@prefix : . @prefix owl: . @prefix rdf: . @prefix xml: . @prefix xsd: . @prefix rdfs: . @base . rdf:type owl:Ontology ; owl:versionIRI ; owl:imports , , , ; "Hohimer Intelligence Strategies LLC" ; "An OWL 2 ontology modelling the STIX 2.1 specification. Provides a class hierarchy for all STIX Domain Objects (SDOs), Cyber Observable Objects (SCOs), Relationship Objects (SROs), Meta Objects, and structured sub-types, together with datatype and object properties covering all standard STIX properties."@en ; ; "STONES — STIX ONtology Expression System"@en ; rdfs:label "STONES"@en ; owl:versionInfo "0.1.0" . ################################################################# # Annotation properties ################################################################# ### http://purl.org/dc/terms/license rdf:type owl:AnnotationProperty . ### http://www.w3.org/2004/02/skos/core#altLabel rdf:type owl:AnnotationProperty ; rdfs:comment "The range of skos:altLabel is the class of RDF plain literals."@en , "skos:prefLabel, skos:altLabel and skos:hiddenLabel are pairwise disjoint properties."@en ; rdfs:isDefinedBy ; rdfs:label "alternative label"@en ; "An alternative lexical label for a resource."@en ; "Acronyms, abbreviations, spelling variants, and irregular plural/singular forms may be included among the alternative labels for a concept. Mis-spelled terms are normally included as hidden labels (see skos:hiddenLabel)."@en ; rdfs:subPropertyOf rdfs:label . ### http://www.w3.org/2004/02/skos/core#changeNote rdf:type owl:AnnotationProperty ; rdfs:isDefinedBy ; rdfs:label "change note"@en ; "A note about a modification to a concept."@en ; rdfs:subPropertyOf . ### http://www.w3.org/2004/02/skos/core#definition rdf:type owl:AnnotationProperty ; rdfs:isDefinedBy ; rdfs:label "definition"@en ; "A statement or formal explanation of the meaning of a concept."@en ; rdfs:subPropertyOf . ### http://www.w3.org/2004/02/skos/core#editorialNote rdf:type owl:AnnotationProperty ; rdfs:isDefinedBy ; rdfs:label "editorial note"@en ; "A note for an editor, translator or maintainer of the vocabulary."@en ; rdfs:subPropertyOf . ### http://www.w3.org/2004/02/skos/core#example rdf:type owl:AnnotationProperty ; rdfs:isDefinedBy ; rdfs:label "example"@en ; "An example of the use of a concept."@en ; rdfs:subPropertyOf . ### http://www.w3.org/2004/02/skos/core#hiddenLabel rdf:type owl:AnnotationProperty ; rdfs:comment "The range of skos:hiddenLabel is the class of RDF plain literals."@en , "skos:prefLabel, skos:altLabel and skos:hiddenLabel are pairwise disjoint properties."@en ; rdfs:isDefinedBy ; rdfs:label "hidden label"@en ; "A lexical label for a resource that should be hidden when generating visual displays of the resource, but should still be accessible to free text search operations."@en ; rdfs:subPropertyOf rdfs:label . ### http://www.w3.org/2004/02/skos/core#historyNote rdf:type owl:AnnotationProperty ; rdfs:isDefinedBy ; rdfs:label "history note"@en ; "A note about the past state/use/meaning of a concept."@en ; rdfs:subPropertyOf . ### http://www.w3.org/2004/02/skos/core#note rdf:type owl:AnnotationProperty ; rdfs:isDefinedBy ; rdfs:label "note"@en ; "A general note, for any purpose."@en ; "This property may be used directly, or as a super-property for more specific note types."@en . ### http://www.w3.org/2004/02/skos/core#prefLabel rdf:type owl:AnnotationProperty ; rdfs:comment "A resource has no more than one value of skos:prefLabel per language tag, and no more than one value of skos:prefLabel without language tag."@en , "The range of skos:prefLabel is the class of RDF plain literals."@en , """skos:prefLabel, skos:altLabel and skos:hiddenLabel are pairwise disjoint properties."""@en ; rdfs:isDefinedBy ; rdfs:label "preferred label"@en ; "The preferred lexical label for a resource, in a given language."@en ; rdfs:subPropertyOf rdfs:label . ### http://www.w3.org/2004/02/skos/core#scopeNote rdf:type owl:AnnotationProperty ; rdfs:isDefinedBy ; rdfs:label "scope note"@en ; "A note that helps to clarify the meaning and/or the use of a concept."@en ; rdfs:subPropertyOf . ################################################################# # Object Properties ################################################################# ### http://www.w3.org/2004/02/skos/core#broadMatch rdf:type owl:ObjectProperty ; rdfs:subPropertyOf , ; owl:inverseOf ; rdfs:isDefinedBy ; rdfs:label "has broader match"@en ; "skos:broadMatch is used to state a hierarchical mapping link between two conceptual resources in different concept schemes."@en . ### http://www.w3.org/2004/02/skos/core#broader rdf:type owl:ObjectProperty ; rdfs:subPropertyOf ; rdfs:comment "Broader concepts are typically rendered as parents in a concept hierarchy (tree)."@en ; rdfs:isDefinedBy ; rdfs:label "has broader"@en ; "Relates a concept to a concept that is more general in meaning."@en ; "By convention, skos:broader is only used to assert an immediate (i.e. direct) hierarchical link between two conceptual resources."@en . ### http://www.w3.org/2004/02/skos/core#broaderTransitive rdf:type owl:ObjectProperty ; rdfs:subPropertyOf ; owl:inverseOf ; rdf:type owl:TransitiveProperty ; rdfs:isDefinedBy ; rdfs:label "has broader transitive"@en ; "skos:broaderTransitive is a transitive superproperty of skos:broader." ; "By convention, skos:broaderTransitive is not used to make assertions. Rather, the properties can be used to draw inferences about the transitive closure of the hierarchical relation, which is useful e.g. when implementing a simple query expansion algorithm in a search application."@en . ### http://www.w3.org/2004/02/skos/core#closeMatch rdf:type owl:ObjectProperty ; rdfs:subPropertyOf ; rdf:type owl:SymmetricProperty ; rdfs:isDefinedBy ; rdfs:label "has close match"@en ; "skos:closeMatch is used to link two concepts that are sufficiently similar that they can be used interchangeably in some information retrieval applications. In order to avoid the possibility of \"compound errors\" when combining mappings across more than two concept schemes, skos:closeMatch is not declared to be a transitive property."@en . ### http://www.w3.org/2004/02/skos/core#exactMatch rdf:type owl:ObjectProperty ; rdfs:subPropertyOf ; rdf:type owl:SymmetricProperty , owl:TransitiveProperty ; rdfs:comment "skos:exactMatch is disjoint with each of the properties skos:broadMatch and skos:relatedMatch."@en ; rdfs:isDefinedBy ; rdfs:label "has exact match"@en ; "skos:exactMatch is used to link two concepts, indicating a high degree of confidence that the concepts can be used interchangeably across a wide range of information retrieval applications. skos:exactMatch is a transitive property, and is a sub-property of skos:closeMatch."@en . ### http://www.w3.org/2004/02/skos/core#hasTopConcept rdf:type owl:ObjectProperty ; owl:inverseOf ; rdfs:domain ; rdfs:range ; rdfs:isDefinedBy ; rdfs:label "has top concept"@en ; "Relates, by convention, a concept scheme to a concept which is topmost in the broader/narrower concept hierarchies for that scheme, providing an entry point to these hierarchies."@en . ### http://www.w3.org/2004/02/skos/core#inScheme rdf:type owl:ObjectProperty ; rdfs:range ; rdfs:isDefinedBy ; rdfs:label "is in scheme"@en ; "Relates a resource (for example a concept) to a concept scheme in which it is included."@en ; "A concept may be a member of more than one concept scheme."@en . ### http://www.w3.org/2004/02/skos/core#mappingRelation rdf:type owl:ObjectProperty ; rdfs:subPropertyOf ; rdfs:comment "These concept mapping relations mirror semantic relations, and the data model defined below is similar (with the exception of skos:exactMatch) to the data model defined for semantic relations. A distinct vocabulary is provided for concept mapping relations, to provide a convenient way to differentiate links within a concept scheme from links between concept schemes. However, this pattern of usage is not a formal requirement of the SKOS data model, and relies on informal definitions of best practice."@en ; rdfs:isDefinedBy ; rdfs:label "is in mapping relation with"@en ; "Relates two concepts coming, by convention, from different schemes, and that have comparable meanings"@en . ### http://www.w3.org/2004/02/skos/core#member rdf:type owl:ObjectProperty ; rdfs:domain ; rdfs:range [ rdf:type owl:Class ; owl:unionOf ( ) ] ; rdfs:isDefinedBy ; rdfs:label "has member"@en ; "Relates a collection to one of its members."@en . ### http://www.w3.org/2004/02/skos/core#memberList rdf:type owl:ObjectProperty , owl:FunctionalProperty ; rdfs:domain ; rdfs:range rdf:List ; rdfs:comment """For any resource, every item in the list given as the value of the skos:memberList property is also a value of the skos:member property."""@en ; rdfs:isDefinedBy ; rdfs:label "has member list"@en ; "Relates an ordered collection to the RDF list containing its members."@en . ### http://www.w3.org/2004/02/skos/core#narrowMatch rdf:type owl:ObjectProperty ; rdfs:subPropertyOf , ; rdfs:isDefinedBy ; rdfs:label "has narrower match"@en ; "skos:narrowMatch is used to state a hierarchical mapping link between two conceptual resources in different concept schemes."@en . ### http://www.w3.org/2004/02/skos/core#narrower rdf:type owl:ObjectProperty ; rdfs:subPropertyOf ; owl:inverseOf ; rdfs:comment "Narrower concepts are typically rendered as children in a concept hierarchy (tree)."@en ; rdfs:isDefinedBy ; rdfs:label "has narrower"@en ; "Relates a concept to a concept that is more specific in meaning."@en ; "By convention, skos:broader is only used to assert an immediate (i.e. direct) hierarchical link between two conceptual resources."@en . ### http://www.w3.org/2004/02/skos/core#narrowerTransitive rdf:type owl:ObjectProperty ; rdfs:subPropertyOf ; rdf:type owl:TransitiveProperty ; rdfs:isDefinedBy ; rdfs:label "has narrower transitive"@en ; "skos:narrowerTransitive is a transitive superproperty of skos:narrower." ; "By convention, skos:narrowerTransitive is not used to make assertions. Rather, the properties can be used to draw inferences about the transitive closure of the hierarchical relation, which is useful e.g. when implementing a simple query expansion algorithm in a search application."@en . ### http://www.w3.org/2004/02/skos/core#related rdf:type owl:ObjectProperty ; rdfs:subPropertyOf ; rdf:type owl:SymmetricProperty ; rdfs:comment "skos:related is disjoint with skos:broaderTransitive"@en ; rdfs:isDefinedBy ; rdfs:label "has related"@en ; "Relates a concept to a concept with which there is an associative semantic relationship."@en . ### http://www.w3.org/2004/02/skos/core#relatedMatch rdf:type owl:ObjectProperty ; rdfs:subPropertyOf , ; rdf:type owl:SymmetricProperty ; rdfs:isDefinedBy ; rdfs:label "has related match"@en ; "skos:relatedMatch is used to state an associative mapping link between two conceptual resources in different concept schemes."@en . ### http://www.w3.org/2004/02/skos/core#semanticRelation rdf:type owl:ObjectProperty ; rdfs:domain ; rdfs:range ; rdfs:isDefinedBy ; rdfs:label "is in semantic relation with"@en ; "Links a concept to a concept related by meaning."@en ; "This property should not be used directly, but as a super-property for all properties denoting a relationship of meaning between concepts."@en . ### http://www.w3.org/2004/02/skos/core#topConceptOf rdf:type owl:ObjectProperty ; rdfs:subPropertyOf ; rdfs:domain ; rdfs:range ; rdfs:isDefinedBy ; rdfs:label "is top concept in scheme"@en ; "Relates a concept to the concept scheme that it is a top level concept of."@en . ### https://cyberterrain.org/ns/stones#accountType :accountType rdf:type owl:ObjectProperty ; rdfs:domain :UserAccountObject ; rdfs:range :AccountTypeVocabulary ; rdfs:comment "(STIX: account_type)" ; rdfs:isDefinedBy ; "Type of user account (account-type-ov): facebook, ldap, nis, openid, radius, skype, tacacs, twitter, unix, windows-domain, windows-local." . ### https://cyberterrain.org/ns/stones#addressFamily :addressFamily rdf:type owl:ObjectProperty ; rdfs:range :NetworkSocketAddressFamilyEnumeration ; rdfs:comment "(STIX: address_family)" ; rdfs:isDefinedBy ; "Address family of this socket (network-socket-address-family-enum): AF_UNSPEC, AF_INET, AF_INET6, AF_IPX, AF_APPLETALK, AF_NETBIOS, AF_IRDA, AF_BTH." . ### https://cyberterrain.org/ns/stones#algorithm :algorithm rdf:type owl:ObjectProperty ; rdfs:domain :HashEntry ; rdfs:range :HashingAlgorithmVocabulary ; rdfs:comment "(STIX: hashes dictionary key)" ; rdfs:isDefinedBy ; "The hashing algorithm used for this hash entry (hashing-algorithm-ov)." . ### https://cyberterrain.org/ns/stones#alternateDataStreams :alternateDataStreams rdf:type owl:ObjectProperty ; rdfs:range :AlternateDataStream ; rdfs:comment "(STIX: alternate_data_streams)" ; rdfs:isDefinedBy ; "NTFS Alternate Data Streams present on this file. Each entry is a stones:AlternateDataStream individual." . ### https://cyberterrain.org/ns/stones#analysisScoRefs :analysisScoRefs rdf:type owl:ObjectProperty ; rdfs:domain :MalwareAnalysis ; rdfs:range :StixCyberobservableObject ; rdfs:comment "(STIX: analysis_sco_refs)" ; rdfs:isDefinedBy ; "References to SCOs generated or observed as a result of this analysis." . ### https://cyberterrain.org/ns/stones#architectureExecutionEnvs :architectureExecutionEnvs rdf:type owl:ObjectProperty ; rdfs:domain :Malware ; rdfs:range :ProcessorArchitectureVocabulary ; rdfs:comment "(STIX: architecture_execution_envs)" ; rdfs:isDefinedBy ; "Processor architectures this malware can execute on (processor-architecture-ov). Multiple values as multiple triples." . ### https://cyberterrain.org/ns/stones#bccRefs :bccRefs rdf:type owl:ObjectProperty ; rdfs:domain :EmailMessageObject ; rdfs:range :EmailAddressObject ; rdfs:comment "(STIX: bcc_refs)" ; rdfs:isDefinedBy ; "References to email-addr SCOs in the Bcc: header." . ### https://cyberterrain.org/ns/stones#belongsToRef :belongsToRef rdf:type owl:ObjectProperty ; rdfs:domain :EmailAddressObject ; rdfs:range :UserAccountObject ; rdfs:comment "(STIX: belongs_to_ref)" ; rdfs:isDefinedBy ; "Reference to the user-account SCO that owns this email address." . ### https://cyberterrain.org/ns/stones#belongsToRefs :belongsToRefs rdf:type owl:ObjectProperty ; rdfs:range :AutonomousSystemObject ; rdfs:comment "(STIX: belongs_to_refs)" ; rdfs:isDefinedBy ; "References to autonomous-system SCOs that own this IP address." . ### https://cyberterrain.org/ns/stones#bodyMultipart :bodyMultipart rdf:type owl:ObjectProperty ; rdfs:domain :EmailMessageObject ; rdfs:range :EmailMimePart ; rdfs:comment "(STIX: body_multipart)" ; rdfs:isDefinedBy ; "MIME parts of a multipart email message. Each part is a stones:EmailMimePart individual." . ### https://cyberterrain.org/ns/stones#bodyRawRef :bodyRawRef rdf:type owl:ObjectProperty ; rdfs:domain :EmailMimePart ; rdfs:range :StixCyberobservableObject ; rdfs:comment "(STIX: body_raw_ref)" ; rdfs:isDefinedBy ; "Reference to an artifact or file SCO containing the raw bytes of this MIME part." . ### https://cyberterrain.org/ns/stones#capabilities :capabilities rdf:type owl:ObjectProperty ; rdfs:domain :Malware ; rdfs:range :MalwareCapabilitesVocabulary ; rdfs:comment "(STIX: capabilities)" ; rdfs:isDefinedBy ; "Functional capabilities exhibited by this malware (malware-capabilities-ov). Multiple values as multiple triples." . ### https://cyberterrain.org/ns/stones#ccRefs :ccRefs rdf:type owl:ObjectProperty ; rdfs:domain :EmailMessageObject ; rdfs:range :EmailAddressObject ; rdfs:comment "(STIX: cc_refs)" ; rdfs:isDefinedBy ; "References to email-addr SCOs in the Cc: header." . ### https://cyberterrain.org/ns/stones#childRefs :childRefs rdf:type owl:ObjectProperty ; rdfs:domain :ProcessObject ; rdfs:range :ProcessObject ; rdfs:comment "(STIX: child_refs)" ; rdfs:isDefinedBy ; "References to child process SCOs spawned by this process." . ### https://cyberterrain.org/ns/stones#containsRefs :containsRefs rdf:type owl:ObjectProperty ; rdfs:range :StixCyberobservableObject ; rdfs:comment "(STIX: contains_refs)" ; rdfs:isDefinedBy ; "References to file or directory SCOs contained within this directory or archive." . ### https://cyberterrain.org/ns/stones#contentRef :contentRef rdf:type owl:ObjectProperty ; rdfs:domain :FileObject ; rdfs:range :ArtifactObject ; rdfs:comment "(STIX: content_ref)" ; rdfs:isDefinedBy ; "Reference to the artifact SCO that holds the content of this file." . ### https://cyberterrain.org/ns/stones#context :context rdf:type owl:ObjectProperty ; rdfs:domain :Grouping ; rdfs:range :GroupingContextVocabulary ; rdfs:comment "(STIX: context)" ; rdfs:isDefinedBy ; "Shared context that motivates this grouping (grouping-context-ov)." . ### https://cyberterrain.org/ns/stones#createdByRef :createdByRef rdf:type owl:ObjectProperty ; rdfs:domain :StixCoreObject ; rdfs:range :Identity ; rdfs:comment "(STIX: created_by_ref)" ; rdfs:isDefinedBy ; "Reference to the Identity SDO that created this STIX object." . ### https://cyberterrain.org/ns/stones#creatorUserRef :creatorUserRef rdf:type owl:ObjectProperty ; rdfs:range :UserAccountObject ; rdfs:comment "(STIX: creator_user_ref)" ; rdfs:isDefinedBy ; "Reference to the user-account SCO of the user who created this process or registry key." . ### https://cyberterrain.org/ns/stones#dataType :dataType rdf:type owl:ObjectProperty ; rdfs:domain :WindowsRegistryValue ; rdfs:range :WindowsRegistryDatatypeEnumeration ; rdfs:comment "(STIX: data_type)" ; rdfs:isDefinedBy ; "Data type of this Windows registry value (windows-registry-datatype-enum): REG_NONE, REG_SZ, REG_EXPAND_SZ, REG_BINARY, REG_DWORD, etc." . ### https://cyberterrain.org/ns/stones#dstPayloadRef :dstPayloadRef rdf:type owl:ObjectProperty ; rdfs:domain :NetworkTrafficObject ; rdfs:range :ArtifactObject ; rdfs:comment "(STIX: dst_payload_ref)" ; rdfs:isDefinedBy ; "Reference to the artifact SCO containing the destination-to-source payload bytes." . ### https://cyberterrain.org/ns/stones#dstRef :dstRef rdf:type owl:ObjectProperty ; rdfs:domain :NetworkTrafficObject ; rdfs:range :StixCyberobservableObject ; rdfs:comment "(STIX: dst_ref)" ; rdfs:isDefinedBy ; "Reference to the destination address SCO for this network traffic flow." . ### https://cyberterrain.org/ns/stones#encapsulatedByRef :encapsulatedByRef rdf:type owl:ObjectProperty ; rdfs:domain :NetworkTrafficObject ; rdfs:range :NetworkTrafficObject ; rdfs:comment "(STIX: encapsulated_by_ref)" ; rdfs:isDefinedBy ; "Reference to the network-traffic SCO that encapsulates (wraps) this flow." . ### https://cyberterrain.org/ns/stones#encapsulatesRefs :encapsulatesRefs rdf:type owl:ObjectProperty ; rdfs:domain :NetworkTrafficObject ; rdfs:range :NetworkTrafficObject ; rdfs:comment "(STIX: encapsulates_refs)" ; rdfs:isDefinedBy ; "References to network-traffic SCOs encapsulated within this flow, e.g. inner tunnelled protocols." . ### https://cyberterrain.org/ns/stones#encryptionAlgorithm :encryptionAlgorithm rdf:type owl:ObjectProperty ; rdfs:domain :ArtifactObject ; rdfs:range :EncryptionAlgorithmEnumeration ; rdfs:comment "(STIX: encryption_algorithm)" ; rdfs:isDefinedBy ; "Encryption algorithm applied to this artifact (encryption-algorithm-enum). Required when decryptionKey is present." . ### https://cyberterrain.org/ns/stones#extensionTypes :extensionTypes rdf:type owl:ObjectProperty ; rdfs:domain :ExtensionDefinitionObject ; rdfs:range :ExtensionTypesEnumeration ; rdfs:comment "(STIX: extension_types)" ; rdfs:isDefinedBy ; "How this extension definition is used (extension-types-enum): new-sdo, new-sco, new-sro, property-extension, toplevel-property-extension. Multiple values as multiple triples." . ### https://cyberterrain.org/ns/stones#externalReferences :externalReferences rdf:type owl:ObjectProperty ; rdfs:domain :StixCoreObject ; rdfs:range :ExternalReference ; rdfs:comment "(STIX: external_references)" ; rdfs:isDefinedBy ; "References to non-STIX information sources such as CVEs, ATT&CK techniques, or URLs." . ### https://cyberterrain.org/ns/stones#fileHeaderHashes :fileHeaderHashes rdf:type owl:ObjectProperty ; rdfs:range :HashEntry ; rdfs:comment "(STIX: file_header_hashes)" ; rdfs:isDefinedBy ; "Hashes of the PE file header, expressed as HashEntry individuals." . ### https://cyberterrain.org/ns/stones#fromRef :fromRef rdf:type owl:ObjectProperty ; rdfs:domain :EmailMessageObject ; rdfs:range :EmailAddressObject ; rdfs:comment "(STIX: from_ref)" ; rdfs:isDefinedBy ; "Reference to the email-addr SCO in the From: header." . ### https://cyberterrain.org/ns/stones#granularMarkings :granularMarkings rdf:type owl:ObjectProperty ; rdfs:domain :StixCoreObject ; rdfs:range :GranularMarking ; rdfs:comment "(STIX: granular_markings)" ; rdfs:isDefinedBy ; "Property-level data-handling markings targeting specific fields of this object." . ### https://cyberterrain.org/ns/stones#hashes :hashes rdf:type owl:ObjectProperty ; rdfs:range :HashEntry ; rdfs:comment "(STIX: hashes)" ; rdfs:isDefinedBy ; "Cryptographic hashes of an artifact, file, certificate, or other content, expressed as a set of HashEntry individuals." . ### https://cyberterrain.org/ns/stones#hostVmRef :hostVmRef rdf:type owl:ObjectProperty ; rdfs:domain :MalwareAnalysis ; rdfs:range :SoftwareObject ; rdfs:comment "(STIX: host_vm_ref)" ; rdfs:isDefinedBy ; "Reference to the software SCO describing the virtual machine used for analysis." . ### https://cyberterrain.org/ns/stones#identityClass :identityClass rdf:type owl:ObjectProperty ; rdfs:domain :Identity ; rdfs:range :IdentityClassVocabulary ; rdfs:comment "(STIX: identity_class)" ; rdfs:isDefinedBy ; "Type of entity represented by this identity (identity-class-ov): individual, group, system, organization, class, unknown." . ### https://cyberterrain.org/ns/stones#imageRef :imageRef rdf:type owl:ObjectProperty ; rdfs:domain :ProcessObject ; rdfs:range :FileObject ; rdfs:comment "(STIX: image_ref)" ; rdfs:isDefinedBy ; "Reference to the file SCO of the executable image that was launched to create this process." . ### https://cyberterrain.org/ns/stones#implementationLanguages :implementationLanguages rdf:type owl:ObjectProperty ; rdfs:domain :Malware ; rdfs:range :ImplementationLanguageVocabulary ; rdfs:comment "(STIX: implementation_languages)" ; rdfs:isDefinedBy ; "Programming languages used to implement this malware (implementation-language-ov). Multiple values as multiple triples." . ### https://cyberterrain.org/ns/stones#indicatorTypes :indicatorTypes rdf:type owl:ObjectProperty ; rdfs:domain :Indicator ; rdfs:range :IndicatorTypeVocabulary ; rdfs:comment "(STIX: indicator_types)" ; rdfs:isDefinedBy ; "Categories of this indicator (indicator-type-ov): anomalous-activity, anonymization, benign, compromised, malicious-activity, attribution, unknown." . ### https://cyberterrain.org/ns/stones#infrastructureTypes :infrastructureTypes rdf:type owl:ObjectProperty ; rdfs:domain :Infrastructure ; rdfs:range :InfrastuctureTypeVocabulary ; rdfs:comment "(STIX: infrastructure_types)" ; rdfs:isDefinedBy ; "Functional categories of this infrastructure (infrastructure-type-ov)." . ### https://cyberterrain.org/ns/stones#installedSoftwareRefs :installedSoftwareRefs rdf:type owl:ObjectProperty ; rdfs:domain :MalwareAnalysis ; rdfs:range :SoftwareObject ; rdfs:comment "(STIX: installed_software_refs)" ; rdfs:isDefinedBy ; "References to software SCOs installed in the analysis environment." . ### https://cyberterrain.org/ns/stones#integrityLevel :integrityLevel rdf:type owl:ObjectProperty ; rdfs:range :WindowsIntegrityLevelEnumeration ; rdfs:comment "(STIX: integrity_level)" ; rdfs:isDefinedBy ; "Windows integrity level of this process (windows-integrity-level-enum): low, medium, high, system." . ### https://cyberterrain.org/ns/stones#killChainPhases :killChainPhases rdf:type owl:ObjectProperty ; rdfs:range :KillChainPhase ; rdfs:comment "(STIX: kill_chain_phases)" ; rdfs:isDefinedBy ; "Kill chain phase(s) associated with this attack-pattern, indicator, infrastructure, malware, or tool." . ### https://cyberterrain.org/ns/stones#malwareTypes :malwareTypes rdf:type owl:ObjectProperty ; rdfs:domain :Malware ; rdfs:range :MalwareTypeVocabulary ; rdfs:comment "(STIX: malware_types)" ; rdfs:isDefinedBy ; "Functional categories of this malware (malware-type-ov). Multiple values as multiple triples." . ### https://cyberterrain.org/ns/stones#markingRef :markingRef rdf:type owl:ObjectProperty ; rdfs:domain :GranularMarking ; rdfs:range :MarkingDefinitionObject ; rdfs:comment "(STIX: granular-marking.marking_ref)" ; rdfs:isDefinedBy ; "Reference to the MarkingDefinition applied by this granular marking entry." . ### https://cyberterrain.org/ns/stones#messageBodyRef :messageBodyRef rdf:type owl:ObjectProperty ; rdfs:range :ArtifactObject ; rdfs:comment "(STIX: http-request-ext.message_body_ref)" ; rdfs:isDefinedBy ; "Reference to the artifact SCO containing the HTTP message body." . ### https://cyberterrain.org/ns/stones#objectMarkingRefs :objectMarkingRefs rdf:type owl:ObjectProperty ; rdfs:domain :StixCoreObject ; rdfs:range :MarkingDefinitionObject ; rdfs:comment "(STIX: object_marking_refs)" ; rdfs:isDefinedBy ; "References to MarkingDefinition objects that apply data-handling markings to this entire object." . ### https://cyberterrain.org/ns/stones#objectRef :objectRef rdf:type owl:ObjectProperty ; rdfs:domain :LanguageContentObject ; rdfs:range :StixObject ; rdfs:comment "(STIX: object_ref)" ; rdfs:isDefinedBy ; "Reference to the STIX object whose string properties are being translated by this language-content object." . ### https://cyberterrain.org/ns/stones#objectRefs :objectRefs rdf:type owl:ObjectProperty ; rdfs:range :StixObject ; rdfs:comment "(STIX: object_refs)" ; rdfs:isDefinedBy ; "References to STIX objects included in or annotated by this grouping, report, note, opinion, or observed-data. For observed-data the referenced objects MUST be SCOs." . ### https://cyberterrain.org/ns/stones#objects :objects rdf:type owl:ObjectProperty ; rdfs:domain :StixBundle ; rdfs:range :StixObject ; rdfs:comment "(STIX: objects)" ; rdfs:isDefinedBy ; "STIX objects (SDOs, SCOs, SROs, meta-objects) carried in this bundle." . ### https://cyberterrain.org/ns/stones#observedDataRefs :observedDataRefs rdf:type owl:ObjectProperty ; rdfs:domain :Sighting ; rdfs:range :ObservedData ; rdfs:comment "(STIX: observed_data_refs)" ; rdfs:isDefinedBy ; "References to ObservedData SDOs that provide evidence supporting this sighting." . ### https://cyberterrain.org/ns/stones#openedConnectionRefs :openedConnectionRefs rdf:type owl:ObjectProperty ; rdfs:domain :ProcessObject ; rdfs:range :NetworkTrafficObject ; rdfs:comment "(STIX: opened_connection_refs)" ; rdfs:isDefinedBy ; "References to network-traffic SCOs representing connections this process has opened." . ### https://cyberterrain.org/ns/stones#operatingSystemRef :operatingSystemRef rdf:type owl:ObjectProperty ; rdfs:domain :MalwareAnalysis ; rdfs:range :SoftwareObject ; rdfs:comment "(STIX: operating_system_ref)" ; rdfs:isDefinedBy ; "Reference to the software SCO describing the operating system used for analysis." . ### https://cyberterrain.org/ns/stones#operatingSystemRefs :operatingSystemRefs rdf:type owl:ObjectProperty ; rdfs:domain :Malware ; rdfs:range :SoftwareObject ; rdfs:comment "(STIX: operating_system_refs)" ; rdfs:isDefinedBy ; "References to software SCOs describing the operating systems this malware targets or runs on." . ### https://cyberterrain.org/ns/stones#opinion :opinion rdf:type owl:ObjectProperty ; rdfs:domain :Opinion ; rdfs:range :OpinionEnumeration ; rdfs:comment "(STIX: opinion)" ; rdfs:isDefinedBy ; "Level of agreement expressed by this opinion (opinion-enum): strongly-disagree, disagree, neutral, agree, strongly-agree." . ### https://cyberterrain.org/ns/stones#parentDirectoryRef :parentDirectoryRef rdf:type owl:ObjectProperty ; rdfs:domain :FileObject ; rdfs:range :DirectoryObject ; rdfs:comment "(STIX: parent_directory_ref)" ; rdfs:isDefinedBy ; "Reference to the directory SCO that contains this file." . ### https://cyberterrain.org/ns/stones#parentRef :parentRef rdf:type owl:ObjectProperty ; rdfs:domain :ProcessObject ; rdfs:range :ProcessObject ; rdfs:comment "(STIX: parent_ref)" ; rdfs:isDefinedBy ; "Reference to the parent process SCO of this process." . ### https://cyberterrain.org/ns/stones#patternType :patternType rdf:type owl:ObjectProperty ; rdfs:domain :Indicator ; rdfs:range :PatternTypeVocabulary ; rdfs:comment "(STIX: pattern_type)" ; rdfs:isDefinedBy ; "Pattern language used by this indicator (pattern-type-ov): stix, pcre, sigma, snort, suricata, yara." . ### https://cyberterrain.org/ns/stones#peType :peType rdf:type owl:ObjectProperty ; rdfs:range :WindowsPEBinaryVocabulary ; rdfs:comment "(STIX: pe_type)" ; rdfs:isDefinedBy ; "PE binary subtype (windows-pebinary-type-ov): exe, dll, or sys." . ### https://cyberterrain.org/ns/stones#personalMotivations :personalMotivations rdf:type owl:ObjectProperty ; rdfs:domain :ThreatActor ; rdfs:range :AttackMotivationVocabulary ; rdfs:comment "(STIX: personal_motivations)" ; rdfs:isDefinedBy ; "Personal motivations of this threat actor, distinct from organisational motivations (attack-motivation-ov). Multiple values as multiple triples." . ### https://cyberterrain.org/ns/stones#primaryMotivation :primaryMotivation rdf:type owl:ObjectProperty ; rdfs:range :AttackMotivationVocabulary ; rdfs:comment "(STIX: primary_motivation)" ; rdfs:isDefinedBy ; "Primary motivation driving this intrusion set or threat actor (attack-motivation-ov)." . ### https://cyberterrain.org/ns/stones#rawEmailRef :rawEmailRef rdf:type owl:ObjectProperty ; rdfs:domain :EmailMessageObject ; rdfs:range :ArtifactObject ; rdfs:comment "(STIX: raw_email_ref)" ; rdfs:isDefinedBy ; "Reference to the artifact SCO containing the full raw email bytes." . ### https://cyberterrain.org/ns/stones#region :region rdf:type owl:ObjectProperty ; rdfs:domain :Location ; rdfs:range :RegionVocabulary ; rdfs:comment "(STIX: region)" ; rdfs:isDefinedBy ; "UN M.49 macro-geographical region (region-ov)." . ### https://cyberterrain.org/ns/stones#reportTypes :reportTypes rdf:type owl:ObjectProperty ; rdfs:domain :Report ; rdfs:range :ReportTypeVocabulary ; rdfs:comment "(STIX: report_types)" ; rdfs:isDefinedBy ; "Categories of intelligence covered by this report (report-type-ov). Multiple values as multiple triples." . ### https://cyberterrain.org/ns/stones#resolvesToRefs :resolvesToRefs rdf:type owl:ObjectProperty ; rdfs:range :StixCyberobservableObject ; rdfs:comment "(STIX: resolves_to_refs)" ; rdfs:isDefinedBy ; "For domain-name: references to ipv4-addr, ipv6-addr, or domain-name SCOs this domain resolves to. For ipv4-addr or ipv6-addr: references to mac-addr SCOs." . ### https://cyberterrain.org/ns/stones#resourceLevel :resourceLevel rdf:type owl:ObjectProperty ; rdfs:range :AttackResourceLevelVocabulary ; rdfs:comment "(STIX: resource_level)" ; rdfs:isDefinedBy ; "Resource level available to this intrusion set or threat actor (attack-resource-level-ov): individual, club, contest, team, organization, government." . ### https://cyberterrain.org/ns/stones#result :result rdf:type owl:ObjectProperty ; rdfs:domain :MalwareAnalysis ; rdfs:range :MalwareResultVocabulary ; rdfs:comment "(STIX: result)" ; rdfs:isDefinedBy ; "Analysis verdict for this malware analysis (malware-result-ov): malicious, suspicious, benign, unknown." . ### https://cyberterrain.org/ns/stones#sampleRefs :sampleRefs rdf:type owl:ObjectProperty ; rdfs:domain :Malware ; rdfs:range :StixCyberobservableObject ; rdfs:comment "(STIX: sample_refs)" ; rdfs:isDefinedBy ; "References to file or artifact SCOs that are samples of this malware." . ### https://cyberterrain.org/ns/stones#secondaryMotivations :secondaryMotivations rdf:type owl:ObjectProperty ; rdfs:range :AttackMotivationVocabulary ; rdfs:comment "(STIX: secondary_motivations)" ; rdfs:isDefinedBy ; "Additional motivations beyond the primary motivation (attack-motivation-ov). Multiple values as multiple triples." . ### https://cyberterrain.org/ns/stones#sections :sections rdf:type owl:ObjectProperty ; rdfs:range :WindowsPeSection ; rdfs:comment "(STIX: sections)" ; rdfs:isDefinedBy ; "PE section entries for this binary. Each entry is a stones:WindowsPeSection individual." . ### https://cyberterrain.org/ns/stones#sectors :sectors rdf:type owl:ObjectProperty ; rdfs:domain :Identity ; rdfs:range :IndustrySectorVocabulary ; rdfs:comment "(STIX: sectors)" ; rdfs:isDefinedBy ; "Industry sectors this identity operates in (industry-sector-ov). Multiple values as multiple triples." . ### https://cyberterrain.org/ns/stones#senderRef :senderRef rdf:type owl:ObjectProperty ; rdfs:domain :EmailMessageObject ; rdfs:range :EmailAddressObject ; rdfs:comment "(STIX: sender_ref)" ; rdfs:isDefinedBy ; "Reference to the email-addr SCO in the Sender: header." . ### https://cyberterrain.org/ns/stones#serviceDllRefs :serviceDllRefs rdf:type owl:ObjectProperty ; rdfs:range :FileObject ; rdfs:comment "(STIX: service_dll_refs)" ; rdfs:isDefinedBy ; "References to file SCOs for DLLs loaded by this Windows service." . ### https://cyberterrain.org/ns/stones#serviceStatus :serviceStatus rdf:type owl:ObjectProperty ; rdfs:range :WindowsServiceStatusEnumeration ; rdfs:comment "(STIX: service_status)" ; rdfs:isDefinedBy ; "Current status of this Windows service (windows-service-status-enum): SERVICE_RUNNING, SERVICE_STOPPED, SERVICE_PAUSED, etc." . ### https://cyberterrain.org/ns/stones#serviceType :serviceType rdf:type owl:ObjectProperty ; rdfs:range :WindowsServiceTypeEnumeration ; rdfs:comment "(STIX: service_type)" ; rdfs:isDefinedBy ; "Windows service type (windows-service-type-enum): SERVICE_KERNEL_DRIVER, SERVICE_FILE_SYSTEM_DRIVER, SERVICE_WIN32_OWN_PROCESS, SERVICE_WIN32_SHARE_PROCESS." . ### https://cyberterrain.org/ns/stones#sightingOfRef :sightingOfRef rdf:type owl:ObjectProperty ; rdfs:domain :Sighting ; rdfs:range :StixCoreObject ; rdfs:comment "(STIX: sighting_of_ref)" ; rdfs:isDefinedBy ; "Reference to the STIX Core Object that was sighted. Typically an indicator, malware, campaign, threat-actor, intrusion-set, tool, attack-pattern, or infrastructure." . ### https://cyberterrain.org/ns/stones#socketType :socketType rdf:type owl:ObjectProperty ; rdfs:range :NetworkSocketTypeEnumeration ; rdfs:comment "(STIX: socket_type)" ; rdfs:isDefinedBy ; "Type of this socket (network-socket-type-enum): SOCK_STREAM, SOCK_DGRAM, SOCK_RAW, SOCK_RDM, SOCK_SEQPACKET." . ### https://cyberterrain.org/ns/stones#sophistication :sophistication rdf:type owl:ObjectProperty ; rdfs:domain :ThreatActor ; rdfs:range :ThreatActorSophisticationVocabulary ; rdfs:comment "(STIX: sophistication)" ; rdfs:isDefinedBy ; "Skill and knowledge level of this threat actor (threat-actor-sophistication-ov): none, minimal, intermediate, advanced, expert, innovator, strategic." . ### https://cyberterrain.org/ns/stones#sourceRef :sourceRef rdf:type owl:ObjectProperty ; rdfs:domain :Relationship ; rdfs:range :StixCoreObject ; rdfs:comment "(STIX: source_ref)" ; rdfs:isDefinedBy ; "The STIX Core Object at the source (start) of this relationship." . ### https://cyberterrain.org/ns/stones#srcPayloadRef :srcPayloadRef rdf:type owl:ObjectProperty ; rdfs:domain :NetworkTrafficObject ; rdfs:range :ArtifactObject ; rdfs:comment "(STIX: src_payload_ref)" ; rdfs:isDefinedBy ; "Reference to the artifact SCO containing the source-to-destination payload bytes." . ### https://cyberterrain.org/ns/stones#srcRef :srcRef rdf:type owl:ObjectProperty ; rdfs:domain :NetworkTrafficObject ; rdfs:range :StixCyberobservableObject ; rdfs:comment "(STIX: src_ref)" ; rdfs:isDefinedBy ; "Reference to the source address SCO for this network traffic flow (ipv4-addr, ipv6-addr, mac-addr, or domain-name)." . ### https://cyberterrain.org/ns/stones#startType :startType rdf:type owl:ObjectProperty ; rdfs:range :WindowsServiceStartTypeEnumeration ; rdfs:comment "(STIX: start_type)" ; rdfs:isDefinedBy ; "Service start type (windows-service-start-type-enum): SERVICE_AUTO_START, SERVICE_BOOT_START, SERVICE_DEMAND_START, SERVICE_DISABLED, SERVICE_SYSTEM_ALERT." . ### https://cyberterrain.org/ns/stones#targetRef :targetRef rdf:type owl:ObjectProperty ; rdfs:domain :Relationship ; rdfs:range :StixCoreObject ; rdfs:comment "(STIX: target_ref)" ; rdfs:isDefinedBy ; "The STIX Core Object at the target (end) of this relationship." . ### https://cyberterrain.org/ns/stones#threatActorRoles :threatActorRoles rdf:type owl:ObjectProperty ; rdfs:domain :ThreatActor ; rdfs:range :ThreatActorRoleVocabulary ; rdfs:comment "(STIX: roles)" ; rdfs:isDefinedBy ; "Roles this threat actor plays in an attack (threat-actor-role-ov): agent, director, independent, infrastructure-architect, infrastructure-operator, malware-author, sponsor." . ### https://cyberterrain.org/ns/stones#threatActorTypes :threatActorTypes rdf:type owl:ObjectProperty ; rdfs:domain :ThreatActor ; rdfs:range :ThreatActorTypeVocabulary ; rdfs:comment "(STIX: threat_actor_types)" ; rdfs:isDefinedBy ; "Categories of this threat actor (threat-actor-type-ov). Multiple values as multiple triples." . ### https://cyberterrain.org/ns/stones#toRefs :toRefs rdf:type owl:ObjectProperty ; rdfs:domain :EmailMessageObject ; rdfs:range :EmailAddressObject ; rdfs:comment "(STIX: to_refs)" ; rdfs:isDefinedBy ; "References to email-addr SCOs in the To: header." . ### https://cyberterrain.org/ns/stones#toolTypes :toolTypes rdf:type owl:ObjectProperty ; rdfs:domain :Tool ; rdfs:range :ToolTypeVocabulary ; rdfs:comment "(STIX: tool_types)" ; rdfs:isDefinedBy ; "Functional categories of this tool (tool-type-ov). Multiple values as multiple triples." . ### https://cyberterrain.org/ns/stones#values :values rdf:type owl:ObjectProperty ; rdfs:domain :WindowsRegistryKeyObject ; rdfs:range :WindowsRegistryValue ; rdfs:comment "(STIX: values)" ; rdfs:isDefinedBy ; "Windows registry value entries under this key. Each entry is a stones:WindowsRegistryValue individual." . ### https://cyberterrain.org/ns/stones#whereSightedRefs :whereSightedRefs rdf:type owl:ObjectProperty ; rdfs:domain :Sighting ; rdfs:range :Identity ; rdfs:comment "(STIX: where_sighted_refs)" ; rdfs:isDefinedBy ; "References to Identity SDOs representing where or by whom the sighting was recorded." . ### https://cyberterrain.org/ns/stones#x509V3Extensions :x509V3Extensions rdf:type owl:ObjectProperty ; rdfs:domain :X509CertificateObject ; rdfs:range :X509V3Extensions ; rdfs:comment "(STIX: x509_v3_extensions)" ; rdfs:isDefinedBy ; "X.509 v3 extension fields for this certificate." . ################################################################# # Data properties ################################################################# ### http://www.w3.org/2004/02/skos/core#notation rdf:type owl:DatatypeProperty ; rdfs:isDefinedBy ; rdfs:label "notation"@en ; "A notation, also known as classification code, is a string of characters such as \"T58.5\" or \"303.4833\" used to uniquely identify a concept within the scope of a given concept scheme."@en ; "By convention, skos:notation is used with a typed literal in the object position of the triple."@en . ### https://cyberterrain.org/ns/stones#abstract :abstract rdf:type owl:DatatypeProperty ; rdfs:domain :Note ; rdfs:range xsd:string ; rdfs:comment "(STIX: abstract)" ; rdfs:isDefinedBy ; "Brief summary of the note." . ### https://cyberterrain.org/ns/stones#accountCreated :accountCreated rdf:type owl:DatatypeProperty ; rdfs:domain :UserAccountObject ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: account_created)" ; rdfs:isDefinedBy ; "Timestamp when this account was created." . ### https://cyberterrain.org/ns/stones#accountExpires :accountExpires rdf:type owl:DatatypeProperty ; rdfs:domain :UserAccountObject ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: account_expires)" ; rdfs:isDefinedBy ; "Timestamp when this account expires." . ### https://cyberterrain.org/ns/stones#accountFirstLogin :accountFirstLogin rdf:type owl:DatatypeProperty ; rdfs:domain :UserAccountObject ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: account_first_login)" ; rdfs:isDefinedBy ; "Timestamp of the first login for this account." . ### https://cyberterrain.org/ns/stones#accountLastLogin :accountLastLogin rdf:type owl:DatatypeProperty ; rdfs:domain :UserAccountObject ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: account_last_login)" ; rdfs:isDefinedBy ; "Timestamp of the most recent login for this account." . ### https://cyberterrain.org/ns/stones#accountLogin :accountLogin rdf:type owl:DatatypeProperty ; rdfs:domain :UserAccountObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: account_login)" ; rdfs:isDefinedBy ; "Login name if different from userId." . ### https://cyberterrain.org/ns/stones#administrativeArea :administrativeArea rdf:type owl:DatatypeProperty ; rdfs:domain :Location ; rdfs:range xsd:string ; rdfs:comment "(STIX: administrative_area)" ; rdfs:isDefinedBy ; "State, province, or region within a country." . ### https://cyberterrain.org/ns/stones#aliases :aliases rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: aliases)" ; rdfs:isDefinedBy ; "Alternative names for this object. Multiple aliases are expressed as multiple triples." . ### https://cyberterrain.org/ns/stones#analysisDefinitionVersion :analysisDefinitionVersion rdf:type owl:DatatypeProperty ; rdfs:domain :MalwareAnalysis ; rdfs:range xsd:string ; rdfs:comment "(STIX: analysis_definition_version)" ; rdfs:isDefinedBy ; "Version of the analysis definitions or signatures." . ### https://cyberterrain.org/ns/stones#analysisEnded :analysisEnded rdf:type owl:DatatypeProperty ; rdfs:domain :MalwareAnalysis ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: analysis_ended)" ; rdfs:isDefinedBy ; "Timestamp when analysis concluded." . ### https://cyberterrain.org/ns/stones#analysisEngineVersion :analysisEngineVersion rdf:type owl:DatatypeProperty ; rdfs:domain :MalwareAnalysis ; rdfs:range xsd:string ; rdfs:comment "(STIX: analysis_engine_version)" ; rdfs:isDefinedBy ; "Version of the analysis engine." . ### https://cyberterrain.org/ns/stones#analysisStarted :analysisStarted rdf:type owl:DatatypeProperty ; rdfs:domain :MalwareAnalysis ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: analysis_started)" ; rdfs:isDefinedBy ; "Timestamp when analysis began." . ### https://cyberterrain.org/ns/stones#aslrEnabled :aslrEnabled rdf:type owl:DatatypeProperty ; rdfs:range xsd:boolean ; rdfs:comment "(STIX: windows-process-ext.aslr_enabled)" ; rdfs:isDefinedBy ; "True if Address Space Layout Randomisation (ASLR) is enabled for this process." . ### https://cyberterrain.org/ns/stones#atime :atime rdf:type owl:DatatypeProperty ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: atime)" ; rdfs:isDefinedBy ; "Last-accessed timestamp of a file system object." . ### https://cyberterrain.org/ns/stones#authorityInfoAccess :authorityInfoAccess rdf:type owl:DatatypeProperty ; rdfs:domain :X509V3Extensions ; rdfs:range xsd:string ; rdfs:comment "(STIX: x509-v3-extensions-type.authority_info_access)" ; rdfs:isDefinedBy ; "X.509 v3 authority information access extension." . ### https://cyberterrain.org/ns/stones#authorityKeyIdentifier :authorityKeyIdentifier rdf:type owl:DatatypeProperty ; rdfs:domain :X509V3Extensions ; rdfs:range xsd:string ; rdfs:comment "(STIX: x509-v3-extensions-type.authority_key_identifier)" ; rdfs:isDefinedBy ; "X.509 v3 authority key identifier." . ### https://cyberterrain.org/ns/stones#authors :authors rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: authors)" ; rdfs:isDefinedBy ; "Names of the authors of a note or opinion. Multiple values are expressed as multiple triples." . ### https://cyberterrain.org/ns/stones#avResult :avResult rdf:type owl:DatatypeProperty ; rdfs:domain :MalwareAnalysis ; rdfs:range xsd:string ; rdfs:comment "(STIX: av_result)" ; rdfs:isDefinedBy ; "Raw classification string from an antivirus engine, e.g. 