The following is a description of the elements, types, and attributes that compose Malware Attribute Enumeration and Characterization (MAEC) Bundle schema.
The MAEC Bundle Schema is maintained by The Mitre Corporation. For more information, including how to get involved in the project, please visit the MAEC website at http://maec.mitre.org.
This schema imports the CyBOX schema and object schemas. More info on CybOX can be found at http://cybox.mitre.org.
The object_idref field specifies the id of a CybOX Object being referenced in the current MAEC Bundle.
Source
<xs:element maxOccurs="unbounded" name="Object_Reference" type="maecBundle:ObjectReferenceType"><xs:annotation><xs:documentation>The Object_Reference field specifies a reference to a single CybOX Object.</xs:documentation></xs:annotation></xs:element>
The Malware_Instance_Object_Attributes field characterizes the attributes of the object (most typically a file) that represents the malware instance whose Behaviors, Actions, Objects, Process Tree, and Candidate Indicators are characterized in this Bundle. This is equivalent to the Malware_Instance_Object_Attributes inside of a Malware_Subject in the MAEC Package, and is therefore only required if this Bundle is to be used in a stand-alone fashion, i.e., without an accompanying MAEC Package and with the defined_subject field set to 'True'.
The has_changed field is optional and conveys a targeted observation pattern of whether the associated object specified has changed in some way without requiring further specific detail. This field would be leveraged within a pattern observable triggering on whether the value of an object specification has changed at all. This field is NOT intended to be used for versioning of CybOX content.
The idref field specifies a unique id reference to an Object defined elsewhere.
When idref is specified, the id attribute must not be specified, and any instance of this Object should not hold content unless an extension of the Object allows it.
Source
<xs:element minOccurs="0" name="Malware_Instance_Object_Attributes" type="cybox:ObjectType"><xs:annotation><xs:documentation>The Malware_Instance_Object_Attributes field characterizes the attributes of the object (most typically a file) that represents the malware instance whose Behaviors, Actions, Objects, Process Tree, and Candidate Indicators are characterized in this Bundle. This is equivalent to the Malware_Instance_Object_Attributes inside of a Malware_Subject in the MAEC Package, and is therefore only required if this Bundle is to be used in a stand-alone fashion, i.e., without an accompanying MAEC Package and with the defined_subject field set to 'True'.</xs:documentation></xs:annotation></xs:element>
The AV_Classifications field contains 1-n AVClassificationType objects, which capture any Anti-Virus scanner tool classifications of the malware instance object.
<xs:element minOccurs="0" name="AV_Classifications" type="maecBundle:AVClassificationsType"><xs:annotation><xs:documentation>The AV_Classifications field contains 1-n AVClassificationType objects, which capture any Anti-Virus scanner tool classifications of the malware instance object.</xs:documentation></xs:annotation></xs:element>
The idref field specifies reference to a unique ID for this Tool.
When idref is specified, the id attribute must not be specified, and any instance of this type should not hold content unless an extension of the type allows it.
Source
<xs:element maxOccurs="unbounded" name="AV_Classification" type="maecBundle:AVClassificationType"><xs:annotation><xs:documentation>The AV_Classification field captures a single AV classication of the malware instance object.</xs:documentation></xs:annotation></xs:element>
The Engine_Version field captures the version of the AV engine used by the AV scanner tool that assigned the classification to the malware instance object.
Diagram
Type
xs:string
Source
<xs:element minOccurs="0" name="Engine_Version" type="xs:string"><xs:annotation><xs:documentation>The Engine_Version field captures the version of the AV engine used by the AV scanner tool that assigned the classification to the malware instance object.</xs:documentation></xs:annotation></xs:element>
The Definition_Version field captures the version of the AV definitions used by the AV scanner tool that assigned the classification to the malware instance object.
Diagram
Type
xs:string
Source
<xs:element minOccurs="0" name="Definition_Version" type="xs:string"><xs:annotation><xs:documentation>The Definition_Version field captures the version of the AV definitions used by the AV scanner tool that assigned the classification to the malware instance object.</xs:documentation></xs:annotation></xs:element>
The Classification_Name field captures the classification assigned to the malware instance object by the AV scanner tool characterized in the Company_Name and Product_Name fields.
Diagram
Type
xs:string
Source
<xs:element minOccurs="0" name="Classification_Name" type="xs:string"><xs:annotation><xs:documentation>The Classification_Name field captures the classification assigned to the malware instance object by the AV scanner tool characterized in the Company_Name and Product_Name fields.</xs:documentation></xs:annotation></xs:element>
The Process_Tree field specifies the observed process tree of execution for the malware instance, along with references to any corresponding actions that were initiated, if applicable.
<xs:element minOccurs="0" name="Process_Tree" type="maecBundle:ProcessTreeType"><xs:annotation><xs:documentation>The Process_Tree field specifies the observed process tree of execution for the malware instance, along with references to any corresponding actions that were initiated, if applicable.</xs:documentation></xs:annotation></xs:element>
The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
The parent_action_idref field specifies the id of the action that created or injected this process.
Source
<xs:element name="Root_Process" type="maecBundle:ProcessTreeNodeType"><xs:annotation><xs:documentation>The Root_Process field captures the root process in the process tree.</xs:documentation></xs:annotation></xs:element>
The Initiated_Actions field captures, via references, the actions (found inside the top-level Actions element, or an Action Collection inside the top-level Collections element) initiated by the Process.
<xs:element minOccurs="0" name="Initiated_Actions" type="maecBundle:ActionReferenceListType"><xs:annotation><xs:documentation>The Initiated_Actions field captures, via references, the actions (found inside the top-level Actions element, or an Action Collection inside the top-level Collections element) initiated by the Process.</xs:documentation></xs:annotation></xs:element>
The action_id field refers to the id of the action being referenced.
Source
<xs:element maxOccurs="unbounded" name="Action_Reference" type="cybox:ActionReferenceType"><xs:annotation><xs:documentation>The Action_Reference field specifies a reference to a single Action.</xs:documentation></xs:annotation></xs:element>
The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
The parent_action_idref field specifies the id of the action that created or injected this process.
Source
<xs:element maxOccurs="unbounded" minOccurs="0" name="Spawned_Process" type="maecBundle:ProcessTreeNodeType"><xs:annotation><xs:documentation>The Spawned_Process field captures a single child process spawned by this process.</xs:documentation></xs:annotation></xs:element>
The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
The parent_action_idref field specifies the id of the action that created or injected this process.
Source
<xs:element maxOccurs="unbounded" minOccurs="0" name="Injected_Process" type="maecBundle:ProcessTreeNodeType"><xs:annotation><xs:documentation>The Injected_Process field captures a single process that was injected by this process.</xs:documentation></xs:annotation></xs:element>
The Capabilities field contains 1-n CapabilityType objects, which serve to describe the high-level capabilities and objectives of the malware instance.
<xs:element minOccurs="0" name="Capabilities" type="maecBundle:CapabilityListType"><xs:annotation><xs:documentation>The Capabilities field contains 1-n CapabilityType objects, which serve to describe the high-level capabilities and objectives of the malware instance.</xs:documentation></xs:annotation></xs:element>
The name field captures the name of the Capability. It uses the MalwareCapabilityEnum-1.0 enumeration from the MAEC Vocabularies schema.
Source
<xs:element maxOccurs="1" minOccurs="1" name="Capability" type="maecBundle:CapabilityType"><xs:annotation><xs:documentation>The Capability field captures a single Capability in the list, and therefore represents a single Capability possessed by the malware instance.</xs:documentation></xs:annotation></xs:element>
The Description field captures a basic textual description of the Capability.
Diagram
Type
xs:string
Source
<xs:element minOccurs="0" name="Description" type="xs:string"><xs:annotation><xs:documentation>The Description field captures a basic textual description of the Capability.</xs:documentation></xs:annotation></xs:element>
The Property field permits the capture of a single property of the Capability, as a key/value pair. More than one property can be specified via multiple occurrences of this field.
<xs:element minOccurs="0" name="Property" type="maecBundle:CapabilityPropertyType" maxOccurs="unbounded"><xs:annotation><xs:documentation>The Property field permits the capture of a single property of the Capability, as a key/value pair. More than one property can be specified via multiple occurrences of this field.</xs:documentation></xs:annotation></xs:element>
The Name field specifies the name of the property being captured. The name can be either free form text or a standardized value from a vocabulary included in the MAEC Default Vocabularies schema. This field uses the ControlledVocabularyStringType from the imported CybOX Common schema.
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
<xs:element minOccurs="0" name="Name" type="cyboxCommon:ControlledVocabularyStringType"><xs:annotation><xs:documentation>The Name field specifies the name of the property being captured. The name can be either free form text or a standardized value from a vocabulary included in the MAEC Default Vocabularies schema. This field uses the ControlledVocabularyStringType from the imported CybOX Common schema.</xs:documentation></xs:annotation></xs:element>
This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
The idref field specifies a unique ID reference for this Object Property.
When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
This field is intended to be applicable only to fields which contain string values.
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
Source
<xs:element minOccurs="0" name="Value" type="cyboxCommon:StringObjectPropertyType"><xs:annotation><xs:documentation>The Value field specifies the value of the property being captured.</xs:documentation></xs:annotation></xs:element>
The Strategic_Objective field captures a single Strategic Objective that the Capability attempts to achieve. It can be considered as a more granular way of capturing the Capabilities present in the malware instance.
The required id field specifies a unique ID for this Capability Objective.
Source
<xs:element maxOccurs="unbounded" minOccurs="0" name="Strategic_Objective" type="maecBundle:CapabilityObjectiveType"><xs:annotation><xs:documentation>The Strategic_Objective field captures a single Strategic Objective that the Capability attempts to achieve. It can be considered as a more granular way of capturing the Capabilities present in the malware instance.</xs:documentation></xs:annotation></xs:element>
The Name field captures the name of the Capability Objective. There are several default vocabularies for this usage included in the MAEC Vocabularies schema. It uses the ControlledVocabularyStringType from the imported CybOX Common schema.
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
<xs:element name="Name" minOccurs="0" type="cyboxCommon:ControlledVocabularyStringType"><xs:annotation><xs:documentation>The Name field captures the name of the Capability Objective. There are several default vocabularies for this usage included in the MAEC Vocabularies schema. It uses the ControlledVocabularyStringType from the imported CybOX Common schema.</xs:documentation></xs:annotation></xs:element>
The Description field captures a basic textual description of the Capability Objective.
Diagram
Type
xs:string
Source
<xs:element minOccurs="0" name="Description" type="xs:string"><xs:annotation><xs:documentation>The Description field captures a basic textual description of the Capability Objective.</xs:documentation></xs:annotation></xs:element>
The Property field permits the capture of a single property of the Capability Objective, as a key/value pair. More than one property can be specified via multiple occurrences of this field.
<xs:element minOccurs="0" name="Property" type="maecBundle:CapabilityPropertyType" maxOccurs="unbounded"><xs:annotation><xs:documentation>The Property field permits the capture of a single property of the Capability Objective, as a key/value pair. More than one property can be specified via multiple occurrences of this field.</xs:documentation></xs:annotation></xs:element>
The behavior_idref field specifies the id of the Behavior being referenced; this Behavior must be present in the current Bundle.
Source
<xs:element minOccurs="0" name="Behavior_Reference" type="maecBundle:BehaviorReferenceType" maxOccurs="unbounded"><xs:annotation><xs:documentation>The Behavior_Reference field captures a reference to a Behavior that functions as an implementation of the Capability Objective.</xs:documentation></xs:annotation></xs:element>
<xs:element maxOccurs="unbounded" minOccurs="0" name="Relationship" type="maecBundle:CapabilityObjectiveRelationshipType"><xs:annotation><xs:documentation>The Relationship field captures a relationship from the Capability Objective to one or more other Capability Objectives.</xs:documentation></xs:annotation></xs:element>
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
<xs:element minOccurs="0" name="Relationship_Type" type="cyboxCommon:ControlledVocabularyStringType"><xs:annotation><xs:documentation>The Relationship_Type field captures the type of relationship being expressed between Objectives (either Strategic or Tactical).</xs:documentation></xs:annotation></xs:element>
The objective_idref field references the ID of a Capability Objective (either Strategic or Tactical) contained inside the current MAEC document.
Source
<xs:element maxOccurs="unbounded" minOccurs="1" name="Objective_Reference" type="maecBundle:CapabilityObjectiveReferenceType"><xs:annotation><xs:documentation>The Objective_Reference field references a single Capability Objective (either Strategic or Objective) in the relationship.</xs:documentation></xs:annotation></xs:element>
The Tactical_Objective field captures a single Tactical Objective that the Capability attempts to achieve, typically in the context of a broader Strategic Objective. It can be considered as a way of expounding upon Strategic Objectives to capture the Capabilities of the malware instance in more detail.
The required id field specifies a unique ID for this Capability Objective.
Source
<xs:element maxOccurs="unbounded" minOccurs="0" name="Tactical_Objective" type="maecBundle:CapabilityObjectiveType"><xs:annotation><xs:documentation>The Tactical_Objective field captures a single Tactical Objective that the Capability attempts to achieve, typically in the context of a broader Strategic Objective. It can be considered as a way of expounding upon Strategic Objectives to capture the Capabilities of the malware instance in more detail.</xs:documentation></xs:annotation></xs:element>
The Behavior_Reference field captures a reference to a Behavior that serves as an implementation of the Capability. For Behaviors that serve as implementations of specific Strategic or Tactical Objectives, the Behavior_Reference field under the Strategic_Objective or Tactical_Objective fields should be used, respectively.
