You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: ontologies/vocabs.ttl
+266Lines changed: 266 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -84,6 +84,13 @@ gist:InfrastructureType
84
84
rdfs:subClassOf gist:StixCategoryObject ;
85
85
.
86
86
87
+
gist:MalwareCapability
88
+
a owl:Class ;
89
+
rdfs:subClassOf gist:StixCategoryObject ;
90
+
skos:definition "A Category class who's instances provide categorization by capability of malware. Describes categories of what a malware can do."^^xsd:string ;
91
+
skos:prefLabel "Malware Capability"^^xsd:string ;
92
+
.
93
+
87
94
gist:MalwareResult
88
95
a owl:Class ;
89
96
rdfs:subClassOf gist:StixCategoryObject ;
@@ -1062,6 +1069,265 @@ Specifies an endpoint machine used for work by an organization that needs protec
1062
1069
skos:prefLabel "workstation"^^xsd:string ;
1063
1070
.
1064
1071
1072
+
gist:_MalwareCapability_Accesses-Remote-Machines
1073
+
a gist:MalwareCapability ;
1074
+
skos:definition """STIX 2.1 description:
1075
+
Indicates that the malware instance or family is able to access one or more remote machines."""^^xsd:string ;
Indicates that the malware instance or family is able to prevent itself from being debugged and/or from being run in a debugger or is able to make debugging more difficult."""^^xsd:string ;
1083
+
skos:prefLabel "anti-debugging"^^xsd:string ;
1084
+
.
1085
+
1086
+
gist:_MalwareCapability_Anti-Disassembly
1087
+
a gist:MalwareCapability ;
1088
+
skos:definition """STIX 2.1 description:
1089
+
Indicates that the malware instance or family is able to prevent itself from being disassembled or make disassembly more difficult."""^^xsd:string ;
1090
+
skos:prefLabel "anti-disassembly"^^xsd:string ;
1091
+
.
1092
+
1093
+
gist:_MalwareCapability_Anti-Emulation
1094
+
a gist:MalwareCapability ;
1095
+
skos:definition """STIX 2.1 description:
1096
+
Indicates that the malware instance or family is able to prevent its execution inside of an emulator or is able to make emulation more difficult."""^^xsd:string ;
1097
+
skos:prefLabel "anti-emulation"^^xsd:string ;
1098
+
.
1099
+
1100
+
gist:_MalwareCapability_Anti-Memory-Forensics
1101
+
a gist:MalwareCapability ;
1102
+
skos:definition """STIX 2.1 description:
1103
+
Indicates that the malware instance or family is able to prevent or make memory forensics more difficult."""^^xsd:string ;
Indicates that the malware instance or family is able to prevent sandbox-based behavioral analysis or make it more difficult."""^^xsd:string ;
1111
+
skos:prefLabel "anti-sandbox"^^xsd:string ;
1112
+
.
1113
+
1114
+
gist:_MalwareCapability_Anti-Vm
1115
+
a gist:MalwareCapability ;
1116
+
skos:definition """STIX 2.1 description:
1117
+
Indicates that the malware instance or family is able to prevent virtual machine (VM) based behavioral analysis or make it more difficult."""^^xsd:string ;
Indicates that the malware instance or family is able to capture data from a system's input peripheral devices, such as a keyboard or mouse. This includes things like keylogging."""^^xsd:string ;
Indicates that the malware instance or family captures data sent to a system's output peripherals, such as a display. Examples include things like screen scraping."""^^xsd:string ;
Indicates that the malware instance or family is able to capture information about a system's state (e.g., data currently in its RAM)."""^^xsd:string ;
Indicates that the malware instance or family commits fraud, such as click fraud (for example)."""^^xsd:string ;
1146
+
skos:prefLabel "commits-fraud"^^xsd:string ;
1147
+
.
