Skip to content

Commit f409e05

Browse files
authored
Merge pull request #55 from semanticarts/issue-37-malware-capabilities-vocab
fixes issue #37, implemented the STIX malware capability vocabulary
2 parents 9430871 + effb2da commit f409e05

File tree

1 file changed

+266
-0
lines changed

1 file changed

+266
-0
lines changed

ontologies/vocabs.ttl

Lines changed: 266 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,13 @@ gist:InfrastructureType
8484
rdfs:subClassOf gist:StixCategoryObject ;
8585
.
8686

87+
gist:MalwareCapability
88+
a owl:Class ;
89+
rdfs:subClassOf gist:StixCategoryObject ;
90+
skos:definition "A Category class who's instances provide categorization by capability of malware. Describes categories of what a malware can do."^^xsd:string ;
91+
skos:prefLabel "Malware Capability"^^xsd:string ;
92+
.
93+
8794
gist:MalwareResult
8895
a owl:Class ;
8996
rdfs:subClassOf gist:StixCategoryObject ;
@@ -1062,6 +1069,265 @@ Specifies an endpoint machine used for work by an organization that needs protec
10621069
skos:prefLabel "workstation"^^xsd:string ;
10631070
.
10641071

1072+
gist:_MalwareCapability_Accesses-Remote-Machines
1073+
a gist:MalwareCapability ;
1074+
skos:definition """STIX 2.1 description:
1075+
Indicates that the malware instance or family is able to access one or more remote machines."""^^xsd:string ;
1076+
skos:prefLabel "accesses-remote-machines"^^xsd:string ;
1077+
.
1078+
1079+
gist:_MalwareCapability_Anti-Debugging
1080+
a gist:MalwareCapability ;
1081+
skos:definition """STIX 2.1 description:
1082+
Indicates that the malware instance or family is able to prevent itself from being debugged and/or from being run in a debugger or is able to make debugging more difficult."""^^xsd:string ;
1083+
skos:prefLabel "anti-debugging"^^xsd:string ;
1084+
.
1085+
1086+
gist:_MalwareCapability_Anti-Disassembly
1087+
a gist:MalwareCapability ;
1088+
skos:definition """STIX 2.1 description:
1089+
Indicates that the malware instance or family is able to prevent itself from being disassembled or make disassembly more difficult."""^^xsd:string ;
1090+
skos:prefLabel "anti-disassembly"^^xsd:string ;
1091+
.
1092+
1093+
gist:_MalwareCapability_Anti-Emulation
1094+
a gist:MalwareCapability ;
1095+
skos:definition """STIX 2.1 description:
1096+
Indicates that the malware instance or family is able to prevent its execution inside of an emulator or is able to make emulation more difficult."""^^xsd:string ;
1097+
skos:prefLabel "anti-emulation"^^xsd:string ;
1098+
.
1099+
1100+
gist:_MalwareCapability_Anti-Memory-Forensics
1101+
a gist:MalwareCapability ;
1102+
skos:definition """STIX 2.1 description:
1103+
Indicates that the malware instance or family is able to prevent or make memory forensics more difficult."""^^xsd:string ;
1104+
skos:prefLabel "anti-memory-forensics"^^xsd:string ;
1105+
.
1106+
1107+
gist:_MalwareCapability_Anti-Sandbox
1108+
a gist:MalwareCapability ;
1109+
skos:definition """STIX 2.1 description:
1110+
Indicates that the malware instance or family is able to prevent sandbox-based behavioral analysis or make it more difficult."""^^xsd:string ;
1111+
skos:prefLabel "anti-sandbox"^^xsd:string ;
1112+
.
1113+
1114+
gist:_MalwareCapability_Anti-Vm
1115+
a gist:MalwareCapability ;
1116+
skos:definition """STIX 2.1 description:
1117+
Indicates that the malware instance or family is able to prevent virtual machine (VM) based behavioral analysis or make it more difficult."""^^xsd:string ;
1118+
skos:prefLabel "anti-vm"^^xsd:string ;
1119+
.
1120+
1121+
gist:_MalwareCapability_Captures-Input-Peripherals
1122+
a gist:MalwareCapability ;
1123+
skos:definition """STIX 2.1 description:
1124+
Indicates that the malware instance or family is able to capture data from a system's input peripheral devices, such as a keyboard or mouse. This includes things like keylogging."""^^xsd:string ;
1125+
