accidental
type: NamedIndividual
type: AttackMotivationVocabulary
notation: accidental

accesses-remote-machines
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: accesses-remote-machines

activist
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: activist

adware
type: NamedIndividual
type: MalwareTypeVocabulary
notation: adware

advanced
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: advanced

AES-256-GCM
type: NamedIndividual
type: EncryptionAlgorithmEnumeration
notation: AES-256-GCM

AF APPLETALK
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_APPLETALK

AF BTH
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_BTH

AF INET
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_INET

AF INET6
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_INET6

AF IPX
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_IPX

AF IRDA
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_IRDA

AF NETBIOS
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_NETBIOS

AF UNSPEC
type: NamedIndividual
type: NetworkSocketAddressFamilyEnumeration
notation: AF_UNSPEC

africa
type: NamedIndividual
type: RegionVocabulary
notation: africa

aerospace
type: NamedIndividual
type: IndustrySectorVocabulary
notation: aerospace

agent
type: NamedIndividual
type: ThreatActorRoleVocabulary
notation: agent

agriculture
type: NamedIndividual
type: IndustrySectorVocabulary
notation: agriculture

agree
type: NamedIndividual
type: OpinionEnumeration
notation: agree

alpha
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: alpha

amplification
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: amplification

anomalous-activity
type: NamedIndividual
type: IndicatorTypeVocabulary
notation: anomalous-activity

anonymization
type: NamedIndividual
type: IndicatorTypeVocabulary
type: InfrastuctureTypeVocabulary
notation: anonymization

anti-debugging
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: anti-debugging

anti-disassembly
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: anti-disassembly

anti-emulation
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: anti-emulation

anti-memory-forensics
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: anti-memory-forensics

anti-sandbox
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: anti-sandbox

anti-vm
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: anti-vm

applescript
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: applescript

arm
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: arm

asia
type: NamedIndividual
type: RegionVocabulary
notation: asia

attack-pattern
type: NamedIndividual
type: ReportTypeVocabulary
notation: attack-pattern

attribution
type: NamedIndividual
type: IndicatorTypeVocabulary
notation: attribution

australia-new-zealand
type: NamedIndividual
type: RegionVocabulary
notation: australia-new-zealand

automotive
type: NamedIndividual
type: IndustrySectorVocabulary
notation: automotive

backdoor
type: NamedIndividual
type: MalwareTypeVocabulary
notation: backdoor

bash
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: bash

benign
type: NamedIndividual
type: IndicatorTypeVocabulary
type: MalwareResultVocabulary
notation: benign

bot
type: NamedIndividual
type: MalwareTypeVocabulary
notation: bot

bootkit
type: NamedIndividual
type: MalwareTypeVocabulary
notation: bootkit

botnet
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: botnet

c
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: c

c-plus-plus
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: c++

c-sharp
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: c#

campaign
type: NamedIndividual
type: ReportTypeVocabulary
notation: campaign

captures-input-peripherals
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: captures-input-peripherals

captures-output-peripherals
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: captures-output-peripherals

captures-system-state-data
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: captures-system-state-data

caribbean
type: NamedIndividual
type: RegionVocabulary
notation: caribbean

central-america
type: NamedIndividual
type: RegionVocabulary
notation: central-america

central-asia
type: NamedIndividual
type: RegionVocabulary
notation: central-asia

ChaCha20-Poly1305
type: NamedIndividual
type: EncryptionAlgorithmEnumeration
notation: ChaCha20-Poly1305

chemical
type: NamedIndividual
type: IndustrySectorVocabulary
notation: chemical

class
type: NamedIndividual
type: IdentityClassVocabulary
notation: class

cleans-traces-of-infection
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: cleans-traces-of-infection

club
type: NamedIndividual
type: AttackResourceLevelVocabulary
notation: club

coercion
type: NamedIndividual
type: AttackMotivationVocabulary
notation: coercion

command-and-control
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: command-and-control

commercial
type: NamedIndividual
type: IndustrySectorVocabulary
notation: commercial

commits-fraud
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: commits-fraud

communications
type: NamedIndividual
type: IndustrySectorVocabulary
notation: communications

competitor
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: competitor

compromised
type: NamedIndividual
type: IndicatorTypeVocabulary
notation: compromised

compromises-data-availability
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: compromises-data-availability