The behavior_idref field specifies the id of the Behavior being referenced; this Behavior must be present in the current Bundle.
Source
<xs:element minOccurs="0" name="Behavior_Reference" type="maecBundle:BehaviorReferenceType" maxOccurs="unbounded"><xs:annotation><xs:documentation>The Behavior_Reference field captures a reference to a Behavior that serves as an implementation of the Capability. For Behaviors that serve as implementations of specific Strategic or Tactical Objectives, the Behavior_Reference field under the Strategic_Objective or Tactical_Objective fields should be used, respectively.</xs:documentation></xs:annotation></xs:element>
<xs:element minOccurs="0" name="Relationship" maxOccurs="unbounded" type="maecBundle:CapabilityRelationshipType"><xs:annotation><xs:documentation>The Relationship field captures a relationship from the Capability to one or more other Capabilities.</xs:documentation></xs:annotation></xs:element>
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
<xs:element minOccurs="0" name="Relationship_Type" type="cyboxCommon:ControlledVocabularyStringType"><xs:annotation><xs:documentation>The Relationship_Type field captures the type of relationship being expressed between Capabilities.</xs:documentation></xs:annotation></xs:element>
The capability_idref field references the ID of a Capability contained inside the current MAEC document.
Source
<xs:element maxOccurs="unbounded" minOccurs="1" name="Capability_Reference" type="maecBundle:CapabilityReferenceType"><xs:annotation><xs:documentation>The Capability_Reference field references a single Capability in the relationship, via its ID.</xs:documentation></xs:annotation></xs:element>
The Capability_Reference field references a single Capability defined elsewhere in the MAEC document, and therefore represents a single Capability possessed by the malware instance.
The capability_idref field references the ID of a Capability contained inside the current MAEC document.
Source
<xs:element name="Capability_Reference" type="maecBundle:CapabilityReferenceType"><xs:annotation><xs:documentation>The Capability_Reference field references a single Capability defined elsewhere in the MAEC document, and therefore represents a single Capability possessed by the malware instance.</xs:documentation></xs:annotation></xs:element>
The Behaviors field contains 1-n BehaviorType objects, which function as the MAEC representation for any behaviors that were observed for the malware instance.
<xs:element minOccurs="0" name="Behaviors" type="maecBundle:BehaviorListType"><xs:annotation><xs:documentation>The Behaviors field contains 1-n BehaviorType objects, which function as the MAEC representation for any behaviors that were observed for the malware instance.</xs:documentation></xs:annotation></xs:element>
The duration field specifies the duration of the Behavior. One way to derive such a value may be to calculate the difference between the timestamps of the first and last actions that compose the behavior.
The status field specifies the execution status of the Behavior being characterized.
Source
<xs:element name="Behavior" type="maecBundle:BehaviorType" maxOccurs="unbounded" form="qualified" minOccurs="1"><xs:annotation><xs:documentation>The Behavior field specifies a single Behavior in the list.</xs:documentation></xs:annotation></xs:element>
The Purpose field specifies the intended purpose of the Behavior. Since a Behavior is not always successful, and may not be fully observed, this is meant as way to state the nature of the Behavior apart from its constituent actions.
<xs:element minOccurs="0" name="Purpose" type="maecBundle:BehaviorPurposeType"><xs:annotation><xs:documentation>The Purpose field specifies the intended purpose of the Behavior. Since a Behavior is not always successful, and may not be fully observed, this is meant as way to state the nature of the Behavior apart from its constituent actions.</xs:documentation></xs:annotation></xs:element>
The Description field contains a prose text description of the purpose of the Behavior, whether it was successful or not.
Diagram
Type
xs:string
Source
<xs:element minOccurs="0" name="Description" type="xs:string"><xs:annotation><xs:documentation>The Description field contains a prose text description of the purpose of the Behavior, whether it was successful or not.</xs:documentation></xs:annotation></xs:element>
The Vulnerability_Exploit field characterizes any vulnerability that a Behavior may have attempted to exploit, whether or not the exploitation was successful (where success is not necessarily known).
The known_vulnerability field specifies whether the vulnerability that the malware is exploiting has been previously identified. If so, it should be referenced via a CVE ID in the CVE element. If not, the platform(s) targeted by the vulnerability exploitation behavior may be specified in the Targeted_Platforms element.
Source
<xs:element minOccurs="0" name="Vulnerability_Exploit" type="maecBundle:ExploitType"><xs:annotation><xs:documentation>The Vulnerability_Exploit field characterizes any vulnerability that a Behavior may have attempted to exploit, whether or not the exploitation was successful (where success is not necessarily known).</xs:documentation></xs:annotation></xs:element>
The cve_id attribute contains the ID of the CVE that is being referenced, e.g., CVE-1999-0002.
Source
<xs:element minOccurs="0" name="CVE" type="maecBundle:CVEVulnerabilityType"><xs:annotation><xs:documentation>The CVE field specifies the CVE ID and description of the vulnerability targeted by the exploit, if available.</xs:documentation></xs:annotation></xs:element>
The Description field specifies the textual description of the vulnerability referenced by the cve_id.
Diagram
Type
xs:string
Source
<xs:element name="Description" type="xs:string" minOccurs="0"><xs:annotation><xs:documentation>The Description field specifies the textual description of the vulnerability referenced by the cve_id.</xs:documentation></xs:annotation></xs:element>
The CWE_ID field captures the ID of the Common Weakness Enumeration (CWE) entry that represents the type of weakness targeted by the exploit. More than one such CWE ID can be specified by using multiple occurrences of this field.
Diagram
Type
xs:string
Source
<xs:element maxOccurs="unbounded" minOccurs="0" name="CWE_ID" type="xs:string"><xs:annotation><xs:documentation>The CWE_ID field captures the ID of the Common Weakness Enumeration (CWE) entry that represents the type of weakness targeted by the exploit. More than one such CWE ID can be specified by using multiple occurrences of this field.</xs:documentation></xs:annotation></xs:element>
<xs:element minOccurs="0" name="Targeted_Platforms" type="maecBundle:PlatformListType"><xs:annotation><xs:documentation>The Targeted_Platforms field specifies the platforms(s) targeted by the vulnerability exploit.</xs:documentation></xs:annotation></xs:element>
The Platform field specifies a single Platform in the list via a common platform enumeration ID. It uses the PlatformSpecificationType type from the CybOX Common schema v2.0.1.
<xs:element maxOccurs="unbounded" name="Platform" type="cyboxCommon:PlatformSpecificationType"><xs:annotation><xs:documentation>The Platform field specifies a single Platform in the list via a common platform enumeration ID. It uses the PlatformSpecificationType type from the CybOX Common schema v2.0.1.</xs:documentation></xs:annotation></xs:element>
The Description field specifies a prose textual description of the Behavior.
Diagram
Type
xs:string
Source
<xs:element minOccurs="0" name="Description" type="xs:string"><xs:annotation><xs:documentation>The Description field specifies a prose textual description of the Behavior.</xs:documentation></xs:annotation></xs:element>
The source_type field is optional and enables identification of the broad type of this cyber observation source.
Source
<xs:element minOccurs="0" name="Discovery_Method" type="cyboxCommon:MeasureSourceType"><xs:annotation><xs:documentation>The Discovery_Method field specifies the method used to discover the Behavior.</xs:documentation></xs:annotation></xs:element>
<xs:element minOccurs="0" name="Action_Composition" type="maecBundle:BehavioralActionsType"><xs:annotation><xs:documentation>The Action_Composition field captures the Actions that compose the Behavior.</xs:documentation></xs:annotation></xs:element>
The name field specifies the name of the collection.
Source
<xs:element minOccurs="1" name="Action_Collection" type="maecBundle:ActionCollectionType"><xs:annotation><xs:documentation>The Action_Collection field specifies an Action Collection that is part of the behavioral composition.</xs:documentation></xs:annotation></xs:element>
The Affinity_Type field provides an abstract way of characterizing how the objects in a collection are related.
Diagram
Type
xs:string
Source
<xs:element name="Affinity_Type" type="xs:string" minOccurs="0"><xs:annotation><xs:documentation>The Affinity_Type field provides an abstract way of characterizing how the objects in a collection are related.</xs:documentation></xs:annotation></xs:element>
The Affinity_Degree field is intended to provide an abstract way of characterizing the degree to which the objects in a collection are related.
Diagram
Type
xs:string
Source
<xs:element name="Affinity_Degree" type="xs:string" minOccurs="0"><xs:annotation><xs:documentation>The Affinity_Degree field is intended to provide an abstract way of characterizing the degree to which the objects in a collection are related.</xs:documentation></xs:annotation></xs:element>
The Description field contains a textual description of the collection.
Diagram
Type
xs:string
Source
<xs:element minOccurs="0" name="Description" type="xs:string"><xs:annotation><xs:documentation>The Description field contains a textual description of the collection.</xs:documentation></xs:annotation></xs:element>
<xs:element name="Action_List" type="maecBundle:ActionListType"><xs:annotation><xs:documentation>The Action_List field specifies a list of Actions that make up the collection.</xs:documentation></xs:annotation></xs:element>
The Action field specifies a single Action in the list.
The recommended syntax for Action IDs is a dash-delimited format that starts with the word maec, followed by a unique string, followed by the three letter code 'act', and ending with an integer. The regular expression validating these IDs is: maec-[A-Za-z0-9_\-\.]+-act-[1-9][0-9]*.
The idref field specifies a unique id reference to an Action defined elsewhere.
When idref is specified, the id attribute must not be specified, and any instance of this Action should not hold content unless an extension of the Action allows it.
The timestamp field represents the local or relative time at which the action occurred or was observed. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Represents the precision of the associated timestamp value. If omitted, the default is "second", meaning the timestamp is precise to the full field value. Digits in the timestamp that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.
Source
<xs:element name="Action" type="maecBundle:MalwareActionType" maxOccurs="unbounded" minOccurs="1"><xs:annotation><xs:documentation>The Action field specifies a single Action in the list.</xs:documentation><xs:documentation>The recommended syntax for Action IDs is a dash-delimited format that starts with the word maec, followed by a unique string, followed by the three letter code 'act', and ending with an integer. The regular expression validating these IDs is: maec-[A-Za-z0-9_\-\.]+-act-[1-9][0-9]*.</xs:documentation></xs:annotation></xs:element>
The Implementation field is optional and serves to capture attributes that are relevant to how the Action is implemented in the malware, such as the specific API call that was used.
The required type field refers to the type of Action Implementation being characterized in this element.
Source
<xs:element minOccurs="0" name="Implementation" type="maecBundle:ActionImplementationType"><xs:annotation><xs:documentation>The Implementation field is optional and serves to capture attributes that are relevant to how the Action is implemented in the malware, such as the specific API call that was used.</xs:documentation></xs:annotation></xs:element>
The Compatible_Platforms field specifies the specific platform(s) that the Action is compatible with, or in other words, capable of being successfully executed on.
<xs:element name="Compatible_Platforms" type="maecBundle:PlatformListType" minOccurs="0"><xs:annotation><xs:documentation>The Compatible_Platforms field specifies the specific platform(s) that the Action is compatible with, or in other words, capable of being successfully executed on.</xs:documentation></xs:annotation></xs:element>
The API_Call field allows for the characterization of a system-level API call that was used to implement the action. Software must make use of such calls to talk to hardware and perform system-specific functions.
The normalized_function_name field contains the normalized name of the API function called, e.g. CreateFile.
Source
<xs:element name="API_Call" maxOccurs="1" minOccurs="0" type="maecBundle:APICallType"><xs:annotation><xs:documentation>The API_Call field allows for the characterization of a system-level API call that was used to implement the action. Software must make use of such calls to talk to hardware and perform system-specific functions.</xs:documentation></xs:annotation></xs:element>
The Address field contains the address of the API call in the binary.
Diagram
Type
xs:hexBinary
Source
<xs:element name="Address" type="xs:hexBinary" minOccurs="0"><xs:annotation><xs:documentation>The Address field contains the address of the API call in the binary.</xs:documentation></xs:annotation></xs:element>
The Return_Value field contains the return value of the API call.
Diagram
Type
xs:string
Source
<xs:element name="Return_Value" type="xs:string" minOccurs="0"><xs:annotation><xs:documentation>The Return_Value field contains the return value of the API call.</xs:documentation></xs:annotation></xs:element>
<xs:element minOccurs="0" name="Parameters" type="maecBundle:ParameterListType"><xs:annotation><xs:documentation>The Parameter field captures any name/value pairs of the parameters passed into the API call.</xs:documentation></xs:annotation></xs:element>
The value field specifies the actual value of the parameter.
Source
<xs:element maxOccurs="unbounded" name="Parameter" type="maecBundle:ParameterType"><xs:annotation><xs:documentation>The Parameter field specifies a single function parameter.</xs:documentation></xs:annotation></xs:element>
The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
Source
<xs:element name="Code" maxOccurs="unbounded" type="CodeObj:CodeObjectType" minOccurs="0"><xs:annotation><xs:documentation>The Code field contains any form of code that was used to implement the action.</xs:documentation></xs:annotation></xs:element>
The behavioral_ordering field defines the ordering of the Action with respect to the other Actions that make up the behavior. So an action with a behavioral_ordering of "1" would come before an Action with a behavioral_ordering of "2", etc.
The idref field specifies a unique id reference to an Action defined elsewhere.
When idref is specified, the id attribute must not be specified, and any instance of this Action should not hold content unless an extension of the Action allows it.
