sha256WithRSAEncryption'.

size
type: DatatypeProperty
comment: (STIX: size)
range: integer
definition: Size in bytes (file, windows-pe-section, alternate-data-stream).

sizeOfOptionalHeader
type: DatatypeProperty
comment: (STIX: size_of_optional_header)
range: integer
definition: Size of the optional PE header in bytes.

socketDescriptor
type: DatatypeProperty
comment: (STIX: socket-ext.socket_descriptor)
range: integer
definition: Platform-specific socket file descriptor number.

socketHandle
type: DatatypeProperty
comment: (STIX: socket-ext.socket_handle)
range: integer
definition: Windows handle value for this socket.

socketType
type: ObjectProperty
comment: (STIX: socket_type)
range: NetworkSocketTypeEnumeration
definition: Type of this socket (network-socket-type-enum): SOCK_STREAM, SOCK_DGRAM, SOCK_RAW, SOCK_RDM, SOCK_SEQPACKET.

sophistication
type: ObjectProperty
comment: (STIX: sophistication)
domain: Threat Actor
range: ThreatActorSophisticationVocabulary
definition: Skill and knowledge level of this threat actor (threat-actor-sophistication-ov): none, minimal, intermediate, advanced, expert, innovator, strategic.

sourceName
type: DatatypeProperty
comment: (STIX: source_name)
domain: External Reference
range: string
definition: Name of the information source, e.g. 'mitre-attack', 'cve', 'capec'.

sourceRef
type: ObjectProperty
comment: (STIX: source_ref)
domain: Relationship
range: STIX Core Object
definition: The STIX Core Object at the source (start) of this relationship.

specVersion
type: DatatypeProperty
comment: (STIX: spec_version)
domain: STIX Object
range: string
definition: STIX specification version. MUST be '2.1'.

srcByteCount
type: DatatypeProperty
comment: (STIX: src_byte_count)
domain: Network Traffic Object
range: integer
definition: Total bytes sent from source to destination.

srcFlagsHex
type: DatatypeProperty
comment: (STIX: tcp-ext.src_flags_hex)
range: hexBinary
definition: TCP flags set on packets from the source endpoint as hex, e.g. '0x02' for SYN.

srcPackets
type: DatatypeProperty
comment: (STIX: src_packets)
domain: Network Traffic Object
range: integer
definition: Number of packets sent from source to destination.

srcPayloadRef
type: ObjectProperty
comment: (STIX: src_payload_ref)
domain: Network Traffic Object
range: Artifact Object
definition: Reference to the artifact SCO containing the source-to-destination payload bytes.

srcPort
type: DatatypeProperty
comment: (STIX: src_port)
domain: Network Traffic Object
range: integer
definition: Source port number (0–65535).

srcRef
type: ObjectProperty
comment: (STIX: src_ref)
domain: Network Traffic Object
range: STIX Cyber Observable Object
definition: Reference to the source address SCO for this network traffic flow (ipv4-addr, ipv6-addr, mac-addr, or domain-name).

start
type: DatatypeProperty
comment: (STIX: start)
domain: Network Traffic Object
range: dateTime
definition: Timestamp when this network traffic flow started.

startTime
type: DatatypeProperty
comment: (STIX: start_time)
domain: Relationship
range: dateTime
definition: Timestamp when this relationship began.

startType
type: ObjectProperty
comment: (STIX: start_type)
range: WindowsServiceStartTypeEnumeration
definition: Service start type (windows-service-start-type-enum): SERVICE_AUTO_START, SERVICE_BOOT_START, SERVICE_DEMAND_START, SERVICE_DISABLED, SERVICE_SYSTEM_ALERT.

statement
type: DatatypeProperty
comment: (STIX: definition.statement)
range: string
definition: Human-readable statement for a statement marking definition, e.g. a copyright notice.

stixId
type: DatatypeProperty
type: FunctionalProperty
comment: (STIX: id)
domain: STIX Object
range: string
definition: The STIX identifier string in the format <type>--<UUIDv4>. The IRI of the individual is the canonical identity; this property retains the string for JSON round-tripping and SPARQL querying.

stixType
type: DatatypeProperty
type: FunctionalProperty
comment: (STIX: type)
domain: STIX Object
range: string
definition: The STIX object type string, e.g. 'attack-pattern'. Semantically redundant with rdf:type but preserved for JSON round-tripping.

stopTime
type: DatatypeProperty
comment: (STIX: stop_time)
domain: Relationship
range: dateTime
definition: Timestamp when this relationship ended. MUST be >= startTime.