'Trojan.GenericKD'." . ### https://cyberterrain.org/ns/stones#basicConstraints :basicConstraints rdf:type owl:DatatypeProperty ; rdfs:domain :X509V3Extensions ; rdfs:range xsd:string ; rdfs:comment "(STIX: x509-v3-extensions-type.basic_constraints)" ; rdfs:isDefinedBy ; "X.509 v3 basic constraints extension value." . ### https://cyberterrain.org/ns/stones#bitsPerPixel :bitsPerPixel rdf:type owl:DatatypeProperty ; rdfs:range xsd:integer ; rdfs:comment "(STIX: raster-image-ext.bits_per_pixel)" ; rdfs:isDefinedBy ; "Colour depth of the image in bits per pixel." . ### https://cyberterrain.org/ns/stones#body :body rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: body)" ; rdfs:isDefinedBy ; "Plain-text body of an email message or a MIME part." . ### https://cyberterrain.org/ns/stones#canEscalatePrivs :canEscalatePrivs rdf:type owl:DatatypeProperty ; rdfs:domain :UserAccountObject ; rdfs:range xsd:boolean ; rdfs:comment "(STIX: can_escalate_privs)" ; rdfs:isDefinedBy ; "True if this account can escalate its own privileges." . ### https://cyberterrain.org/ns/stones#certificatePolicies :certificatePolicies rdf:type owl:DatatypeProperty ; rdfs:domain :X509V3Extensions ; rdfs:range xsd:string ; rdfs:comment "(STIX: x509-v3-extensions-type.certificate_policies)" ; rdfs:isDefinedBy ; "X.509 v3 certificate policies extension." . ### https://cyberterrain.org/ns/stones#characteristicsHex :characteristicsHex rdf:type owl:DatatypeProperty ; rdfs:range xsd:hexBinary ; rdfs:comment "(STIX: characteristics_hex)" ; rdfs:isDefinedBy ; "Characteristics flags from the PE COFF header as hex." . ### https://cyberterrain.org/ns/stones#city :city rdf:type owl:DatatypeProperty ; rdfs:domain :Location ; rdfs:range xsd:string ; rdfs:comment "(STIX: city)" ; rdfs:isDefinedBy ; "City name." . ### https://cyberterrain.org/ns/stones#commandLine :commandLine rdf:type owl:DatatypeProperty ; rdfs:domain :ProcessObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: command_line)" ; rdfs:isDefinedBy ; "Full command line string used to launch this process." . ### https://cyberterrain.org/ns/stones#comment :comment rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: archive-ext.comment)" ; rdfs:isDefinedBy ; "Comment field embedded in an archive file." . ### https://cyberterrain.org/ns/stones#confidence :confidence rdf:type owl:DatatypeProperty ; rdfs:domain :StixObject ; rdfs:range xsd:integer ; rdfs:comment "(STIX: confidence)" ; rdfs:isDefinedBy ; "Producer's confidence in the accuracy of this data, from 0 (no confidence) to 100 (fully confident)." . ### https://cyberterrain.org/ns/stones#configurationVersion :configurationVersion rdf:type owl:DatatypeProperty ; rdfs:domain :MalwareAnalysis ; rdfs:range xsd:string ; rdfs:comment "(STIX: configuration_version)" ; rdfs:isDefinedBy ; "Version of the analysis tool configuration." . ### https://cyberterrain.org/ns/stones#contactInformation :contactInformation rdf:type owl:DatatypeProperty ; rdfs:domain :Identity ; rdfs:range xsd:string ; rdfs:comment "(STIX: contact_information)" ; rdfs:isDefinedBy ; "Contact details such as email address or phone number." . ### https://cyberterrain.org/ns/stones#content :content rdf:type owl:DatatypeProperty ; rdfs:domain :Note ; rdfs:range xsd:string ; rdfs:comment "(STIX: content)" ; rdfs:isDefinedBy ; "Full body text of the note." . ### https://cyberterrain.org/ns/stones#contentDisposition :contentDisposition rdf:type owl:DatatypeProperty ; rdfs:domain :EmailMimePart ; rdfs:range xsd:string ; rdfs:comment "(STIX: content_disposition)" ; rdfs:isDefinedBy ; "Content-Disposition header value for an email MIME part." . ### https://cyberterrain.org/ns/stones#contentType :contentType rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: content_type)" ; rdfs:isDefinedBy ; "Value of the Content-Type header (email-message, email MIME part)." . ### https://cyberterrain.org/ns/stones#count :count rdf:type owl:DatatypeProperty ; rdfs:domain :Sighting ; rdfs:range xsd:integer ; rdfs:comment "(STIX: count)" ; rdfs:isDefinedBy ; "Number of times the sighted object was observed. MUST be >= 0." . ### https://cyberterrain.org/ns/stones#country :country rdf:type owl:DatatypeProperty ; rdfs:domain :Location ; rdfs:range xsd:string ; rdfs:comment "(STIX: country)" ; rdfs:isDefinedBy ; "ISO 3166-1 alpha-2 country code, e.g. 'US', 'GB'." . ### https://cyberterrain.org/ns/stones#cpe :cpe rdf:type owl:DatatypeProperty ; rdfs:domain :SoftwareObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: cpe)" ; rdfs:isDefinedBy ; "NVD CPE 2.3 URI binding identifier for this software." . ### https://cyberterrain.org/ns/stones#created :created rdf:type owl:DatatypeProperty ; rdfs:domain :StixCoreObject ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: created)" ; rdfs:isDefinedBy ; "Timestamp when this object was created." . ### https://cyberterrain.org/ns/stones#createdTime :createdTime rdf:type owl:DatatypeProperty ; rdfs:domain :ProcessObject ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: created_time)" ; rdfs:isDefinedBy ; "Timestamp when the process was created." . ### https://cyberterrain.org/ns/stones#credential :credential rdf:type owl:DatatypeProperty ; rdfs:domain :UserAccountObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: credential)" ; rdfs:isDefinedBy ; "Clear-text credential associated with this account. Handle with care." . ### https://cyberterrain.org/ns/stones#credentialLastChanged :credentialLastChanged rdf:type owl:DatatypeProperty ; rdfs:domain :UserAccountObject ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: credential_last_changed)" ; rdfs:isDefinedBy ; "Timestamp when the account credentials were last changed." . ### https://cyberterrain.org/ns/stones#crlDistributionPoints :crlDistributionPoints rdf:type owl:DatatypeProperty ; rdfs:domain :X509V3Extensions ; rdfs:range xsd:string ; rdfs:comment "(STIX: x509-v3-extensions-type.crl_distribution_points)" ; rdfs:isDefinedBy ; "X.509 v3 CRL distribution points extension." . ### https://cyberterrain.org/ns/stones#ctime :ctime rdf:type owl:DatatypeProperty ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: ctime)" ; rdfs:isDefinedBy ; "Creation timestamp of a file system object." . ### https://cyberterrain.org/ns/stones#cwd :cwd rdf:type owl:DatatypeProperty ; rdfs:domain :ProcessObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: cwd)" ; rdfs:isDefinedBy ; "Current working directory of the process." . ### https://cyberterrain.org/ns/stones#data :data rdf:type owl:DatatypeProperty ; rdfs:domain :WindowsRegistryValue ; rdfs:range xsd:string ; rdfs:comment "(STIX: data)" ; rdfs:isDefinedBy ; "Data stored in this Windows registry value." . ### https://cyberterrain.org/ns/stones#date :date rdf:type owl:DatatypeProperty ; rdfs:domain :EmailMessageObject ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: date)" ; rdfs:isDefinedBy ; "Date and time the email was sent as recorded in the Date header." . ### https://cyberterrain.org/ns/stones#decryptionKey :decryptionKey rdf:type owl:DatatypeProperty ; rdfs:domain :ArtifactObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: decryption_key)" ; rdfs:isDefinedBy ; "Decryption key for this artifact when it is encrypted." . ### https://cyberterrain.org/ns/stones#defanged :defanged rdf:type owl:DatatypeProperty ; rdfs:domain :StixCyberobservableObject ; rdfs:range xsd:boolean ; rdfs:comment "(STIX: defanged)" ; rdfs:isDefinedBy ; "If true, the observable has been defanged, e.g. '198[.]51[.]100[.]0' in place of '198.51.100.0'." . ### https://cyberterrain.org/ns/stones#definitionType :definitionType rdf:type owl:DatatypeProperty ; rdfs:domain :MarkingDefinitionObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: definition_type)" ; rdfs:isDefinedBy ; "Type of marking definition: 'tlp' or 'statement'." . ### https://cyberterrain.org/ns/stones#depEnabled :depEnabled rdf:type owl:DatatypeProperty ; rdfs:range xsd:boolean ; rdfs:comment "(STIX: windows-process-ext.dep_enabled)" ; rdfs:isDefinedBy ; "True if Data Execution Prevention (DEP) is enabled for this process." . ### https://cyberterrain.org/ns/stones#description :description rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: description)" ; rdfs:isDefinedBy ; "Human-readable description providing additional detail." . ### https://cyberterrain.org/ns/stones#descriptions :descriptions rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: windows-service-ext.descriptions)" ; rdfs:isDefinedBy ; "Description strings for a Windows service. Multiple values as multiple triples." . ### https://cyberterrain.org/ns/stones#displayName :displayName rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: display_name)" ; rdfs:isDefinedBy ; "Human-readable display name (email-addr, user-account, windows-service-ext)." . ### https://cyberterrain.org/ns/stones#dstByteCount :dstByteCount rdf:type owl:DatatypeProperty ; rdfs:domain :NetworkTrafficObject ; rdfs:range xsd:integer ; rdfs:comment "(STIX: dst_byte_count)" ; rdfs:isDefinedBy ; "Total bytes sent from destination to source." . ### https://cyberterrain.org/ns/stones#dstFlagsHex :dstFlagsHex rdf:type owl:DatatypeProperty ; rdfs:range xsd:hexBinary ; rdfs:comment "(STIX: tcp-ext.dst_flags_hex)" ; rdfs:isDefinedBy ; "TCP flags set on packets from the destination endpoint as hex." . ### https://cyberterrain.org/ns/stones#dstPackets :dstPackets rdf:type owl:DatatypeProperty ; rdfs:domain :NetworkTrafficObject ; rdfs:range xsd:integer ; rdfs:comment "(STIX: dst_packets)" ; rdfs:isDefinedBy ; "Number of packets sent from destination to source." . ### https://cyberterrain.org/ns/stones#dstPort :dstPort rdf:type owl:DatatypeProperty ; rdfs:domain :NetworkTrafficObject ; rdfs:range xsd:integer ; rdfs:comment "(STIX: dst_port)" ; rdfs:isDefinedBy ; "Destination port number (0–65535)." . ### https://cyberterrain.org/ns/stones#end :end rdf:type owl:DatatypeProperty ; rdfs:domain :NetworkTrafficObject ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: end)" ; rdfs:isDefinedBy ; "Timestamp when this network traffic flow ended." . ### https://cyberterrain.org/ns/stones#entropy :entropy rdf:type owl:DatatypeProperty ; rdfs:domain :WindowsPeSection ; rdfs:range xsd:float ; rdfs:comment "(STIX: windows-pe-section-type.entropy)" ; rdfs:isDefinedBy ; "Calculated entropy of this PE section." . ### https://cyberterrain.org/ns/stones#explanation :explanation rdf:type owl:DatatypeProperty ; rdfs:domain :Opinion ; rdfs:range xsd:string ; rdfs:comment "(STIX: explanation)" ; rdfs:isDefinedBy ; "Explanation of why this opinion was formed." . ### https://cyberterrain.org/ns/stones#extendedKeyUsage :extendedKeyUsage rdf:type owl:DatatypeProperty ; rdfs:domain :X509V3Extensions ; rdfs:range xsd:string ; rdfs:comment "(STIX: x509-v3-extensions-type.extended_key_usage)" ; rdfs:isDefinedBy ; "X.509 v3 extended key usage extension value." . ### https://cyberterrain.org/ns/stones#extensionProperties :extensionProperties rdf:type owl:DatatypeProperty ; rdfs:domain :ExtensionDefinitionObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: extension_properties)" ; rdfs:isDefinedBy ; "Names of new top-level properties introduced by a toplevel-property-extension. Multiple values as multiple triples." . ### https://cyberterrain.org/ns/stones#externalId :externalId rdf:type owl:DatatypeProperty ; rdfs:domain :ExternalReference ; rdfs:range xsd:string ; rdfs:comment "(STIX: external_id)" ; rdfs:isDefinedBy ; "Identifier in the external system, e.g. 'T1059', 'CVE-2021-44228'." . ### https://cyberterrain.org/ns/stones#firstObserved :firstObserved rdf:type owl:DatatypeProperty ; rdfs:domain :ObservedData ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: first_observed)" ; rdfs:isDefinedBy ; "Earliest timestamp at which this observation occurred." . ### https://cyberterrain.org/ns/stones#firstSeen :firstSeen rdf:type owl:DatatypeProperty ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: first_seen)" ; rdfs:isDefinedBy ; "Timestamp when this object was first observed or seen." . ### https://cyberterrain.org/ns/stones#gid :gid rdf:type owl:DatatypeProperty ; rdfs:domain :UserAccountObject ; rdfs:range xsd:integer ; rdfs:comment "(STIX: unix-account-ext.gid)" ; rdfs:isDefinedBy ; "Primary numeric UNIX group ID (GID)." . ### https://cyberterrain.org/ns/stones#goals :goals rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: goals)" ; rdfs:isDefinedBy ; "High-level goals of this intrusion set or threat actor, e.g. 'financial gain'. Multiple values are expressed as multiple triples." . ### https://cyberterrain.org/ns/stones#groupName :groupName rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: windows-service-ext.group_name)" ; rdfs:isDefinedBy ; "Load ordering group for this Windows service." . ### https://cyberterrain.org/ns/stones#groups :groups rdf:type owl:DatatypeProperty ; rdfs:domain :UserAccountObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: unix-account-ext.groups)" ; rdfs:isDefinedBy ; "Names of UNIX groups this account belongs to. Multiple values as multiple triples." . ### https://cyberterrain.org/ns/stones#hashValue :hashValue rdf:type owl:DatatypeProperty ; rdfs:domain :HashEntry ; rdfs:range xsd:string ; rdfs:comment "(STIX: hashes dictionary value)" ; rdfs:isDefinedBy ; "Hex-encoded hash digest value." . ### https://cyberterrain.org/ns/stones#homeDir :homeDir rdf:type owl:DatatypeProperty ; rdfs:domain :UserAccountObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: unix-account-ext.home_dir)" ; rdfs:isDefinedBy ; "Home directory path for this UNIX account." . ### https://cyberterrain.org/ns/stones#icmpCodeHex :icmpCodeHex rdf:type owl:DatatypeProperty ; rdfs:range xsd:hexBinary ; rdfs:comment "(STIX: icmp-ext.icmp_code_hex)" ; rdfs:isDefinedBy ; "ICMP code field as a hex value." . ### https://cyberterrain.org/ns/stones#icmpTypeHex :icmpTypeHex rdf:type owl:DatatypeProperty ; rdfs:range xsd:hexBinary ; rdfs:comment "(STIX: icmp-ext.icmp_type_hex)" ; rdfs:isDefinedBy ; "ICMP type field as a hex value." . ### https://cyberterrain.org/ns/stones#imageHeight :imageHeight rdf:type owl:DatatypeProperty ; rdfs:range xsd:integer ; rdfs:comment "(STIX: raster-image-ext.image_height)" ; rdfs:isDefinedBy ; "Image height in pixels." . ### https://cyberterrain.org/ns/stones#imageWidth :imageWidth rdf:type owl:DatatypeProperty ; rdfs:range xsd:integer ; rdfs:comment "(STIX: raster-image-ext.image_width)" ; rdfs:isDefinedBy ; "Image width in pixels." . ### https://cyberterrain.org/ns/stones#imphash :imphash rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: imphash)" ; rdfs:isDefinedBy ; "Import hash (imphash) of the PE binary." . ### https://cyberterrain.org/ns/stones#inhibitAnyPolicy :inhibitAnyPolicy rdf:type owl:DatatypeProperty ; rdfs:domain :X509V3Extensions ; rdfs:range xsd:string ; rdfs:comment "(STIX: x509-v3-extensions-type.inhibit_any_policy)" ; rdfs:isDefinedBy ; "X.509 v3 inhibit any policy extension." . ### https://cyberterrain.org/ns/stones#isActive :isActive rdf:type owl:DatatypeProperty ; rdfs:domain :NetworkTrafficObject ; rdfs:range xsd:boolean ; rdfs:comment "(STIX: is_active)" ; rdfs:isDefinedBy ; "True if this network traffic flow was still active when it was observed." . ### https://cyberterrain.org/ns/stones#isBlocking :isBlocking rdf:type owl:DatatypeProperty ; rdfs:range xsd:boolean ; rdfs:comment "(STIX: socket-ext.is_blocking)" ; rdfs:isDefinedBy ; "True if this socket is in blocking mode." . ### https://cyberterrain.org/ns/stones#isDisabled :isDisabled rdf:type owl:DatatypeProperty ; rdfs:domain :UserAccountObject ; rdfs:range xsd:boolean ; rdfs:comment "(STIX: is_disabled)" ; rdfs:isDefinedBy ; "True if this account is currently disabled." . ### https://cyberterrain.org/ns/stones#isFamily :isFamily rdf:type owl:DatatypeProperty ; rdfs:domain :Malware ; rdfs:range xsd:boolean ; rdfs:comment "(STIX: is_family)" ; rdfs:isDefinedBy ; "True if this represents a malware family; false for a specific instance or sample." . ### https://cyberterrain.org/ns/stones#isHidden :isHidden rdf:type owl:DatatypeProperty ; rdfs:domain :ProcessObject ; rdfs:range xsd:boolean ; rdfs:comment "(STIX: is_hidden)" ; rdfs:isDefinedBy ; "If true, this process is hidden from normal process enumeration." . ### https://cyberterrain.org/ns/stones#isListening :isListening rdf:type owl:DatatypeProperty ; rdfs:range xsd:boolean ; rdfs:comment "(STIX: socket-ext.is_listening)" ; rdfs:isDefinedBy ; "True if this socket is in a listening state." . ### https://cyberterrain.org/ns/stones#isMultipart :isMultipart rdf:type owl:DatatypeProperty ; rdfs:domain :EmailMessageObject ; rdfs:range xsd:boolean ; rdfs:comment "(STIX: is_multipart)" ; rdfs:isDefinedBy ; "True if this email uses multipart MIME (bodyMultipart is populated); false if body contains the single plain-text body." . ### https://cyberterrain.org/ns/stones#isOptimized :isOptimized rdf:type owl:DatatypeProperty ; rdfs:range xsd:boolean ; rdfs:comment "(STIX: pdf-ext.is_optimized)" ; rdfs:isDefinedBy ; "True if the PDF is linearized (optimised for fast web viewing)." . ### https://cyberterrain.org/ns/stones#isPrivileged :isPrivileged rdf:type owl:DatatypeProperty ; rdfs:domain :UserAccountObject ; rdfs:range xsd:boolean ; rdfs:comment "(STIX: is_privileged)" ; rdfs:isDefinedBy ; "True if this account has elevated privileges." . ### https://cyberterrain.org/ns/stones#isSelfSigned :isSelfSigned rdf:type owl:DatatypeProperty ; rdfs:domain :X509CertificateObject ; rdfs:range xsd:boolean ; rdfs:comment "(STIX: is_self_signed)" ; rdfs:isDefinedBy ; "True if this certificate is self-signed." . ### https://cyberterrain.org/ns/stones#isServiceAccount :isServiceAccount rdf:type owl:DatatypeProperty ; rdfs:domain :UserAccountObject ; rdfs:range xsd:boolean ; rdfs:comment "(STIX: is_service_account)" ; rdfs:isDefinedBy ; "True if this is a service or system account rather than a user account." . ### https://cyberterrain.org/ns/stones#issuer :issuer rdf:type owl:DatatypeProperty ; rdfs:domain :X509CertificateObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: issuer)" ; rdfs:isDefinedBy ; "Distinguished Name of the certificate issuer." . ### https://cyberterrain.org/ns/stones#issuerAlternativeName :issuerAlternativeName rdf:type owl:DatatypeProperty ; rdfs:domain :X509V3Extensions ; rdfs:range xsd:string ; rdfs:comment "(STIX: x509-v3-extensions-type.issuer_alternative_name)" ; rdfs:isDefinedBy ; "X.509 v3 issuer alternative name extension." . ### https://cyberterrain.org/ns/stones#key :key rdf:type owl:DatatypeProperty ; rdfs:domain :WindowsRegistryKeyObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: key)" ; rdfs:isDefinedBy ; "Full Windows Registry key path, e.g. 'HKEY_LOCAL_MACHINE\\Software\\...'." . ### https://cyberterrain.org/ns/stones#keyUsage :keyUsage rdf:type owl:DatatypeProperty ; rdfs:domain :X509V3Extensions ; rdfs:range xsd:string ; rdfs:comment "(STIX: x509-v3-extensions-type.key_usage)" ; rdfs:isDefinedBy ; "X.509 v3 key usage extension value." . ### https://cyberterrain.org/ns/stones#killChainName :killChainName rdf:type owl:DatatypeProperty ; rdfs:domain :KillChainPhase ; rdfs:range xsd:string ; rdfs:comment "(STIX: kill_chain_name)" ; rdfs:isDefinedBy ; "Name of the kill chain framework, e.g. 'mitre-attack', 'lockheed-martin-cyber-kill-chain'." . ### https://cyberterrain.org/ns/stones#labels :labels rdf:type owl:DatatypeProperty ; rdfs:domain :StixObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: labels)" ; rdfs:isDefinedBy ; "Free-form string terms applying to this object. Multiple labels are expressed as multiple triples." . ### https://cyberterrain.org/ns/stones#lang :lang rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: lang)" ; rdfs:isDefinedBy ; "BCP 47 language tag for the human-readable content of this object, e.g. 