The timestamp field represents the local or relative time at which the action occurred or was observed. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Represents the precision of the associated timestamp value. If omitted, the default is "second", meaning the timestamp is precise to the full field value. Digits in the timestamp that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.
Source
<xs:element minOccurs="1" name="Action" type="maecBundle:BehavioralActionType"><xs:annotation><xs:documentation>The Action field specifies a single Action that is part of the behavioral composition.</xs:documentation></xs:annotation></xs:element>
The behavioral_ordering field defines the ordering of the Action with respect to the other Actions that make up the Behavior. For example, an Action with a behavioral_ordering of "1" would come before an Action with a behavioral_ordering of "2", etc.
Source
<xs:element name="Action_Reference" type="maecBundle:BehavioralActionReferenceType"><xs:annotation><xs:documentation>The Action_Reference field specifies a reference to a single Action that is part of the behavioral composition.</xs:documentation></xs:annotation></xs:element>
The behavioral_ordering field defines the ordering of the Action Equivalency with respect to the other actions that make up the behavior. So an action with a behavioral_ordering of "1" would come before an action with a behavioral_ordering of "2", etc.
Source
<xs:element name="Action_Equivalence_Reference" type="maecBundle:BehavioralActionEquivalenceReferenceType"><xs:annotation><xs:documentation>The Action_Equivalence_Reference field specifies a reference to a single Action Equivalence that is part of the behavioral composition.</xs:documentation></xs:annotation></xs:element>
<xs:element minOccurs="0" name="Associated_Code" type="maecBundle:AssociatedCodeType"><xs:annotation><xs:documentation>The Associated_Code field specifies any code snippets that may be associated with the Behavior.</xs:documentation></xs:annotation></xs:element>
The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
Source
<xs:element maxOccurs="unbounded" name="Code_Snippet" type="CodeObj:CodeObjectType"><xs:annotation><xs:documentation>The Code_Snippet field captures a single snippet of code, via the CybOX CodeObjectType.</xs:documentation></xs:annotation></xs:element>
<xs:element minOccurs="0" name="Relationships" type="maecBundle:BehaviorRelationshipListType"><xs:annotation><xs:documentation>The Relationships field specifies any relationships between this Behavior and any other Behaviors.</xs:documentation></xs:annotation></xs:element>
The type field specifies the nature of the relationship between Behaviors that is being captured.
Source
<xs:element maxOccurs="unbounded" name="Relationship" type="maecBundle:BehaviorRelationshipType"><xs:annotation><xs:documentation>The Relationship field specifies a single relationship between a single Behavior and one or more other Behaviors.</xs:documentation></xs:annotation></xs:element>
The behavior_idref field specifies the id of the Behavior being referenced; this Behavior must be present in the current Bundle.
Source
<xs:element maxOccurs="unbounded" name="Behavior_Reference" type="maecBundle:BehaviorReferenceType" minOccurs="1"><xs:annotation><xs:documentation>The Behavior_Reference field specifies a reference to a single Behavior in the relationship.</xs:documentation></xs:annotation></xs:element>
The Actions field contains 1-n ActionType objects, which function as the MAEC representation for any lower-level actions that were observed for the malware instance.
<xs:element minOccurs="0" name="Actions" type="maecBundle:ActionListType"><xs:annotation><xs:documentation>The Actions field contains 1-n ActionType objects, which function as the MAEC representation for any lower-level actions that were observed for the malware instance.</xs:documentation></xs:annotation></xs:element>
<xs:element minOccurs="0" name="Objects" type="maecBundle:ObjectListType"><xs:annotation><xs:documentation>The Objects field contains 1-n ObjectType objects, which function as the MAEC representation for any objects associated with the malware instance.</xs:documentation></xs:annotation></xs:element>
The has_changed field is optional and conveys a targeted observation pattern of whether the associated object specified has changed in some way without requiring further specific detail. This field would be leveraged within a pattern observable triggering on whether the value of an object specification has changed at all. This field is NOT intended to be used for versioning of CybOX content.
The idref field specifies a unique id reference to an Object defined elsewhere.
When idref is specified, the id attribute must not be specified, and any instance of this Object should not hold content unless an extension of the Object allows it.
Source
<xs:element maxOccurs="unbounded" name="Object" type="cybox:ObjectType"><xs:annotation><xs:documentation>The Object field specifies a single CybOX Object in the list. For use in MAEC, the id attribute at the top level of the Object must be utilized.</xs:documentation></xs:annotation></xs:element>
The Candidate_Indicators field contains 1-n CandidateIndicatorType objects, which function as the MAEC representation of any candidate indicators associated with the malware instance.
<xs:element minOccurs="0" name="Candidate_Indicators" type="maecBundle:CandidateIndicatorListType"><xs:annotation><xs:documentation>The Candidate_Indicators field contains 1-n CandidateIndicatorType objects, which function as the MAEC representation of any candidate indicators associated with the malware instance.</xs:documentation></xs:annotation></xs:element>
The version field specifies the version of the Candidate Indicator.
Source
<xs:element maxOccurs="unbounded" name="Candidate_Indicator" type="maecBundle:CandidateIndicatorType"><xs:annotation><xs:documentation>The Candidate_Indicator field specifies a single Candidate Indicator in the list.</xs:documentation></xs:annotation></xs:element>
The Importance field specifies the relative importance of the Candidate Indicator.
This field is implemented through the xsi:type controlled vocabulary extension Capability. The default vocabulary type is ImportanceTypeVocab-1.0 in the http://maec.mitre.org/default_vocabularies-1 namespace. This type is defined in the maec_default_vocabularies.xsd file or at the URL http://maec.mitre.org/XMLSchema/default_vocabularies/1.0.0/maec_default_vocabularies.xsd.
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
<xs:element minOccurs="0" name="Importance" type="cyboxCommon:ControlledVocabularyStringType"><xs:annotation><xs:documentation>The Importance field specifies the relative importance of the Candidate Indicator.</xs:documentation><xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension Capability. The default vocabulary type is ImportanceTypeVocab-1.0 in the http://maec.mitre.org/default_vocabularies-1 namespace. This type is defined in the maec_default_vocabularies.xsd file or at the URL http://maec.mitre.org/XMLSchema/default_vocabularies/1.0.0/maec_default_vocabularies.xsd.</xs:documentation></xs:annotation></xs:element>
The Numeric_Importance field specifies the specific numeric importance of the Candidate Indicator.
Diagram
Type
xs:positiveInteger
Source
<xs:element minOccurs="0" name="Numeric_Importance" type="xs:positiveInteger"><xs:annotation><xs:documentation>The Numeric_Importance field specifies the specific numeric importance of the Candidate Indicator.</xs:documentation></xs:annotation></xs:element>
The Author field specifies the author of the Candidate Indicator.
Diagram
Type
xs:string
Source
<xs:element minOccurs="0" name="Author" type="xs:string"><xs:annotation><xs:documentation>The Author field specifies the author of the Candidate Indicator.</xs:documentation></xs:annotation></xs:element>
The Description field provides a brief description of the Candidate Indicator.
Diagram
Type
xs:string
Source
<xs:element minOccurs="0" name="Description" type="xs:string"><xs:annotation><xs:documentation>The Description field provides a brief description of the Candidate Indicator.</xs:documentation></xs:annotation></xs:element>
The Malware_Entity field specifies the particular malware entity that the Candidate Indicator is written against, whether it be a malware instance, family, etc.
<xs:element minOccurs="0" name="Malware_Entity" type="maecBundle:MalwareEntityType"><xs:annotation><xs:documentation>The Malware_Entity field specifies the particular malware entity that the Candidate Indicator is written against, whether it be a malware instance, family, etc.</xs:documentation></xs:annotation></xs:element>
The Type field refers to the specific type of malware entity that the indicator or signature is written against.
This field is implemented through the xsi:type controlled vocabulary extension Capability. The default vocabulary type is MalwareEntityTypeVocab-1.0 in the http://maec.mitre.org/default_vocabularies-1 namespace. This type is defined in the maec_default_vocabularies.xsd file or at the URL http://maec.mitre.org/XMLSchema/default_vocabularies/1.0.0/maec_default_vocabularies.xsd.
This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
Source
<xs:element minOccurs="0" name="Type" type="cyboxCommon:ControlledVocabularyStringType"><xs:annotation><xs:documentation>The Type field refers to the specific type of malware entity that the indicator or signature is written against.</xs:documentation><xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension Capability. The default vocabulary type is MalwareEntityTypeVocab-1.0 in the http://maec.mitre.org/default_vocabularies-1 namespace. This type is defined in the maec_default_vocabularies.xsd file or at the URL http://maec.mitre.org/XMLSchema/default_vocabularies/1.0.0/maec_default_vocabularies.xsd.</xs:documentation></xs:annotation></xs:element>
The Name field refers to the name of the malware instance, malware family, or malware class that the indicator or signature is written against.
Diagram
Type
xs:string
Source
<xs:element minOccurs="0" name="Name" type="xs:string"><xs:annotation><xs:documentation>The Name field refers to the name of the malware instance, malware family, or malware class that the indicator or signature is written against.</xs:documentation></xs:annotation></xs:element>
The Description field is intended to provide a brief description of the entity that the indicator or signature is written against.
Diagram
Type
xs:string
Source
<xs:element minOccurs="0" name="Description" type="xs:string"><xs:annotation><xs:documentation>The Description field is intended to provide a brief description of the entity that the indicator or signature is written against.</xs:documentation></xs:annotation></xs:element>
The Composition field specifies the actual observables that the Candidate Indicator is composed of, via a reference to a one or more MAEC entities contained in the Bundle.
The operator field specifies the Boolean operator for this level of the Candidate Indicator's composition.
Source
<xs:element minOccurs="0" name="Composition" type="maecBundle:CandidateIndicatorCompositionType"><xs:annotation><xs:documentation>The Composition field specifies the actual observables that the Candidate Indicator is composed of, via a reference to a one or more MAEC entities contained in the Bundle.</xs:documentation></xs:annotation></xs:element>
The behavior_idref field specifies the id of the Behavior being referenced; this Behavior must be present in the current Bundle.
Source
<xs:element minOccurs="0" name="Behavior_Reference" type="maecBundle:BehaviorReferenceType"><xs:annotation><xs:documentation>The Behavior_Reference field specifies a reference to a single Behavior in the Bundle that is part of the candidate indicator's composition.</xs:documentation></xs:annotation></xs:element>
The action_id field refers to the id of the action being referenced.
Source
<xs:element minOccurs="0" name="Action_Reference" type="cybox:ActionReferenceType"><xs:annotation><xs:documentation>The Action_Reference field specifies a reference to a single Action in the Bundle that is part of the candidate indicator's composition.</xs:documentation></xs:annotation></xs:element>
The object_idref field specifies the id of a CybOX Object being referenced in the current MAEC Bundle.
Source
<xs:element minOccurs="0" name="Object_Reference" type="maecBundle:ObjectReferenceType"><xs:annotation><xs:documentation>The Object_Reference field specifies a reference to a single Object in the Bundle that is part of the candidate indicator's composition.</xs:documentation></xs:annotation></xs:element>
The operator field specifies the Boolean operator for this level of the Candidate Indicator's composition.
Source
<xs:element maxOccurs="unbounded" minOccurs="0" name="Sub_Composition" type="maecBundle:CandidateIndicatorCompositionType"><xs:annotation><xs:documentation>The Sub_Composition field captures any sub-compositions in this Candidate Indicator, for expressing more complex Candidate Indicators.</xs:documentation></xs:annotation></xs:element>
<xs:element minOccurs="0" name="Collections" type="maecBundle:CollectionsType"><xs:annotation><xs:documentation>The Collections field contains the collection element types for Behaviors, Actions, Objects, and Candidate Indicators.</xs:documentation></xs:annotation></xs:element>
<xs:element minOccurs="0" name="Behavior_Collections" type="maecBundle:BehaviorCollectionListType"><xs:annotation><xs:documentation>The Behavior_Collections field captures any collections of Behaviors in the Bundle.</xs:documentation></xs:annotation></xs:element>
The name field specifies the name of the collection.
Source
<xs:element maxOccurs="unbounded" name="Behavior_Collection" type="maecBundle:BehaviorCollectionType"><xs:annotation><xs:documentation>The Behavior_Collection field specifies a single collection of Behaviors in the Bundle.</xs:documentation></xs:annotation></xs:element>
The Purpose field states the intended purpose of the collection of Behaviors. Since Behaviors are not always successful, and may not be fully observed, this is meant as way of absracting the nature of the collection of Behaviors away from its constituent Actions.
Diagram
Type
xs:string
Source
<xs:element name="Purpose" type="xs:string" minOccurs="0"><xs:annotation><xs:documentation>The Purpose field states the intended purpose of the collection of Behaviors. Since Behaviors are not always successful, and may not be fully observed, this is meant as way of absracting the nature of the collection of Behaviors away from its constituent Actions.</xs:documentation></xs:annotation></xs:element>
<xs:element name="Behavior_List" type="maecBundle:BehaviorListType"><xs:annotation><xs:documentation>The Behavior_List field specifies a list of Behaviors that make up the collection.</xs:documentation></xs:annotation></xs:element>
<xs:element minOccurs="0" name="Action_Collections" type="maecBundle:ActionCollectionListType"><xs:annotation><xs:documentation>The Action_Collections field captures any collections of Actions in the Bundle.</xs:documentation></xs:annotation></xs:element>
The name field specifies the name of the collection.