streetAddress
type: DatatypeProperty
comment: (STIX: street_address)
domain: Location
range: string
definition: Street address.

subject
type: DatatypeProperty
comment: (STIX: subject)
range: string
definition: Subject line of an email message, or Distinguished Name of the certificate subject.

subjectAlternativeName
type: DatatypeProperty
comment: (STIX: x509-v3-extensions-type.subject_alternative_name)
domain: X.509 v3 Extensions
range: string
definition: X.509 v3 subject alternative name extension.

subjectDirectoryAttributes
type: DatatypeProperty
comment: (STIX: x509-v3-extensions-type.subject_directory_attributes)
domain: X.509 v3 Extensions
range: string
definition: X.509 v3 subject directory attributes extension.

subjectKeyIdentifier
type: DatatypeProperty
comment: (STIX: x509-v3-extensions-type.subject_key_identifier)
domain: X.509 v3 Extensions
range: string
definition: X.509 v3 subject key identifier.

subjectPublicKeyAlgorithm
type: DatatypeProperty
comment: (STIX: subject_public_key_algorithm)
domain: X.509 Certificate Object
range: string
definition: Algorithm of the subject's public key, e.g. 'rsaEncryption'.

subjectPublicKeyExponent
type: DatatypeProperty
comment: (STIX: subject_public_key_exponent)
domain: X.509 Certificate Object
range: integer
definition: RSA public exponent of the subject's public key.

subjectPublicKeyModulus
type: DatatypeProperty
comment: (STIX: subject_public_key_modulus)
domain: X.509 Certificate Object
range: string
definition: RSA modulus of the subject's public key as a hex string.

submitted
type: DatatypeProperty
comment: (STIX: submitted)
domain: Malware Analysis
range: dateTime
definition: Timestamp when the sample was submitted for analysis.

summary
type: DatatypeProperty
comment: (STIX: summary)
domain: Sighting
range: boolean
definition: If true, this sighting aggregates multiple observations rather than recording a single specific event.

swid
type: DatatypeProperty
comment: (STIX: swid)
domain: Software Object
range: string
definition: ISO/IEC 19770-2 SWID tag identifier.

targetRef
type: ObjectProperty
comment: (STIX: target_ref)
domain: Relationship
range: STIX Core Object
definition: The STIX Core Object at the target (end) of this relationship.

threatActorRoles
type: ObjectProperty
comment: (STIX: roles)
domain: Threat Actor
range: ThreatActorRoleVocabulary
definition: Roles this threat actor plays in an attack (threat-actor-role-ov): agent, director, independent, infrastructure-architect, infrastructure-operator, malware-author, sponsor.

threatActorTypes
type: ObjectProperty
comment: (STIX: threat_actor_types)
domain: Threat Actor
range: ThreatActorTypeVocabulary
definition: Categories of this threat actor (threat-actor-type-ov). Multiple values as multiple triples.

timeDateStamp
type: DatatypeProperty
comment: (STIX: time_date_stamp)
range: dateTime
definition: Timestamp recorded in the PE header.

tlp
type: DatatypeProperty
comment: (STIX: definition.tlp)
range: string
definition: TLP level for a TLP marking definition: 'white', 'green', 'amber', or 'red'.

toRefs
type: ObjectProperty
comment: (STIX: to_refs)
domain: Email Message Object
range: Email Address Object
definition: References to email-addr SCOs in the To: header.

toolTypes
type: ObjectProperty
comment: (STIX: tool_types)
domain: Tool
range: ToolTypeVocabulary
definition: Functional categories of this tool (tool-type-ov). Multiple values as multiple triples.

toolVersion
type: DatatypeProperty
comment: (STIX: tool_version)
domain: Tool
range: string
definition: Version string of the tool.

uid
type: DatatypeProperty
comment: (STIX: unix-account-ext.uid)
domain: User Account Object
range: integer
definition: Numeric UNIX user ID (UID).

url
type: DatatypeProperty
comment: (STIX: url)
range: anyURI
definition: URL to a referenced resource (external-reference) or the location of artifact content.

userId
type: DatatypeProperty
comment: (STIX: user_id)
domain: User Account Object
range: string
definition: Identifier of the user account, such as a login name or UID.

validFrom
type: DatatypeProperty
comment: (STIX: valid_from)
domain: Indicator
range: dateTime
definition: Timestamp from which this indicator is considered valid.