'en', 'fr'. Also used in GranularMarking." . ### https://cyberterrain.org/ns/stones#languages :languages rdf:type owl:DatatypeProperty ; rdfs:domain :SoftwareObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: languages)" ; rdfs:isDefinedBy ; "BCP 47 language tags for languages supported by this software. Multiple values as multiple triples." . ### https://cyberterrain.org/ns/stones#lastObserved :lastObserved rdf:type owl:DatatypeProperty ; rdfs:domain :ObservedData ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: last_observed)" ; rdfs:isDefinedBy ; "Latest timestamp at which this observation occurred. MUST be >= firstObserved." . ### https://cyberterrain.org/ns/stones#lastSeen :lastSeen rdf:type owl:DatatypeProperty ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: last_seen)" ; rdfs:isDefinedBy ; "Timestamp when this object was last observed or seen. MUST be >= firstSeen." . ### https://cyberterrain.org/ns/stones#latitude :latitude rdf:type owl:DatatypeProperty ; rdfs:domain :Location ; rdfs:range xsd:float ; rdfs:comment "(STIX: latitude)" ; rdfs:isDefinedBy ; "Latitude in decimal degrees, range -90 to 90. Required when longitude is present." . ### https://cyberterrain.org/ns/stones#longitude :longitude rdf:type owl:DatatypeProperty ; rdfs:domain :Location ; rdfs:range xsd:float ; rdfs:comment "(STIX: longitude)" ; rdfs:isDefinedBy ; "Longitude in decimal degrees, range -180 to 180. Required when latitude is present." . ### https://cyberterrain.org/ns/stones#machineHex :machineHex rdf:type owl:DatatypeProperty ; rdfs:range xsd:hexBinary ; rdfs:comment "(STIX: machine_hex)" ; rdfs:isDefinedBy ; "Machine type from the COFF header as a hex value." . ### https://cyberterrain.org/ns/stones#magicNumberHex :magicNumberHex rdf:type owl:DatatypeProperty ; rdfs:domain :FileObject ; rdfs:range xsd:hexBinary ; rdfs:comment "(STIX: magic_number_hex)" ; rdfs:isDefinedBy ; "Magic bytes (file signature) as a hex string." . ### https://cyberterrain.org/ns/stones#messageBodyLength :messageBodyLength rdf:type owl:DatatypeProperty ; rdfs:range xsd:integer ; rdfs:comment "(STIX: http-request-ext.message_body_length)" ; rdfs:isDefinedBy ; "Length of the HTTP message body in bytes." . ### https://cyberterrain.org/ns/stones#messageId :messageId rdf:type owl:DatatypeProperty ; rdfs:domain :EmailMessageObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: message_id)" ; rdfs:isDefinedBy ; "Value of the Message-ID header." . ### https://cyberterrain.org/ns/stones#mimeType :mimeType rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: mime_type)" ; rdfs:isDefinedBy ; "IANA MIME type of the content (artifact, file)." . ### https://cyberterrain.org/ns/stones#modified :modified rdf:type owl:DatatypeProperty ; rdfs:domain :StixCoreObject ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: modified)" ; rdfs:isDefinedBy ; "Timestamp when this object was last modified. MUST be >= created." . ### https://cyberterrain.org/ns/stones#modifiedTime :modifiedTime rdf:type owl:DatatypeProperty ; rdfs:domain :WindowsRegistryKeyObject ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: modified_time)" ; rdfs:isDefinedBy ; "Last modification timestamp of this registry key." . ### https://cyberterrain.org/ns/stones#modules :modules rdf:type owl:DatatypeProperty ; rdfs:domain :MalwareAnalysis ; rdfs:range xsd:string ; rdfs:comment "(STIX: modules)" ; rdfs:isDefinedBy ; "Names of analysis modules or plugins used. Multiple values as multiple triples." . ### https://cyberterrain.org/ns/stones#mtime :mtime rdf:type owl:DatatypeProperty ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: mtime)" ; rdfs:isDefinedBy ; "Last-modified timestamp of a file system object." . ### https://cyberterrain.org/ns/stones#name :name rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: name)" ; rdfs:isDefinedBy ; "Human-readable name. Used across SDOs, SCOs, and sub-objects." . ### https://cyberterrain.org/ns/stones#nameConstraints :nameConstraints rdf:type owl:DatatypeProperty ; rdfs:domain :X509V3Extensions ; rdfs:range xsd:string ; rdfs:comment "(STIX: x509-v3-extensions-type.name_constraints)" ; rdfs:isDefinedBy ; "X.509 v3 name constraints extension value." . ### https://cyberterrain.org/ns/stones#nameEnc :nameEnc rdf:type owl:DatatypeProperty ; rdfs:domain :FileObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: name_enc)" ; rdfs:isDefinedBy ; "Character encoding of the file name when non-ASCII characters are present." . ### https://cyberterrain.org/ns/stones#number :number rdf:type owl:DatatypeProperty ; rdfs:domain :AutonomousSystemObject ; rdfs:range xsd:integer ; rdfs:comment "(STIX: number)" ; rdfs:isDefinedBy ; "Autonomous System number (ASN)." . ### https://cyberterrain.org/ns/stones#numberObserved :numberObserved rdf:type owl:DatatypeProperty ; rdfs:domain :ObservedData ; rdfs:range xsd:integer ; rdfs:comment "(STIX: number_observed)" ; rdfs:isDefinedBy ; "Number of times the observation occurred. MUST be >= 1." . ### https://cyberterrain.org/ns/stones#numberOfSections :numberOfSections rdf:type owl:DatatypeProperty ; rdfs:range xsd:integer ; rdfs:comment "(STIX: number_of_sections)" ; rdfs:isDefinedBy ; "Number of sections in the PE binary." . ### https://cyberterrain.org/ns/stones#numberOfSubkeys :numberOfSubkeys rdf:type owl:DatatypeProperty ; rdfs:domain :WindowsRegistryKeyObject ; rdfs:range xsd:integer ; rdfs:comment "(STIX: number_of_subkeys)" ; rdfs:isDefinedBy ; "Number of subkeys under this registry key." . ### https://cyberterrain.org/ns/stones#numberOfSymbols :numberOfSymbols rdf:type owl:DatatypeProperty ; rdfs:range xsd:integer ; rdfs:comment "(STIX: number_of_symbols)" ; rdfs:isDefinedBy ; "Number of entries in the COFF symbol table." . ### https://cyberterrain.org/ns/stones#objectModified :objectModified rdf:type owl:DatatypeProperty ; rdfs:domain :LanguageContentObject ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: object_modified)" ; rdfs:isDefinedBy ; "The modified timestamp of the STIX object being translated. Used to pin a translation to a specific version." . ### https://cyberterrain.org/ns/stones#objective :objective rdf:type owl:DatatypeProperty ; rdfs:domain :Campaign ; rdfs:range xsd:string ; rdfs:comment "(STIX: objective)" ; rdfs:isDefinedBy ; "Primary goal or objective of the campaign." . ### https://cyberterrain.org/ns/stones#path :path rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: path)" ; rdfs:isDefinedBy ; "Absolute file system path (directory, file)." . ### https://cyberterrain.org/ns/stones#pathEnc :pathEnc rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: path_enc)" ; rdfs:isDefinedBy ; "Character encoding used for the path property when the path contains non-ASCII characters." . ### https://cyberterrain.org/ns/stones#pattern :pattern rdf:type owl:DatatypeProperty ; rdfs:domain :Indicator ; rdfs:range xsd:string ; rdfs:comment "(STIX: pattern)" ; rdfs:isDefinedBy ; "Detection pattern expression, e.g. a STIX patterning language expression." . ### https://cyberterrain.org/ns/stones#patternVersion :patternVersion rdf:type owl:DatatypeProperty ; rdfs:domain :Indicator ; rdfs:range xsd:string ; rdfs:comment "(STIX: pattern_version)" ; rdfs:isDefinedBy ; "Version of the pattern language, e.g. the STIX patterning language version." . ### https://cyberterrain.org/ns/stones#payloadBin :payloadBin rdf:type owl:DatatypeProperty ; rdfs:domain :ArtifactObject ; rdfs:range xsd:base64Binary ; rdfs:comment "(STIX: payload_bin)" ; rdfs:isDefinedBy ; "Artifact byte content encoded as base64. Mutually exclusive with url." . ### https://cyberterrain.org/ns/stones#pdfid0 :pdfid0 rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: pdf-ext.pdfid0)" ; rdfs:isDefinedBy ; "First PDF file identifier string from the PDF trailer." . ### https://cyberterrain.org/ns/stones#pdfid1 :pdfid1 rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: pdf-ext.pdfid1)" ; rdfs:isDefinedBy ; "Second PDF file identifier string from the PDF trailer." . ### https://cyberterrain.org/ns/stones#phaseName :phaseName rdf:type owl:DatatypeProperty ; rdfs:domain :KillChainPhase ; rdfs:range xsd:string ; rdfs:comment "(STIX: phase_name)" ; rdfs:isDefinedBy ; "Phase within the kill chain, e.g. 'execution', 'persistence', 'lateral-movement'." . ### https://cyberterrain.org/ns/stones#pid :pid rdf:type owl:DatatypeProperty ; rdfs:domain :ProcessObject ; rdfs:range xsd:integer ; rdfs:comment "(STIX: pid)" ; rdfs:isDefinedBy ; "Process ID (PID)." . ### https://cyberterrain.org/ns/stones#pointerToSymbolTableHex :pointerToSymbolTableHex rdf:type owl:DatatypeProperty ; rdfs:range xsd:hexBinary ; rdfs:comment "(STIX: pointer_to_symbol_table_hex)" ; rdfs:isDefinedBy ; "File offset of the COFF symbol table as hex." . ### https://cyberterrain.org/ns/stones#policyConstraints :policyConstraints rdf:type owl:DatatypeProperty ; rdfs:domain :X509V3Extensions ; rdfs:range xsd:string ; rdfs:comment "(STIX: x509-v3-extensions-type.policy_constraints)" ; rdfs:isDefinedBy ; "X.509 v3 policy constraints extension value." . ### https://cyberterrain.org/ns/stones#policyMappings :policyMappings rdf:type owl:DatatypeProperty ; rdfs:domain :X509V3Extensions ; rdfs:range xsd:string ; rdfs:comment "(STIX: x509-v3-extensions-type.policy_mappings)" ; rdfs:isDefinedBy ; "X.509 v3 policy mappings extension." . ### https://cyberterrain.org/ns/stones#postalCode :postalCode rdf:type owl:DatatypeProperty ; rdfs:domain :Location ; rdfs:range xsd:string ; rdfs:comment "(STIX: postal_code)" ; rdfs:isDefinedBy ; "Postal or ZIP code." . ### https://cyberterrain.org/ns/stones#precision :precision rdf:type owl:DatatypeProperty ; rdfs:domain :Location ; rdfs:range xsd:float ; rdfs:comment "(STIX: precision)" ; rdfs:isDefinedBy ; "Radius of accuracy in metres around the latitude/longitude point." . ### https://cyberterrain.org/ns/stones#priority :priority rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: windows-process-ext.priority)" ; rdfs:isDefinedBy ; "Scheduling priority string for this Windows process, e.g. 'HIGH_PRIORITY_CLASS'." . ### https://cyberterrain.org/ns/stones#privateKeyUsagePeriodNotAfter :privateKeyUsagePeriodNotAfter rdf:type owl:DatatypeProperty ; rdfs:domain :X509V3Extensions ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: x509-v3-extensions-type.private_key_usage_period_not_after)" ; rdfs:isDefinedBy ; "End of the private key usage period." . ### https://cyberterrain.org/ns/stones#privateKeyUsagePeriodNotBefore :privateKeyUsagePeriodNotBefore rdf:type owl:DatatypeProperty ; rdfs:domain :X509V3Extensions ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: x509-v3-extensions-type.private_key_usage_period_not_before)" ; rdfs:isDefinedBy ; "Start of the private key usage period." . ### https://cyberterrain.org/ns/stones#product :product rdf:type owl:DatatypeProperty ; rdfs:domain :MalwareAnalysis ; rdfs:range xsd:string ; rdfs:comment "(STIX: product)" ; rdfs:isDefinedBy ; "Name of the analysis tool used, e.g. 'Cuckoo', 'VirusTotal'." . ### https://cyberterrain.org/ns/stones#protocols :protocols rdf:type owl:DatatypeProperty ; rdfs:domain :NetworkTrafficObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: protocols)" ; rdfs:isDefinedBy ; "Ordered list of protocols from lowest to highest layer, e.g. 'ipv4', 'tcp', 'http'. Multiple values as multiple triples." . ### https://cyberterrain.org/ns/stones#published :published rdf:type owl:DatatypeProperty ; rdfs:domain :Report ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: published)" ; rdfs:isDefinedBy ; "Date and time this report was published." . ### https://cyberterrain.org/ns/stones#receivedLines :receivedLines rdf:type owl:DatatypeProperty ; rdfs:domain :EmailMessageObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: received_lines)" ; rdfs:isDefinedBy ; "Received: header values in the order received. Multiple values as multiple triples." . ### https://cyberterrain.org/ns/stones#relationshipType :relationshipType rdf:type owl:DatatypeProperty ; rdfs:domain :Relationship ; rdfs:range xsd:string ; rdfs:comment "(STIX: relationship_type)" ; rdfs:isDefinedBy ; "Semantic type of this relationship, e.g. 'uses', 'targets', 'indicates'." . ### https://cyberterrain.org/ns/stones#requestMethod :requestMethod rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: http-request-ext.request_method)" ; rdfs:isDefinedBy ; "HTTP method, e.g. 'GET', 'POST'." . ### https://cyberterrain.org/ns/stones#requestValue :requestValue rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: http-request-ext.request_value)" ; rdfs:isDefinedBy ; "HTTP request URI path, e.g. '/index.html?q=1'." . ### https://cyberterrain.org/ns/stones#requestVersion :requestVersion rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: http-request-ext.request_version)" ; rdfs:isDefinedBy ; "HTTP version string, e.g. 'HTTP/1.1'." . ### https://cyberterrain.org/ns/stones#resultName :resultName rdf:type owl:DatatypeProperty ; rdfs:domain :MalwareAnalysis ; rdfs:range xsd:string ; rdfs:comment "(STIX: result_name)" ; rdfs:isDefinedBy ; "Classification name from the analysis product." . ### https://cyberterrain.org/ns/stones#revoked :revoked rdf:type owl:DatatypeProperty ; rdfs:domain :StixObject ; rdfs:range xsd:boolean ; rdfs:comment "(STIX: revoked)" ; rdfs:isDefinedBy ; "If true, this object has been revoked and should no longer be considered accurate." . ### https://cyberterrain.org/ns/stones#rir :rir rdf:type owl:DatatypeProperty ; rdfs:domain :AutonomousSystemObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: rir)" ; rdfs:isDefinedBy ; "Regional Internet Registry that assigned this ASN, e.g. 'ARIN', 'RIPE'." . ### https://cyberterrain.org/ns/stones#roles :roles rdf:type owl:DatatypeProperty ; rdfs:domain :Identity ; rdfs:range xsd:string ; rdfs:comment "(STIX: roles)" ; rdfs:isDefinedBy ; "Free-form roles this identity plays, e.g. 'analyst'. For threat-actor roles see the object property stones:threatActorRoles." . ### https://cyberterrain.org/ns/stones#schema :schema rdf:type owl:DatatypeProperty ; rdfs:domain :ExtensionDefinitionObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: schema)" ; rdfs:isDefinedBy ; "URL pointing to, or the raw content of, the JSON Schema defining this extension." . ### https://cyberterrain.org/ns/stones#selectors :selectors rdf:type owl:DatatypeProperty ; rdfs:domain :GranularMarking ; rdfs:range xsd:string ; rdfs:comment "(STIX: selectors)" ; rdfs:isDefinedBy ; "JSON property path selectors identifying the properties this marking applies to, e.g. 'name', 'description'. Multiple values as multiple triples." . ### https://cyberterrain.org/ns/stones#serialNumber :serialNumber rdf:type owl:DatatypeProperty ; rdfs:domain :X509CertificateObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: serial_number)" ; rdfs:isDefinedBy ; "Serial number assigned to this certificate by the issuer." . ### https://cyberterrain.org/ns/stones#serviceName :serviceName rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: windows-service-ext.service_name)" ; rdfs:isDefinedBy ; "Windows service name as used in the Service Control Manager." . ### https://cyberterrain.org/ns/stones#shell :shell rdf:type owl:DatatypeProperty ; rdfs:domain :UserAccountObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: unix-account-ext.shell)" ; rdfs:isDefinedBy ; "Login shell path for this UNIX account, e.g. '/bin/bash'." . ### https://cyberterrain.org/ns/stones#sid :sid rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: sid / owner_sid)" ; rdfs:isDefinedBy ; "Windows Security Identifier (SID) of the file owner (ntfs-ext) or process owner (windows-process-ext)." . ### https://cyberterrain.org/ns/stones#signatureAlgorithm :signatureAlgorithm rdf:type owl:DatatypeProperty ; rdfs:domain :X509CertificateObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: signature_algorithm)" ; rdfs:isDefinedBy ; "Algorithm used to sign this certificate, e.g. 'sha256WithRSAEncryption'." . ### https://cyberterrain.org/ns/stones#size :size rdf:type owl:DatatypeProperty ; rdfs:range xsd:integer ; rdfs:comment "(STIX: size)" ; rdfs:isDefinedBy ; "Size in bytes (file, windows-pe-section, alternate-data-stream)." . ### https://cyberterrain.org/ns/stones#sizeOfOptionalHeader :sizeOfOptionalHeader rdf:type owl:DatatypeProperty ; rdfs:range xsd:integer ; rdfs:comment "(STIX: size_of_optional_header)" ; rdfs:isDefinedBy ; "Size of the optional PE header in bytes." . ### https://cyberterrain.org/ns/stones#socketDescriptor :socketDescriptor rdf:type owl:DatatypeProperty ; rdfs:range xsd:integer ; rdfs:comment "(STIX: socket-ext.socket_descriptor)" ; rdfs:isDefinedBy ; "Platform-specific socket file descriptor number." . ### https://cyberterrain.org/ns/stones#socketHandle :socketHandle rdf:type owl:DatatypeProperty ; rdfs:range xsd:integer ; rdfs:comment "(STIX: socket-ext.socket_handle)" ; rdfs:isDefinedBy ; "Windows handle value for this socket." . ### https://cyberterrain.org/ns/stones#sourceName :sourceName rdf:type owl:DatatypeProperty ; rdfs:domain :ExternalReference ; rdfs:range xsd:string ; rdfs:comment "(STIX: source_name)" ; rdfs:isDefinedBy ; "Name of the information source, e.g. 'mitre-attack', 'cve', 'capec'." . ### https://cyberterrain.org/ns/stones#specVersion :specVersion rdf:type owl:DatatypeProperty ; rdfs:domain :StixObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: spec_version)" ; rdfs:isDefinedBy ; "STIX specification version. MUST be '2.1'." . ### https://cyberterrain.org/ns/stones#srcByteCount :srcByteCount rdf:type owl:DatatypeProperty ; rdfs:domain :NetworkTrafficObject ; rdfs:range xsd:integer ; rdfs:comment "(STIX: src_byte_count)" ; rdfs:isDefinedBy ; "Total bytes sent from source to destination." . ### https://cyberterrain.org/ns/stones#srcFlagsHex :srcFlagsHex rdf:type owl:DatatypeProperty ; rdfs:range xsd:hexBinary ; rdfs:comment "(STIX: tcp-ext.src_flags_hex)" ; rdfs:isDefinedBy ; "TCP flags set on packets from the source endpoint as hex, e.g. '0x02' for SYN." . ### https://cyberterrain.org/ns/stones#srcPackets :srcPackets rdf:type owl:DatatypeProperty ; rdfs:domain :NetworkTrafficObject ; rdfs:range xsd:integer ; rdfs:comment "(STIX: src_packets)" ; rdfs:isDefinedBy ; "Number of packets sent from source to destination." . ### https://cyberterrain.org/ns/stones#srcPort :srcPort rdf:type owl:DatatypeProperty ; rdfs:domain :NetworkTrafficObject ; rdfs:range xsd:integer ; rdfs:comment "(STIX: src_port)" ; rdfs:isDefinedBy ; "Source port number (0–65535)." . ### https://cyberterrain.org/ns/stones#start :start rdf:type owl:DatatypeProperty ; rdfs:domain :NetworkTrafficObject ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: start)" ; rdfs:isDefinedBy ; "Timestamp when this network traffic flow started." . ### https://cyberterrain.org/ns/stones#startTime :startTime rdf:type owl:DatatypeProperty ; rdfs:domain :Relationship ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: start_time)" ; rdfs:isDefinedBy ; "Timestamp when this relationship began." . ### https://cyberterrain.org/ns/stones#statement :statement rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: definition.statement)" ; rdfs:isDefinedBy ; "Human-readable statement for a statement marking definition, e.g. a copyright notice." . ### https://cyberterrain.org/ns/stones#stixId :stixId rdf:type owl:DatatypeProperty , owl:FunctionalProperty ; rdfs:domain :StixObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: id)" ; rdfs:isDefinedBy ; "The STIX identifier string in the format --. The IRI of the individual is the canonical identity; this property retains the string for JSON round-tripping and SPARQL querying." . ### https://cyberterrain.org/ns/stones#stixType :stixType rdf:type owl:DatatypeProperty , owl:FunctionalProperty ; rdfs:domain :StixObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: type)" ; rdfs:isDefinedBy ; "The STIX object type string, e.g. 'attack-pattern'. Semantically redundant with rdf:type but preserved for JSON round-tripping." . ### https://cyberterrain.org/ns/stones#stopTime :stopTime rdf:type owl:DatatypeProperty ; rdfs:domain :Relationship ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: stop_time)" ; rdfs:isDefinedBy ; "Timestamp when this relationship ended. MUST be >= startTime." . ### https://cyberterrain.org/ns/stones#streetAddress :streetAddress rdf:type owl:DatatypeProperty ; rdfs:domain :Location ; rdfs:range xsd:string ; rdfs:comment "(STIX: street_address)" ; rdfs:isDefinedBy ; "Street address." . ### https://cyberterrain.org/ns/stones#subject :subject rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: subject)" ; rdfs:isDefinedBy ; "Subject line of an email message, or Distinguished Name of the certificate subject." . ### https://cyberterrain.org/ns/stones#subjectAlternativeName :subjectAlternativeName rdf:type owl:DatatypeProperty ; rdfs:domain :X509V3Extensions ; rdfs:range xsd:string ; rdfs:comment "(STIX: x509-v3-extensions-type.subject_alternative_name)" ; rdfs:isDefinedBy ; "X.509 v3 subject alternative name extension." . ### https://cyberterrain.org/ns/stones#subjectDirectoryAttributes :subjectDirectoryAttributes rdf:type owl:DatatypeProperty ; rdfs:domain :X509V3Extensions ; rdfs:range xsd:string ; rdfs:comment "(STIX: x509-v3-extensions-type.subject_directory_attributes)" ; rdfs:isDefinedBy ; "X.509 v3 subject directory attributes extension." . ### https://cyberterrain.org/ns/stones#subjectKeyIdentifier :subjectKeyIdentifier rdf:type owl:DatatypeProperty ; rdfs:domain :X509V3Extensions ; rdfs:range xsd:string ; rdfs:comment "(STIX: x509-v3-extensions-type.subject_key_identifier)" ; rdfs:isDefinedBy ; "X.509 v3 subject key identifier." . ### https://cyberterrain.org/ns/stones#subjectPublicKeyAlgorithm :subjectPublicKeyAlgorithm rdf:type owl:DatatypeProperty ; rdfs:domain :X509CertificateObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: subject_public_key_algorithm)" ; rdfs:isDefinedBy ; "Algorithm of the subject's public key, e.g. 