compromises-data-integrity
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: compromises-data-integrity

compromises-system-availability
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: compromises-system-availability

construction
type: NamedIndividual
type: IndustrySectorVocabulary
notation: construction

contest
type: NamedIndividual
type: AttackResourceLevelVocabulary
notation: contest

controls-local-machine
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: controls-local-machine

credential-exploitation
type: NamedIndividual
type: ToolTypeVocabulary
notation: credential-exploitation

crime-syndicate
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: crime-syndicate

criminal
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: criminal

dams
type: NamedIndividual
type: IndustrySectorVocabulary
notation: dams

ddos
type: NamedIndividual
type: MalwareTypeVocabulary
notation: ddos

defense
type: NamedIndividual
type: IndustrySectorVocabulary
notation: defense

degrades-security-software
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: degrades-security-software

degrades-system-updates
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: degrades-system-updates

denial-of-service
type: NamedIndividual
type: ToolTypeVocabulary
notation: denial-of-service

determines-c2-server
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: determines-c2-server

director
type: NamedIndividual
type: ThreatActorRoleVocabulary
notation: director

disagree
type: NamedIndividual
type: OpinionEnumeration
notation: disagree

dll
type: NamedIndividual
type: WindowsPEBinaryVocabulary
notation: dll

dominance
type: NamedIndividual
type: AttackMotivationVocabulary
notation: dominance

downloader
type: NamedIndividual
type: MalwareTypeVocabulary
notation: downloader

dropper
type: NamedIndividual
type: MalwareTypeVocabulary
notation: dropper

eastern-africa
type: NamedIndividual
type: RegionVocabulary
notation: eastern-africa

eastern-asia
type: NamedIndividual
type: RegionVocabulary
notation: eastern-asia

eastern-europe
type: NamedIndividual
type: RegionVocabulary
notation: eastern-europe

education
type: NamedIndividual
type: IndustrySectorVocabulary
notation: education

emails-spam
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: emails-spam

emergency-services
type: NamedIndividual
type: IndustrySectorVocabulary
notation: emergency-services

energy
type: NamedIndividual
type: IndustrySectorVocabulary
notation: energy

engineering
type: NamedIndividual
type: IndustrySectorVocabulary
notation: engineering

entertainment
type: NamedIndividual
type: IndustrySectorVocabulary
notation: entertainment

escalates-privileges
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: escalates-privileges

europe
type: NamedIndividual
type: RegionVocabulary
notation: europe

evades-av
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: evades-av

exe
type: NamedIndividual
type: WindowsPEBinaryVocabulary
notation: exe

exfiltrates-data
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: exfiltrates-data

exfiltration
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: exfiltration

expert
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: expert

exploit-kit
type: NamedIndividual
type: MalwareTypeVocabulary
notation: exploit-kit

exploitation
type: NamedIndividual
type: ToolTypeVocabulary
notation: exploitation

facebook
type: NamedIndividual
type: AccountTypeVocabulary
notation: facebook

financial-services
type: NamedIndividual
type: IndustrySectorVocabulary
notation: financial-services

fingerprints-host
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: fingerprints-host

firewall
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: firewall

go
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: go

government
type: NamedIndividual
type: AttackResourceLevelVocabulary
type: IndustrySectorVocabulary
notation: government

government-local
type: NamedIndividual
type: IndustrySectorVocabulary
notation: government-local

government-national
type: NamedIndividual
type: IndustrySectorVocabulary
notation: government-national

government-public-services
type: NamedIndividual
type: IndustrySectorVocabulary
notation: government-public-services

government-regional
type: NamedIndividual
type: IndustrySectorVocabulary
notation: government-regional

group
type: NamedIndividual
type: IdentityClassVocabulary
notation: group

hacker
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: hacker

healthcare
type: NamedIndividual
type: IndustrySectorVocabulary
notation: healthcare

hides-artifacts
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: hides-artifacts

hides-executing-code
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: hides-executing-code

high
type: NamedIndividual
type: WindowsIntegrityLevelEnumeration
notation: high

hospitality-leisure
type: NamedIndividual
type: IndustrySectorVocabulary
notation: hospitality-leisure

hosting-malware
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: hosting-malware

hosting-target-lists
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: hosting-target-lists