validUntil
type: DatatypeProperty
comment: (STIX: valid_until)
domain: Indicator
range: dateTime
definition: Timestamp after which this indicator is no longer valid.

validityNotAfter
type: DatatypeProperty
comment: (STIX: validity_not_after)
domain: X.509 Certificate Object
range: dateTime
definition: End of the certificate validity period.

validityNotBefore
type: DatatypeProperty
comment: (STIX: validity_not_before)
domain: X.509 Certificate Object
range: dateTime
definition: Start of the certificate validity period.

value
type: DatatypeProperty
comment: (STIX: value)
range: string
definition: Primary string value of an observable: the domain name, email address, IP address, MAC address, or URL.

values
type: ObjectProperty
comment: (STIX: values)
domain: Windows Registry Key Object
range: Windows Registry Value
definition: Windows registry value entries under this key. Each entry is a stones:WindowsRegistryValue individual.

vendor
type: DatatypeProperty
comment: (STIX: vendor)
domain: Software Object
range: string
definition: Name of the software vendor.

version
type: DatatypeProperty
comment: (STIX: version)
range: string
definition: Version string. Used for analysis tool version (malware-analysis), schema version (extension-definition), software version, X.509 version, and PDF format version.

whereSightedRefs
type: ObjectProperty
comment: (STIX: where_sighted_refs)
domain: Sighting
range: Identity
definition: References to Identity SDOs representing where or by whom the sighting was recorded.

windowTitle
type: DatatypeProperty
comment: (STIX: windows-process-ext.window_title)
range: string
definition: Title text of the main window of this Windows process.

x509V3Extensions
type: ObjectProperty
comment: (STIX: x509_v3_extensions)
domain: X.509 Certificate Object
range: X.509 v3 Extensions
definition: X.509 v3 extension fields for this certificate.

AES-256-GCM
type: NamedIndividual
type: EncryptionAlgorithmEnumeration
notation: AES-256-GCM

AF APPLETALK
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_APPLETALK

AF BTH
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_BTH

AF INET
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_INET

AF INET6
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_INET6

AF IPX
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_IPX

AF IRDA
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_IRDA

AF NETBIOS
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_NETBIOS

AF UNSPEC
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_UNSPEC

ChaCha20-Poly1305
type: NamedIndividual
type: EncryptionAlgorithmEnumeration
notation: ChaCha20-Poly1305

MD5
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: MD5

MD6
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: MD6

REG BINARY
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_BINARY

REG DWORD
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_DWORD

REG DWORD BIG ENDIAN
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_DWORD_BIG_ENDIAN

REG DWORD LITTLE ENDIAN
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_DWORD_LITTLE_ENDIAN

REG EXPAND SZ
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_EXPAND_SZ

REG FULL RESOURCE DESCRIPTION
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_FULL_RESOURCE_DESCRIPTION

REG INVALID TYPE
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_INVALID_TYPE

REG LINK
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_LINK

REG MULTI SZ
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_MULTI_SZ

REG NONE
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_NONE

REG QWORD
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_QWORD

REG RESOURCE LIST
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_RESOURCE_LIST

REG RESOURCE REQUIREMENTS LIST
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_RESOURCE_REQUIREMENTS_LIST

REG SZ
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_SZ

RIPEMD-160
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: RIPEMD-160

SERVICE AUTO START
type: NamedIndividual
type: WindowsServiceStartTypeEnumeration
notation: SERVICE_AUTO_START

SERVICE BOOT START
type: NamedIndividual
type: WindowsServiceStartTypeEnumeration
notation: SERVICE_BOOT_START

SERVICE CONTINUE PENDING
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_CONTINUE_PENDING

SERVICE DEMAND START
type: NamedIndividual
type: WindowsServiceStartTypeEnumeration
notation: SERVICE_DEMAND_START

SERVICE DISABLED
type: NamedIndividual
type: WindowsServiceStartTypeEnumeration
notation: SERVICE_DISABLED

SERVICE FILE SYSTEM DRIVER
type: NamedIndividual
type: WindowsServiceTypeEnumeration
notation: SERVICE_FILE_SYSTEM_DRIVER

SERVICE KERNEL DRIVER
type: NamedIndividual
type: WindowsServiceTypeEnumeration
notation: SERVICE_KERNEL_DRIVER

SERVICE PAUSED
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_PAUSED

SERVICE PAUSE PENDING
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_PAUSE_PENDING

SERVICE RUNNING
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_RUNNING

SERVICE START PENDING
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_START_PENDING

