You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Indicates that the malware instance or family is able to prevent itself from being debugged and/or from being run in a debugger or is able to make debugging more difficult."""^^xsd:string ;
1083
1090
skos:prefLabel "anti-debugging"^^xsd:string ;
1084
1091
.
1085
1092
1086
-
gist:_MalwareCapability_Anti-Disassembly
1093
+
gist:_MalwareCapability_anti-disassembly
1087
1094
a gist:MalwareCapability ;
1088
1095
skos:definition """STIX 2.1 description:
1089
1096
Indicates that the malware instance or family is able to prevent itself from being disassembled or make disassembly more difficult."""^^xsd:string ;
1090
1097
skos:prefLabel "anti-disassembly"^^xsd:string ;
1091
1098
.
1092
1099
1093
-
gist:_MalwareCapability_Anti-Emulation
1100
+
gist:_MalwareCapability_anti-emulation
1094
1101
a gist:MalwareCapability ;
1095
1102
skos:definition """STIX 2.1 description:
1096
1103
Indicates that the malware instance or family is able to prevent its execution inside of an emulator or is able to make emulation more difficult."""^^xsd:string ;
1097
1104
skos:prefLabel "anti-emulation"^^xsd:string ;
1098
1105
.
1099
1106
1100
-
gist:_MalwareCapability_Anti-Memory-Forensics
1107
+
gist:_MalwareCapability_anti-memory-forensics
1101
1108
a gist:MalwareCapability ;
1102
1109
skos:definition """STIX 2.1 description:
1103
1110
Indicates that the malware instance or family is able to prevent or make memory forensics more difficult."""^^xsd:string ;
Indicates that the malware instance or family is able to prevent sandbox-based behavioral analysis or make it more difficult."""^^xsd:string ;
1111
-
skos:prefLabel "anti-sandbox"^^xsd:string ;
1112
-
.
1113
-
1114
-
gist:_MalwareCapability_Anti-Vm
1114
+
gist:_MalwareCapability_anti-vm
1115
1115
a gist:MalwareCapability ;
1116
1116
skos:definition """STIX 2.1 description:
1117
1117
Indicates that the malware instance or family is able to prevent virtual machine (VM) based behavioral analysis or make it more difficult."""^^xsd:string ;
Indicates that the malware instance or family is able to capture data from a system's input peripheral devices, such as a keyboard or mouse. This includes things like keylogging."""^^xsd:string ;
Indicates that the malware instance or family captures data sent to a system's output peripherals, such as a display. Examples include things like screen scraping."""^^xsd:string ;
Indicates that the malware instance or family is able to capture information about a system's state (e.g., data currently in its RAM)."""^^xsd:string ;
Indicates that the malware instance or family commits fraud, such as click fraud (for example)."""^^xsd:string ;
1146
1153
skos:prefLabel "commits-fraud"^^xsd:string ;
1147
1154
.
1148
1155
1149
-
gist:_MalwareCapability_Communicates-With-C2
1156
+
gist:_MalwareCapability_communicates-with-c2
1150
1157
a gist:MalwareCapability ;
1151
1158
skos:definition """STIX 2.1 description:
1152
1159
Indicates that the malware instance or family is able to communicate (i.e., send or receive data) with a command and control (C2) server."""^^xsd:string ;
Indicates that the malware instance or family is able to compromise the availability of data on the local system on which it is executing and/or one or more remote systems. For example, encrypting data on disk, as done by ransomware."""^^xsd:string ;
Indicates that the malware instance or family is able to compromise the integrity of some data that resides on (e.g., in the case of files) or is received/transmitted (e.g., in the case of network traffic) by the system on which it is executing."""^^xsd:string ;
Indicates that the malware instance or family is able to consume system resources for its malicious purposes, such as password cracking or participating in a DDoS botnet, thereby compromising the availability of the local system and/or one or more remote systems."""^^xsd:string ;
Indicates that the malware instance or family is able to bypass or disable security programs or operating system security features on a system (including mobile devices), either by stopping them from executing or by making changes to their code or configuration parameters. For example, malware that blocks the local machine from accessing the websites of security vendors."""^^xsd:string ;
Indicates that the malware instance or family is able to identify one or more command and control (C2) servers with which to communicate (e.g., DGA)."""^^xsd:string ;
Indicates that the malware instance or family is able to evade detection by antivirus tools."""^^xsd:string ;
1209
1230
skos:prefLabel "evades-av"^^xsd:string ;
1210
1231
.