ia-64
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: ia-64

identity
type: NamedIndividual
type: ReportTypeVocabulary
notation: identity

ideology
type: NamedIndividual
type: AttackMotivationVocabulary
notation: ideology

indicator
type: NamedIndividual
type: ReportTypeVocabulary
notation: indicator

individual
type: NamedIndividual
type: AttackResourceLevelVocabulary
type: IdentityClassVocabulary
notation: individual

infects-files
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: infects-files

infects-remote-machines
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: infects-remote-machines

information-gathering
type: NamedIndividual
type: ToolTypeVocabulary
notation: information-gathering

infrastructure
type: NamedIndividual
type: IndustrySectorVocabulary
notation: infrastructure

infrastructure-architect
type: NamedIndividual
type: ThreatActorRoleVocabulary
notation: infrastructure-architect

infrastructure-operator
type: NamedIndividual
type: ThreatActorRoleVocabulary
notation: infrastructure-operator

innovator
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: innovator

insider-accidental
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: insider-accidental

insider-disgruntled
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: insider-disgruntled

installs-other-components
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: installs-other-components

insurance
type: NamedIndividual
type: IndustrySectorVocabulary
notation: insurance

intermediate
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: intermediate

intrusion-set
type: NamedIndividual
type: ReportTypeVocabulary
notation: intrusion-set

java
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: java

javascript
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: javascript

keylogger
type: NamedIndividual
type: MalwareTypeVocabulary
notation: keylogger

latin-america-caribbean
type: NamedIndividual
type: RegionVocabulary
notation: latin-america-caribbean

ldap
type: NamedIndividual
type: AccountTypeVocabulary
notation: ldap

low
type: NamedIndividual
type: WindowsIntegrityLevelEnumeration
notation: low

lua
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: lua

malicious
type: NamedIndividual
type: MalwareResultVocabulary
notation: malicious

malicious-activity
type: NamedIndividual
type: IndicatorTypeVocabulary
notation: malicious-activity

malware
type: NamedIndividual
type: ReportTypeVocabulary
notation: malware

malware-analysis
type: NamedIndividual
type: GroupingContextVocabulary
notation: malware-analysis

malware-author
type: NamedIndividual
type: ThreatActorRoleVocabulary
notation: malware-author

manufacturing
type: NamedIndividual
type: IndustrySectorVocabulary
notation: manufacturing

MD5
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: MD5

MD6
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: MD6

medium
type: NamedIndividual
type: WindowsIntegrityLevelEnumeration
notation: medium

melanesia
type: NamedIndividual
type: RegionVocabulary
notation: melanesia

micronesia
type: NamedIndividual
type: RegionVocabulary
notation: micronesia

middle-africa
type: NamedIndividual
type: RegionVocabulary
notation: middle-africa

mime-type-indicated
type: NamedIndividual
type: EncryptionAlgorithmEnumeration
notation: mime-type-indicated

minimal
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: minimal

mining
type: NamedIndividual
type: IndustrySectorVocabulary
notation: mining

mips
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: mips

mips-le
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: mips-le

nation-state
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: nation-state

network-capture
type: NamedIndividual
type: ToolTypeVocabulary
notation: network-capture

neutral
type: NamedIndividual
type: OpinionEnumeration
notation: neutral

new-sco
type: NamedIndividual
type: ExtensionTypesEnumeration
notation: new-sco

new-sdo
type: NamedIndividual
type: ExtensionTypesEnumeration
notation: new-sdo

new-sro
type: NamedIndividual
type: ExtensionTypesEnumeration
notation: new-sro

nis
type: NamedIndividual
type: AccountTypeVocabulary
notation: nis

none
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: none

non-profit
type: NamedIndividual
type: IndustrySectorVocabulary
notation: non-profit

northern-africa
type: NamedIndividual
type: RegionVocabulary
notation: northern-africa

northern-america
type: NamedIndividual
type: RegionVocabulary
notation: northern-america

northern-europe
type: NamedIndividual
type: RegionVocabulary
notation: northern-europe

notoriety
type: NamedIndividual
type: AttackMotivationVocabulary
notation: notoriety

nuclear
type: NamedIndividual
type: IndustrySectorVocabulary
notation: nuclear

objective-c
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: objective-c

observed-data
type: NamedIndividual
type: ReportTypeVocabulary
notation: observed-data