SERVICE STOPPED
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_STOPPED

SERVICE STOP PENDING
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_STOP_PENDING

SERVICE SYSTEM ALERT
type: NamedIndividual
type: WindowsServiceStartTypeEnumeration
notation: SERVICE_SYSTEM_ALERT

SERVICE WIN32 OWN PROCESS
type: NamedIndividual
type: WindowsServiceTypeEnumeration
notation: SERVICE_WIN32_OWN_PROCESS

SERVICE WIN32 SHARE PROCESS
type: NamedIndividual
type: WindowsServiceTypeEnumeration
notation: SERVICE_WIN32_SHARE_PROCESS

SHA-1
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA-1

SHA-224
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA-224

SHA-256
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA-256

SHA-384
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA-384

SHA-512
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA-512

SHA3-224
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA3-224

SHA3-256
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA3-256

SHA3-384
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA3-384

SHA3-512
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA3-512

SOCK DGRAM
type: NamedIndividual
type: NetworkSocketTypeEnumeration
notation: SOCK_DGRAM

SOCK RAW
type: NamedIndividual
type: NetworkSocketTypeEnumeration
notation: SOCK_RAW

SOCK RDM
type: NamedIndividual
type: NetworkSocketTypeEnumeration
notation: SOCK_RDM

SOCK SEQPACKET
type: NamedIndividual
type: NetworkSocketTypeEnumeration
notation: SOCK_SEQPACKET

SOCK STREAM
type: NamedIndividual
type: NetworkSocketTypeEnumeration
notation: SOCK_STREAM

SSDEEP
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SSDEEP

TLSH
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: TLSH

accesses-remote-machines
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: accesses-remote-machines

accidental
type: NamedIndividual
type: AttackMotivationVocabulary
notation: accidental

activist
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: activist

advanced
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: advanced

adware
type: NamedIndividual
type: MalwareTypeVocabulary
notation: adware

aerospace
type: NamedIndividual
type: IndustrySectorVocabulary
notation: aerospace

africa
type: NamedIndividual
type: RegionVocabulary
notation: africa

agent
type: NamedIndividual
type: ThreatActorRoleVocabulary
notation: agent

agree
type: NamedIndividual
type: OpinionEnumeration
notation: agree

agriculture
type: NamedIndividual
type: IndustrySectorVocabulary
notation: agriculture

alpha
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: alpha

amplification
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: amplification

analysis-of
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: analysis-of

anomalous-activity
type: NamedIndividual
type: IndicatorTypeVocabulary
notation: anomalous-activity

anonymization
type: NamedIndividual
type: IndicatorTypeVocabulary
type: InfrastuctureTypeVocabulary
notation: anonymization

anti-debugging
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: anti-debugging

anti-disassembly
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: anti-disassembly

anti-emulation
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: anti-emulation

anti-memory-forensics
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: anti-memory-forensics

anti-sandbox
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: anti-sandbox

anti-vm
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: anti-vm

applescript
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: applescript

arm
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: arm

asia
type: NamedIndividual
type: RegionVocabulary
notation: asia

attack-pattern
type: NamedIndividual
type: ReportTypeVocabulary
notation: attack-pattern

attributed-to
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: attributed-to

attribution
type: NamedIndividual
type: IndicatorTypeVocabulary
notation: attribution

australia-new-zealand
type: NamedIndividual
type: RegionVocabulary
notation: australia-new-zealand

authored-by
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: authored-by

automotive
type: NamedIndividual
type: IndustrySectorVocabulary
notation: automotive

backdoor
type: NamedIndividual
type: MalwareTypeVocabulary
notation: backdoor

based-on
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: based-on

bash
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: bash

beacons-to
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: beacons-to

benign
type: NamedIndividual
type: IndicatorTypeVocabulary
type: MalwareResultVocabulary
notation: benign

bootkit
type: NamedIndividual
type: MalwareTypeVocabulary
notation: bootkit

bot
type: NamedIndividual
type: MalwareTypeVocabulary
notation: bot

botnet
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: botnet

c
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: c

c-plus-plus
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: c++

c-sharp
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: c#

campaign
type: NamedIndividual
type: ReportTypeVocabulary
notation: campaign

captures-input-peripherals
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: captures-input-peripherals

captures-output-peripherals
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: captures-output-peripherals

captures-system-state-data
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: captures-system-state-data

caribbean
type: NamedIndividual
type: RegionVocabulary
notation: caribbean

central-america
type: NamedIndividual
type: RegionVocabulary
notation: central-america

