You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Indicates that the malware instance or family is able to prevent itself from being debugged and/or from being run in a debugger or is able to make debugging more difficult."""^^xsd:string ;
1076
1083
skos:prefLabel "anti-debugging"^^xsd:string ;
1077
1084
.
1078
1085
1079
-
gist:_MalwareCapability_Anti-Disassembly
1086
+
gist:_MalwareCapability_anti-disassembly
1080
1087
a gist:MalwareCapability ;
1081
1088
skos:definition """STIX 2.1 description:
1082
1089
Indicates that the malware instance or family is able to prevent itself from being disassembled or make disassembly more difficult."""^^xsd:string ;
1083
1090
skos:prefLabel "anti-disassembly"^^xsd:string ;
1084
1091
.
1085
1092
1086
-
gist:_MalwareCapability_Anti-Emulation
1093
+
gist:_MalwareCapability_anti-emulation
1087
1094
a gist:MalwareCapability ;
1088
1095
skos:definition """STIX 2.1 description:
1089
1096
Indicates that the malware instance or family is able to prevent its execution inside of an emulator or is able to make emulation more difficult."""^^xsd:string ;
1090
1097
skos:prefLabel "anti-emulation"^^xsd:string ;
1091
1098
.
1092
1099
1093
-
gist:_MalwareCapability_Anti-Memory-Forensics
1100
+
gist:_MalwareCapability_anti-memory-forensics
1094
1101
a gist:MalwareCapability ;
1095
1102
skos:definition """STIX 2.1 description:
1096
1103
Indicates that the malware instance or family is able to prevent or make memory forensics more difficult."""^^xsd:string ;
Indicates that the malware instance or family is able to prevent sandbox-based behavioral analysis or make it more difficult."""^^xsd:string ;
1104
-
skos:prefLabel "anti-sandbox"^^xsd:string ;
1105
-
.
1106
-
1107
-
gist:_MalwareCapability_Anti-Vm
1107
+
gist:_MalwareCapability_anti-vm
1108
1108
a gist:MalwareCapability ;
1109
1109
skos:definition """STIX 2.1 description:
1110
1110
Indicates that the malware instance or family is able to prevent virtual machine (VM) based behavioral analysis or make it more difficult."""^^xsd:string ;
Indicates that the malware instance or family is able to capture data from a system's input peripheral devices, such as a keyboard or mouse. This includes things like keylogging."""^^xsd:string ;
Indicates that the malware instance or family captures data sent to a system's output peripherals, such as a display. Examples include things like screen scraping."""^^xsd:string ;
Indicates that the malware instance or family is able to capture information about a system's state (e.g., data currently in its RAM)."""^^xsd:string ;
Indicates that the malware instance or family commits fraud, such as click fraud (for example)."""^^xsd:string ;
1139
1146
skos:prefLabel "commits-fraud"^^xsd:string ;
1140
1147
.
1141
1148
1142
-
gist:_MalwareCapability_Communicates-With-C2
1149
+
gist:_MalwareCapability_communicates-with-c2
1143
1150
a gist:MalwareCapability ;
1144
1151
skos:definition """STIX 2.1 description:
1145
1152
Indicates that the malware instance or family is able to communicate (i.e., send or receive data) with a command and control (C2) server."""^^xsd:string ;
Indicates that the malware instance or family is able to compromise the availability of data on the local system on which it is executing and/or one or more remote systems. For example, encrypting data on disk, as done by ransomware."""^^xsd:string ;
Indicates that the malware instance or family is able to compromise the integrity of some data that resides on (e.g., in the case of files) or is received/transmitted (e.g., in the case of network traffic) by the system on which it is executing."""^^xsd:string ;
Indicates that the malware instance or family is able to consume system resources for its malicious purposes, such as password cracking or participating in a DDoS botnet, thereby compromising the availability of the local system and/or one or more remote systems."""^^xsd:string ;
Indicates that the malware instance or family is able to bypass or disable security programs or operating system security features on a system (including mobile devices), either by stopping them from executing or by making changes to their code or configuration parameters. For example, malware that blocks the local machine from accessing the websites of security vendors."""^^xsd:string ;
Indicates that the malware instance or family is able to identify one or more command and control (C2) servers with which to communicate (e.g., DGA)."""^^xsd:string ;
Indicates that the malware instance or family is able to evade detection by antivirus tools."""^^xsd:string ;
1202
1223
skos:prefLabel "evades-av"^^xsd:string ;
1203
1224
.