1211
1232
1212
-
gist:_MalwareCapability_Exfiltrates-Data
1233
+
gist:_MalwareCapability_exfiltrates-data
1213
1234
a gist:MalwareCapability ;
1214
1235
skos:definition """STIX 2.1 description:
1215
1236
Indicates that the malware instance or family is able to gather, prepare, (possibly obfuscate) data and transmit it to exfiltration points."""^^xsd:string ;
1216
1237
skos:prefLabel "exfiltrates-data"^^xsd:string ;
1217
1238
.
1218
1239
1219
-
gist:_MalwareCapability_Fingerprints-Host
1240
+
gist:_MalwareCapability_fingerprints-host
1220
1241
a gist:MalwareCapability ;
1221
1242
skos:definition """STIX 2.1 description:
1222
1243
Indicates that the malware instance or family is able to fingerprint or probe the configuration of the host system on which it is executing for the purpose of altering its behavior based on this environment."""^^xsd:string ;
1223
1244
skos:prefLabel "fingerprints-host"^^xsd:string ;
1224
1245
.
1225
1246
1226
-
gist:_MalwareCapability_Hides-Artifacts
1247
+
gist:_MalwareCapability_hides-artifacts
1227
1248
a gist:MalwareCapability ;
1228
1249
skos:definition """STIX 2.1 description:
1229
1250
Indicates that the malware instance or family is able to hide its artifacts, such as files and open ports."""^^xsd:string ;
1230
1251
skos:prefLabel "hides-artifacts"^^xsd:string ;
1231
1252
.
1232
1253
1233
-
gist:_MalwareCapability_Infects-Files
1254
+
gist:_MalwareCapability_hides-executing-code
1255
+
a gist:MalwareCapability ;
1256
+
skos:definition """STIX 2.1 description:
1257
+
Indicates that the malware instance or family is able to hide its code by compromising the bootloader, kernel modules, hypervisor, etc."""^^xsd:string ;
Indicates that the malware instance or family is able to infect one or more files on the system on which it executes. For example, malware which injects a malicious payload into all PDFs on a host as a means of propagation."""^^xsd:string ;
1237
1265
skos:prefLabel "infects-files"^^xsd:string ;
1238
1266
.
1239
1267
1240
-
gist:_MalwareCapability_Infects-Remote-Machines
1268
+
gist:_MalwareCapability_infects-remote-machines
1241
1269
a gist:MalwareCapability ;
1242
1270
skos:definition """STIX 2.1 description:
1243
1271
Indicates that the malware instance or family is able to self-propagate to a remote machine or infect a remote machine with malware that is different than itself."""^^xsd:string ;
Indicates that the malware instance or family is able to install additional components. This encompasses the dropping/downloading of other malicious components such as libraries, other malware, and tools."""^^xsd:string ;
Indicates that the malware instance or family is able to prevent its artifacts (e.g., files, registry keys, etc.) from being accessed."""^^xsd:string ;
Indicates that the malware instance or family is able to probe the properties of its network environment, e.g. to determine whether it funnels traffic through a proxy."""^^xsd:string ;
Indicates that the malware instance or family is able to compromise the operational integrity of the system on which it is executing and/or one or more remote systems, e.g., by causing them to operate beyond their set of specified operational parameters. For example, malware that causes the CPU fan on the machine that it is executing to spin at a higher than normal speed."""^^xsd:string ;
Indicates that the malware instance or family is able to hide its code by compromising the bootloader, kernel modules, hypervisor, etc."""^^xsd:string ;
0 commit comments