Source
<xs:element maxOccurs="unbounded" name="Action_Collection" type="maecBundle:ActionCollectionType"><xs:annotation><xs:documentation>The Action_Collection field specifies a single collection of Actions in the Bundle.</xs:documentation></xs:annotation></xs:element>
<xs:element minOccurs="0" name="Object_Collections" type="maecBundle:ObjectCollectionListType"><xs:annotation><xs:documentation>The Objects_Collections field captures any collections of CybOX Objects in the Bundle.</xs:documentation></xs:annotation></xs:element>
The name field specifies the name of the collection.
Source
<xs:element maxOccurs="unbounded" name="Object_Collection" type="maecBundle:ObjectCollectionType"><xs:annotation><xs:documentation>The Object_Collection field specifies a single collection of CybOX Objects.</xs:documentation></xs:annotation></xs:element>
<xs:element name="Object_List" type="maecBundle:ObjectListType"><xs:annotation><xs:documentation>The Object_List field specifies a list of Objects that make up the collection.</xs:documentation></xs:annotation></xs:element>
<xs:element minOccurs="0" name="Candidate_Indicator_Collections" type="maecBundle:CandidateIndicatorCollectionListType"><xs:annotation><xs:documentation>The Candidate_Indicator_Collections field captures any collections of Candidate Indicators in the Bundle.</xs:documentation></xs:annotation></xs:element>
The name field specifies the name of the collection.
Source
<xs:element maxOccurs="unbounded" name="Candidate_Indicator_Collection" type="maecBundle:CandidateIndicatorCollectionType"><xs:annotation><xs:documentation>The Candidate_Indicator_Collection field specifies a single collection of Candidate Indicators.</xs:documentation></xs:annotation></xs:element>
<xs:element name="Candidate_Indicator_List" type="maecBundle:CandidateIndicatorListType"><xs:annotation><xs:documentation>The Candidate_Indicator_List field specifies a list of Candidate Indicators that make up the collection.</xs:documentation></xs:annotation></xs:element>
Element maecBundle:MAEC_Bundle
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The MAEC_Bundle element is the root element of this schema, and is of type BundleType. As such, it represents the characterization of a single malware instance, characterized in the top-level Subject_Details element, via its MAEC entities.
The content_type field specifies the general type of content contained in this Bundle, e.g. static analysis tool output, dynamic analysis tool output, etc.
The required defined_subject field specifies whether the subject attributes of the characterized malware instance are included inside this Bundle (via the top-level Malware_Instance_Object_Attributes field) or elsewhere (such as a MAEC Subject in a MAEC Package).
The required schema_version field specifies the version of the MAEC Bundle Schema that the document has been written in and that should be used for validation.
The timestamp field specifies the date/time that the bundle was generated.
Source
<xs:element name="MAEC_Bundle" type="maecBundle:BundleType"><xs:annotation><xs:documentation>The MAEC_Bundle element is the root element of this schema, and is of type BundleType. As such, it represents the characterization of a single malware instance, characterized in the top-level Subject_Details element, via its MAEC entities.</xs:documentation></xs:annotation><xs:unique name="unique-bundle-id"><xs:selector xpath=".//*"/><xs:field xpath="@id"/></xs:unique></xs:element>
Element maecBundle:Action
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The Action element enables description/specification of a single malware action.
The idref field specifies a unique id reference to an Action defined elsewhere.
When idref is specified, the id attribute must not be specified, and any instance of this Action should not hold content unless an extension of the Action allows it.
The timestamp field represents the local or relative time at which the action occurred or was observed. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Represents the precision of the associated timestamp value. If omitted, the default is "second", meaning the timestamp is precise to the full field value. Digits in the timestamp that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.
Source
<xs:element name="Action" type="maecBundle:MalwareActionType"><xs:annotation><xs:documentation>The Action element enables description/specification of a single malware action.</xs:documentation></xs:annotation><xs:unique name="unique-action-id"><xs:selector xpath=".//*"/><xs:field xpath="@id"/></xs:unique></xs:element>
Element maecBundle:Behavior
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The Behavior element enables description/specification of a single malware behavior.
The duration field specifies the duration of the Behavior. One way to derive such a value may be to calculate the difference between the timestamps of the first and last actions that compose the behavior.
The status field specifies the execution status of the Behavior being characterized.
Source
<xs:element name="Behavior" type="maecBundle:BehaviorType"><xs:annotation><xs:documentation>The Behavior element enables description/specification of a single malware behavior.</xs:documentation></xs:annotation><xs:unique name="unique-behavior-id"><xs:selector xpath=".//*"/><xs:field xpath="@id"/></xs:unique></xs:element>
The behavior_idref field specifies the id of the Behavior being referenced; this Behavior must be present in the current Bundle.
Source
<xs:element maxOccurs="unbounded" name="Behavior_Reference" type="maecBundle:BehaviorReferenceType"><xs:annotation><xs:documentation>The Behavior_Reference field specifies a reference to a single Behavior.</xs:documentation></xs:annotation></xs:element>
Complex Type maecBundle:BundleReferenceType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The BundleReferenceType serves as a method for linking to Bundles embedded in other locations.
The bundle_idref field references the ID of a Bundle contained inside the current MAEC document.
Source
<xs:complexType name="BundleReferenceType"><xs:annotation><xs:documentation>The BundleReferenceType serves as a method for linking to Bundles embedded in other locations.</xs:documentation></xs:annotation><xs:attribute name="bundle_idref" type="xs:QName" use="required"><xs:annotation><xs:documentation>The bundle_idref field references the ID of a Bundle contained inside the current MAEC document.</xs:documentation></xs:annotation></xs:attribute></xs:complexType>
Complex Type maecBundle:ObjectReferenceListType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The ObjectReferenceListType captures a list of references to CybOX Objects.
<xs:complexType name="ObjectReferenceListType"><xs:annotation><xs:documentation>The ObjectReferenceListType captures a list of references to CybOX Objects.</xs:documentation></xs:annotation><xs:sequence><xs:element maxOccurs="unbounded" name="Object_Reference" type="maecBundle:ObjectReferenceType"><xs:annotation><xs:documentation>The Object_Reference field specifies a reference to a single CybOX Object.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:ObjectReferenceType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The ObjectReferenceType serves as a method for linking to CybOX Objects embedded in the MAEC Bundle.
The object_idref field specifies the id of a CybOX Object being referenced in the current MAEC Bundle.
Source
<xs:complexType name="ObjectReferenceType"><xs:annotation><xs:documentation>The ObjectReferenceType serves as a method for linking to CybOX Objects embedded in the MAEC Bundle.</xs:documentation></xs:annotation><xs:attribute name="object_idref" type="xs:QName" use="required"><xs:annotation><xs:documentation>The object_idref field specifies the id of a CybOX Object being referenced in the current MAEC Bundle.</xs:documentation></xs:annotation></xs:attribute></xs:complexType>
Complex Type maecBundle:BundleType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The BundleType serves as the high-level construct which encapsulates all Bundle elements, and represents some characterized analysis data (from any arbitrary set of analyses) for a single malware instance in terms of its MAEC Components (e.g., Behaviors, Actions, Objects, etc.).
The content_type field specifies the general type of content contained in this Bundle, e.g. static analysis tool output, dynamic analysis tool output, etc.
The required defined_subject field specifies whether the subject attributes of the characterized malware instance are included inside this Bundle (via the top-level Malware_Instance_Object_Attributes field) or elsewhere (such as a MAEC Subject in a MAEC Package).
The required schema_version field specifies the version of the MAEC Bundle Schema that the document has been written in and that should be used for validation.
The timestamp field specifies the date/time that the bundle was generated.
Source
<xs:complexType name="BundleType"><xs:annotation><xs:documentation>The BundleType serves as the high-level construct which encapsulates all Bundle elements, and represents some characterized analysis data (from any arbitrary set of analyses) for a single malware instance in terms of its MAEC Components (e.g., Behaviors, Actions, Objects, etc.).</xs:documentation></xs:annotation><xs:sequence><xs:element minOccurs="0" name="Malware_Instance_Object_Attributes" type="cybox:ObjectType"><xs:annotation><xs:documentation>The Malware_Instance_Object_Attributes field characterizes the attributes of the object (most typically a file) that represents the malware instance whose Behaviors, Actions, Objects, Process Tree, and Candidate Indicators are characterized in this Bundle. This is equivalent to the Malware_Instance_Object_Attributes inside of a Malware_Subject in the MAEC Package, and is therefore only required if this Bundle is to be used in a stand-alone fashion, i.e., without an accompanying MAEC Package and with the defined_subject field set to 'True'.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="AV_Classifications" type="maecBundle:AVClassificationsType"><xs:annotation><xs:documentation>The AV_Classifications field contains 1-n AVClassificationType objects, which capture any Anti-Virus scanner tool classifications of the malware instance object.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Process_Tree" type="maecBundle:ProcessTreeType"><xs:annotation><xs:documentation>The Process_Tree field specifies the observed process tree of execution for the malware instance, along with references to any corresponding actions that were initiated, if applicable.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Capabilities" type="maecBundle:CapabilityListType"><xs:annotation><xs:documentation>The Capabilities field contains 1-n CapabilityType objects, which serve to describe the high-level capabilities and objectives of the malware instance.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Behaviors" type="maecBundle:BehaviorListType"><xs:annotation><xs:documentation>The Behaviors field contains 1-n BehaviorType objects, which function as the MAEC representation for any behaviors that were observed for the malware instance.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Actions" type="maecBundle:ActionListType"><xs:annotation><xs:documentation>The Actions field contains 1-n ActionType objects, which function as the MAEC representation for any lower-level actions that were observed for the malware instance.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Objects" type="maecBundle:ObjectListType"><xs:annotation><xs:documentation>The Objects field contains 1-n ObjectType objects, which function as the MAEC representation for any objects associated with the malware instance.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Candidate_Indicators" type="maecBundle:CandidateIndicatorListType"><xs:annotation><xs:documentation>The Candidate_Indicators field contains 1-n CandidateIndicatorType objects, which function as the MAEC representation of any candidate indicators associated with the malware instance.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Collections" type="maecBundle:CollectionsType"><xs:annotation><xs:documentation>The Collections field contains the collection element types for Behaviors, Actions, Objects, and Candidate Indicators.</xs:documentation></xs:annotation></xs:element></xs:sequence><xs:attribute name="id" use="required" type="xs:QName"><xs:annotation><xs:documentation>The required id field specifies a unique ID for this MAEC Bundle.</xs:documentation></xs:annotation></xs:attribute><xs:attribute name="schema_version" type="xs:string" use="required" fixed="4.1"><xs:annotation><xs:documentation>The required schema_version field specifies the version of the MAEC Bundle Schema that the document has been written in and that should be used for validation.</xs:documentation></xs:annotation></xs:attribute><xs:attribute name="defined_subject" type="xs:boolean" use="required"><xs:annotation><xs:documentation>The required defined_subject field specifies whether the subject attributes of the characterized malware instance are included inside this Bundle (via the top-level Malware_Instance_Object_Attributes field) or elsewhere (such as a MAEC Subject in a MAEC Package).</xs:documentation></xs:annotation></xs:attribute><xs:attribute name="content_type" type="maecBundle:BundleContentTypeEnum"><xs:annotation><xs:documentation>The content_type field specifies the general type of content contained in this Bundle, e.g. static analysis tool output, dynamic analysis tool output, etc.</xs:documentation></xs:annotation></xs:attribute><xs:attribute name="timestamp" type="xs:dateTime"><xs:annotation><xs:documentation>The timestamp field specifies the date/time that the bundle was generated.</xs:documentation></xs:annotation></xs:attribute></xs:complexType>
Complex Type maecBundle:AVClassificationsType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The AVClassificationsType captures any Anti-Virus (AV) tool classifications for an Object.
<xs:complexType name="AVClassificationsType"><xs:annotation><xs:documentation>The AVClassificationsType captures any Anti-Virus (AV) tool classifications for an Object.</xs:documentation></xs:annotation><xs:sequence><xs:element maxOccurs="unbounded" name="AV_Classification" type="maecBundle:AVClassificationType"><xs:annotation><xs:documentation>The AV_Classification field captures a single AV classication of the malware instance object.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:AVClassificationType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The AVClassificationType captures information on AV scanner classifications for the malware instance object captured in the Bundle or Package.
The idref field specifies reference to a unique ID for this Tool.
When idref is specified, the id attribute must not be specified, and any instance of this type should not hold content unless an extension of the type allows it.
Source
<xs:complexType name="AVClassificationType"><xs:annotation><xs:documentation>The AVClassificationType captures information on AV scanner classifications for the malware instance object captured in the Bundle or Package.</xs:documentation></xs:annotation><xs:complexContent><xs:extension base="cyboxCommon:ToolInformationType"><xs:sequence><xs:element minOccurs="0" name="Engine_Version" type="xs:string"><xs:annotation><xs:documentation>The Engine_Version field captures the version of the AV engine used by the AV scanner tool that assigned the classification to the malware instance object.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Definition_Version" type="xs:string"><xs:annotation><xs:documentation>The Definition_Version field captures the version of the AV definitions used by the AV scanner tool that assigned the classification to the malware instance object.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Classification_Name" type="xs:string"><xs:annotation><xs:documentation>The Classification_Name field captures the classification assigned to the malware instance object by the AV scanner tool characterized in the Company_Name and Product_Name fields.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:extension></xs:complexContent></xs:complexType>
Complex Type maecBundle:ProcessTreeType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The ProcessTreeType captures the process tree for the malware instance, including the parent process and processes spawned by it, along with any Actions initiated by each.