central-asia
type: NamedIndividual
type: RegionVocabulary
notation: central-asia

characterizes
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: characterizes

chemical
type: NamedIndividual
type: IndustrySectorVocabulary
notation: chemical

class
type: NamedIndividual
type: IdentityClassVocabulary
notation: class

cleans-traces-of-infection
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: cleans-traces-of-infection

club
type: NamedIndividual
type: AttackResourceLevelVocabulary
notation: club

coercion
type: NamedIndividual
type: AttackMotivationVocabulary
notation: coercion

command-and-control
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: command-and-control

commercial
type: NamedIndividual
type: IndustrySectorVocabulary
notation: commercial

commits-fraud
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: commits-fraud

communications
type: NamedIndividual
type: IndustrySectorVocabulary
notation: communications

competitor
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: competitor

compromised
type: NamedIndividual
type: IndicatorTypeVocabulary
notation: compromised

compromises
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: compromises

compromises-data-availability
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: compromises-data-availability

compromises-data-integrity
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: compromises-data-integrity

compromises-system-availability
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: compromises-system-availability

construction
type: NamedIndividual
type: IndustrySectorVocabulary
notation: construction

contest
type: NamedIndividual
type: AttackResourceLevelVocabulary
notation: contest

controls-local-machine
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: controls-local-machine

credential-exploitation
type: NamedIndividual
type: ToolTypeVocabulary
notation: credential-exploitation

crime-syndicate
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: crime-syndicate

criminal
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: criminal

dams
type: NamedIndividual
type: IndustrySectorVocabulary
notation: dams

ddos
type: NamedIndividual
type: MalwareTypeVocabulary
notation: ddos

defense
type: NamedIndividual
type: IndustrySectorVocabulary
notation: defense

degrades-security-software
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: degrades-security-software

degrades-system-updates
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: degrades-system-updates

denial-of-service
type: NamedIndividual
type: ToolTypeVocabulary
notation: denial-of-service

derived-from
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: derived-from

detects
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: detects

determines-c2-server
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: determines-c2-server

director
type: NamedIndividual
type: ThreatActorRoleVocabulary
notation: director

disagree
type: NamedIndividual
type: OpinionEnumeration
notation: disagree

dll
type: NamedIndividual
type: WindowsPEBinaryVocabulary
notation: dll

dominance
type: NamedIndividual
type: AttackMotivationVocabulary
notation: dominance

downloader
type: NamedIndividual
type: MalwareTypeVocabulary
notation: downloader

downloads
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: downloads

dropper
type: NamedIndividual
type: MalwareTypeVocabulary
notation: dropper

drops
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: drops

duplicate-of
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: duplicate-of

dynamic-analysis-of
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: dynamic-analysis-of

eastern-africa
type: NamedIndividual
type: RegionVocabulary
notation: eastern-africa

eastern-asia
type: NamedIndividual
type: RegionVocabulary
notation: eastern-asia

eastern-europe
type: NamedIndividual
type: RegionVocabulary
notation: eastern-europe

education
type: NamedIndividual
type: IndustrySectorVocabulary
notation: education

emails-spam
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: emails-spam

emergency-services
type: NamedIndividual
type: IndustrySectorVocabulary
notation: emergency-services

energy
type: NamedIndividual
type: IndustrySectorVocabulary
notation: energy

engineering
type: NamedIndividual
type: IndustrySectorVocabulary
notation: engineering

entertainment
type: NamedIndividual
type: IndustrySectorVocabulary
notation: entertainment

escalates-privileges
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: escalates-privileges

europe
type: NamedIndividual
type: RegionVocabulary
notation: europe

evades-av
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: evades-av

exe
type: NamedIndividual
type: WindowsPEBinaryVocabulary
notation: exe

exfiltrates-data
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: exfiltrates-data

exfiltrates-to
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: exfiltrates-to

exfiltration
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: exfiltration

expert
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: expert

exploit-kit
type: NamedIndividual
type: MalwareTypeVocabulary
notation: exploit-kit

exploitation
type: NamedIndividual
type: ToolTypeVocabulary
notation: exploitation

exploits
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: exploits

facebook
type: NamedIndividual
type: AccountTypeVocabulary
notation: facebook

financial-services
type: NamedIndividual
type: IndustrySectorVocabulary
notation: financial-services

fingerprints-host
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: fingerprints-host