1148
+
1149
+
gist:_MalwareCapability_Communicates-With-C2
1150
+
a gist:MalwareCapability ;
1151
+
skos:definition """STIX 2.1 description:
1152
+
Indicates that the malware instance or family is able to communicate (i.e., send or receive data) with a command and control (C2) server."""^^xsd:string ;
Indicates that the malware instance or family is able to compromise the availability of data on the local system on which it is executing and/or one or more remote systems. For example, encrypting data on disk, as done by ransomware."""^^xsd:string ;
Indicates that the malware instance or family is able to compromise the integrity of some data that resides on (e.g., in the case of files) or is received/transmitted (e.g., in the case of network traffic) by the system on which it is executing."""^^xsd:string ;
Indicates that the malware instance or family is able to consume system resources for its malicious purposes, such as password cracking or participating in a DDoS botnet, thereby compromising the availability of the local system and/or one or more remote systems."""^^xsd:string ;
Indicates that the malware instance or family is able to bypass or disable security programs or operating system security features on a system (including mobile devices), either by stopping them from executing or by making changes to their code or configuration parameters. For example, malware that blocks the local machine from accessing the websites of security vendors."""^^xsd:string ;
Indicates that the malware instance or family is able to identify one or more command and control (C2) servers with which to communicate (e.g., DGA)."""^^xsd:string ;
Indicates that the malware instance or family is able to evade detection by antivirus tools."""^^xsd:string ;
1209
+
skos:prefLabel "evades-av"^^xsd:string ;
1210
+
.
1211
+
1212
+
gist:_MalwareCapability_Exfiltrates-Data
1213
+
a gist:MalwareCapability ;
1214
+
skos:definition """STIX 2.1 description:
1215
+
Indicates that the malware instance or family is able to gather, prepare, (possibly obfuscate) data and transmit it to exfiltration points."""^^xsd:string ;
1216
+
skos:prefLabel "exfiltrates-data"^^xsd:string ;
1217
+
.
1218
+
1219
+
gist:_MalwareCapability_Fingerprints-Host
1220
+
a gist:MalwareCapability ;
1221
+
skos:definition """STIX 2.1 description:
1222
+
Indicates that the malware instance or family is able to fingerprint or probe the configuration of the host system on which it is executing for the purpose of altering its behavior based on this environment."""^^xsd:string ;
1223
+
skos:prefLabel "fingerprints-host"^^xsd:string ;
1224
+
.
1225
+
1226
+
gist:_MalwareCapability_Hides-Artifacts
1227
+
a gist:MalwareCapability ;
1228
+
skos:definition """STIX 2.1 description:
1229
+
Indicates that the malware instance or family is able to hide its artifacts, such as files and open ports."""^^xsd:string ;
1230
+
skos:prefLabel "hides-artifacts"^^xsd:string ;
1231
+
.
1232
+
1233
+
gist:_MalwareCapability_Infects-Files
1234
+
a gist:MalwareCapability ;
1235
+
skos:definition """STIX 2.1 description:
1236
+
Indicates that the malware instance or family is able to infect one or more files on the system on which it executes. For example, malware which injects a malicious payload into all PDFs on a host as a means of propagation."""^^xsd:string ;
1237
+
skos:prefLabel "infects-files"^^xsd:string ;
1238
+
.
1239
+
1240
+
gist:_MalwareCapability_Infects-Remote-Machines
1241
+
a gist:MalwareCapability ;
1242
+
skos:definition """STIX 2.1 description:
1243
+
Indicates that the malware instance or family is able to self-propagate to a remote machine or infect a remote machine with malware that is different than itself."""^^xsd:string ;
Indicates that the malware instance or family is able to install additional components. This encompasses the dropping/downloading of other malicious components such as libraries, other malware, and tools."""^^xsd:string ;
Indicates that the malware instance or family is able to prevent its artifacts (e.g., files, registry keys, etc.) from being accessed."""^^xsd:string ;
Indicates that the malware instance or family is able to probe the properties of its network environment, e.g. to determine whether it funnels traffic through a proxy."""^^xsd:string ;
Indicates that the malware instance or family is able to compromise the operational integrity of the system on which it is executing and/or one or more remote systems, e.g., by causing them to operate beyond their set of specified operational parameters. For example, malware that causes the CPU fan on the machine that it is executing to spin at a higher than normal speed."""^^xsd:string ;
Indicates that the malware instance or family is able to hide its code by compromising the bootloader, kernel modules, hypervisor, etc."""^^xsd:string ;
0 commit comments