<xs:complexType name="ProcessTreeType"><xs:annotation><xs:documentation>The ProcessTreeType captures the process tree for the malware instance, including the parent process and processes spawned by it, along with any Actions initiated by each.</xs:documentation></xs:annotation><xs:sequence><xs:element name="Root_Process" type="maecBundle:ProcessTreeNodeType"><xs:annotation><xs:documentation>The Root_Process field captures the root process in the process tree.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:ProcessTreeNodeType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The ProcessTreeNodeType captures a single process, or node, in the process tree. It imports and extends the ProcessObjectType from the CybOX Process Object.
The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
The parent_action_idref field specifies the id of the action that created or injected this process.
Source
<xs:complexType name="ProcessTreeNodeType"><xs:annotation><xs:documentation>The ProcessTreeNodeType captures a single process, or node, in the process tree. It imports and extends the ProcessObjectType from the CybOX Process Object.</xs:documentation></xs:annotation><xs:complexContent><xs:extension base="ProcessObj:ProcessObjectType"><xs:sequence><xs:element minOccurs="0" name="Initiated_Actions" type="maecBundle:ActionReferenceListType"><xs:annotation><xs:documentation>The Initiated_Actions field captures, via references, the actions (found inside the top-level Actions element, or an Action Collection inside the top-level Collections element) initiated by the Process.</xs:documentation></xs:annotation></xs:element><xs:element maxOccurs="unbounded" minOccurs="0" name="Spawned_Process" type="maecBundle:ProcessTreeNodeType"><xs:annotation><xs:documentation>The Spawned_Process field captures a single child process spawned by this process.</xs:documentation></xs:annotation></xs:element><xs:element maxOccurs="unbounded" minOccurs="0" name="Injected_Process" type="maecBundle:ProcessTreeNodeType"><xs:annotation><xs:documentation>The Injected_Process field captures a single process that was injected by this process.</xs:documentation></xs:annotation></xs:element></xs:sequence><xs:attribute name="id" type="xs:QName" use="required"><xs:annotation><xs:documentation>The required id field specifies a unique ID for the Process Node.</xs:documentation></xs:annotation></xs:attribute><xs:attribute name="parent_action_idref" type="xs:QName"><xs:annotation><xs:documentation>The parent_action_idref field specifies the id of the action that created or injected this process.</xs:documentation></xs:annotation></xs:attribute><xs:attribute name="ordinal_position" type="xs:positiveInteger"><xs:annotation><xs:documentation>The ordinal_position field specifies the ordinal position of the process with respect to the other processes spawned or injected by the malware.</xs:documentation></xs:annotation></xs:attribute></xs:extension></xs:complexContent></xs:complexType>
Complex Type maecBundle:ActionReferenceListType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The ActionReferenceListType captures a list of Action References.
<xs:complexType name="ActionReferenceListType"><xs:annotation><xs:documentation>The ActionReferenceListType captures a list of Action References.</xs:documentation></xs:annotation><xs:sequence><xs:element maxOccurs="unbounded" name="Action_Reference" type="cybox:ActionReferenceType"><xs:annotation><xs:documentation>The Action_Reference field specifies a reference to a single Action.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:CapabilityListType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The CapabilityListType captures a list of Capabilities.
<xs:complexType name="CapabilityListType"><xs:annotation><xs:documentation>The CapabilityListType captures a list of Capabilities.</xs:documentation></xs:annotation><xs:choice maxOccurs="unbounded"><xs:element maxOccurs="1" minOccurs="1" name="Capability" type="maecBundle:CapabilityType"><xs:annotation><xs:documentation>The Capability field captures a single Capability in the list, and therefore represents a single Capability possessed by the malware instance.</xs:documentation></xs:annotation></xs:element><xs:element name="Capability_Reference" type="maecBundle:CapabilityReferenceType"><xs:annotation><xs:documentation>The Capability_Reference field references a single Capability defined elsewhere in the MAEC document, and therefore represents a single Capability possessed by the malware instance.</xs:documentation></xs:annotation></xs:element></xs:choice></xs:complexType>
Complex Type maecBundle:CapabilityType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The CapabilityType captures details of a Capability that may be implemented in the malware instance, along with its child Strategic and Tactical Objectives.
The name field captures the name of the Capability. It uses the MalwareCapabilityEnum-1.0 enumeration from the MAEC Vocabularies schema.
Source
<xs:complexType name="CapabilityType"><xs:annotation><xs:documentation>The CapabilityType captures details of a Capability that may be implemented in the malware instance, along with its child Strategic and Tactical Objectives.</xs:documentation></xs:annotation><xs:sequence><xs:element minOccurs="0" name="Description" type="xs:string"><xs:annotation><xs:documentation>The Description field captures a basic textual description of the Capability.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Property" type="maecBundle:CapabilityPropertyType" maxOccurs="unbounded"><xs:annotation><xs:documentation>The Property field permits the capture of a single property of the Capability, as a key/value pair. More than one property can be specified via multiple occurrences of this field.</xs:documentation></xs:annotation></xs:element><xs:element maxOccurs="unbounded" minOccurs="0" name="Strategic_Objective" type="maecBundle:CapabilityObjectiveType"><xs:annotation><xs:documentation>The Strategic_Objective field captures a single Strategic Objective that the Capability attempts to achieve. It can be considered as a more granular way of capturing the Capabilities present in the malware instance.</xs:documentation></xs:annotation></xs:element><xs:element maxOccurs="unbounded" minOccurs="0" name="Tactical_Objective" type="maecBundle:CapabilityObjectiveType"><xs:annotation><xs:documentation>The Tactical_Objective field captures a single Tactical Objective that the Capability attempts to achieve, typically in the context of a broader Strategic Objective. It can be considered as a way of expounding upon Strategic Objectives to capture the Capabilities of the malware instance in more detail.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Behavior_Reference" type="maecBundle:BehaviorReferenceType" maxOccurs="unbounded"><xs:annotation><xs:documentation>The Behavior_Reference field captures a reference to a Behavior that serves as an implementation of the Capability. For Behaviors that serve as implementations of specific Strategic or Tactical Objectives, the Behavior_Reference field under the Strategic_Objective or Tactical_Objective fields should be used, respectively.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Relationship" maxOccurs="unbounded" type="maecBundle:CapabilityRelationshipType"><xs:annotation><xs:documentation>The Relationship field captures a relationship from the Capability to one or more other Capabilities.</xs:documentation></xs:annotation></xs:element></xs:sequence><xs:attribute name="id" use="required" type="xs:QName"><xs:annotation><xs:documentation>The required id field specifies a unique ID for this MAEC Capability.</xs:documentation></xs:annotation></xs:attribute><xs:attribute name="name" type="maecVocabs:MalwareCapabilityEnum-1.0"><xs:annotation><xs:documentation>The name field captures the name of the Capability. It uses the MalwareCapabilityEnum-1.0 enumeration from the MAEC Vocabularies schema.</xs:documentation></xs:annotation></xs:attribute></xs:complexType>
Complex Type maecBundle:CapabilityPropertyType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The CapabilityPropertyType captures a single property of a Capability or Capability Objective.
<xs:complexType name="CapabilityPropertyType"><xs:annotation><xs:documentation>The CapabilityPropertyType captures a single property of a Capability or Capability Objective.</xs:documentation></xs:annotation><xs:sequence><xs:element minOccurs="0" name="Name" type="cyboxCommon:ControlledVocabularyStringType"><xs:annotation><xs:documentation>The Name field specifies the name of the property being captured. The name can be either free form text or a standardized value from a vocabulary included in the MAEC Default Vocabularies schema. This field uses the ControlledVocabularyStringType from the imported CybOX Common schema.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Value" type="cyboxCommon:StringObjectPropertyType"><xs:annotation><xs:documentation>The Value field specifies the value of the property being captured.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:CapabilityObjectiveType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The CapabilityObjectiveType captures details of a Capability Strategic or Tactical Objective.
The required id field specifies a unique ID for this Capability Objective.
Source
<xs:complexType name="CapabilityObjectiveType"><xs:annotation><xs:documentation>The CapabilityObjectiveType captures details of a Capability Strategic or Tactical Objective.</xs:documentation></xs:annotation><xs:sequence><xs:element name="Name" minOccurs="0" type="cyboxCommon:ControlledVocabularyStringType"><xs:annotation><xs:documentation>The Name field captures the name of the Capability Objective. There are several default vocabularies for this usage included in the MAEC Vocabularies schema. It uses the ControlledVocabularyStringType from the imported CybOX Common schema.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Description" type="xs:string"><xs:annotation><xs:documentation>The Description field captures a basic textual description of the Capability Objective.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Property" type="maecBundle:CapabilityPropertyType" maxOccurs="unbounded"><xs:annotation><xs:documentation>The Property field permits the capture of a single property of the Capability Objective, as a key/value pair. More than one property can be specified via multiple occurrences of this field.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Behavior_Reference" type="maecBundle:BehaviorReferenceType" maxOccurs="unbounded"><xs:annotation><xs:documentation>The Behavior_Reference field captures a reference to a Behavior that functions as an implementation of the Capability Objective.</xs:documentation></xs:annotation></xs:element><xs:element maxOccurs="unbounded" minOccurs="0" name="Relationship" type="maecBundle:CapabilityObjectiveRelationshipType"><xs:annotation><xs:documentation>The Relationship field captures a relationship from the Capability Objective to one or more other Capability Objectives.</xs:documentation></xs:annotation></xs:element></xs:sequence><xs:attribute name="id" use="required" type="xs:QName"><xs:annotation><xs:documentation>The required id field specifies a unique ID for this Capability Objective.</xs:documentation></xs:annotation></xs:attribute></xs:complexType>
Complex Type maecBundle:BehaviorReferenceType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The BehaviorReferenceType serves as a method for referencing existing behaviors contained in the Bundle.
The behavior_idref field specifies the id of the Behavior being referenced; this Behavior must be present in the current Bundle.
Source
<xs:complexType name="BehaviorReferenceType"><xs:annotation><xs:documentation>The BehaviorReferenceType serves as a method for referencing existing behaviors contained in the Bundle.</xs:documentation></xs:annotation><xs:attribute name="behavior_idref" type="xs:QName" use="required"><xs:annotation><xs:documentation>The behavior_idref field specifies the id of the Behavior being referenced; this Behavior must be present in the current Bundle.</xs:documentation></xs:annotation></xs:attribute></xs:complexType>
Complex Type maecBundle:CapabilityObjectiveRelationshipType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The CapabilityObjectiveRelationshipType captures a relationship between a Strategic or Tactical Objective and one or more other Strategic or Tactical Objectives.
<xs:complexType name="CapabilityObjectiveRelationshipType"><xs:annotation><xs:documentation>The CapabilityObjectiveRelationshipType captures a relationship between a Strategic or Tactical Objective and one or more other Strategic or Tactical Objectives.</xs:documentation></xs:annotation><xs:sequence><xs:element minOccurs="0" name="Relationship_Type" type="cyboxCommon:ControlledVocabularyStringType"><xs:annotation><xs:documentation>The Relationship_Type field captures the type of relationship being expressed between Objectives (either Strategic or Tactical).</xs:documentation></xs:annotation></xs:element><xs:element maxOccurs="unbounded" minOccurs="1" name="Objective_Reference" type="maecBundle:CapabilityObjectiveReferenceType"><xs:annotation><xs:documentation>The Objective_Reference field references a single Capability Objective (either Strategic or Objective) in the relationship.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:CapabilityObjectiveReferenceType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The CapabilityObjectiveReferenceType serves as a method for referencing existing Capability Objectives (either Strategic or Tactical) contained in the Bundle.
The objective_idref field references the ID of a Capability Objective (either Strategic or Tactical) contained inside the current MAEC document.
Source
<xs:complexType name="CapabilityObjectiveReferenceType"><xs:annotation><xs:documentation>The CapabilityObjectiveReferenceType serves as a method for referencing existing Capability Objectives (either Strategic or Tactical) contained in the Bundle.</xs:documentation></xs:annotation><xs:attribute name="objective_idref" type="xs:QName" use="required"><xs:annotation><xs:documentation>The objective_idref field references the ID of a Capability Objective (either Strategic or Tactical) contained inside the current MAEC document.</xs:documentation></xs:annotation></xs:attribute></xs:complexType>
Complex Type maecBundle:CapabilityRelationshipType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The CapabilityObjectiveRelationshipType captures a relationship between a Capability and one or more other Capabilitys.
<xs:complexType name="CapabilityRelationshipType"><xs:annotation><xs:documentation>The CapabilityObjectiveRelationshipType captures a relationship between a Capability and one or more other Capabilitys.</xs:documentation></xs:annotation><xs:sequence><xs:element minOccurs="0" name="Relationship_Type" type="cyboxCommon:ControlledVocabularyStringType"><xs:annotation><xs:documentation>The Relationship_Type field captures the type of relationship being expressed between Capabilities.</xs:documentation></xs:annotation></xs:element><xs:element maxOccurs="unbounded" minOccurs="1" name="Capability_Reference" type="maecBundle:CapabilityReferenceType"><xs:annotation><xs:documentation>The Capability_Reference field references a single Capability in the relationship, via its ID.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:CapabilityReferenceType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The CapabilityReferenceType serves as a method for referencing existing Capabilities contained in the MAEC document.
The capability_idref field references the ID of a Capability contained inside the current MAEC document.