'rsaEncryption'." . ### https://cyberterrain.org/ns/stones#subjectPublicKeyExponent :subjectPublicKeyExponent rdf:type owl:DatatypeProperty ; rdfs:domain :X509CertificateObject ; rdfs:range xsd:integer ; rdfs:comment "(STIX: subject_public_key_exponent)" ; rdfs:isDefinedBy ; "RSA public exponent of the subject's public key." . ### https://cyberterrain.org/ns/stones#subjectPublicKeyModulus :subjectPublicKeyModulus rdf:type owl:DatatypeProperty ; rdfs:domain :X509CertificateObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: subject_public_key_modulus)" ; rdfs:isDefinedBy ; "RSA modulus of the subject's public key as a hex string." . ### https://cyberterrain.org/ns/stones#submitted :submitted rdf:type owl:DatatypeProperty ; rdfs:domain :MalwareAnalysis ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: submitted)" ; rdfs:isDefinedBy ; "Timestamp when the sample was submitted for analysis." . ### https://cyberterrain.org/ns/stones#summary :summary rdf:type owl:DatatypeProperty ; rdfs:domain :Sighting ; rdfs:range xsd:boolean ; rdfs:comment "(STIX: summary)" ; rdfs:isDefinedBy ; "If true, this sighting aggregates multiple observations rather than recording a single specific event." . ### https://cyberterrain.org/ns/stones#swid :swid rdf:type owl:DatatypeProperty ; rdfs:domain :SoftwareObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: swid)" ; rdfs:isDefinedBy ; "ISO/IEC 19770-2 SWID tag identifier." . ### https://cyberterrain.org/ns/stones#timeDateStamp :timeDateStamp rdf:type owl:DatatypeProperty ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: time_date_stamp)" ; rdfs:isDefinedBy ; "Timestamp recorded in the PE header." . ### https://cyberterrain.org/ns/stones#tlp :tlp rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: definition.tlp)" ; rdfs:isDefinedBy ; "TLP level for a TLP marking definition: 'white', 'green', 'amber', or 'red'." . ### https://cyberterrain.org/ns/stones#toolVersion :toolVersion rdf:type owl:DatatypeProperty ; rdfs:domain :Tool ; rdfs:range xsd:string ; rdfs:comment "(STIX: tool_version)" ; rdfs:isDefinedBy ; "Version string of the tool." . ### https://cyberterrain.org/ns/stones#uid :uid rdf:type owl:DatatypeProperty ; rdfs:domain :UserAccountObject ; rdfs:range xsd:integer ; rdfs:comment "(STIX: unix-account-ext.uid)" ; rdfs:isDefinedBy ; "Numeric UNIX user ID (UID)." . ### https://cyberterrain.org/ns/stones#url :url rdf:type owl:DatatypeProperty ; rdfs:range xsd:anyURI ; rdfs:comment "(STIX: url)" ; rdfs:isDefinedBy ; "URL to a referenced resource (external-reference) or the location of artifact content." . ### https://cyberterrain.org/ns/stones#userId :userId rdf:type owl:DatatypeProperty ; rdfs:domain :UserAccountObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: user_id)" ; rdfs:isDefinedBy ; "Identifier of the user account, such as a login name or UID." . ### https://cyberterrain.org/ns/stones#validFrom :validFrom rdf:type owl:DatatypeProperty ; rdfs:domain :Indicator ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: valid_from)" ; rdfs:isDefinedBy ; "Timestamp from which this indicator is considered valid." . ### https://cyberterrain.org/ns/stones#validUntil :validUntil rdf:type owl:DatatypeProperty ; rdfs:domain :Indicator ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: valid_until)" ; rdfs:isDefinedBy ; "Timestamp after which this indicator is no longer valid." . ### https://cyberterrain.org/ns/stones#validityNotAfter :validityNotAfter rdf:type owl:DatatypeProperty ; rdfs:domain :X509CertificateObject ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: validity_not_after)" ; rdfs:isDefinedBy ; "End of the certificate validity period." . ### https://cyberterrain.org/ns/stones#validityNotBefore :validityNotBefore rdf:type owl:DatatypeProperty ; rdfs:domain :X509CertificateObject ; rdfs:range xsd:dateTime ; rdfs:comment "(STIX: validity_not_before)" ; rdfs:isDefinedBy ; "Start of the certificate validity period." . ### https://cyberterrain.org/ns/stones#value :value rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: value)" ; rdfs:isDefinedBy ; "Primary string value of an observable: the domain name, email address, IP address, MAC address, or URL." . ### https://cyberterrain.org/ns/stones#vendor :vendor rdf:type owl:DatatypeProperty ; rdfs:domain :SoftwareObject ; rdfs:range xsd:string ; rdfs:comment "(STIX: vendor)" ; rdfs:isDefinedBy ; "Name of the software vendor." . ### https://cyberterrain.org/ns/stones#version :version rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: version)" ; rdfs:isDefinedBy ; "Version string. Used for analysis tool version (malware-analysis), schema version (extension-definition), software version, X.509 version, and PDF format version." . ### https://cyberterrain.org/ns/stones#windowTitle :windowTitle rdf:type owl:DatatypeProperty ; rdfs:range xsd:string ; rdfs:comment "(STIX: windows-process-ext.window_title)" ; rdfs:isDefinedBy ; "Title text of the main window of this Windows process." . ################################################################# # Classes ################################################################# ### http://www.w3.org/2004/02/skos/core#Collection rdf:type owl:Class ; owl:disjointWith , ; rdfs:isDefinedBy ; rdfs:label "Collection"@en ; "A meaningful collection of concepts."@en ; "Labelled collections can be used where you would like a set of concepts to be displayed under a 'node label' in the hierarchy."@en . ### http://www.w3.org/2004/02/skos/core#Concept rdf:type owl:Class ; owl:disjointWith ; rdfs:isDefinedBy ; rdfs:label "Concept"@en ; "An idea or notion; a unit of thought."@en . ### http://www.w3.org/2004/02/skos/core#ConceptScheme rdf:type owl:Class ; rdfs:isDefinedBy ; rdfs:label "Concept Scheme"@en ; "A set of concepts, optionally including statements about semantic relationships between those concepts."@en ; "Thesauri, classification schemes, subject heading lists, taxonomies, 'folksonomies', and other types of controlled vocabulary are all examples of concept schemes. Concept schemes are also embedded in glossaries and terminologies."@en ; "A concept scheme may be defined to include concepts from different sources."@en . ### http://www.w3.org/2004/02/skos/core#OrderedCollection rdf:type owl:Class ; rdfs:subClassOf ; rdfs:isDefinedBy ; rdfs:label "Ordered Collection"@en ; "An ordered collection of concepts, where both the grouping and the ordering are meaningful."@en ; "Ordered collections can be used where you would like a set of concepts to be displayed in a specific order, and optionally under a 'node label'."@en . ### https://cyberterrain.org/ns/stones#AccountTypeVocabulary :AccountTypeVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#AlternateDataStream :AlternateDataStream rdf:type owl:Class ; rdfs:subClassOf :StixSubType , [ rdf:type owl:Restriction ; owl:onProperty :name ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "An NTFS Alternate Data Stream (ADS) attached to a file, identified by name with optional hashes and size." ; "Alternate Data Stream"@en . ### https://cyberterrain.org/ns/stones#ArtifactObject :ArtifactObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "artifact" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixCyberobservableObject ; rdfs:isDefinedBy ; "Represents a sequence of bytes, such as the content of a file, a raw stream of network traffic, or a data blob captured from memory. The content may be embedded directly via payload_bin or referenced via url." ; "Artifact Object"@en . ### https://cyberterrain.org/ns/stones#AttackMotivationVocabulary :AttackMotivationVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#AttackPattern :AttackPattern rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "attack-pattern" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixDomainObject , [ rdf:type owl:Restriction ; owl:onProperty :name ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A type of Tactics, Techniques, and Procedures (TTP) that describes ways that adversaries attempt to compromise targets. Often maps to MITRE ATT&CK techniques." ; "Attack Pattern"@en . ### https://cyberterrain.org/ns/stones#AttackResourceLevelVocabulary :AttackResourceLevelVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#AutonomousSystemObject :AutonomousSystemObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "autonomous-system" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixCyberobservableObject ; rdfs:isDefinedBy ; "Represents an Autonomous System (AS), a collection of IP routing prefixes under the control of a single administrative entity, identified by its AS number." ; "Autonomous System Object"@en . ### https://cyberterrain.org/ns/stones#Campaign :Campaign rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "campaign" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixDomainObject , [ rdf:type owl:Restriction ; owl:onProperty :name ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A grouping of adversary behaviours and resources with a common objective pursued over a period of time. Campaigns may be attributed to intrusion sets or threat actors." ; "Campaign"@en . ### https://cyberterrain.org/ns/stones#CourseOfAction :CourseOfAction rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "course-of-action" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixDomainObject , [ rdf:type owl:Restriction ; owl:onProperty :name ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A recommendation for a specific measure to be taken in response to an attack. May describe automated responses, playbook steps, or manual mitigations." ; "Course of Action"@en . ### https://cyberterrain.org/ns/stones#DirectoryObject :DirectoryObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "directory" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixCyberobservableObject ; rdfs:isDefinedBy ; "Represents a file system directory, conveying its path and timestamps. May reference the files and sub-directories it contains." ; "Directory Object"@en . ### https://cyberterrain.org/ns/stones#DomainNameObject :DomainNameObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "domain-name" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixCyberobservableObject ; rdfs:isDefinedBy ; "Represents a network domain name. Can reference the IP addresses it resolves to." ; "Domain Name Object"@en . ### https://cyberterrain.org/ns/stones#EmailAddressObject :EmailAddressObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "email-addr" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixCyberobservableObject ; rdfs:isDefinedBy ; "Represents a single email address, optionally associating it with a display name and a user account." ; "Email Address Object"@en . ### https://cyberterrain.org/ns/stones#EmailMessageObject :EmailMessageObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "email-message" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixCyberobservableObject ; rdfs:isDefinedBy ; "Represents an email message, including its headers, body, and any MIME parts." ; "Email Message Object"@en . ### https://cyberterrain.org/ns/stones#EmailMimePart :EmailMimePart rdf:type owl:Class ; rdfs:subClassOf :StixSubType ; rdfs:isDefinedBy ; "A single MIME part within a multipart email message, including its body content, content type, and content disposition." ; "Email MIME Part"@en . ### https://cyberterrain.org/ns/stones#EncryptionAlgorithmEnumeration :EncryptionAlgorithmEnumeration rdf:type owl:Class ; owl:equivalentClass [ rdf:type owl:Class ; owl:oneOf ( ) ] ; rdfs:subClassOf :Enumeration . ### https://cyberterrain.org/ns/stones#Enumeration :Enumeration rdf:type owl:Class ; rdfs:subClassOf :Vocabulary . ### https://cyberterrain.org/ns/stones#ExtensionDefinitionObject :ExtensionDefinitionObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "extension-definition" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixMetaObject ; rdfs:isDefinedBy ; "Defines a schema extension to STIX 2.1. Allows producers to add new properties or new object types in a structured, interoperable way." ; "Extension Definition Object"@en . ### https://cyberterrain.org/ns/stones#ExtensionTypesEnumeration :ExtensionTypesEnumeration rdf:type owl:Class ; owl:equivalentClass [ rdf:type owl:Class ; owl:oneOf ( ) ] ; rdfs:subClassOf :Enumeration . ### https://cyberterrain.org/ns/stones#ExternalReference :ExternalReference rdf:type owl:Class ; rdfs:subClassOf :StixSubType , [ rdf:type owl:Restriction ; owl:onProperty :sourceName ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A structured reference to non-STIX information, such as a CVE entry, MITRE ATT&CK technique, or external URL. Used to link STIX content to authoritative external sources." ; "External Reference"@en . ### https://cyberterrain.org/ns/stones#FileObject :FileObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "file" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixCyberobservableObject ; rdfs:isDefinedBy ; "Represents a file with its metadata and optional content reference. Supports extensions for archive files, NTFS streams, PE binaries, PDF documents, and raster images." ; "File Object"@en . ### https://cyberterrain.org/ns/stones#GranularMarking :GranularMarking rdf:type owl:Class ; rdfs:subClassOf :StixSubType , [ rdf:type owl:Restriction ; owl:onProperty :markingRef ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :selectors ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A property-level data handling marking that applies a marking definition to specific named fields of a STIX object, enabling fine-grained access control." ; "Granular Marking"@en . ### https://cyberterrain.org/ns/stones#Grouping :Grouping rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "grouping" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixDomainObject , [ rdf:type owl:Restriction ; owl:onProperty :context ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :objectRefs ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Explicitly asserts that a set of STIX objects share a common context without implying the existence of a threat report. Useful for linking related objects without a formal report." ; "Grouping"@en . ### https://cyberterrain.org/ns/stones#GroupingContextVocabulary :GroupingContextVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#HashEntry :HashEntry rdf:type owl:Class ; rdfs:subClassOf :StixSubType , [ rdf:type owl:Restriction ; owl:onProperty :algorithm ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :hashValue ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A single cryptographic hash entry associating a hashing algorithm with its hex-encoded digest value. Used to represent entries in the STIX hashes dictionary." ; "Hash Entry"@en . ### https://cyberterrain.org/ns/stones#HashingAlgorithmVocabulary :HashingAlgorithmVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#IPv4AddressObject :IPv4AddressObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "ipv4-addr" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixCyberobservableObject ; rdfs:isDefinedBy ; "Represents one or more IPv4 addresses expressed using CIDR notation." ; "IPv4 Address Object"@en . ### https://cyberterrain.org/ns/stones#IPv6AddressObject :IPv6AddressObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "ipv6-addr" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixCyberobservableObject ; rdfs:isDefinedBy ; "Represents one or more IPv6 addresses expressed using CIDR notation." ; "IPv6 Address Object"@en . ### https://cyberterrain.org/ns/stones#Identity :Identity rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "identity" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixDomainObject , [ rdf:type owl:Restriction ; owl:onProperty :name ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Actual individuals, organisations, or groups, as well as classes of individuals, organisations, systems, or groups. Used to represent victims, producers, or any other real-world actor." ; "Identity"@en . ### https://cyberterrain.org/ns/stones#IdentityClassVocabulary :IdentityClassVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#ImplementationLanguageVocabulary :ImplementationLanguageVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#Indicator :Indicator rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "indicator" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixDomainObject , [ rdf:type owl:Restriction ; owl:onProperty :indicatorTypes ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :patternType ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :pattern ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :validFrom ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Contains a pattern that can be used to detect suspicious or malicious cyber activity. Patterns are expressed using the STIX Patterning Language or another supported pattern language." ; "Indicator"@en . ### https://cyberterrain.org/ns/stones#IndicatorTypeVocabulary :IndicatorTypeVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#IndustrySectorVocabulary :IndustrySectorVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#Infrastructure :Infrastructure rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "infrastructure" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixDomainObject , [ rdf:type owl:Restriction ; owl:onProperty :infrastructureTypes ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :name ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Represents systems, software services, or any group of resources used to conduct cyber operations. Infrastructure is used by threat actors and intrusion sets both offensively and defensively." ; "Infrastructure"@en . ### https://cyberterrain.org/ns/stones#InfrastuctureTypeVocabulary :InfrastuctureTypeVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#IntrusionSet :IntrusionSet rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "intrusion-set" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixDomainObject , [ rdf:type owl:Restriction ; owl:onProperty :name ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A grouped set of adversarial behaviours and resources with common properties, believed to be orchestrated by a single organisation. Often represents a named APT group." ; "Intrusion Set"@en . ### https://cyberterrain.org/ns/stones#KillChainPhase :KillChainPhase rdf:type owl:Class ; rdfs:subClassOf :StixSubType , [ rdf:type owl:Restriction ; owl:onProperty :killChainName ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :phaseName ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Represents a phase within a named kill chain framework, such as the MITRE ATT&CK or Lockheed Martin Cyber Kill Chain, used to categorise the stage of an attack." ; "Kill Chain Phase"@en . ### https://cyberterrain.org/ns/stones#LanguageContentObject :LanguageContentObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "language-content" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixMetaObject ; rdfs:isDefinedBy ; "Provides translations of string properties of another STIX object into different languages. Allows internationalisation without modifying the original object." ; "Language Content Object"@en . ### https://cyberterrain.org/ns/stones#Location :Location rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "location" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixDomainObject , [ rdf:type owl:Restriction ; owl:onProperty :region ; owl:maxCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :country ; owl:maxCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :latitude ; owl:maxCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :longitude ; owl:maxCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Represents a geographic location. May be as specific as a latitude/longitude coordinate or as broad as a continent. At least one of region, country, or latitude/longitude must be provided." ; "Location"@en . ### https://cyberterrain.org/ns/stones#MACAddressObject :MACAddressObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "mac-addr" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixCyberobservableObject ; rdfs:isDefinedBy ; "Represents a single MAC address expressed in lowercase IEEE 802 colon-hexadecimal