oceania
type: NamedIndividual
type: RegionVocabulary
notation: oceania

openid
type: NamedIndividual
type: AccountTypeVocabulary
notation: openid

organization
type: NamedIndividual
type: AttackResourceLevelVocabulary
type: IdentityClassVocabulary
notation: organization

organizational-gain
type: NamedIndividual
type: AttackMotivationVocabulary
notation: organizational-gain

pcre
type: NamedIndividual
type: PatternTypeVocabulary
notation: pcre

perl
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: perl

persists-after-system-reboot
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: persists-after-system-reboot

personal-gain
type: NamedIndividual
type: AttackMotivationVocabulary
notation: personal-gain

personal-satisfaction
type: NamedIndividual
type: AttackMotivationVocabulary
notation: personal-satisfaction

pharmaceuticals
type: NamedIndividual
type: IndustrySectorVocabulary
notation: pharmaceuticals

phishing
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: phishing

php
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: php

polynesia
type: NamedIndividual
type: RegionVocabulary
notation: polynesia

powerpc
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: powerpc

powershell
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: powershell

prevents-artifact-access
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: prevents-artifact-access

prevents-artifact-deletion
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: prevents-artifact-deletion

probes-network-environment
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: probes-network-environment

property-extension
type: NamedIndividual
type: ExtensionTypesEnumeration
notation: property-extension

python
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: python

radius
type: NamedIndividual
type: AccountTypeVocabulary
notation: radius

ransomware
type: NamedIndividual
type: MalwareTypeVocabulary
notation: ransomware

reconnaissance
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: reconnaissance

REG BINARY
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_BINARY

REG DWORD
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_DWORD

REG DWORD BIG ENDIAN
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_DWORD_BIG_ENDIAN

REG DWORD LITTLE ENDIAN
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_DWORD_LITTLE_ENDIAN

REG EXPAND SZ
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_EXPAND_SZ

REG FULL RESOURCE DESCRIPTION
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_FULL_RESOURCE_DESCRIPTION

REG INVALID TYPE
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_INVALID_TYPE

REG LINK
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_LINK

REG MULTI SZ
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_MULTI_SZ

REG NONE
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_NONE

REG QWORD
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_QWORD

REG RESOURCE LIST
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_RESOURCE_LIST

REG RESOURCE REQUIREMENTS LIST
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_RESOURCE_REQUIREMENTS_LIST

REG SZ
type: NamedIndividual
type: WindowsRegistryDatatypeEnumeration
notation: REG_SZ

remote-access
type: NamedIndividual
type: ToolTypeVocabulary
notation: remote-access

remote-access-trojan
type: NamedIndividual
type: MalwareTypeVocabulary
notation: remote-access-trojan

resource-exploitation
type: NamedIndividual
type: MalwareTypeVocabulary
notation: resource-exploitation

retail
type: NamedIndividual
type: IndustrySectorVocabulary
notation: retail

revenge
type: NamedIndividual
type: AttackMotivationVocabulary
notation: revenge

RIPEMD-160
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: RIPEMD-160

rogue-security-software
type: NamedIndividual
type: MalwareTypeVocabulary
notation: rogue-security-software

rootkit
type: NamedIndividual
type: MalwareTypeVocabulary
notation: rootkit

routers-switches
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: routers-switches

ruby
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: ruby

scala
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: scala

screen-capture
type: NamedIndividual
type: MalwareTypeVocabulary
notation: screen-capture

self-modifies
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: self-modifies

sensationalist
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: sensationalist

SERVICE AUTO START
type: NamedIndividual
type: WindowsServiceStartTypeEnumeration
notation: SERVICE_AUTO_START

SERVICE BOOT START
type: NamedIndividual
type: WindowsServiceStartTypeEnumeration
notation: SERVICE_BOOT_START

SERVICE CONTINUE PENDING
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_CONTINUE_PENDING

SERVICE DEMAND START
type: NamedIndividual
type: WindowsServiceStartTypeEnumeration
notation: SERVICE_DEMAND_START

SERVICE DISABLED
type: NamedIndividual
type: WindowsServiceStartTypeEnumeration
notation: SERVICE_DISABLED

SERVICE FILE SYSTEM DRIVER
type: NamedIndividual
type: WindowsServiceTypeEnumeration
notation: SERVICE_FILE_SYSTEM_DRIVER