firewall
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: firewall

go
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: go

government
type: NamedIndividual
type: AttackResourceLevelVocabulary
type: IndustrySectorVocabulary
notation: government

government-local
type: NamedIndividual
type: IndustrySectorVocabulary
notation: government-local

government-national
type: NamedIndividual
type: IndustrySectorVocabulary
notation: government-national

government-public-services
type: NamedIndividual
type: IndustrySectorVocabulary
notation: government-public-services

government-regional
type: NamedIndividual
type: IndustrySectorVocabulary
notation: government-regional

group
type: NamedIndividual
type: IdentityClassVocabulary
notation: group

hacker
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: hacker

healthcare
type: NamedIndividual
type: IndustrySectorVocabulary
notation: healthcare

hides-artifacts
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: hides-artifacts

hides-executing-code
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: hides-executing-code

high
type: NamedIndividual
type: WindowsIntegrityLevelEnumeration
notation: high

hospitality-leisure
type: NamedIndividual
type: IndustrySectorVocabulary
notation: hospitality-leisure

hosting-malware
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: hosting-malware

hosting-target-lists
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: hosting-target-lists

hosts
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: hosts

ia-64
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: ia-64

identity
type: NamedIndividual
type: ReportTypeVocabulary
notation: identity

ideology
type: NamedIndividual
type: AttackMotivationVocabulary
notation: ideology

indicates
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: indicates

indicator
type: NamedIndividual
type: ReportTypeVocabulary
notation: indicator

individual
type: NamedIndividual
type: AttackResourceLevelVocabulary
type: IdentityClassVocabulary
notation: individual

infects-files
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: infects-files

infects-remote-machines
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: infects-remote-machines

information-gathering
type: NamedIndividual
type: ToolTypeVocabulary
notation: information-gathering

infrastructure
type: NamedIndividual
type: IndustrySectorVocabulary
notation: infrastructure

infrastructure-architect
type: NamedIndividual
type: ThreatActorRoleVocabulary
notation: infrastructure-architect

infrastructure-operator
type: NamedIndividual
type: ThreatActorRoleVocabulary
notation: infrastructure-operator

innovator
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: innovator

insider-accidental
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: insider-accidental

insider-disgruntled
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: insider-disgruntled

installs-other-components
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: installs-other-components

insurance
type: NamedIndividual
type: IndustrySectorVocabulary
notation: insurance

intermediate
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: intermediate

intrusion-set
type: NamedIndividual
type: ReportTypeVocabulary
notation: intrusion-set

java
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: java

javascript
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: javascript

keylogger
type: NamedIndividual
type: MalwareTypeVocabulary
notation: keylogger

latin-america-caribbean
type: NamedIndividual
type: RegionVocabulary
notation: latin-america-caribbean

ldap
type: NamedIndividual
type: AccountTypeVocabulary
notation: ldap

located-at
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: located-at

low
type: NamedIndividual
type: WindowsIntegrityLevelEnumeration
notation: low

lua
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: lua

malicious
type: NamedIndividual
type: MalwareResultVocabulary
notation: malicious

malicious-activity
type: NamedIndividual
type: IndicatorTypeVocabulary
notation: malicious-activity

malware
type: NamedIndividual
type: ReportTypeVocabulary
notation: malware

malware-analysis
type: NamedIndividual
type: GroupingContextVocabulary
notation: malware-analysis

malware-author
type: NamedIndividual
type: ThreatActorRoleVocabulary
notation: malware-author

manufacturing
type: NamedIndividual
type: IndustrySectorVocabulary
notation: manufacturing

medium
type: NamedIndividual
type: WindowsIntegrityLevelEnumeration
notation: medium

melanesia
type: NamedIndividual
type: RegionVocabulary
notation: melanesia

micronesia
type: NamedIndividual
type: RegionVocabulary
notation: micronesia

middle-africa
type: NamedIndividual
type: RegionVocabulary
notation: middle-africa

mime-type-indicated
type: NamedIndividual
type: EncryptionAlgorithmEnumeration
notation: mime-type-indicated

minimal
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: minimal

mining
type: NamedIndividual
type: IndustrySectorVocabulary
notation: mining

mips
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: mips

mips-le
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: mips-le

mitigates
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: mitigates

nation-state
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: nation-state

network-capture
type: NamedIndividual
type: ToolTypeVocabulary
notation: network-capture