skos:prefLabel "captures-input-peripherals"^^xsd:string ;
1126+
.
1127+
1128+
gist:_MalwareCapability_Captures-Output-Peripherals
1129+
a gist:MalwareCapability ;
1130+
skos:definition """STIX 2.1 description:
1131+
Indicates that the malware instance or family captures data sent to a system's output peripherals, such as a display. Examples include things like screen scraping."""^^xsd:string ;
1132+
skos:prefLabel "captures-output-peripherals"^^xsd:string ;
1133+
.
1134+
1135+
gist:_MalwareCapability_Captures-System-State-Data
1136+
a gist:MalwareCapability ;
1137+
skos:definition """STIX 2.1 description:
1138+
Indicates that the malware instance or family is able to capture information about a system's state (e.g., data currently in its RAM)."""^^xsd:string ;
1139+
skos:prefLabel "captures-system-state-data"^^xsd:string ;
1140+
.
1141+
1142+
gist:_MalwareCapability_Commits-Fraud
1143+
a gist:MalwareCapability ;
1144+
skos:definition """STIX 2.1 description:
1145+
Indicates that the malware instance or family commits fraud, such as click fraud (for example)."""^^xsd:string ;
1146+
skos:prefLabel "commits-fraud"^^xsd:string ;
1147+
.
1148+
1149+
gist:_MalwareCapability_Communicates-With-C2
1150+
a gist:MalwareCapability ;
1151+
skos:definition """STIX 2.1 description:
1152+
Indicates that the malware instance or family is able to communicate (i.e., send or receive data) with a command and control (C2) server."""^^xsd:string ;
1153+
skos:prefLabel "communicates-with-c2"^^xsd:string ;
1154+
.
1155+
1156+
gist:_MalwareCapability_Compromises-Data-Availability
1157+
a gist:MalwareCapability ;
1158+
skos:definition """STIX 2.1 description:
1159+
Indicates that the malware instance or family is able to compromise the availability of data on the local system on which it is executing and/or one or more remote systems. For example, encrypting data on disk, as done by ransomware."""^^xsd:string ;
1160+
skos:prefLabel "compromises-data-availability"^^xsd:string ;
1161+
.
1162+
1163+
gist:_MalwareCapability_Compromises-Data-Integrity
1164+
a gist:MalwareCapability ;
1165+
skos:definition """STIX 2.1 description:
1166+
Indicates that the malware instance or family is able to compromise the integrity of some data that resides on (e.g., in the case of files) or is received/transmitted (e.g., in the case of network traffic) by the system on which it is executing."""^^xsd:string ;
1167+
skos:prefLabel "compromises-data-integrity"^^xsd:string ;
1168+
.
1169+
1170+
gist:_MalwareCapability_Compromises-System-Availability
1171+
a gist:MalwareCapability ;
1172+
skos:definition """STIX 2.1 description:
1173+
Indicates that the malware instance or family is able to consume system resources for its malicious purposes, such as password cracking or participating in a DDoS botnet, thereby compromising the availability of the local system and/or one or more remote systems."""^^xsd:string ;
1174+
skos:prefLabel "compromises-system-availability"^^xsd:string ;
1175+
.
1176+
1177+
gist:_MalwareCapability_Controls-Local-Machine
1178+
a gist:MalwareCapability ;
1179+
skos:definition """STIX 2.1 description:
1180+
Indicates that the malware instance or family is able to control the machine on which it is executing (e.g., RATs)."""^^xsd:string ;
1181+
skos:prefLabel "controls-local-machine"^^xsd:string ;
1182+
.
1183+
1184+
gist:_MalwareCapability_Degrades-Security-Software
1185+
a gist:MalwareCapability ;
1186+
skos:definition """STIX 2.1 description:
1187+
Indicates that the malware instance or family is able to bypass or disable security programs or operating system security features on a system (including mobile devices), either by stopping them from executing or by making changes to their code or configuration parameters. For example, malware that blocks the local machine from accessing the websites of security vendors."""^^xsd:string ;
1188+