SERVICE KERNEL DRIVER
type: NamedIndividual
type: WindowsServiceTypeEnumeration
notation: SERVICE_KERNEL_DRIVER

SERVICE PAUSE PENDING
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_PAUSE_PENDING

SERVICE PAUSED
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_PAUSED

SERVICE RUNNING
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_RUNNING

SERVICE START PENDING
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_START_PENDING

SERVICE STOP PENDING
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_STOP_PENDING

SERVICE STOPPED
type: NamedIndividual
type: WindowsServiceStatusEnumeration
notation: SERVICE_STOPPED

SERVICE SYSTEM ALERT
type: NamedIndividual
type: WindowsServiceStartTypeEnumeration
notation: SERVICE_SYSTEM_ALERT

SERVICE WIN32 OWN PROCESS
type: NamedIndividual
type: WindowsServiceTypeEnumeration
notation: SERVICE_WIN32_OWN_PROCESS

SERVICE WIN32 SHARE PROCESS
type: NamedIndividual
type: WindowsServiceTypeEnumeration
notation: SERVICE_WIN32_SHARE_PROCESS

SHA-1
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA-1

SHA-224
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA-224

SHA-256
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA-256

SHA-384
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA-384

SHA-512
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA-512

SHA3-224
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA3-224

SHA3-256
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA3-256

SHA3-384
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA3-384

SHA3-512
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SHA3-512

sigma
type: NamedIndividual
type: PatternTypeVocabulary
notation: sigma

skype
type: NamedIndividual
type: AccountTypeVocabulary
notation: skype

snort
type: NamedIndividual
type: PatternTypeVocabulary
notation: snort

SOCK DGRAM
type: NamedIndividual
type: NetworkSocketTypeEnumeration
notation: SOCK_DGRAM

SOCK RAW
type: NamedIndividual
type: NetworkSocketTypeEnumeration
notation: SOCK_RAW

SOCK RDM
type: NamedIndividual
type: NetworkSocketTypeEnumeration
notation: SOCK_RDM

SOCK SEQPACKET
type: NamedIndividual
type: NetworkSocketTypeEnumeration
notation: SOCK_SEQPACKET

SOCK STREAM
type: NamedIndividual
type: NetworkSocketTypeEnumeration
notation: SOCK_STREAM

south-america
type: NamedIndividual
type: RegionVocabulary
notation: south-america

south-eastern-asia
type: NamedIndividual
type: RegionVocabulary
notation: south-eastern-asia

southern-africa
type: NamedIndividual
type: RegionVocabulary
notation: southern-africa

southern-asia
type: NamedIndividual
type: RegionVocabulary
notation: southern-asia

southern-europe
type: NamedIndividual
type: RegionVocabulary
notation: southern-europe

sparc
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: sparc

sponsor
type: NamedIndividual
type: ThreatActorRoleVocabulary
notation: sponsor

spy
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: spy

spyware
type: NamedIndividual
type: MalwareTypeVocabulary
notation: spyware

SSDEEP
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: SSDEEP

staging
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: staging

steals-authentication-credentials
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: steals-authentication-credentials

stix
type: NamedIndividual
type: PatternTypeVocabulary
notation: stix

strategic
type: NamedIndividual
type: ThreatActorSophisticationVocabulary
notation: strategic

strongly-agree
type: NamedIndividual
type: OpinionEnumeration
notation: strongly-agree

strongly-disagree
type: NamedIndividual
type: OpinionEnumeration
notation: strongly-disagree

suricata
type: NamedIndividual
type: PatternTypeVocabulary
notation: suricata

suspicious
type: NamedIndividual
type: MalwareResultVocabulary
notation: suspicious

suspicious-activity
type: NamedIndividual
type: GroupingContextVocabulary
notation: suspicious-activity

swift
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: swift

sys
type: NamedIndividual
type: WindowsPEBinaryVocabulary
notation: sys

system
type: NamedIndividual
type: IdentityClassVocabulary
type: WindowsIntegrityLevelEnumeration
notation: system

tacacs
type: NamedIndividual
type: AccountTypeVocabulary
notation: tacacs

team
type: NamedIndividual
type: AttackResourceLevelVocabulary
notation: team

technology
type: NamedIndividual
type: IndustrySectorVocabulary
notation: technology

telecommunications
type: NamedIndividual
type: IndustrySectorVocabulary
notation: telecommunications

terrorist
type: NamedIndividual
type: ThreatActorTypeVocabulary
notation: terrorist

threat-actor
type: NamedIndividual
type: ReportTypeVocabulary
notation: threat-actor

threat-report
type: NamedIndividual
type: ReportTypeVocabulary
notation: threat-report