1204
1225
1205
-
gist:_MalwareCapability_Exfiltrates-Data
1226
+
gist:_MalwareCapability_exfiltrates-data
1206
1227
a gist:MalwareCapability ;
1207
1228
skos:definition """STIX 2.1 description:
1208
1229
Indicates that the malware instance or family is able to gather, prepare, (possibly obfuscate) data and transmit it to exfiltration points."""^^xsd:string ;
1209
1230
skos:prefLabel "exfiltrates-data"^^xsd:string ;
1210
1231
.
1211
1232
1212
-
gist:_MalwareCapability_Fingerprints-Host
1233
+
gist:_MalwareCapability_fingerprints-host
1213
1234
a gist:MalwareCapability ;
1214
1235
skos:definition """STIX 2.1 description:
1215
1236
Indicates that the malware instance or family is able to fingerprint or probe the configuration of the host system on which it is executing for the purpose of altering its behavior based on this environment."""^^xsd:string ;
1216
1237
skos:prefLabel "fingerprints-host"^^xsd:string ;
1217
1238
.
1218
1239
1219
-
gist:_MalwareCapability_Hides-Artifacts
1240
+
gist:_MalwareCapability_hides-artifacts
1220
1241
a gist:MalwareCapability ;
1221
1242
skos:definition """STIX 2.1 description:
1222
1243
Indicates that the malware instance or family is able to hide its artifacts, such as files and open ports."""^^xsd:string ;
1223
1244
skos:prefLabel "hides-artifacts"^^xsd:string ;
1224
1245
.
1225
1246
1226
-
gist:_MalwareCapability_Infects-Files
1247
+
gist:_MalwareCapability_hides-executing-code
1248
+
a gist:MalwareCapability ;
1249
+
skos:definition """STIX 2.1 description:
1250
+
Indicates that the malware instance or family is able to hide its code by compromising the bootloader, kernel modules, hypervisor, etc."""^^xsd:string ;
Indicates that the malware instance or family is able to infect one or more files on the system on which it executes. For example, malware which injects a malicious payload into all PDFs on a host as a means of propagation."""^^xsd:string ;
1230
1258
skos:prefLabel "infects-files"^^xsd:string ;
1231
1259
.
1232
1260
1233
-
gist:_MalwareCapability_Infects-Remote-Machines
1261
+
gist:_MalwareCapability_infects-remote-machines
1234
1262
a gist:MalwareCapability ;
1235
1263
skos:definition """STIX 2.1 description:
1236
1264
Indicates that the malware instance or family is able to self-propagate to a remote machine or infect a remote machine with malware that is different than itself."""^^xsd:string ;
Indicates that the malware instance or family is able to install additional components. This encompasses the dropping/downloading of other malicious components such as libraries, other malware, and tools."""^^xsd:string ;
Indicates that the malware instance or family is able to prevent its artifacts (e.g., files, registry keys, etc.) from being accessed."""^^xsd:string ;
Indicates that the malware instance or family is able to probe the properties of its network environment, e.g. to determine whether it funnels traffic through a proxy."""^^xsd:string ;
Indicates that the malware instance or family is able to compromise the operational integrity of the system on which it is executing and/or one or more remote systems, e.g., by causing them to operate beyond their set of specified operational parameters. For example, malware that causes the CPU fan on the machine that it is executing to spin at a higher than normal speed."""^^xsd:string ;
Indicates that the malware instance or family is able to hide its code by compromising the bootloader, kernel modules, hypervisor, etc."""^^xsd:string ;
0 commit comments