skos:prefLabel "degrades-security-software"^^xsd:string ;
1189+
.
1190+
1191+
gist:_MalwareCapability_Degrades-System-Updates
1192+
a gist:MalwareCapability ;
1193+
skos:definition """STIX 2.1 description:
1194+
Indicates that the malware instance or family is able to disable the downloading and installation of system updates and patches."""^^xsd:string ;
1195+
skos:prefLabel "degrades-system-updates"^^xsd:string ;
1196+
.
1197+
1198+
gist:_MalwareCapability_Determines-C2-Server
1199+
a gist:MalwareCapability ;
1200+
skos:definition """STIX 2.1 description:
1201+
Indicates that the malware instance or family is able to identify one or more command and control (C2) servers with which to communicate (e.g., DGA)."""^^xsd:string ;
1202+
skos:prefLabel "determines-c2-server"^^xsd:string ;
1203+
.
1204+
1205+
gist:_MalwareCapability_Evades-Av
1206+
a gist:MalwareCapability ;
1207+
skos:definition """STIX 2.1 description:
1208+
Indicates that the malware instance or family is able to evade detection by antivirus tools."""^^xsd:string ;
1209+
skos:prefLabel "evades-av"^^xsd:string ;
1210+
.
1211+
1212+
gist:_MalwareCapability_Exfiltrates-Data
1213+
a gist:MalwareCapability ;
1214+
skos:definition """STIX 2.1 description:
1215+
Indicates that the malware instance or family is able to gather, prepare, (possibly obfuscate) data and transmit it to exfiltration points."""^^xsd:string ;
1216+
skos:prefLabel "exfiltrates-data"^^xsd:string ;
1217+
.
1218+
1219+
gist:_MalwareCapability_Fingerprints-Host
1220+
a gist:MalwareCapability ;
1221+
skos:definition """STIX 2.1 description:
1222+
Indicates that the malware instance or family is able to fingerprint or probe the configuration of the host system on which it is executing for the purpose of altering its behavior based on this environment."""^^xsd:string ;
1223+
skos:prefLabel "fingerprints-host"^^xsd:string ;
1224+
.
1225+
1226+
gist:_MalwareCapability_Hides-Artifacts
1227+
a gist:MalwareCapability ;
1228+
skos:definition """STIX 2.1 description:
1229+
Indicates that the malware instance or family is able to hide its artifacts, such as files and open ports."""^^xsd:string ;
1230+
skos:prefLabel "hides-artifacts"^^xsd:string ;
1231+
.
1232+
1233+
gist:_MalwareCapability_Infects-Files
1234+
a gist:MalwareCapability ;
1235+
skos:definition """STIX 2.1 description:
1236+
Indicates that the malware instance or family is able to infect one or more files on the system on which it executes. For example, malware which injects a malicious payload into all PDFs on a host as a means of propagation."""^^xsd:string ;
1237+
skos:prefLabel "infects-files"^^xsd:string ;
1238+
.
1239+
1240+
gist:_MalwareCapability_Infects-Remote-Machines
1241+
a gist:MalwareCapability ;
1242+
skos:definition """STIX 2.1 description:
1243+
Indicates that the malware instance or family is able to self-propagate to a remote machine or infect a remote machine with malware that is different than itself."""^^xsd:string ;
1244+
skos:prefLabel "infects-remote-machines"^^xsd:string ;
1245+
.
1246+
1247+
gist:_MalwareCapability_Installs-Other-Components
1248+
a gist:MalwareCapability ;
1249+
skos:definition """STIX 2.1 description:
1250+
Indicates that the malware instance or family is able to install additional components. This encompasses the dropping/downloading of other malicious components such as libraries, other malware, and tools."""^^xsd:string ;
1251+
skos:prefLabel "installs-other-components"^^xsd:string ;
1252+
.
1253+
1254+
gist:_MalwareCapability_Persists-After-System-Reboot
1255+
a gist:MalwareCapability ;
1256+
skos:definition """STIX 2.1 description:
1257+
Indicates that the malware instance or family is able to continue executing after the reboot of the system on which it is resident."""^^xsd:string ;
1258+
skos:prefLabel "persists-after-system-reboot"^^xsd:string ;
1259+
.
1260+
1261+