TLSH
type: NamedIndividual
type: HashingAlgorithmVocabulary
notation: TLSH

tool
type: NamedIndividual
type: ReportTypeVocabulary
notation: tool

toplevel-property-extension
type: NamedIndividual
type: ExtensionTypesEnumeration
notation: toplevel-property-extension

transportation
type: NamedIndividual
type: IndustrySectorVocabulary
notation: transportation

trojan
type: NamedIndividual
type: MalwareTypeVocabulary
notation: trojan

twitter
type: NamedIndividual
type: AccountTypeVocabulary
notation: twitter

typescript
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: typescript

unix
type: NamedIndividual
type: AccountTypeVocabulary
notation: unix

unknown
type: NamedIndividual
type: IdentityClassVocabulary
type: IndicatorTypeVocabulary
type: MalwareResultVocabulary
type: MalwareTypeVocabulary
type: ThreatActorTypeVocabulary
type: ToolTypeVocabulary
notation: unknown

unpredictable
type: NamedIndividual
type: AttackMotivationVocabulary
notation: unpredictable

unspecified
type: NamedIndividual
type: GroupingContextVocabulary
notation: unspecified

utilities
type: NamedIndividual
type: IndustrySectorVocabulary
notation: utilities

violates-system-operational-integrity
type: NamedIndividual
type: MalwareCapabilitesVocabulary
notation: violates-system-operational-integrity

virus
type: NamedIndividual
type: MalwareTypeVocabulary
notation: virus

visual-basic
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: visual-basic

vulnerability
type: NamedIndividual
type: ReportTypeVocabulary
notation: vulnerability

vulnerability-scanning
type: NamedIndividual
type: ToolTypeVocabulary
notation: vulnerability-scanning

water
type: NamedIndividual
type: IndustrySectorVocabulary
notation: water

webshell
type: NamedIndividual
type: MalwareTypeVocabulary
notation: webshell

western-africa
type: NamedIndividual
type: RegionVocabulary
notation: western-africa

western-asia
type: NamedIndividual
type: RegionVocabulary
notation: western-asia

western-europe
type: NamedIndividual
type: RegionVocabulary
notation: western-europe

windows-domain
type: NamedIndividual
type: AccountTypeVocabulary
notation: windows-domain

windows-local
type: NamedIndividual
type: AccountTypeVocabulary
notation: windows-local

wiper
type: NamedIndividual
type: MalwareTypeVocabulary
notation: wiper

workstation
type: NamedIndividual
type: InfrastuctureTypeVocabulary
notation: workstation

worm
type: NamedIndividual
type: MalwareTypeVocabulary
notation: worm

x86
type: NamedIndividual
type: ProcessorArchitectureVocabulary
notation: x86

x86-32
type: NamedIndividual
type: ImplementationLanguageVocabulary
notation: x86-32

x86-64
type: NamedIndividual
type: ImplementationLanguageVocabulary
type: ProcessorArchitectureVocabulary
notation: x86-64

yara
type: NamedIndividual
type: PatternTypeVocabulary
notation: yara

analysis-of
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: analysis-of

attributed-to
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: attributed-to

authored-by
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: authored-by

based-on
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: based-on

beacons-to
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: beacons-to

characterizes
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: characterizes

compromises
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: compromises

derived-from
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: derived-from

detects
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: detects

downloads
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: downloads

drops
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: drops

duplicate-of
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: duplicate-of

dynamic-analysis-of
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: dynamic-analysis-of

exfiltrates-to
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: exfiltrates-to

exploits
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: exploits

hosts
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: hosts

indicates
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: indicates

located-at
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: located-at

mitigates
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: mitigates

originates-from
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: originates-from

owns
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: owns

related-to
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: related-to

remediates
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: remediates

revoked-by
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: revoked-by

static-analysis-of
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: static-analysis-of

subtechnique-of
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: subtechnique-of

targets
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: targets

uses
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: uses

variant-of
type: NamedIndividual
type: RelationshipTypeVocabulary
notation: variant-of