notation." ; "MAC Address Object"@en . ### https://cyberterrain.org/ns/stones#Malware :Malware rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "malware" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixDomainObject , [ rdf:type owl:Restriction ; owl:onProperty :malwareTypes ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :isFamily ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A type of TTP that represents malicious code. Captures both malware families (when is_family is true) and specific instances or samples." ; "Malware"@en . ### https://cyberterrain.org/ns/stones#MalwareAnalysis :MalwareAnalysis rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "malware-analysis" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixDomainObject , [ rdf:type owl:Restriction ; owl:onProperty :product ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Captures the results of a malware analysis process, whether static or dynamic. Represents the output of a specific analysis run on a specific sample." ; "Malware Analysis"@en . ### https://cyberterrain.org/ns/stones#MalwareCapabilitesVocabulary :MalwareCapabilitesVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#MalwareResultVocabulary :MalwareResultVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#MalwareTypeVocabulary :MalwareTypeVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#MarkingDefinitionObject :MarkingDefinitionObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "marking-definition" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixMetaObject ; rdfs:isDefinedBy ; "Defines a data handling marking used to restrict or label how STIX data can be shared or handled, such as TLP markings. Referenced by object_marking_refs or granular_markings." ; "Marking Definition Object"@en . ### https://cyberterrain.org/ns/stones#MutexObject :MutexObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "mutex" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixCyberobservableObject ; rdfs:isDefinedBy ; "Represents a named mutual-exclusion object, commonly created or checked by malware to prevent multiple concurrent instances from running." ; "Mutex Object"@en . ### https://cyberterrain.org/ns/stones#NetworkSocketAddressFamilyEnumeration :NetworkSocketAddressFamilyEnumeration rdf:type owl:Class ; owl:equivalentClass [ rdf:type owl:Class ; owl:oneOf ( ) ] ; rdfs:subClassOf :Enumeration . ### https://cyberterrain.org/ns/stones#NetworkSocketTypeEnumeration :NetworkSocketTypeEnumeration rdf:type owl:Class ; owl:equivalentClass [ rdf:type owl:Class ; owl:oneOf ( ) ] ; rdfs:subClassOf :Enumeration . ### https://cyberterrain.org/ns/stones#NetworkTrafficObject :NetworkTrafficObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "network-traffic" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixCyberobservableObject ; rdfs:isDefinedBy ; "Represents an arbitrary network traffic flow between source and destination endpoints. Supports extensions for HTTP, ICMP, socket, and TCP specifics." ; "Network Traffic Object"@en . ### https://cyberterrain.org/ns/stones#Note :Note rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "note" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixDomainObject , [ rdf:type owl:Restriction ; owl:onProperty :objectRefs ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :content ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Conveys informational text to provide further context and/or to assess the accuracy of existing STIX information. Similar to a comment or annotation on other STIX objects." ; "Note"@en . ### https://cyberterrain.org/ns/stones#ObservedData :ObservedData rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "observed-data" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixDomainObject , [ rdf:type owl:Restriction ; owl:onProperty :objectRefs ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :firstObserved ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :lastObserved ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :numberObserved ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Conveys information observed on systems and networks, wrapping one or more SCO references together with observation metadata such as first and last observed timestamps." ; "Observed Data"@en . ### https://cyberterrain.org/ns/stones#OpenVocabulary :OpenVocabulary rdf:type owl:Class ; rdfs:subClassOf :Vocabulary . ### https://cyberterrain.org/ns/stones#Opinion :Opinion rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "opinion" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixDomainObject , [ rdf:type owl:Restriction ; owl:onProperty :objectRefs ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :opinion ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "An assessment of the correctness of information in one or more STIX objects. Allows analysts to express agreement or disagreement with existing intelligence." ; "Opinion"@en . ### https://cyberterrain.org/ns/stones#OpinionEnumeration :OpinionEnumeration rdf:type owl:Class ; owl:equivalentClass [ rdf:type owl:Class ; owl:oneOf ( ) ] ; rdfs:subClassOf :Enumeration . ### https://cyberterrain.org/ns/stones#PatternTypeVocabulary :PatternTypeVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#ProcessObject :ProcessObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "process" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixCyberobservableObject ; rdfs:isDefinedBy ; "Represents a running or terminated process on a host. Supports extensions for Windows-specific process and service attributes." ; "Process Object"@en . ### https://cyberterrain.org/ns/stones#ProcessorArchitectureVocabulary :ProcessorArchitectureVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#RegionVocabulary :RegionVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#Relationship :Relationship rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "relationship" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixRelationshipObject , [ rdf:type owl:Restriction ; owl:onProperty :sourceRef ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :targetRef ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :relationshipType ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A directed link between two STIX Core Objects. The semantics of the link are defined by the relationship_type property." ; "Relationship"@en . ### https://cyberterrain.org/ns/stones#RelationshipTypeVocabulary :RelationshipTypeVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#Report :Report rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "report" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixDomainObject , [ rdf:type owl:Restriction ; owl:onProperty :objectRefs ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :reportTypes ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :name ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :published ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A collection of threat intelligence focused on one or more topics, such as a description of a threat actor, malware, or attack technique. Used to package related STIX content." ; "Report"@en . ### https://cyberterrain.org/ns/stones#ReportTypeVocabulary :ReportTypeVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#Sighting :Sighting rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "sighting" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixRelationshipObject , [ rdf:type owl:Restriction ; owl:onProperty :sightingOfRef ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Records that a STIX object such as an indicator, malware, tool, or threat actor was seen. Wraps observation metadata around a reference to the sighted object." ; "Sighting"@en . ### https://cyberterrain.org/ns/stones#SoftwareObject :SoftwareObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "software" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixCyberobservableObject ; rdfs:isDefinedBy ; "Represents a software product, including commercial applications, operating systems, libraries, and utilities." ; "Software Object"@en . ### https://cyberterrain.org/ns/stones#StixBundle :StixBundle rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "bundle" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixObject ; rdfs:isDefinedBy ; "A collection of arbitrary STIX objects used as a transport container. Bundles are not Core Objects, carry no modified timestamp, and cannot be referenced by identifier." ; "STIX Bundle"@en . ### https://cyberterrain.org/ns/stones#StixCoreObject :StixCoreObject rdf:type owl:Class ; rdfs:subClassOf :StixObject , [ rdf:type owl:Restriction ; owl:onProperty :created ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :modified ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Abstract class for STIX Core Objects, comprising SDOs, SCOs, and SROs. Core objects carry a type-qualified identifier and created/modified timestamps, and may be referenced by other objects." ; "STIX Core Object"@en . ### https://cyberterrain.org/ns/stones#StixCyberobservableObject :StixCyberobservableObject rdf:type owl:Class ; rdfs:subClassOf :StixCoreObject ; rdfs:isDefinedBy ; "Abstract class for STIX Cyber Observable Objects (SCOs), which represent technical observations such as IP addresses, files, network traffic, and processes." ; "STIX Cyber Observable Object"@en . ### https://cyberterrain.org/ns/stones#StixDomainObject :StixDomainObject rdf:type owl:Class ; rdfs:subClassOf :StixCoreObject ; rdfs:isDefinedBy ; "Abstract class for STIX Domain Objects (SDOs), which represent modelled cyber threat intelligence concepts such as malware, campaigns, threat actors, and vulnerabilities." ; "STIX Domain Object"@en . ### https://cyberterrain.org/ns/stones#StixMetaObject :StixMetaObject rdf:type owl:Class ; rdfs:subClassOf :StixObject ; rdfs:isDefinedBy ; "Abstract class for STIX Meta Objects, which provide supporting infrastructure for the STIX ecosystem, including data markings, language translations, and extension definitions." ; "STIX Meta Object"@en . ### https://cyberterrain.org/ns/stones#StixObject :StixObject rdf:type owl:Class ; rdfs:subClassOf [ rdf:type owl:Restriction ; owl:onProperty :specVersion ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :stixId ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; owl:disjointWith :StixSubType ; owl:hasKey ( :stixId ) ; rdfs:isDefinedBy ; "The top-level abstract class for all STIX objects, encompassing STIX Core Objects (SDOs, SCOs, SROs), Meta Objects, and Bundles." ; "STIX Object"@en . ### https://cyberterrain.org/ns/stones#StixRelationshipObject :StixRelationshipObject rdf:type owl:Class ; rdfs:subClassOf :StixCoreObject ; rdfs:isDefinedBy ; "Abstract class for STIX Relationship Objects (SROs), which link Core Objects to express directed relationships and sightings between them." ; "STIX Relationship Object"@en . ### https://cyberterrain.org/ns/stones#StixSubType :StixSubType rdf:type owl:Class ; rdfs:isDefinedBy ; "Abstract class for structured sub-types defined by the STIX 2.1 specification that are embedded as property values within STIX objects. Instances are not STIX objects: they carry no identifier, type, spec_version, created, or modified properties and cannot be referenced by identifier from other objects. Subclasses include ExternalReference, GranularMarking, KillChainPhase, HashEntry, EmailMimePart, AlternateDataStream, WindowsPeSection, WindowsRegistryValue, and X509V3Extensions." ; "STIX Sub-Type"@en . ### https://cyberterrain.org/ns/stones#ThreatActor :ThreatActor rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "threat-actor" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixDomainObject , [ rdf:type owl:Restriction ; owl:onProperty :threatActorTypes ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :name ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Actual individuals, groups, or organisations believed to be operating with malicious intent. Unlike Identity, a ThreatActor carries adversarial connotations." ; "Threat Actor"@en . ### https://cyberterrain.org/ns/stones#ThreatActorRoleVocabulary :ThreatActorRoleVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#ThreatActorSophisticationVocabulary :ThreatActorSophisticationVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#ThreatActorTypeVocabulary :ThreatActorTypeVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#Tool :Tool rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "tool" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixDomainObject , [ rdf:type owl:Restriction ; owl:onProperty :toolTypes ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] , [ rdf:type owl:Restriction ; owl:onProperty :name ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "Legitimate software that can be used by threat actors to perform attacks. Distinguishable from malware by being designed for benign purposes but repurposed maliciously." ; "Tool"@en . ### https://cyberterrain.org/ns/stones#ToolTypeVocabulary :ToolTypeVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#URLObject :URLObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "url" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixCyberobservableObject ; rdfs:isDefinedBy ; "Represents a Uniform Resource Locator conforming to RFC 3986." ; "URL Object"@en . ### https://cyberterrain.org/ns/stones#UserAccountObject :UserAccountObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "user-account" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixCyberobservableObject ; rdfs:isDefinedBy ; "Represents a user account on a system or service, including local OS accounts, cloud accounts, and social media accounts. Supports a unix-account extension for POSIX attributes." ; "User Account Object"@en . ### https://cyberterrain.org/ns/stones#Vocabulary :Vocabulary rdf:type owl:Class . ### https://cyberterrain.org/ns/stones#Vulnerability :Vulnerability rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "vulnerability" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixDomainObject , [ rdf:type owl:Restriction ; owl:onProperty :name ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A mistake in software that can be directly used by a threat actor to gain access to a system or network. Typically identified by a CVE number via an external reference." ; "Vulnerability"@en . ### https://cyberterrain.org/ns/stones#WindowsIntegrityLevelEnumeration :WindowsIntegrityLevelEnumeration rdf:type owl:Class ; owl:equivalentClass [ rdf:type owl:Class ; owl:oneOf ( ) ] ; rdfs:subClassOf :Enumeration . ### https://cyberterrain.org/ns/stones#WindowsPEBinaryVocabulary :WindowsPEBinaryVocabulary rdf:type owl:Class ; rdfs:subClassOf :OpenVocabulary . ### https://cyberterrain.org/ns/stones#WindowsPeSection :WindowsPeSection rdf:type owl:Class ; rdfs:subClassOf :StixSubType , [ rdf:type owl:Restriction ; owl:onProperty :name ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A single section entry within a Windows PE (Portable Executable) binary, described by its name, size, and optional entropy value." ; "Windows PE Section"@en . ### https://cyberterrain.org/ns/stones#WindowsRegistryDatatypeEnumeration :WindowsRegistryDatatypeEnumeration rdf:type owl:Class ; owl:equivalentClass [ rdf:type owl:Class ; owl:oneOf ( ) ] ; rdfs:subClassOf :Enumeration . ### https://cyberterrain.org/ns/stones#WindowsRegistryKeyObject :WindowsRegistryKeyObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "windows-registry-key" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixCyberobservableObject ; rdfs:isDefinedBy ; "Represents a Windows Registry key with its full path, value entries, modification timestamp, and creator." ; "Windows Registry Key Object"@en . ### https://cyberterrain.org/ns/stones#WindowsRegistryValue :WindowsRegistryValue rdf:type owl:Class ; rdfs:subClassOf :StixSubType , [ rdf:type owl:Restriction ; owl:onProperty :name ; owl:minCardinality "1"^^xsd:nonNegativeInteger ] ; rdfs:isDefinedBy ; "A single value entry within a Windows Registry key, comprising a name, a data string, and a registry data type." ; "Windows Registry Value"@en . ### https://cyberterrain.org/ns/stones#WindowsServiceStartTypeEnumeration :WindowsServiceStartTypeEnumeration rdf:type owl:Class ; owl:equivalentClass [ rdf:type owl:Class ; owl:oneOf ( ) ] ; rdfs:subClassOf :Enumeration . ### https://cyberterrain.org/ns/stones#WindowsServiceStatusEnumeration :WindowsServiceStatusEnumeration rdf:type owl:Class ; owl:equivalentClass [ rdf:type owl:Class ; owl:oneOf ( ) ] ; rdfs:subClassOf :Enumeration . ### https://cyberterrain.org/ns/stones#WindowsServiceTypeEnumeration :WindowsServiceTypeEnumeration rdf:type owl:Class ; owl:equivalentClass [ rdf:type owl:Class ; owl:oneOf ( ) ] ; rdfs:subClassOf :Enumeration . ### https://cyberterrain.org/ns/stones#X509CertificateObject :X509CertificateObject rdf:type owl:Class ; owl:equivalentClass [ owl:intersectionOf ( :StixObject [ rdf:type owl:Restriction ; owl:onProperty :stixType ; owl:hasValue "x509-certificate" ] ) ; rdf:type owl:Class ] ; rdfs:subClassOf :StixCyberobservableObject ; rdfs:isDefinedBy ; "Represents an X.509 digital certificate, capturing its subject, issuer, validity window, public key details, and optional v3 extensions." ; "X.509 Certificate Object"@en . ### https://cyberterrain.org/ns/stones#X509V3Extensions :X509V3Extensions rdf:type owl:Class ; rdfs:subClassOf :StixSubType ; rdfs:isDefinedBy ; "The set of X.509 version 3 extension fields present in a digital certificate, such as key usage, subject alternative names, and CRL distribution points." ; "X.509 v3 Extensions"@en . ################################################################# # Individuals ################################################################# ### https://cyberterrain.org/ns/stonex#_AES-256-GCM rdf:type owl:NamedIndividual , :EncryptionAlgorithmEnumeration ; "AES-256-GCM" . ### https://cyberterrain.org/ns/stonex#_AF_APPLETALK rdf:type owl:NamedIndividual , :NetworkSocketAddressFamilyEnumeration ; "AF_APPLETALK" . ### https://cyberterrain.org/ns/stonex#_AF_BTH rdf:type owl:NamedIndividual , :NetworkSocketAddressFamilyEnumeration ; "AF_BTH" . ### https://cyberterrain.org/ns/stonex#_AF_INET rdf:type owl:NamedIndividual , :NetworkSocketAddressFamilyEnumeration ; "AF_INET" . ### https://cyberterrain.org/ns/stonex#_AF_INET6 rdf:type owl:NamedIndividual , :NetworkSocketAddressFamilyEnumeration ; "AF_INET6" . ### https://cyberterrain.org/ns/stonex#_AF_IPX rdf:type owl:NamedIndividual , :NetworkSocketAddressFamilyEnumeration ; "AF_IPX" . ### https://cyberterrain.org/ns/stonex#_AF_IRDA rdf:type owl:NamedIndividual , :NetworkSocketAddressFamilyEnumeration ; "AF_IRDA" . ### https://cyberterrain.org/ns/stonex#_AF_NETBIOS rdf:type owl:NamedIndividual , :NetworkSocketAddressFamilyEnumeration ; "AF_NETBIOS" . ### https://cyberterrain.org/ns/stonex#_AF_UNSPEC rdf:type owl:NamedIndividual , :NetworkSocketAddressFamilyEnumeration ; "AF_UNSPEC" . ### https://cyberterrain.org/ns/stonex#_ChaCha20-Poly1305 rdf:type owl:NamedIndividual , :EncryptionAlgorithmEnumeration ; "ChaCha20-Poly1305" . ### https://cyberterrain.org/ns/stonex#_MD5 rdf:type owl:NamedIndividual , :HashingAlgorithmVocabulary ; "MD5" . ### https://cyberterrain.org/ns/stonex#_MD6 rdf:type owl:NamedIndividual , :HashingAlgorithmVocabulary ; "MD6" . ### https://cyberterrain.org/ns/stonex#_REG_BINARY rdf:type owl:NamedIndividual , :WindowsRegistryDatatypeEnumeration ; "REG_BINARY" . ### https://cyberterrain.org/ns/stonex#_REG_DWORD rdf:type owl:NamedIndividual , :WindowsRegistryDatatypeEnumeration ; "REG_DWORD" . ### https://cyberterrain.org/ns/stonex#_REG_DWORD_BIG_ENDIAN rdf:type owl:NamedIndividual , :WindowsRegistryDatatypeEnumeration ; "REG_DWORD_BIG_ENDIAN" . ### https://cyberterrain.org/ns/stonex#_REG_DWORD_LITTLE_ENDIAN rdf:type owl:NamedIndividual , :WindowsRegistryDatatypeEnumeration ; "REG_DWORD_LITTLE_ENDIAN" . ### https://cyberterrain.org/ns/stonex#_REG_EXPAND_SZ rdf:type owl:NamedIndividual , :WindowsRegistryDatatypeEnumeration ; "REG_EXPAND_SZ" . ### https://cyberterrain.org/ns/stonex#_REG_FULL_RESOURCE_DESCRIPTION rdf:type owl:NamedIndividual , :WindowsRegistryDatatypeEnumeration ; "REG_FULL_RESOURCE_DESCRIPTION" . ### https://cyberterrain.org/ns/stonex#_REG_INVALID_TYPE rdf:type owl:NamedIndividual , :WindowsRegistryDatatypeEnumeration ; "REG_INVALID_TYPE" . ### https://cyberterrain.org/ns/stonex#_REG_LINK rdf:type owl:NamedIndividual , :WindowsRegistryDatatypeEnumeration ; "REG_LINK" . ### https://cyberterrain.org/ns/stonex#_REG_MULTI_SZ rdf:type owl:NamedIndividual , :WindowsRegistryDatatypeEnumeration ; "REG_MULTI_SZ" . ### https://cyberterrain.org/ns/stonex#_REG_NONE rdf:type owl:NamedIndividual , :WindowsRegistryDatatypeEnumeration ; "REG_NONE" . ### https://cyberterrain.org/ns/stonex#_REG_QWORD rdf:type owl:NamedIndividual , :WindowsRegistryDatatypeEnumeration ; "REG_QWORD" . ### https://cyberterrain.org/ns/stonex#_REG_RESOURCE_LIST rdf:type owl:NamedIndividual , :WindowsRegistryDatatypeEnumeration ; "REG_RESOURCE_LIST" . ### https://cyberterrain.org/ns/stonex#_REG_RESOURCE_REQUIREMENTS_LIST rdf:type owl:NamedIndividual , :WindowsRegistryDatatypeEnumeration ; "REG_RESOURCE_REQUIREMENTS_LIST" . ### https://cyberterrain.org/ns/stonex#_REG_SZ rdf:type owl:NamedIndividual , :WindowsRegistryDatatypeEnumeration ; "REG_SZ" . ### https://cyberterrain.org/ns/stonex#_RIPEMD-160 rdf:type owl:NamedIndividual , :HashingAlgorithmVocabulary ; "RIPEMD-160" . ### https://cyberterrain.org/ns/stonex#_SERVICE_AUTO_START rdf:type owl:NamedIndividual , :WindowsServiceStartTypeEnumeration ; "SERVICE_AUTO_START" . ### https://cyberterrain.org/ns/stonex#_SERVICE_BOOT_START rdf:type owl:NamedIndividual , :WindowsServiceStartTypeEnumeration ; "SERVICE_BOOT_START" . ### https://cyberterrain.org/ns/stonex#_SERVICE_CONTINUE_PENDING rdf:type owl:NamedIndividual , :WindowsServiceStatusEnumeration ; "SERVICE_CONTINUE_PENDING" . ### https://cyberterrain.org/ns/stonex#_SERVICE_DEMAND_START rdf:type owl:NamedIndividual , :WindowsServiceStartTypeEnumeration ; "SERVICE_DEMAND_START" . ### https://cyberterrain.org/ns/stonex#_SERVICE_DISABLED rdf:type owl:NamedIndividual , :WindowsServiceStartTypeEnumeration ; "SERVICE_DISABLED" . ### https://cyberterrain.org/ns/stonex#_SERVICE_FILE_SYSTEM_DRIVER rdf:type owl:NamedIndividual , :WindowsServiceTypeEnumeration ; "SERVICE_FILE_SYSTEM_DRIVER" . ### https://cyberterrain.org/ns/stonex#_SERVICE_KERNEL_DRIVER rdf:type owl:NamedIndividual , :WindowsServiceTypeEnumeration ; "SERVICE_KERNEL_DRIVER" . ### https://cyberterrain.org/ns/stonex#_SERVICE_PAUSED rdf:type owl:NamedIndividual , :WindowsServiceStatusEnumeration ; "SERVICE_PAUSED" . ### https://cyberterrain.org/ns/stonex#_SERVICE_PAUSE_PENDING rdf:type owl:NamedIndividual , :WindowsServiceStatusEnumeration ; "SERVICE_PAUSE_PENDING" . ### https://cyberterrain.org/ns/stonex#_SERVICE_RUNNING rdf:type owl:NamedIndividual , :WindowsServiceStatusEnumeration ; "SERVICE_RUNNING" . ### https://cyberterrain.org/ns/stonex#_SERVICE_START_PENDING rdf:type owl:NamedIndividual , :WindowsServiceStatusEnumeration ; "SERVICE_START_PENDING" . ### https://cyberterrain.org/ns/stonex#_SERVICE_STOPPED rdf:type owl:NamedIndividual , :WindowsServiceStatusEnumeration ; "SERVICE_STOPPED" . ### https://cyberterrain.org/ns/stonex#_SERVICE_STOP_PENDING rdf:type owl:NamedIndividual , :WindowsServiceStatusEnumeration ; "SERVICE_STOP_PENDING" . ### https://cyberterrain.org/ns/stonex#_SERVICE_SYSTEM_ALERT rdf:type owl:NamedIndividual , :WindowsServiceStartTypeEnumeration ; "SERVICE_SYSTEM_ALERT" . ### https://cyberterrain.org/ns/stonex#_SERVICE_WIN32_OWN_PROCESS rdf:type owl:NamedIndividual , :WindowsServiceTypeEnumeration ; "SERVICE_WIN32_OWN_PROCESS" . ### https://cyberterrain.org/ns/stonex#_SERVICE_WIN32_SHARE_PROCESS rdf:type owl:NamedIndividual , :WindowsServiceTypeEnumeration ; "SERVICE_WIN32_SHARE_PROCESS" . ### https://cyberterrain.org/ns/stonex#_SHA-1 rdf:type owl:NamedIndividual , :HashingAlgorithmVocabulary ; "SHA-1" . ### https://cyberterrain.org/ns/stonex#_SHA-224 rdf:type owl:NamedIndividual , :HashingAlgorithmVocabulary ; "SHA-224" . ### https://cyberterrain.org/ns/stonex#_SHA-256 rdf:type owl:NamedIndividual , :HashingAlgorithmVocabulary ; "SHA-256" . ### https://cyberterrain.org/ns/stonex#_SHA-384 rdf:type owl:NamedIndividual , :HashingAlgorithmVocabulary ; "SHA-384" . ### https://cyberterrain.org/ns/stonex#_SHA-512 rdf:type owl:NamedIndividual , :HashingAlgorithmVocabulary ; "SHA-512" . ### https://cyberterrain.org/ns/stonex#_SHA3-224 rdf:type owl:NamedIndividual , :HashingAlgorithmVocabulary ; "SHA3-224" . ### https://cyberterrain.org/ns/stonex#_SHA3-256 rdf:type owl:NamedIndividual , :HashingAlgorithmVocabulary ; "SHA3-256" . ### https://cyberterrain.org/ns/stonex#_SHA3-384 rdf:type owl:NamedIndividual , :HashingAlgorithmVocabulary ; "SHA3-384" . ### https://cyberterrain.org/ns/stonex#_SHA3-512 rdf:type owl:NamedIndividual , :HashingAlgorithmVocabulary ; "SHA3-512" . ### https://cyberterrain.org/ns/stonex#_SOCK_DGRAM rdf:type owl:NamedIndividual , :NetworkSocketTypeEnumeration ; "SOCK_DGRAM" . ### https://cyberterrain.org/ns/stonex#_SOCK_RAW rdf:type owl:NamedIndividual , :NetworkSocketTypeEnumeration ; "SOCK_RAW" . ### https://cyberterrain.org/ns/stonex#_SOCK_RDM rdf:type owl:NamedIndividual , :NetworkSocketTypeEnumeration ; "SOCK_RDM" . ### https://cyberterrain.org/ns/stonex#_SOCK_SEQPACKET rdf:type owl:NamedIndividual , :NetworkSocketTypeEnumeration ; "SOCK_SEQPACKET" . ### https://cyberterrain.org/ns/stonex#_SOCK_STREAM rdf:type owl:NamedIndividual , :NetworkSocketTypeEnumeration ; "SOCK_STREAM" . ### https://cyberterrain.org/ns/stonex#_SSDEEP rdf:type owl:NamedIndividual , :HashingAlgorithmVocabulary ; "SSDEEP" . ### https://cyberterrain.org/ns/stonex#_TLSH rdf:type owl:NamedIndividual , :HashingAlgorithmVocabulary ; "TLSH" . ### https://cyberterrain.org/ns/stonex#_accesses-remote-machines rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "accesses-remote-machines" . ### https://cyberterrain.org/ns/stonex#_accidental rdf:type owl:NamedIndividual , :AttackMotivationVocabulary ; "accidental" . ### https://cyberterrain.org/ns/stonex#_activist rdf:type owl:NamedIndividual , :ThreatActorTypeVocabulary ; "activist" . ### https://cyberterrain.org/ns/stonex#_advanced rdf:type owl:NamedIndividual , :ThreatActorSophisticationVocabulary ; "advanced" . ### https://cyberterrain.org/ns/stonex#_adware rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "adware" . ### https://cyberterrain.org/ns/stonex#_aerospace rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "aerospace" . ### https://cyberterrain.org/ns/stonex#_africa rdf:type owl:NamedIndividual , :RegionVocabulary ; "africa" . ### https://cyberterrain.org/ns/stonex#_agent rdf:type owl:NamedIndividual , :ThreatActorRoleVocabulary ; "agent" . ### https://cyberterrain.org/ns/stonex#_agree rdf:type owl:NamedIndividual , :OpinionEnumeration ; "agree" . ### https://cyberterrain.org/ns/stonex#_agriculture rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "agriculture" . ### https://cyberterrain.org/ns/stonex#_alpha rdf:type owl:NamedIndividual , :ProcessorArchitectureVocabulary ; "alpha" . ### https://cyberterrain.org/ns/stonex#_amplification rdf:type owl:NamedIndividual , :InfrastuctureTypeVocabulary ; "amplification" . ### https://cyberterrain.org/ns/stonex#_analysis-of rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "analysis-of" . ### https://cyberterrain.org/ns/stonex#_anomalous-activity rdf:type owl:NamedIndividual , :IndicatorTypeVocabulary ; "anomalous-activity" . ### https://cyberterrain.org/ns/stonex#_anonymization rdf:type owl:NamedIndividual , :IndicatorTypeVocabulary , :InfrastuctureTypeVocabulary ; "anonymization" . ### https://cyberterrain.org/ns/stonex#_anti-debugging rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "anti-debugging" . ### https://cyberterrain.org/ns/stonex#_anti-disassembly rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "anti-disassembly" . ### https://cyberterrain.org/ns/stonex#_anti-emulation rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "anti-emulation" . ### https://cyberterrain.org/ns/stonex#_anti-memory-forensics rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "anti-memory-forensics" . ### https://cyberterrain.org/ns/stonex#_anti-sandbox rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "anti-sandbox" . ### https://cyberterrain.org/ns/stonex#_anti-vm rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "anti-vm" . ### https://cyberterrain.org/ns/stonex#_applescript rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary ; "applescript" . ### https://cyberterrain.org/ns/stonex#_arm rdf:type owl:NamedIndividual , :ProcessorArchitectureVocabulary ; "arm" . ### https://cyberterrain.org/ns/stonex#_asia rdf:type owl:NamedIndividual , :RegionVocabulary ; "asia" . ### https://cyberterrain.org/ns/stonex#_attack-pattern rdf:type owl:NamedIndividual , :ReportTypeVocabulary ; "attack-pattern" . ### https://cyberterrain.org/ns/stonex#_attributed-to rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "attributed-to" . ### https://cyberterrain.org/ns/stonex#_attribution rdf:type owl:NamedIndividual , :IndicatorTypeVocabulary ; "attribution" . ### https://cyberterrain.org/ns/stonex#_australia-new-zealand rdf:type owl:NamedIndividual , :RegionVocabulary ; "australia-new-zealand" . ### https://cyberterrain.org/ns/stonex#_authored-by rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "authored-by" . ### https://cyberterrain.org/ns/stonex#_automotive rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "automotive" . ### https://cyberterrain.org/ns/stonex#_backdoor rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "backdoor" . ### https://cyberterrain.org/ns/stonex#_based-on rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "based-on" . ### https://cyberterrain.org/ns/stonex#_bash rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary ; "bash" . ### https://cyberterrain.org/ns/stonex#_beacons-to rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "beacons-to" . ### https://cyberterrain.org/ns/stonex#_benign rdf:type owl:NamedIndividual , :IndicatorTypeVocabulary , :MalwareResultVocabulary ; "benign" . ### https://cyberterrain.org/ns/stonex#_bootkit rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "bootkit" . ### https://cyberterrain.org/ns/stonex#_bot rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "bot" . ### https://cyberterrain.org/ns/stonex#_botnet rdf:type owl:NamedIndividual , :InfrastuctureTypeVocabulary ; "botnet" . ### https://cyberterrain.org/ns/stonex#_c rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary ; "c" . ### https://cyberterrain.org/ns/stonex#_c-plus-plus rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary ; "c++" . ### https://cyberterrain.org/ns/stonex#_c-sharp rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary ; "c#" . ### https://cyberterrain.org/ns/stonex#_campaign rdf:type owl:NamedIndividual , :ReportTypeVocabulary ; "campaign" . ### https://cyberterrain.org/ns/stonex#_captures-input-peripherals rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "captures-input-peripherals" . ### https://cyberterrain.org/ns/stonex#_captures-output-peripherals rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "captures-output-peripherals" . ### https://cyberterrain.org/ns/stonex#_captures-system-state-data rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "captures-system-state-data" . ### https://cyberterrain.org/ns/stonex#_caribbean rdf:type owl:NamedIndividual , :RegionVocabulary ; "caribbean" . ### https://cyberterrain.org/ns/stonex#_central-america rdf:type owl:NamedIndividual , :RegionVocabulary ; "central-america" . ### https://cyberterrain.org/ns/stonex#_central-asia rdf:type owl:NamedIndividual , :RegionVocabulary ; "central-asia" . ### https://cyberterrain.org/ns/stonex#_characterizes rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "characterizes" . ### https://cyberterrain.org/ns/stonex#_chemical rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "chemical" . ### https://cyberterrain.org/ns/stonex#_class rdf:type owl:NamedIndividual , :IdentityClassVocabulary ; "class" . ### https://cyberterrain.org/ns/stonex#_cleans-traces-of-infection rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "cleans-traces-of-infection" . ### https://cyberterrain.org/ns/stonex#_club rdf:type owl:NamedIndividual , :AttackResourceLevelVocabulary ; "club" . ### https://cyberterrain.org/ns/stonex#_coercion rdf:type owl:NamedIndividual , :AttackMotivationVocabulary ; "coercion" . ### https://cyberterrain.org/ns/stonex#_command-and-control rdf:type owl:NamedIndividual , :InfrastuctureTypeVocabulary ; "command-and-control" . ### https://cyberterrain.org/ns/stonex#_commercial rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "commercial" . ### https://cyberterrain.org/ns/stonex#_commits-fraud rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "commits-fraud" . ### https://cyberterrain.org/ns/stonex#_communications rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "communications" . ### https://cyberterrain.org/ns/stonex#_competitor rdf:type owl:NamedIndividual , :ThreatActorTypeVocabulary ; "competitor" . ### https://cyberterrain.org/ns/stonex#_compromised rdf:type owl:NamedIndividual , :IndicatorTypeVocabulary ; "compromised" . ### https://cyberterrain.org/ns/stonex#_compromises rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "compromises" . ### https://cyberterrain.org/ns/stonex#_compromises-data-availability rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "compromises-data-availability" . ### https://cyberterrain.org/ns/stonex#_compromises-data-integrity rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "compromises-data-integrity" . ### https://cyberterrain.org/ns/stonex#_compromises-system-availability rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "compromises-system-availability" . ### https://cyberterrain.org/ns/stonex#_construction rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "construction" . ### https://cyberterrain.org/ns/stonex#_contest rdf:type owl:NamedIndividual , :AttackResourceLevelVocabulary ; "contest" . ### https://cyberterrain.org/ns/stonex#_controls-local-machine rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "controls-local-machine" . ### https://cyberterrain.org/ns/stonex#_credential-exploitation rdf:type owl:NamedIndividual , :ToolTypeVocabulary ; "credential-exploitation" . ### https://cyberterrain.org/ns/stonex#_crime-syndicate rdf:type owl:NamedIndividual , :ThreatActorTypeVocabulary ; "crime-syndicate" . ### https://cyberterrain.org/ns/stonex#_criminal rdf:type owl:NamedIndividual , :ThreatActorTypeVocabulary ; "criminal" . ### https://cyberterrain.org/ns/stonex#_dams rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "dams" . ### https://cyberterrain.org/ns/stonex#_ddos rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "ddos" . ### https://cyberterrain.org/ns/stonex#_defense rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "defense" . ### https://cyberterrain.org/ns/stonex#_degrades-security-software rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "degrades-security-software" . ### https://cyberterrain.org/ns/stonex#_degrades-system-updates rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "degrades-system-updates" . ### https://cyberterrain.org/ns/stonex#_denial-of-service rdf:type owl:NamedIndividual , :ToolTypeVocabulary ; "denial-of-service" . ### https://cyberterrain.org/ns/stonex#_derived-from rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "derived-from" . ### https://cyberterrain.org/ns/stonex#_detects rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "detects" . ### https://cyberterrain.org/ns/stonex#_determines-c2-server rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "determines-c2-server" . ### https://cyberterrain.org/ns/stonex#_director rdf:type owl:NamedIndividual , :ThreatActorRoleVocabulary ; "director" . ### https://cyberterrain.org/ns/stonex#_disagree rdf:type owl:NamedIndividual , :OpinionEnumeration ; "disagree" . ### https://cyberterrain.org/ns/stonex#_dll rdf:type owl:NamedIndividual , :WindowsPEBinaryVocabulary ; "dll" . ### https://cyberterrain.org/ns/stonex#_dominance rdf:type owl:NamedIndividual , :AttackMotivationVocabulary ; "dominance" . ### https://cyberterrain.org/ns/stonex#_downloader rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "downloader" . ### https://cyberterrain.org/ns/stonex#_downloads rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "downloads" . ### https://cyberterrain.org/ns/stonex#_dropper rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "dropper" . ### https://cyberterrain.org/ns/stonex#_drops rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "drops" . ### https://cyberterrain.org/ns/stonex#_duplicate-of rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "duplicate-of" . ### https://cyberterrain.org/ns/stonex#_dynamic-analysis-of rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "dynamic-analysis-of" . ### https://cyberterrain.org/ns/stonex#_eastern-africa rdf:type owl:NamedIndividual , :RegionVocabulary ; "eastern-africa" . ### https://cyberterrain.org/ns/stonex#_eastern-asia rdf:type owl:NamedIndividual , :RegionVocabulary ; "eastern-asia" . ### https://cyberterrain.org/ns/stonex#_eastern-europe rdf:type owl:NamedIndividual , :RegionVocabulary ; "eastern-europe" . ### https://cyberterrain.org/ns/stonex#_education rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "education" . ### https://cyberterrain.org/ns/stonex#_emails-spam rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "emails-spam" . ### https://cyberterrain.org/ns/stonex#_emergency-services rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "emergency-services" . ### https://cyberterrain.org/ns/stonex#_energy rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "energy" . ### https://cyberterrain.org/ns/stonex#_engineering rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "engineering" . ### https://cyberterrain.org/ns/stonex#_entertainment rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "entertainment" . ### https://cyberterrain.org/ns/stonex#_escalates-privileges rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "escalates-privileges" . ### https://cyberterrain.org/ns/stonex#_europe rdf:type owl:NamedIndividual , :RegionVocabulary ; "europe" . ### https://cyberterrain.org/ns/stonex#_evades-av rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "evades-av" . ### https://cyberterrain.org/ns/stonex#_exe rdf:type owl:NamedIndividual , :WindowsPEBinaryVocabulary ; "exe" . ### https://cyberterrain.org/ns/stonex#_exfiltrates-data rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "exfiltrates-data" . ### https://cyberterrain.org/ns/stonex#_exfiltrates-to rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "exfiltrates-to" . ### https://cyberterrain.org/ns/stonex#_exfiltration rdf:type owl:NamedIndividual , :InfrastuctureTypeVocabulary ; "exfiltration" . ### https://cyberterrain.org/ns/stonex#_expert rdf:type owl:NamedIndividual , :ThreatActorSophisticationVocabulary ; "expert" . ### https://cyberterrain.org/ns/stonex#_exploit-kit rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "exploit-kit" . ### https://cyberterrain.org/ns/stonex#_exploitation rdf:type owl:NamedIndividual , :ToolTypeVocabulary ; "exploitation" . ### https://cyberterrain.org/ns/stonex#_exploits rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "exploits" . ### https://cyberterrain.org/ns/stonex#_facebook rdf:type owl:NamedIndividual , :AccountTypeVocabulary ; "facebook" . ### https://cyberterrain.org/ns/stonex#_financial-services rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "financial-services" . ### https://cyberterrain.org/ns/stonex#_fingerprints-host rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "fingerprints-host" . ### https://cyberterrain.org/ns/stonex#_firewall rdf:type owl:NamedIndividual , :InfrastuctureTypeVocabulary ; "firewall" . ### https://cyberterrain.org/ns/stonex#_go rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary ; "go" . ### https://cyberterrain.org/ns/stonex#_government rdf:type owl:NamedIndividual , :AttackResourceLevelVocabulary , :IndustrySectorVocabulary ; "government" . ### https://cyberterrain.org/ns/stonex#_government-local rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "government-local" . ### https://cyberterrain.org/ns/stonex#_government-national rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "government-national" . ### https://cyberterrain.org/ns/stonex#_government-public-services rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "government-public-services" . ### https://cyberterrain.org/ns/stonex#_government-regional rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "government-regional" . ### https://cyberterrain.org/ns/stonex#_group rdf:type owl:NamedIndividual , :IdentityClassVocabulary ; "group" . ### https://cyberterrain.org/ns/stonex#_hacker rdf:type owl:NamedIndividual , :ThreatActorTypeVocabulary ; "hacker" . ### https://cyberterrain.org/ns/stonex#_healthcare rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "healthcare" . ### https://cyberterrain.org/ns/stonex#_hides-artifacts rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "hides-artifacts" . ### https://cyberterrain.org/ns/stonex#_hides-executing-code rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "hides-executing-code" . ### https://cyberterrain.org/ns/stonex#_high rdf:type owl:NamedIndividual , :WindowsIntegrityLevelEnumeration ; "high" . ### https://cyberterrain.org/ns/stonex#_hospitality-leisure rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "hospitality-leisure" . ### https://cyberterrain.org/ns/stonex#_hosting-malware rdf:type owl:NamedIndividual , :InfrastuctureTypeVocabulary ; "hosting-malware" . ### https://cyberterrain.org/ns/stonex#_hosting-target-lists rdf:type owl:NamedIndividual , :InfrastuctureTypeVocabulary ; "hosting-target-lists" . ### https://cyberterrain.org/ns/stonex#_hosts rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "hosts" . ### https://cyberterrain.org/ns/stonex#_ia-64 rdf:type owl:NamedIndividual , :ProcessorArchitectureVocabulary ; "ia-64" . ### https://cyberterrain.org/ns/stonex#_identity rdf:type owl:NamedIndividual , :ReportTypeVocabulary ; "identity" . ### https://cyberterrain.org/ns/stonex#_ideology rdf:type owl:NamedIndividual , :AttackMotivationVocabulary ; "ideology" . ### https://cyberterrain.org/ns/stonex#_indicates rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "indicates" . ### https://cyberterrain.org/ns/stonex#_indicator rdf:type owl:NamedIndividual , :ReportTypeVocabulary ; "indicator" . ### https://cyberterrain.org/ns/stonex#_individual rdf:type owl:NamedIndividual , :AttackResourceLevelVocabulary , :IdentityClassVocabulary ; "individual" . ### https://cyberterrain.org/ns/stonex#_infects-files rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "infects-files" . ### https://cyberterrain.org/ns/stonex#_infects-remote-machines rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "infects-remote-machines" . ### https://cyberterrain.org/ns/stonex#_information-gathering rdf:type owl:NamedIndividual , :ToolTypeVocabulary ; "information-gathering" . ### https://cyberterrain.org/ns/stonex#_infrastructure rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "infrastructure" . ### https://cyberterrain.org/ns/stonex#_infrastructure-architect rdf:type owl:NamedIndividual , :ThreatActorRoleVocabulary ; "infrastructure-architect" . ### https://cyberterrain.org/ns/stonex#_infrastructure-operator rdf:type owl:NamedIndividual , :ThreatActorRoleVocabulary ; "infrastructure-operator" . ### https://cyberterrain.org/ns/stonex#_innovator rdf:type owl:NamedIndividual , :ThreatActorSophisticationVocabulary ; "innovator" . ### https://cyberterrain.org/ns/stonex#_insider-accidental rdf:type owl:NamedIndividual , :ThreatActorTypeVocabulary ; "insider-accidental" . ### https://cyberterrain.org/ns/stonex#_insider-disgruntled rdf:type owl:NamedIndividual , :ThreatActorTypeVocabulary ; "insider-disgruntled" . ### https://cyberterrain.org/ns/stonex#_installs-other-components rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "installs-other-components" . ### https://cyberterrain.org/ns/stonex#_insurance rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "insurance" . ### https://cyberterrain.org/ns/stonex#_intermediate rdf:type owl:NamedIndividual , :ThreatActorSophisticationVocabulary ; "intermediate" . ### https://cyberterrain.org/ns/stonex#_intrusion-set rdf:type owl:NamedIndividual , :ReportTypeVocabulary ; "intrusion-set" . ### https://cyberterrain.org/ns/stonex#_java rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary ; "java" . ### https://cyberterrain.org/ns/stonex#_javascript rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary ; "javascript" . ### https://cyberterrain.org/ns/stonex#_keylogger rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "keylogger" . ### https://cyberterrain.org/ns/stonex#_latin-america-caribbean rdf:type owl:NamedIndividual , :RegionVocabulary ; "latin-america-caribbean" . ### https://cyberterrain.org/ns/stonex#_ldap rdf:type owl:NamedIndividual , :AccountTypeVocabulary ; "ldap" . ### https://cyberterrain.org/ns/stonex#_located-at rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "located-at" . ### https://cyberterrain.org/ns/stonex#_low rdf:type owl:NamedIndividual , :WindowsIntegrityLevelEnumeration ; "low" . ### https://cyberterrain.org/ns/stonex#_lua rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary ; "lua" . ### https://cyberterrain.org/ns/stonex#_malicious rdf:type owl:NamedIndividual , :MalwareResultVocabulary ; "malicious" . ### https://cyberterrain.org/ns/stonex#_malicious-activity rdf:type owl:NamedIndividual , :IndicatorTypeVocabulary ; "malicious-activity" . ### https://cyberterrain.org/ns/stonex#_malware rdf:type owl:NamedIndividual , :ReportTypeVocabulary ; "malware" . ### https://cyberterrain.org/ns/stonex#_malware-analysis rdf:type owl:NamedIndividual , :GroupingContextVocabulary ; "malware-analysis" . ### https://cyberterrain.org/ns/stonex#_malware-author rdf:type owl:NamedIndividual , :ThreatActorRoleVocabulary ; "malware-author" . ### https://cyberterrain.org/ns/stonex#_manufacturing rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "manufacturing" . ### https://cyberterrain.org/ns/stonex#_medium rdf:type owl:NamedIndividual , :WindowsIntegrityLevelEnumeration ; "medium" . ### https://cyberterrain.org/ns/stonex#_melanesia rdf:type owl:NamedIndividual , :RegionVocabulary ; "melanesia" . ### https://cyberterrain.org/ns/stonex#_micronesia rdf:type owl:NamedIndividual , :RegionVocabulary ; "micronesia" . ### https://cyberterrain.org/ns/stonex#_middle-africa rdf:type owl:NamedIndividual , :RegionVocabulary ; "middle-africa" . ### https://cyberterrain.org/ns/stonex#_mime-type-indicated rdf:type owl:NamedIndividual , :EncryptionAlgorithmEnumeration ; "mime-type-indicated" . ### https://cyberterrain.org/ns/stonex#_minimal rdf:type owl:NamedIndividual , :ThreatActorSophisticationVocabulary ; "minimal" . ### https://cyberterrain.org/ns/stonex#_mining rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "mining" . ### https://cyberterrain.org/ns/stonex#_mips rdf:type owl:NamedIndividual , :ProcessorArchitectureVocabulary ; "mips" . ### https://cyberterrain.org/ns/stonex#_mips-le rdf:type owl:NamedIndividual , :ProcessorArchitectureVocabulary ; "mips-le" . ### https://cyberterrain.org/ns/stonex#_mitigates rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "mitigates" . ### https://cyberterrain.org/ns/stonex#_nation-state rdf:type owl:NamedIndividual , :ThreatActorTypeVocabulary ; "nation-state" . ### https://cyberterrain.org/ns/stonex#_network-capture rdf:type owl:NamedIndividual , :ToolTypeVocabulary ; "network-capture" . ### https://cyberterrain.org/ns/stonex#_neutral rdf:type owl:NamedIndividual , :OpinionEnumeration ; "neutral" . ### https://cyberterrain.org/ns/stonex#_new-sco rdf:type owl:NamedIndividual , :ExtensionTypesEnumeration ; "new-sco" . ### https://cyberterrain.org/ns/stonex#_new-sdo rdf:type owl:NamedIndividual , :ExtensionTypesEnumeration ; "new-sdo" . ### https://cyberterrain.org/ns/stonex#_new-sro rdf:type owl:NamedIndividual , :ExtensionTypesEnumeration ; "new-sro" . ### https://cyberterrain.org/ns/stonex#_nis rdf:type owl:NamedIndividual , :AccountTypeVocabulary ; "nis" . ### https://cyberterrain.org/ns/stonex#_non-profit rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "non-profit" . ### https://cyberterrain.org/ns/stonex#_none rdf:type owl:NamedIndividual , :ThreatActorSophisticationVocabulary ; "none" . ### https://cyberterrain.org/ns/stonex#_northern-africa rdf:type owl:NamedIndividual , :RegionVocabulary ; "northern-africa" . ### https://cyberterrain.org/ns/stonex#_northern-america rdf:type owl:NamedIndividual , :RegionVocabulary ; "northern-america" . ### https://cyberterrain.org/ns/stonex#_northern-europe rdf:type owl:NamedIndividual , :RegionVocabulary ; "northern-europe" . ### https://cyberterrain.org/ns/stonex#_notoriety rdf:type owl:NamedIndividual , :AttackMotivationVocabulary ; "notoriety" . ### https://cyberterrain.org/ns/stonex#_nuclear rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "nuclear" . ### https://cyberterrain.org/ns/stonex#_objective-c rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary ; "objective-c" . ### https://cyberterrain.org/ns/stonex#_observed-data rdf:type owl:NamedIndividual , :ReportTypeVocabulary ; "observed-data" . ### https://cyberterrain.org/ns/stonex#_oceania rdf:type owl:NamedIndividual , :RegionVocabulary ; "oceania" . ### https://cyberterrain.org/ns/stonex#_openid rdf:type owl:NamedIndividual , :AccountTypeVocabulary ; "openid" . ### https://cyberterrain.org/ns/stonex#_organization rdf:type owl:NamedIndividual , :AttackResourceLevelVocabulary , :IdentityClassVocabulary ; "organization" . ### https://cyberterrain.org/ns/stonex#_organizational-gain rdf:type owl:NamedIndividual , :AttackMotivationVocabulary ; "organizational-gain" . ### https://cyberterrain.org/ns/stonex#_originates-from rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "originates-from" . ### https://cyberterrain.org/ns/stonex#_owns rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "owns" . ### https://cyberterrain.org/ns/stonex#_pcre rdf:type owl:NamedIndividual , :PatternTypeVocabulary ; "pcre" . ### https://cyberterrain.org/ns/stonex#_perl rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary ; "perl" . ### https://cyberterrain.org/ns/stonex#_persists-after-system-reboot rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "persists-after-system-reboot" . ### https://cyberterrain.org/ns/stonex#_personal-gain rdf:type owl:NamedIndividual , :AttackMotivationVocabulary ; "personal-gain" . ### https://cyberterrain.org/ns/stonex#_personal-satisfaction rdf:type owl:NamedIndividual , :AttackMotivationVocabulary ; "personal-satisfaction" . ### https://cyberterrain.org/ns/stonex#_pharmaceuticals rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "pharmaceuticals" . ### https://cyberterrain.org/ns/stonex#_phishing rdf:type owl:NamedIndividual , :InfrastuctureTypeVocabulary ; "phishing" . ### https://cyberterrain.org/ns/stonex#_php rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary ; "php" . ### https://cyberterrain.org/ns/stonex#_polynesia rdf:type owl:NamedIndividual , :RegionVocabulary ; "polynesia" . ### https://cyberterrain.org/ns/stonex#_powerpc rdf:type owl:NamedIndividual , :ProcessorArchitectureVocabulary ; "powerpc" . ### https://cyberterrain.org/ns/stonex#_powershell rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary ; "powershell" . ### https://cyberterrain.org/ns/stonex#_prevents-artifact-access rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "prevents-artifact-access" . ### https://cyberterrain.org/ns/stonex#_prevents-artifact-deletion rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "prevents-artifact-deletion" . ### https://cyberterrain.org/ns/stonex#_probes-network-environment rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "probes-network-environment" . ### https://cyberterrain.org/ns/stonex#_property-extension rdf:type owl:NamedIndividual , :ExtensionTypesEnumeration ; "property-extension" . ### https://cyberterrain.org/ns/stonex#_python rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary ; "python" . ### https://cyberterrain.org/ns/stonex#_radius rdf:type owl:NamedIndividual , :AccountTypeVocabulary ; "radius" . ### https://cyberterrain.org/ns/stonex#_ransomware rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "ransomware" . ### https://cyberterrain.org/ns/stonex#_reconnaissance rdf:type owl:NamedIndividual , :InfrastuctureTypeVocabulary ; "reconnaissance" . ### https://cyberterrain.org/ns/stonex#_related-to rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "related-to" . ### https://cyberterrain.org/ns/stonex#_remediates rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "remediates" . ### https://cyberterrain.org/ns/stonex#_remote-access rdf:type owl:NamedIndividual , :ToolTypeVocabulary ; "remote-access" . ### https://cyberterrain.org/ns/stonex#_remote-access-trojan rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "remote-access-trojan" . ### https://cyberterrain.org/ns/stonex#_resource-exploitation rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "resource-exploitation" . ### https://cyberterrain.org/ns/stonex#_retail rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "retail" . ### https://cyberterrain.org/ns/stonex#_revenge rdf:type owl:NamedIndividual , :AttackMotivationVocabulary ; "revenge" . ### https://cyberterrain.org/ns/stonex#_revoked-by rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "revoked-by" . ### https://cyberterrain.org/ns/stonex#_rogue-security-software rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "rogue-security-software" . ### https://cyberterrain.org/ns/stonex#_rootkit rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "rootkit" . ### https://cyberterrain.org/ns/stonex#_routers-switches rdf:type owl:NamedIndividual , :InfrastuctureTypeVocabulary ; "routers-switches" . ### https://cyberterrain.org/ns/stonex#_ruby rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary ; "ruby" . ### https://cyberterrain.org/ns/stonex#_scala rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary ; "scala" . ### https://cyberterrain.org/ns/stonex#_screen-capture rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "screen-capture" . ### https://cyberterrain.org/ns/stonex#_self-modifies rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "self-modifies" . ### https://cyberterrain.org/ns/stonex#_sensationalist rdf:type owl:NamedIndividual , :ThreatActorTypeVocabulary ; "sensationalist" . ### https://cyberterrain.org/ns/stonex#_sigma rdf:type owl:NamedIndividual , :PatternTypeVocabulary ; "sigma" . ### https://cyberterrain.org/ns/stonex#_skype rdf:type owl:NamedIndividual , :AccountTypeVocabulary ; "skype" . ### https://cyberterrain.org/ns/stonex#_snort rdf:type owl:NamedIndividual , :PatternTypeVocabulary ; "snort" . ### https://cyberterrain.org/ns/stonex#_south-america rdf:type owl:NamedIndividual , :RegionVocabulary ; "south-america" . ### https://cyberterrain.org/ns/stonex#_south-eastern-asia rdf:type owl:NamedIndividual , :RegionVocabulary ; "south-eastern-asia" . ### https://cyberterrain.org/ns/stonex#_southern-africa rdf:type owl:NamedIndividual , :RegionVocabulary ; "southern-africa" . ### https://cyberterrain.org/ns/stonex#_southern-asia rdf:type owl:NamedIndividual , :RegionVocabulary ; "southern-asia" . ### https://cyberterrain.org/ns/stonex#_southern-europe rdf:type owl:NamedIndividual , :RegionVocabulary ; "southern-europe" . ### https://cyberterrain.org/ns/stonex#_sparc rdf:type owl:NamedIndividual , :ProcessorArchitectureVocabulary ; "sparc" . ### https://cyberterrain.org/ns/stonex#_sponsor rdf:type owl:NamedIndividual , :ThreatActorRoleVocabulary ; "sponsor" . ### https://cyberterrain.org/ns/stonex#_spy rdf:type owl:NamedIndividual , :ThreatActorTypeVocabulary ; "spy" . ### https://cyberterrain.org/ns/stonex#_spyware rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "spyware" . ### https://cyberterrain.org/ns/stonex#_staging rdf:type owl:NamedIndividual , :InfrastuctureTypeVocabulary ; "staging" . ### https://cyberterrain.org/ns/stonex#_static-analysis-of rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "static-analysis-of" . ### https://cyberterrain.org/ns/stonex#_steals-authentication-credentials rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "steals-authentication-credentials" . ### https://cyberterrain.org/ns/stonex#_stix rdf:type owl:NamedIndividual , :PatternTypeVocabulary ; "stix" . ### https://cyberterrain.org/ns/stonex#_strategic rdf:type owl:NamedIndividual , :ThreatActorSophisticationVocabulary ; "strategic" . ### https://cyberterrain.org/ns/stonex#_strongly-agree rdf:type owl:NamedIndividual , :OpinionEnumeration ; "strongly-agree" . ### https://cyberterrain.org/ns/stonex#_strongly-disagree rdf:type owl:NamedIndividual , :OpinionEnumeration ; "strongly-disagree" . ### https://cyberterrain.org/ns/stonex#_subtechnique-of rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "subtechnique-of" . ### https://cyberterrain.org/ns/stonex#_suricata rdf:type owl:NamedIndividual , :PatternTypeVocabulary ; "suricata" . ### https://cyberterrain.org/ns/stonex#_suspicious rdf:type owl:NamedIndividual , :MalwareResultVocabulary ; "suspicious" . ### https://cyberterrain.org/ns/stonex#_suspicious-activity rdf:type owl:NamedIndividual , :GroupingContextVocabulary ; "suspicious-activity" . ### https://cyberterrain.org/ns/stonex#_swift rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary ; "swift" . ### https://cyberterrain.org/ns/stonex#_sys rdf:type owl:NamedIndividual , :WindowsPEBinaryVocabulary ; "sys" . ### https://cyberterrain.org/ns/stonex#_system rdf:type owl:NamedIndividual , :IdentityClassVocabulary , :WindowsIntegrityLevelEnumeration ; "system" . ### https://cyberterrain.org/ns/stonex#_tacacs rdf:type owl:NamedIndividual , :AccountTypeVocabulary ; "tacacs" . ### https://cyberterrain.org/ns/stonex#_targets rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "targets" . ### https://cyberterrain.org/ns/stonex#_team rdf:type owl:NamedIndividual , :AttackResourceLevelVocabulary ; "team" . ### https://cyberterrain.org/ns/stonex#_technology rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "technology" . ### https://cyberterrain.org/ns/stonex#_telecommunications rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "telecommunications" . ### https://cyberterrain.org/ns/stonex#_terrorist rdf:type owl:NamedIndividual , :ThreatActorTypeVocabulary ; "terrorist" . ### https://cyberterrain.org/ns/stonex#_threat-actor rdf:type owl:NamedIndividual , :ReportTypeVocabulary ; "threat-actor" . ### https://cyberterrain.org/ns/stonex#_threat-report rdf:type owl:NamedIndividual , :ReportTypeVocabulary ; "threat-report" . ### https://cyberterrain.org/ns/stonex#_tool rdf:type owl:NamedIndividual , :ReportTypeVocabulary ; "tool" . ### https://cyberterrain.org/ns/stonex#_toplevel-property-extension rdf:type owl:NamedIndividual , :ExtensionTypesEnumeration ; "toplevel-property-extension" . ### https://cyberterrain.org/ns/stonex#_transportation rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "transportation" . ### https://cyberterrain.org/ns/stonex#_trojan rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "trojan" . ### https://cyberterrain.org/ns/stonex#_twitter rdf:type owl:NamedIndividual , :AccountTypeVocabulary ; "twitter" . ### https://cyberterrain.org/ns/stonex#_typescript rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary ; "typescript" . ### https://cyberterrain.org/ns/stonex#_unix rdf:type owl:NamedIndividual , :AccountTypeVocabulary ; "unix" . ### https://cyberterrain.org/ns/stonex#_unknown rdf:type owl:NamedIndividual , :IdentityClassVocabulary , :IndicatorTypeVocabulary , :MalwareResultVocabulary , :MalwareTypeVocabulary , :ThreatActorTypeVocabulary , :ToolTypeVocabulary ; "unknown" . ### https://cyberterrain.org/ns/stonex#_unpredictable rdf:type owl:NamedIndividual , :AttackMotivationVocabulary ; "unpredictable" . ### https://cyberterrain.org/ns/stonex#_unspecified rdf:type owl:NamedIndividual , :GroupingContextVocabulary ; "unspecified" . ### https://cyberterrain.org/ns/stonex#_uses rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "uses" . ### https://cyberterrain.org/ns/stonex#_utilities rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "utilities" . ### https://cyberterrain.org/ns/stonex#_variant-of rdf:type owl:NamedIndividual , :RelationshipTypeVocabulary ; "variant-of" . ### https://cyberterrain.org/ns/stonex#_violates-system-operational-integrity rdf:type owl:NamedIndividual , :MalwareCapabilitesVocabulary ; "violates-system-operational-integrity" . ### https://cyberterrain.org/ns/stonex#_virus rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "virus" . ### https://cyberterrain.org/ns/stonex#_visual-basic rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary ; "visual-basic" . ### https://cyberterrain.org/ns/stonex#_vulnerability rdf:type owl:NamedIndividual , :ReportTypeVocabulary ; "vulnerability" . ### https://cyberterrain.org/ns/stonex#_vulnerability-scanning rdf:type owl:NamedIndividual , :ToolTypeVocabulary ; "vulnerability-scanning" . ### https://cyberterrain.org/ns/stonex#_water rdf:type owl:NamedIndividual , :IndustrySectorVocabulary ; "water" . ### https://cyberterrain.org/ns/stonex#_webshell rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "webshell" . ### https://cyberterrain.org/ns/stonex#_western-africa rdf:type owl:NamedIndividual , :RegionVocabulary ; "western-africa" . ### https://cyberterrain.org/ns/stonex#_western-asia rdf:type owl:NamedIndividual , :RegionVocabulary ; "western-asia" . ### https://cyberterrain.org/ns/stonex#_western-europe rdf:type owl:NamedIndividual , :RegionVocabulary ; "western-europe" . ### https://cyberterrain.org/ns/stonex#_windows-domain rdf:type owl:NamedIndividual , :AccountTypeVocabulary ; "windows-domain" . ### https://cyberterrain.org/ns/stonex#_windows-local rdf:type owl:NamedIndividual , :AccountTypeVocabulary ; "windows-local" . ### https://cyberterrain.org/ns/stonex#_wiper rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "wiper" . ### https://cyberterrain.org/ns/stonex#_workstation rdf:type owl:NamedIndividual , :InfrastuctureTypeVocabulary ; "workstation" . ### https://cyberterrain.org/ns/stonex#_worm rdf:type owl:NamedIndividual , :MalwareTypeVocabulary ; "worm" . ### https://cyberterrain.org/ns/stonex#_x86 rdf:type owl:NamedIndividual , :ProcessorArchitectureVocabulary ; "x86" . ### https://cyberterrain.org/ns/stonex#_x86-32 rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary ; "x86-32" . ### https://cyberterrain.org/ns/stonex#_x86-64 rdf:type owl:NamedIndividual , :ImplementationLanguageVocabulary , :ProcessorArchitectureVocabulary ; "x86-64" . ### https://cyberterrain.org/ns/stonex#_yara rdf:type owl:NamedIndividual , :PatternTypeVocabulary ; "yara" . ################################################################# # General axioms ################################################################# [ rdf:type owl:AllDisjointClasses ; owl:members ( :StixBundle :StixCoreObject :StixMetaObject ) ] . ### Generated by the OWL API (version 5.1.18) https://github.com/owlcs/owlapi/