neutral
type: NamedIndividual
type: OpinionEnumeration
notation: neutral

new-sco
type: NamedIndividual
type: ExtensionTypesEnumeration
notation: new-sco

new-sdo
type: NamedIndividual
type: ExtensionTypesEnumeration
notation: new-sdo

new-sro
type: NamedIndividual
type: ExtensionTypesEnumeration
notation: new-sro

nis
type: NamedIndividual
type: AccountTypeVocabulary
notation: nis

non-profit
type: NamedIndividual
type: IndustrySectorVocabulary
notation: non-profit

none
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: none

northern-africa
type: NamedIndividual
type: RegionVocabulary
notation: northern-africa

northern-america
type: NamedIndividual
type: RegionVocabulary
notation: northern-america

northern-europe
type: NamedIndividual
type: RegionVocabulary
notation: northern-europe

notoriety
type: NamedIndividual
type: AttackMotivationVocabulary
notation: notoriety

nuclear
type: NamedIndividual
type: IndustrySectorVocabulary
notation: nuclear

objective-c
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: objective-c

observed-data
type: NamedIndividual
type: ReportTypeVocabulary
notation: observed-data

oceania
type: NamedIndividual
type: RegionVocabulary
notation: oceania

openid
type: NamedIndividual
type: AccountTypeVocabulary
notation: openid

organization
type: NamedIndividual
type: AttackResourceLevelVocabulary
type: IdentityClassVocabulary
notation: organization

organizational-gain
type: NamedIndividual
type: AttackMotivationVocabulary
notation: organizational-gain

originates-from
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: originates-from

owns
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: owns

pcre
type: NamedIndividual
type: PatternTypeVocabulary
notation: pcre

perl
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: perl

persists-after-system-reboot
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: persists-after-system-reboot

personal-gain
type: NamedIndividual
type: AttackMotivationVocabulary
notation: personal-gain

personal-satisfaction
type: NamedIndividual
type: AttackMotivationVocabulary
notation: personal-satisfaction

pharmaceuticals
type: NamedIndividual
type: IndustrySectorVocabulary
notation: pharmaceuticals

phishing
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: phishing

php
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: php

polynesia
type: NamedIndividual
type: RegionVocabulary
notation: polynesia

powerpc
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: powerpc

powershell
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: powershell

prevents-artifact-access
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: prevents-artifact-access

prevents-artifact-deletion
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: prevents-artifact-deletion

probes-network-environment
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: probes-network-environment

property-extension
type: NamedIndividual
type: ExtensionTypesEnumeration
notation: property-extension

python
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: python

radius
type: NamedIndividual
type: AccountTypeVocabulary
notation: radius

ransomware
type: NamedIndividual
type: MalwareTypeVocabulary
notation: ransomware

reconnaissance
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: reconnaissance

related-to
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: related-to

remediates
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: remediates

remote-access
type: NamedIndividual
type: ToolTypeVocabulary
notation: remote-access

remote-access-trojan
type: NamedIndividual
type: MalwareTypeVocabulary
notation: remote-access-trojan

resource-exploitation
type: NamedIndividual
type: MalwareTypeVocabulary
notation: resource-exploitation

retail
type: NamedIndividual
type: IndustrySectorVocabulary
notation: retail

revenge
type: NamedIndividual
type: AttackMotivationVocabulary
notation: revenge

revoked-by
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: revoked-by

rogue-security-software
type: NamedIndividual
type: MalwareTypeVocabulary
notation: rogue-security-software

rootkit
type: NamedIndividual
type: MalwareTypeVocabulary
notation: rootkit

routers-switches
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: routers-switches

ruby
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: ruby

scala
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: scala

screen-capture
type: NamedIndividual
type: MalwareTypeVocabulary
notation: screen-capture

self-modifies
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: self-modifies

sensationalist
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: sensationalist

sigma
type: NamedIndividual
type: PatternTypeVocabulary
notation: sigma

skype
type: NamedIndividual
type: AccountTypeVocabulary
notation: skype

snort
type: NamedIndividual
type: PatternTypeVocabulary
notation: snort

south-america
type: NamedIndividual
type: RegionVocabulary
notation: south-america

south-eastern-asia
type: NamedIndividual
type: RegionVocabulary
notation: south-eastern-asia

southern-africa
type: NamedIndividual
type: RegionVocabulary
notation: southern-africa

southern-asia
type: NamedIndividual
type: RegionVocabulary
notation: southern-asia

southern-europe
type: NamedIndividual
type: RegionVocabulary
notation: southern-europe