Source
<xs:complexType name="CapabilityReferenceType"><xs:annotation><xs:documentation>The CapabilityReferenceType serves as a method for referencing existing Capabilities contained in the MAEC document.</xs:documentation></xs:annotation><xs:attribute name="capability_idref" type="xs:QName" use="required"><xs:annotation><xs:documentation>The capability_idref field references the ID of a Capability contained inside the current MAEC document.</xs:documentation></xs:annotation></xs:attribute></xs:complexType>
Complex Type maecBundle:BehaviorListType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The BehaviorListType captures a list of Behaviors.
<xs:complexType name="BehaviorListType"><xs:annotation><xs:documentation>The BehaviorListType captures a list of Behaviors.</xs:documentation></xs:annotation><xs:sequence maxOccurs="1"><xs:element name="Behavior" type="maecBundle:BehaviorType" maxOccurs="unbounded" form="qualified" minOccurs="1"><xs:annotation><xs:documentation>The Behavior field specifies a single Behavior in the list.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:BehaviorType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The BehaviorType is one of the foundational MAEC types, and serves as a method for the characterization of malicious behaviors found or observed in malware. Behaviors can be thought of as representing the purpose behind groups of MAEC Actions, and are therefore representative of distinct portions of higher-level malware functionality. Thus, while a malware instance may perform some multitude of Actions, it is likely that these Actions represent only a few distinct behaviors. Some examples include vulnerability exploitation, email address harvesting, the disabling of a security service, etc.
The duration field specifies the duration of the Behavior. One way to derive such a value may be to calculate the difference between the timestamps of the first and last actions that compose the behavior.
The status field specifies the execution status of the Behavior being characterized.
Source
<xs:complexType name="BehaviorType"><xs:annotation><xs:documentation>The BehaviorType is one of the foundational MAEC types, and serves as a method for the characterization of malicious behaviors found or observed in malware. Behaviors can be thought of as representing the purpose behind groups of MAEC Actions, and are therefore representative of distinct portions of higher-level malware functionality. Thus, while a malware instance may perform some multitude of Actions, it is likely that these Actions represent only a few distinct behaviors. Some examples include vulnerability exploitation, email address harvesting, the disabling of a security service, etc.</xs:documentation></xs:annotation><xs:sequence><xs:element minOccurs="0" name="Purpose" type="maecBundle:BehaviorPurposeType"><xs:annotation><xs:documentation>The Purpose field specifies the intended purpose of the Behavior. Since a Behavior is not always successful, and may not be fully observed, this is meant as way to state the nature of the Behavior apart from its constituent actions.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Description" type="xs:string"><xs:annotation><xs:documentation>The Description field specifies a prose textual description of the Behavior.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Discovery_Method" type="cyboxCommon:MeasureSourceType"><xs:annotation><xs:documentation>The Discovery_Method field specifies the method used to discover the Behavior.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Action_Composition" type="maecBundle:BehavioralActionsType"><xs:annotation><xs:documentation>The Action_Composition field captures the Actions that compose the Behavior.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Associated_Code" type="maecBundle:AssociatedCodeType"><xs:annotation><xs:documentation>The Associated_Code field specifies any code snippets that may be associated with the Behavior.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Relationships" type="maecBundle:BehaviorRelationshipListType"><xs:annotation><xs:documentation>The Relationships field specifies any relationships between this Behavior and any other Behaviors.</xs:documentation></xs:annotation></xs:element></xs:sequence><xs:attribute name="id" use="required" type="xs:QName"><xs:annotation><xs:documentation>The required id field specifies a unique ID for this Behavior.</xs:documentation></xs:annotation></xs:attribute><xs:attribute name="ordinal_position" type="xs:positiveInteger"><xs:annotation><xs:documentation>The ordinal_position field specifies the ordinal position of the Behavior with respect to the execution of the malware.</xs:documentation></xs:annotation></xs:attribute><xs:attribute name="status" type="cybox:ActionStatusTypeEnum"><xs:annotation><xs:documentation>The status field specifies the execution status of the Behavior being characterized.</xs:documentation></xs:annotation></xs:attribute><xs:attribute name="duration" type="xs:duration"><xs:annotation><xs:documentation>The duration field specifies the duration of the Behavior. One way to derive such a value may be to calculate the difference between the timestamps of the first and last actions that compose the behavior.</xs:documentation></xs:annotation></xs:attribute></xs:complexType>
Complex Type maecBundle:BehaviorPurposeType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The BehaviorPurposeType captures the purpose behind a malware Behavior.
<xs:complexType name="BehaviorPurposeType"><xs:annotation><xs:documentation>The BehaviorPurposeType captures the purpose behind a malware Behavior.</xs:documentation></xs:annotation><xs:sequence><xs:element minOccurs="0" name="Description" type="xs:string"><xs:annotation><xs:documentation>The Description field contains a prose text description of the purpose of the Behavior, whether it was successful or not.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Vulnerability_Exploit" type="maecBundle:ExploitType"><xs:annotation><xs:documentation>The Vulnerability_Exploit field characterizes any vulnerability that a Behavior may have attempted to exploit, whether or not the exploitation was successful (where success is not necessarily known).</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:ExploitType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The ExploitType characterizes any exploitable weakness that may be targeted for exploitation by a malware instance through a Behavior. Most commonly, this refers to a known and identifiable vulnerability, but it may also refer to one or more weaknesses.
The known_vulnerability field specifies whether the vulnerability that the malware is exploiting has been previously identified. If so, it should be referenced via a CVE ID in the CVE element. If not, the platform(s) targeted by the vulnerability exploitation behavior may be specified in the Targeted_Platforms element.
Source
<xs:complexType name="ExploitType"><xs:annotation><xs:documentation>The ExploitType characterizes any exploitable weakness that may be targeted for exploitation by a malware instance through a Behavior. Most commonly, this refers to a known and identifiable vulnerability, but it may also refer to one or more weaknesses.</xs:documentation></xs:annotation><xs:sequence><xs:element minOccurs="0" name="CVE" type="maecBundle:CVEVulnerabilityType"><xs:annotation><xs:documentation>The CVE field specifies the CVE ID and description of the vulnerability targeted by the exploit, if available.</xs:documentation></xs:annotation></xs:element><xs:element maxOccurs="unbounded" minOccurs="0" name="CWE_ID" type="xs:string"><xs:annotation><xs:documentation>The CWE_ID field captures the ID of the Common Weakness Enumeration (CWE) entry that represents the type of weakness targeted by the exploit. More than one such CWE ID can be specified by using multiple occurrences of this field.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Targeted_Platforms" type="maecBundle:PlatformListType"><xs:annotation><xs:documentation>The Targeted_Platforms field specifies the platforms(s) targeted by the vulnerability exploit.</xs:documentation></xs:annotation></xs:element></xs:sequence><xs:attribute name="known_vulnerability" type="xs:boolean"><xs:annotation><xs:documentation>The known_vulnerability field specifies whether the vulnerability that the malware is exploiting has been previously identified. If so, it should be referenced via a CVE ID in the CVE element. If not, the platform(s) targeted by the vulnerability exploitation behavior may be specified in the Targeted_Platforms element.</xs:documentation></xs:annotation></xs:attribute></xs:complexType>
Complex Type maecBundle:CVEVulnerabilityType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The CVEVulnerabilityType provides a way of referencing specific vulnerabilities that malware exploits or attempts to exploit via a Common Vulnerabilities and Exposures (CVE) identifier. For more information on CVE please see http://cve.mitre.org.
The cve_id attribute contains the ID of the CVE that is being referenced, e.g., CVE-1999-0002.
Source
<xs:complexType name="CVEVulnerabilityType"><xs:annotation><xs:documentation>The CVEVulnerabilityType provides a way of referencing specific vulnerabilities that malware exploits or attempts to exploit via a Common Vulnerabilities and Exposures (CVE) identifier. For more information on CVE please see http://cve.mitre.org.</xs:documentation></xs:annotation><xs:sequence><xs:element name="Description" type="xs:string" minOccurs="0"><xs:annotation><xs:documentation>The Description field specifies the textual description of the vulnerability referenced by the cve_id.</xs:documentation></xs:annotation></xs:element></xs:sequence><xs:attribute name="cve_id" type="xs:string" use="required"><xs:annotation><xs:documentation>The cve_id attribute contains the ID of the CVE that is being referenced, e.g., CVE-1999-0002.</xs:documentation></xs:annotation></xs:attribute></xs:complexType>
Complex Type maecBundle:PlatformListType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The PlatformListType captures a list of software or hardware platforms.
<xs:complexType name="PlatformListType"><xs:annotation><xs:documentation>The PlatformListType captures a list of software or hardware platforms.</xs:documentation></xs:annotation><xs:sequence><xs:element maxOccurs="unbounded" name="Platform" type="cyboxCommon:PlatformSpecificationType"><xs:annotation><xs:documentation>The Platform field specifies a single Platform in the list via a common platform enumeration ID. It uses the PlatformSpecificationType type from the CybOX Common schema v2.0.1.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:BehavioralActionsType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The BehavioralActionsType is intended to capture the Actions or Action Collections that make up a Behavior.
<xs:complexType name="BehavioralActionsType"><xs:annotation><xs:documentation>The BehavioralActionsType is intended to capture the Actions or Action Collections that make up a Behavior.</xs:documentation></xs:annotation><xs:choice maxOccurs="unbounded"><xs:element minOccurs="1" name="Action_Collection" type="maecBundle:ActionCollectionType"><xs:annotation><xs:documentation>The Action_Collection field specifies an Action Collection that is part of the behavioral composition.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="1" name="Action" type="maecBundle:BehavioralActionType"><xs:annotation><xs:documentation>The Action field specifies a single Action that is part of the behavioral composition.</xs:documentation></xs:annotation></xs:element><xs:element name="Action_Reference" type="maecBundle:BehavioralActionReferenceType"><xs:annotation><xs:documentation>The Action_Reference field specifies a reference to a single Action that is part of the behavioral composition.</xs:documentation></xs:annotation></xs:element><xs:element name="Action_Equivalence_Reference" type="maecBundle:BehavioralActionEquivalenceReferenceType"><xs:annotation><xs:documentation>The Action_Equivalence_Reference field specifies a reference to a single Action Equivalence that is part of the behavioral composition.</xs:documentation></xs:annotation></xs:element></xs:choice></xs:complexType>
Complex Type maecBundle:ActionCollectionType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The ActionCollectionType provides a method for characterizing collections of actions. This can be useful for organizing actions that may be related and where the exact relationship is unknown, as well as actions whose associated behavior has not yet been established.
The name field specifies the name of the collection.
Source
<xs:complexType name="ActionCollectionType"><xs:annotation><xs:documentation>The ActionCollectionType provides a method for characterizing collections of actions. This can be useful for organizing actions that may be related and where the exact relationship is unknown, as well as actions whose associated behavior has not yet been established.</xs:documentation></xs:annotation><xs:complexContent><xs:extension base="maecBundle:BaseCollectionType"><xs:sequence><xs:element name="Action_List" type="maecBundle:ActionListType"><xs:annotation><xs:documentation>The Action_List field specifies a list of Actions that make up the collection.</xs:documentation></xs:annotation></xs:element></xs:sequence><xs:attribute name="id" use="required" type="xs:QName"><xs:annotation><xs:documentation>The id field specifies a unique ID for this Action Collection.</xs:documentation></xs:annotation></xs:attribute></xs:extension></xs:complexContent></xs:complexType>
Complex Type maecBundle:BaseCollectionType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The BaseCollectionType is the base type for other MAEC collection types.
The name field specifies the name of the collection.
Source
<xs:complexType name="BaseCollectionType"><xs:annotation><xs:documentation>The BaseCollectionType is the base type for other MAEC collection types.</xs:documentation></xs:annotation><xs:sequence><xs:element name="Affinity_Type" type="xs:string" minOccurs="0"><xs:annotation><xs:documentation>The Affinity_Type field provides an abstract way of characterizing how the objects in a collection are related.</xs:documentation></xs:annotation></xs:element><xs:element name="Affinity_Degree" type="xs:string" minOccurs="0"><xs:annotation><xs:documentation>The Affinity_Degree field is intended to provide an abstract way of characterizing the degree to which the objects in a collection are related.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Description" type="xs:string"><xs:annotation><xs:documentation>The Description field contains a textual description of the collection.</xs:documentation></xs:annotation></xs:element></xs:sequence><xs:attribute name="name" type="xs:string"><xs:annotation><xs:documentation>The name field specifies the name of the collection.</xs:documentation></xs:annotation></xs:attribute></xs:complexType>
<xs:complexType name="ActionListType"><xs:annotation><xs:documentation>The ActionListType captures a list of Actions.</xs:documentation></xs:annotation><xs:sequence maxOccurs="1"><xs:element name="Action" type="maecBundle:MalwareActionType" maxOccurs="unbounded" minOccurs="1"><xs:annotation><xs:documentation>The Action field specifies a single Action in the list.</xs:documentation><xs:documentation>The recommended syntax for Action IDs is a dash-delimited format that starts with the word maec, followed by a unique string, followed by the three letter code 'act', and ending with an integer. The regular expression validating these IDs is: maec-[A-Za-z0-9_\-\.]+-act-[1-9][0-9]*.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:MalwareActionType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The MalwareActionType is one of the foundational MAEC types, and serves as a method for the characterization of actions found or observed in malware. Actions can be thought of as system state changes and similar operations that represent the fundamental low-level operation of malware. Some examples include the creation of a file, deletion of a registry key, and the sending of some data on a socket. It imports and extends the CybOX ActionType. For MAEC, the id attribute is required.
The idref field specifies a unique id reference to an Action defined elsewhere.