gist:_MalwareCapability_Prevents-Artifact-Access
1262+
a gist:MalwareCapability ;
1263+
skos:definition """STIX 2.1 description:
1264+
Indicates that the malware instance or family is able to prevent its artifacts (e.g., files, registry keys, etc.) from being accessed."""^^xsd:string ;
1265+
skos:prefLabel "prevents-artifact-access"^^xsd:string ;
1266+
.
1267+
1268+
gist:_MalwareCapability_Prevents-Artifact-Deletion
1269+
a gist:MalwareCapability ;
1270+
skos:definition """STIX 2.1 description:
1271+
Indicates that the malware instance or family is able to prevent its artifacts (e.g., files, registry keys, etc.) from being deleted."""^^xsd:string ;
1272+
skos:prefLabel "prevents-artifact-deletion"^^xsd:string ;
1273+
.
1274+
1275+
gist:_MalwareCapability_Probes-Network-Environment
1276+
a gist:MalwareCapability ;
1277+
skos:definition """STIX 2.1 description:
1278+
Indicates that the malware instance or family is able to probe the properties of its network environment, e.g. to determine whether it funnels traffic through a proxy."""^^xsd:string ;
1279+
skos:prefLabel "probes-network-environment"^^xsd:string ;
1280+
.
1281+
1282+
gist:_MalwareCapability_Self-Modifies
1283+
a gist:MalwareCapability ;
1284+
skos:definition """STIX 2.1 description:
1285+
Indicates that the malware instance or family is able to modify itself."""^^xsd:string ;
1286+
skos:prefLabel "self-modifies"^^xsd:string ;
1287+
.
1288+
1289+
gist:_MalwareCapability_Steals-Authentication-Credentials
1290+
a gist:MalwareCapability ;
1291+
skos:definition """STIX 2.1 description:
1292+
Indicates that the malware instance is able to steal authentication credentials."""^^xsd:string ;
1293+
skos:prefLabel "steals-authentication-credentials"^^xsd:string ;
1294+
.
1295+
1296+
gist:_MalwareCapability_Violates-System-Operational-Integrity
1297+
a gist:MalwareCapability ;
1298+
skos:definition """STIX 2.1 description:
1299+
Indicates that the malware instance or family is able to compromise the operational integrity of the system on which it is executing and/or one or more remote systems, e.g., by causing them to operate beyond their set of specified operational parameters. For example, malware that causes the CPU fan on the machine that it is executing to spin at a higher than normal speed."""^^xsd:string ;
1300+
skos:prefLabel "violates-system-operational-integrity"^^xsd:string ;
1301+
.
1302+
1303+
gist:_MalwareCapability_cleans-traces-of-infection
1304+
a gist:MalwareCapability ;
1305+
skos:definition """STIX 2.1 description:
1306+
Indicates that the malware instance or family is able to clean traces of its infection (e.g., file system artifacts) from a system."""^^xsd:string ;
1307+
skos:prefLabel "cleans-traces-of-infection"^^xsd:string ;
1308+
.
1309+
1310+
gist:_MalwareCapability_eEails-Spam
1311+
a gist:MalwareCapability ;
1312+
skos:definition """STIX 2.1 description:
1313+
Indicates that the malware instance or family is able to send spam email messages."""^^xsd:string ;
1314+
skos:prefLabel "emails-spam"^^xsd:string ;
1315+
.
1316+
1317+
gist:_MalwareCapability_escalates-privileges
1318+
a gist:MalwareCapability ;
1319+
skos:definition """STIX 2.1 description:
1320+
Indicates that the malware instance or family is able to escalate the privileges under which it is executing."""^^xsd:string ;
1321+
skos:prefLabel "escalates-privileges"^^xsd:string ;
1322+
.
1323+
1324+
gist:_MalwareCapability_hides-executing-code
1325+
a gist:MalwareCapability ;
1326+
skos:definition """STIX 2.1 description:
1327+
Indicates that the malware instance or family is able to hide its code by compromising the bootloader, kernel modules, hypervisor, etc."""^^xsd:string ;
1328+
skos:prefLabel "hides-executing-code"^^xsd:string ;
1329+
.
1330+
10651331
gist:_MalwareResult_benign
10661332
a gist:MalwareResult ;
10671333
skos:definition """STIX 2.1 description:

0 commit comments

Comments
 (0)