sparc
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: sparc

sponsor
type: NamedIndividual
type: ThreatActorRoleVocabulary
notation: sponsor

spy
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: spy

spyware
type: NamedIndividual
type: MalwareTypeVocabulary
notation: spyware

staging
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: staging

static-analysis-of
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: static-analysis-of

steals-authentication-credentials
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: steals-authentication-credentials

stix
type: NamedIndividual
type: PatternTypeVocabulary
notation: stix

strategic
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: strategic

strongly-agree
type: NamedIndividual
type: OpinionEnumeration
notation: strongly-agree

strongly-disagree
type: NamedIndividual
type: OpinionEnumeration
notation: strongly-disagree

subtechnique-of
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: subtechnique-of

suricata
type: NamedIndividual
type: PatternTypeVocabulary
notation: suricata

suspicious
type: NamedIndividual
type: MalwareResultVocabulary
notation: suspicious

suspicious-activity
type: NamedIndividual
type: GroupingContextVocabulary
notation: suspicious-activity

swift
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: swift

sys
type: NamedIndividual
type: WindowsPEBinaryVocabulary
notation: sys

system
type: NamedIndividual
type: IdentityClassVocabulary
type: WindowsIntegrityLevelEnumeration
notation: system

tacacs
type: NamedIndividual
type: AccountTypeVocabulary
notation: tacacs

targets
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: targets

team
type: NamedIndividual
type: AttackResourceLevelVocabulary
notation: team

technology
type: NamedIndividual
type: IndustrySectorVocabulary
notation: technology

telecommunications
type: NamedIndividual
type: IndustrySectorVocabulary
notation: telecommunications

terrorist
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: terrorist

threat-actor
type: NamedIndividual
type: ReportTypeVocabulary
notation: threat-actor

threat-report
type: NamedIndividual
type: ReportTypeVocabulary
notation: threat-report

tool
type: NamedIndividual
type: ReportTypeVocabulary
notation: tool

toplevel-property-extension
type: NamedIndividual
type: ExtensionTypesEnumeration
notation: toplevel-property-extension

transportation
type: NamedIndividual
type: IndustrySectorVocabulary
notation: transportation

trojan
type: NamedIndividual
type: MalwareTypeVocabulary
notation: trojan

twitter
type: NamedIndividual
type: AccountTypeVocabulary
notation: twitter

typescript
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: typescript

unix
type: NamedIndividual
type: AccountTypeVocabulary
notation: unix

unknown
type: NamedIndividual
type: IdentityClassVocabulary
type: IndicatorTypeVocabulary
type: MalwareResultVocabulary
type: MalwareTypeVocabulary
type: ThreatActorTypeVocabulary
type: ToolTypeVocabulary
notation: unknown

unpredictable
type: NamedIndividual
type: AttackMotivationVocabulary
notation: unpredictable

unspecified
type: NamedIndividual
type: GroupingContextVocabulary
notation: unspecified

uses
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: uses

utilities
type: NamedIndividual
type: IndustrySectorVocabulary
notation: utilities

variant-of
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: variant-of

violates-system-operational-integrity
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: violates-system-operational-integrity

virus
type: NamedIndividual
type: MalwareTypeVocabulary
notation: virus

visual-basic
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: visual-basic

vulnerability
type: NamedIndividual
type: ReportTypeVocabulary
notation: vulnerability

vulnerability-scanning
type: NamedIndividual
type: ToolTypeVocabulary
notation: vulnerability-scanning

water
type: NamedIndividual
type: IndustrySectorVocabulary
notation: water

webshell
type: NamedIndividual
type: MalwareTypeVocabulary
notation: webshell

western-africa
type: NamedIndividual
type: RegionVocabulary
notation: western-africa

western-asia
type: NamedIndividual
type: RegionVocabulary
notation: western-asia

western-europe
type: NamedIndividual
type: RegionVocabulary
notation: western-europe

windows-domain
type: NamedIndividual
type: AccountTypeVocabulary
notation: windows-domain

windows-local
type: NamedIndividual
type: AccountTypeVocabulary
notation: windows-local

wiper
type: NamedIndividual
type: MalwareTypeVocabulary
notation: wiper

workstation
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: workstation

worm
type: NamedIndividual
type: MalwareTypeVocabulary
notation: worm

x86
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: x86

x86-32
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: x86-32

x86-64
type: NamedIndividual
type: ImplementationLanguageVocabulary
type: ProcessorArchitectureVocabulary
notation: x86-64

yara
type: NamedIndividual
type: PatternTypeVocabulary
notation: yara