When idref is specified, the id attribute must not be specified, and any instance of this Action should not hold content unless an extension of the Action allows it.
The timestamp field represents the local or relative time at which the action occurred or was observed. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Represents the precision of the associated timestamp value. If omitted, the default is "second", meaning the timestamp is precise to the full field value. Digits in the timestamp that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.
Source
<xs:complexType name="MalwareActionType"><xs:annotation><xs:documentation>The MalwareActionType is one of the foundational MAEC types, and serves as a method for the characterization of actions found or observed in malware. Actions can be thought of as system state changes and similar operations that represent the fundamental low-level operation of malware. Some examples include the creation of a file, deletion of a registry key, and the sending of some data on a socket. It imports and extends the CybOX ActionType. For MAEC, the id attribute is required.</xs:documentation></xs:annotation><xs:complexContent><xs:extension base="cybox:ActionType"><xs:sequence><xs:element minOccurs="0" name="Implementation" type="maecBundle:ActionImplementationType"><xs:annotation><xs:documentation>The Implementation field is optional and serves to capture attributes that are relevant to how the Action is implemented in the malware, such as the specific API call that was used.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:extension></xs:complexContent></xs:complexType>
Complex Type maecBundle:ActionImplementationType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The ActionImplementationType serves as a method for the characterization of Action Implementations. Currently supported are implementations achieved through API function calls and abstractly defined code.
The required type field refers to the type of Action Implementation being characterized in this element.
Source
<xs:complexType name="ActionImplementationType"><xs:annotation><xs:documentation>The ActionImplementationType serves as a method for the characterization of Action Implementations. Currently supported are implementations achieved through API function calls and abstractly defined code.</xs:documentation></xs:annotation><xs:sequence><xs:element name="Compatible_Platforms" type="maecBundle:PlatformListType" minOccurs="0"><xs:annotation><xs:documentation>The Compatible_Platforms field specifies the specific platform(s) that the Action is compatible with, or in other words, capable of being successfully executed on.</xs:documentation></xs:annotation></xs:element><xs:choice><xs:element name="API_Call" maxOccurs="1" minOccurs="0" type="maecBundle:APICallType"><xs:annotation><xs:documentation>The API_Call field allows for the characterization of a system-level API call that was used to implement the action. Software must make use of such calls to talk to hardware and perform system-specific functions.</xs:documentation></xs:annotation></xs:element><xs:element name="Code" maxOccurs="unbounded" type="CodeObj:CodeObjectType" minOccurs="0"><xs:annotation><xs:documentation>The Code field contains any form of code that was used to implement the action.</xs:documentation></xs:annotation></xs:element></xs:choice></xs:sequence><xs:attribute name="id" use="optional" type="xs:QName"><xs:annotation><xs:documentation>The id field specifies a unique ID for this Action Implementation.</xs:documentation></xs:annotation></xs:attribute><xs:attribute name="type" use="required" type="maecBundle:ActionImplementationTypeEnum"><xs:annotation><xs:documentation>The required type field refers to the type of Action Implementation being characterized in this element.</xs:documentation></xs:annotation></xs:attribute></xs:complexType>
Complex Type maecBundle:APICallType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The APICallType provides a method for the characterization of API calls, including functions and their parameters.
The normalized_function_name field contains the normalized name of the API function called, e.g. CreateFile.
Source
<xs:complexType name="APICallType"><xs:annotation><xs:documentation>The APICallType provides a method for the characterization of API calls, including functions and their parameters.</xs:documentation></xs:annotation><xs:sequence><xs:element name="Address" type="xs:hexBinary" minOccurs="0"><xs:annotation><xs:documentation>The Address field contains the address of the API call in the binary.</xs:documentation></xs:annotation></xs:element><xs:element name="Return_Value" type="xs:string" minOccurs="0"><xs:annotation><xs:documentation>The Return_Value field contains the return value of the API call.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Parameters" type="maecBundle:ParameterListType"><xs:annotation><xs:documentation>The Parameter field captures any name/value pairs of the parameters passed into the API call.</xs:documentation></xs:annotation></xs:element></xs:sequence><xs:attribute name="function_name" type="xs:string"><xs:annotation><xs:documentation>The function_name field contains the exact name of the API function called, e.g. CreateFileEx.</xs:documentation></xs:annotation></xs:attribute><xs:attribute name="normalized_function_name" type="xs:string"><xs:annotation><xs:documentation>The normalized_function_name field contains the normalized name of the API function called, e.g. CreateFile.</xs:documentation></xs:annotation></xs:attribute></xs:complexType>
Complex Type maecBundle:ParameterListType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The ParametersType captures a list of function parameters.
<xs:complexType name="ParameterListType"><xs:annotation><xs:documentation>The ParametersType captures a list of function parameters.</xs:documentation></xs:annotation><xs:sequence><xs:element maxOccurs="unbounded" name="Parameter" type="maecBundle:ParameterType"><xs:annotation><xs:documentation>The Parameter field specifies a single function parameter.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:ParameterType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The ParameterType characterizes function parameters.
The value field specifies the actual value of the parameter.
Source
<xs:complexType name="ParameterType"><xs:annotation><xs:documentation>The ParameterType characterizes function parameters.</xs:documentation></xs:annotation><xs:attribute name="ordinal_position" type="xs:positiveInteger"><xs:annotation><xs:documentation>This field refers to the ordinal position of the parameter with respect to the function where it is used.</xs:documentation></xs:annotation></xs:attribute><xs:attribute name="name" type="xs:string"><xs:annotation><xs:documentation>The name field specifies the name of the parameter.</xs:documentation></xs:annotation></xs:attribute><xs:attribute name="value" type="xs:string"><xs:annotation><xs:documentation>The value field specifies the actual value of the parameter.</xs:documentation></xs:annotation></xs:attribute></xs:complexType>
Simple Type maecBundle:ActionImplementationTypeEnum
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The ActionImplementationTypeEnum represents an enumeration of action implementation types.
Diagram
Type
restriction of xs:string
Facets
enumeration
api call
The api call value specifies that the action was implemented using some particular API call, details of which may be captured in the API_Call element.
enumeration
code
The Code value specifies that the action was implemented using some particular code snippet, details of which may be captured in the Code element
<xs:simpleType name="ActionImplementationTypeEnum"><xs:annotation><xs:documentation>The ActionImplementationTypeEnum represents an enumeration of action implementation types.</xs:documentation></xs:annotation><xs:restriction base="xs:string"><xs:enumeration value="api call"><xs:annotation><xs:documentation>The api call value specifies that the action was implemented using some particular API call, details of which may be captured in the API_Call element.</xs:documentation></xs:annotation></xs:enumeration><xs:enumeration value="code"><xs:annotation><xs:documentation>The Code value specifies that the action was implemented using some particular code snippet, details of which may be captured in the Code element</xs:documentation></xs:annotation></xs:enumeration></xs:restriction></xs:simpleType>
Complex Type maecBundle:BehavioralActionType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The BehavioralActionType type defines an Action field that can be used as part of a Behavior. It extends the MAEC MalwareActionType type, which in turn extends the CybOX ActionType type.
The behavioral_ordering field defines the ordering of the Action with respect to the other Actions that make up the behavior. So an action with a behavioral_ordering of "1" would come before an Action with a behavioral_ordering of "2", etc.
The idref field specifies a unique id reference to an Action defined elsewhere.
When idref is specified, the id attribute must not be specified, and any instance of this Action should not hold content unless an extension of the Action allows it.
The timestamp field represents the local or relative time at which the action occurred or was observed. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
Represents the precision of the associated timestamp value. If omitted, the default is "second", meaning the timestamp is precise to the full field value. Digits in the timestamp that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.
Source
<xs:complexType name="BehavioralActionType"><xs:annotation><xs:documentation>The BehavioralActionType type defines an Action field that can be used as part of a Behavior. It extends the MAEC MalwareActionType type, which in turn extends the CybOX ActionType type.</xs:documentation></xs:annotation><xs:complexContent><xs:extension base="maecBundle:MalwareActionType"><xs:attribute name="behavioral_ordering" type="xs:positiveInteger"><xs:annotation><xs:documentation>The behavioral_ordering field defines the ordering of the Action with respect to the other Actions that make up the behavior. So an action with a behavioral_ordering of "1" would come before an Action with a behavioral_ordering of "2", etc.</xs:documentation></xs:annotation></xs:attribute></xs:extension></xs:complexContent></xs:complexType>
Complex Type maecBundle:BehavioralActionReferenceType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The BehavioralActionReferenceType defines an action reference that can be used as part of a Behavior.
The behavioral_ordering field defines the ordering of the Action with respect to the other Actions that make up the Behavior. For example, an Action with a behavioral_ordering of "1" would come before an Action with a behavioral_ordering of "2", etc.
Source
<xs:complexType name="BehavioralActionReferenceType"><xs:annotation><xs:documentation>The BehavioralActionReferenceType defines an action reference that can be used as part of a Behavior.</xs:documentation></xs:annotation><xs:complexContent><xs:extension base="cybox:ActionReferenceType"><xs:attribute name="behavioral_ordering" type="xs:positiveInteger"><xs:annotation><xs:documentation>The behavioral_ordering field defines the ordering of the Action with respect to the other Actions that make up the Behavior. For example, an Action with a behavioral_ordering of "1" would come before an Action with a behavioral_ordering of "2", etc.</xs:documentation></xs:annotation></xs:attribute></xs:extension></xs:complexContent></xs:complexType>
Complex Type maecBundle:BehavioralActionEquivalenceReferenceType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The BehavioralActionEquivalenceReferenceType defines an Action Equivalence reference that can be used as part of a Behavior. Since the Action Equivalency equates two or more actions to a single one, this can be thought of as specifying one of the aforementioned Actions as part of the composition of the Behavior.
The behavioral_ordering field defines the ordering of the Action Equivalency with respect to the other actions that make up the behavior. So an action with a behavioral_ordering of "1" would come before an action with a behavioral_ordering of "2", etc.
Source
<xs:complexType name="BehavioralActionEquivalenceReferenceType"><xs:annotation><xs:documentation>The BehavioralActionEquivalenceReferenceType defines an Action Equivalence reference that can be used as part of a Behavior. Since the Action Equivalency equates two or more actions to a single one, this can be thought of as specifying one of the aforementioned Actions as part of the composition of the Behavior.</xs:documentation></xs:annotation><xs:attribute name="action_equivalence_idref" type="xs:QName" use="required"><xs:annotation><xs:documentation>The action_equivalence_idref field specifies the ID of an Action Equivalence contained in the same MAEC document as the Behavior that utilizes it.</xs:documentation></xs:annotation></xs:attribute><xs:attribute name="behavioral_ordering" type="xs:positiveInteger"><xs:annotation><xs:documentation>The behavioral_ordering field defines the ordering of the Action Equivalency with respect to the other actions that make up the behavior. So an action with a behavioral_ordering of "1" would come before an action with a behavioral_ordering of "2", etc.</xs:documentation></xs:annotation></xs:attribute></xs:complexType>
Complex Type maecBundle:AssociatedCodeType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The AssociatedCodeType serves as generic way of specifying any code snippets associated with a MAEC entity, such as a Behavior.
<xs:complexType name="AssociatedCodeType"><xs:annotation><xs:documentation>The AssociatedCodeType serves as generic way of specifying any code snippets associated with a MAEC entity, such as a Behavior.</xs:documentation></xs:annotation><xs:sequence><xs:element maxOccurs="unbounded" name="Code_Snippet" type="CodeObj:CodeObjectType"><xs:annotation><xs:documentation>The Code_Snippet field captures a single snippet of code, via the CybOX CodeObjectType.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:BehaviorRelationshipListType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The BehaviorRelationshipListType captures any relationships between a Behavior and other Behaviors.
<xs:complexType name="BehaviorRelationshipListType"><xs:annotation><xs:documentation>The BehaviorRelationshipListType captures any relationships between a Behavior and other Behaviors.</xs:documentation></xs:annotation><xs:sequence><xs:element maxOccurs="unbounded" name="Relationship" type="maecBundle:BehaviorRelationshipType"><xs:annotation><xs:documentation>The Relationship field specifies a single relationship between a single Behavior and one or more other Behaviors.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:BehaviorRelationshipType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The BehaviorRelationshipType provides a method for the characterization of relationships between Behaviors.
The type field specifies the nature of the relationship between Behaviors that is being captured.
Source
<xs:complexType name="BehaviorRelationshipType"><xs:annotation><xs:documentation>The BehaviorRelationshipType provides a method for the characterization of relationships between Behaviors.</xs:documentation></xs:annotation><xs:sequence><xs:element maxOccurs="unbounded" name="Behavior_Reference" type="maecBundle:BehaviorReferenceType" minOccurs="1"><xs:annotation><xs:documentation>The Behavior_Reference field specifies a reference to a single Behavior in the relationship.</xs:documentation></xs:annotation></xs:element></xs:sequence><xs:attribute name="type" use="optional"><xs:annotation><xs:documentation>The type field specifies the nature of the relationship between Behaviors that is being captured.</xs:documentation></xs:annotation><xs:simpleType><xs:restriction base="cyboxVocabs:ActionRelationshipTypeEnum-1.0"><xs:enumeration value="Preceded_By"/><xs:enumeration value="Followed_By"/><xs:enumeration value="Related_To"/><xs:enumeration value="Dependent_On"/></xs:restriction></xs:simpleType></xs:attribute></xs:complexType>
Complex Type maecBundle:ObjectListType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The ObjectListType captures a list of CybOX Objects.
<xs:complexType name="ObjectListType"><xs:annotation><xs:documentation>The ObjectListType captures a list of CybOX Objects.</xs:documentation></xs:annotation><xs:sequence maxOccurs="1"><xs:element maxOccurs="unbounded" name="Object" type="cybox:ObjectType"><xs:annotation><xs:documentation>The Object field specifies a single CybOX Object in the list. For use in MAEC, the id attribute at the top level of the Object must be utilized.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:CandidateIndicatorListType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The CandidateIndicatorListType captures a list of Candidate Indicators.
<xs:complexType name="CandidateIndicatorListType"><xs:annotation><xs:documentation>The CandidateIndicatorListType captures a list of Candidate Indicators.</xs:documentation></xs:annotation><xs:sequence maxOccurs="1" minOccurs="1"><xs:element maxOccurs="unbounded" name="Candidate_Indicator" type="maecBundle:CandidateIndicatorType"><xs:annotation><xs:documentation>The Candidate_Indicator field specifies a single Candidate Indicator in the list.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:CandidateIndicatorType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The CandidateIndicatorType provides a way of defining a MAEC entity-based Candidate Indicator, which specifies the particular components that may signify the presence of the malware instance on a host system or network.
The version field specifies the version of the Candidate Indicator.
Source
<xs:complexType name="CandidateIndicatorType"><xs:annotation><xs:documentation>The CandidateIndicatorType provides a way of defining a MAEC entity-based Candidate Indicator, which specifies the particular components that may signify the presence of the malware instance on a host system or network.</xs:documentation></xs:annotation><xs:sequence><xs:element minOccurs="0" name="Importance" type="cyboxCommon:ControlledVocabularyStringType"><xs:annotation><xs:documentation>The Importance field specifies the relative importance of the Candidate Indicator.</xs:documentation><xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension Capability. The default vocabulary type is ImportanceTypeVocab-1.0 in the http://maec.mitre.org/default_vocabularies-1 namespace. This type is defined in the maec_default_vocabularies.xsd file or at the URL http://maec.mitre.org/XMLSchema/default_vocabularies/1.0.0/maec_default_vocabularies.xsd.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Numeric_Importance" type="xs:positiveInteger"><xs:annotation><xs:documentation>The Numeric_Importance field specifies the specific numeric importance of the Candidate Indicator.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Author" type="xs:string"><xs:annotation><xs:documentation>The Author field specifies the author of the Candidate Indicator.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Description" type="xs:string"><xs:annotation><xs:documentation>The Description field provides a brief description of the Candidate Indicator.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Malware_Entity" type="maecBundle:MalwareEntityType"><xs:annotation><xs:documentation>The Malware_Entity field specifies the particular malware entity that the Candidate Indicator is written against, whether it be a malware instance, family, etc.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Composition" type="maecBundle:CandidateIndicatorCompositionType"><xs:annotation><xs:documentation>The Composition field specifies the actual observables that the Candidate Indicator is composed of, via a reference to a one or more MAEC entities contained in the Bundle.</xs:documentation></xs:annotation></xs:element></xs:sequence><xs:attribute name="id" type="xs:QName" use="required"><xs:annotation><xs:documentation>The id field specifies a unique ID for this Candidate Indicator.</xs:documentation></xs:annotation></xs:attribute><xs:attribute name="creation_datetime" type="xs:dateTime"><xs:annotation><xs:documentation>The creation_datetime field specifies the date/time that the Candidate Indicator was created.</xs:documentation></xs:annotation></xs:attribute><xs:attribute name="lastupdate_datetime" type="xs:dateTime"><xs:annotation><xs:documentation>The lastupdate_datetime field specifies the last date/time that the Candidate Indicator was updated.</xs:documentation></xs:annotation></xs:attribute><xs:attribute name="version" type="xs:string"><xs:annotation><xs:documentation>The version field specifies the version of the Candidate Indicator.</xs:documentation></xs:annotation></xs:attribute></xs:complexType>
Complex Type maecBundle:MalwareEntityType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The MalwareEntityType provides a Capability for characterizing the particular entity that an indicator or signature is written against, whether it is a particular malware instance, family, etc.
<xs:complexType name="MalwareEntityType"><xs:annotation><xs:documentation>The MalwareEntityType provides a Capability for characterizing the particular entity that an indicator or signature is written against, whether it is a particular malware instance, family, etc.</xs:documentation></xs:annotation><xs:sequence><xs:element minOccurs="0" name="Type" type="cyboxCommon:ControlledVocabularyStringType"><xs:annotation><xs:documentation>The Type field refers to the specific type of malware entity that the indicator or signature is written against.</xs:documentation><xs:documentation>This field is implemented through the xsi:type controlled vocabulary extension Capability. The default vocabulary type is MalwareEntityTypeVocab-1.0 in the http://maec.mitre.org/default_vocabularies-1 namespace. This type is defined in the maec_default_vocabularies.xsd file or at the URL http://maec.mitre.org/XMLSchema/default_vocabularies/1.0.0/maec_default_vocabularies.xsd.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Name" type="xs:string"><xs:annotation><xs:documentation>The Name field refers to the name of the malware instance, malware family, or malware class that the indicator or signature is written against.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Description" type="xs:string"><xs:annotation><xs:documentation>The Description field is intended to provide a brief description of the entity that the indicator or signature is written against.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:CandidateIndicatorCompositionType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The CandidateIndicatorCompositionType captures the composition of a Candidate Indicator, via references to any corresponding MAEC entities contained in the Bundle.
The operator field specifies the Boolean operator for this level of the Candidate Indicator's composition.
Source
<xs:complexType name="CandidateIndicatorCompositionType"><xs:annotation><xs:documentation>The CandidateIndicatorCompositionType captures the composition of a Candidate Indicator, via references to any corresponding MAEC entities contained in the Bundle.</xs:documentation></xs:annotation><xs:sequence><xs:choice maxOccurs="unbounded"><xs:element minOccurs="0" name="Behavior_Reference" type="maecBundle:BehaviorReferenceType"><xs:annotation><xs:documentation>The Behavior_Reference field specifies a reference to a single Behavior in the Bundle that is part of the candidate indicator's composition.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Action_Reference" type="cybox:ActionReferenceType"><xs:annotation><xs:documentation>The Action_Reference field specifies a reference to a single Action in the Bundle that is part of the candidate indicator's composition.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Object_Reference" type="maecBundle:ObjectReferenceType"><xs:annotation><xs:documentation>The Object_Reference field specifies a reference to a single Object in the Bundle that is part of the candidate indicator's composition.</xs:documentation></xs:annotation></xs:element></xs:choice><xs:element maxOccurs="unbounded" minOccurs="0" name="Sub_Composition" type="maecBundle:CandidateIndicatorCompositionType"><xs:annotation><xs:documentation>The Sub_Composition field captures any sub-compositions in this Candidate Indicator, for expressing more complex Candidate Indicators.</xs:documentation></xs:annotation></xs:element></xs:sequence><xs:attribute name="operator" type="cybox:OperatorTypeEnum"><xs:annotation><xs:documentation>The operator field specifies the Boolean operator for this level of the Candidate Indicator's composition.</xs:documentation></xs:annotation></xs:attribute></xs:complexType>
Complex Type maecBundle:CollectionsType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The CollectionsType captures the various types of MAEC entity collections.
<xs:complexType name="CollectionsType"><xs:annotation><xs:documentation>The CollectionsType captures the various types of MAEC entity collections.</xs:documentation></xs:annotation><xs:sequence><xs:element minOccurs="0" name="Behavior_Collections" type="maecBundle:BehaviorCollectionListType"><xs:annotation><xs:documentation>The Behavior_Collections field captures any collections of Behaviors in the Bundle.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Action_Collections" type="maecBundle:ActionCollectionListType"><xs:annotation><xs:documentation>The Action_Collections field captures any collections of Actions in the Bundle.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Object_Collections" type="maecBundle:ObjectCollectionListType"><xs:annotation><xs:documentation>The Objects_Collections field captures any collections of CybOX Objects in the Bundle.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Candidate_Indicator_Collections" type="maecBundle:CandidateIndicatorCollectionListType"><xs:annotation><xs:documentation>The Candidate_Indicator_Collections field captures any collections of Candidate Indicators in the Bundle.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:BehaviorCollectionListType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The BehaviorCollectionListType captures a list of Behaviors Collections.
<xs:complexType name="BehaviorCollectionListType"><xs:annotation><xs:documentation>The BehaviorCollectionListType captures a list of Behaviors Collections.</xs:documentation></xs:annotation><xs:sequence><xs:element maxOccurs="unbounded" name="Behavior_Collection" type="maecBundle:BehaviorCollectionType"><xs:annotation><xs:documentation>The Behavior_Collection field specifies a single collection of Behaviors in the Bundle.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:BehaviorCollectionType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The BehaviorCollectionType provides a Capability for characterizing collections of behaviors.
The name field specifies the name of the collection.
Source
<xs:complexType name="BehaviorCollectionType"><xs:annotation><xs:documentation>The BehaviorCollectionType provides a Capability for characterizing collections of behaviors.</xs:documentation></xs:annotation><xs:complexContent><xs:extension base="maecBundle:BaseCollectionType"><xs:sequence><xs:element name="Purpose" type="xs:string" minOccurs="0"><xs:annotation><xs:documentation>The Purpose field states the intended purpose of the collection of Behaviors. Since Behaviors are not always successful, and may not be fully observed, this is meant as way of absracting the nature of the collection of Behaviors away from its constituent Actions.</xs:documentation></xs:annotation></xs:element><xs:element name="Behavior_List" type="maecBundle:BehaviorListType"><xs:annotation><xs:documentation>The Behavior_List field specifies a list of Behaviors that make up the collection.</xs:documentation></xs:annotation></xs:element></xs:sequence><xs:attribute name="id" use="required" type="xs:QName"><xs:annotation><xs:documentation>The id field specifies a unique ID for this Behavior Collection.</xs:documentation></xs:annotation></xs:attribute></xs:extension></xs:complexContent></xs:complexType>
Complex Type maecBundle:ActionCollectionListType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The ActionCollectionListType captures a list of Actions Collections.
<xs:complexType name="ActionCollectionListType"><xs:annotation><xs:documentation>The ActionCollectionListType captures a list of Actions Collections.</xs:documentation></xs:annotation><xs:sequence><xs:element maxOccurs="unbounded" name="Action_Collection" type="maecBundle:ActionCollectionType"><xs:annotation><xs:documentation>The Action_Collection field specifies a single collection of Actions in the Bundle.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:ObjectCollectionListType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The ObjectCollectionListType captures a list of Object Collections.
<xs:complexType name="ObjectCollectionListType"><xs:annotation><xs:documentation>The ObjectCollectionListType captures a list of Object Collections.</xs:documentation></xs:annotation><xs:sequence><xs:element maxOccurs="unbounded" name="Object_Collection" type="maecBundle:ObjectCollectionType"><xs:annotation><xs:documentation>The Object_Collection field specifies a single collection of CybOX Objects.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:ObjectCollectionType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The ObjectCollectionType provides a Capability for characterizing collections of Objects. For instance, it can be used to group all of the Objects that are associated with a specific behavior.
The name field specifies the name of the collection.
Source
<xs:complexType name="ObjectCollectionType"><xs:annotation><xs:documentation>The ObjectCollectionType provides a Capability for characterizing collections of Objects. For instance, it can be used to group all of the Objects that are associated with a specific behavior.</xs:documentation></xs:annotation><xs:complexContent><xs:extension base="maecBundle:BaseCollectionType"><xs:sequence><xs:element name="Object_List" type="maecBundle:ObjectListType"><xs:annotation><xs:documentation>The Object_List field specifies a list of Objects that make up the collection.</xs:documentation></xs:annotation></xs:element></xs:sequence><xs:attribute name="id" use="required" type="xs:QName"><xs:annotation><xs:documentation>The id attribute specifies a unique ID for this Object Collection.</xs:documentation></xs:annotation></xs:attribute></xs:extension></xs:complexContent></xs:complexType>
Complex Type maecBundle:CandidateIndicatorCollectionListType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The CandidateIndicatorCollectionListType captures a list of Candidate Indicators.
<xs:complexType name="CandidateIndicatorCollectionListType"><xs:annotation><xs:documentation>The CandidateIndicatorCollectionListType captures a list of Candidate Indicators.</xs:documentation></xs:annotation><xs:sequence><xs:element maxOccurs="unbounded" name="Candidate_Indicator_Collection" type="maecBundle:CandidateIndicatorCollectionType"><xs:annotation><xs:documentation>The Candidate_Indicator_Collection field specifies a single collection of Candidate Indicators.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
Complex Type maecBundle:CandidateIndicatorCollectionType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The CandidateIndicatorCollectionType provides a Capability for characterizing collections of Candidate Indicators.
The name field specifies the name of the collection.
Source
<xs:complexType name="CandidateIndicatorCollectionType"><xs:annotation><xs:documentation>The CandidateIndicatorCollectionType provides a Capability for characterizing collections of Candidate Indicators.</xs:documentation></xs:annotation><xs:complexContent><xs:extension base="maecBundle:BaseCollectionType"><xs:sequence><xs:element name="Candidate_Indicator_List" type="maecBundle:CandidateIndicatorListType"><xs:annotation><xs:documentation>The Candidate_Indicator_List field specifies a list of Candidate Indicators that make up the collection.</xs:documentation></xs:annotation></xs:element></xs:sequence><xs:attribute name="id" type="xs:QName" use="required"><xs:annotation><xs:documentation>The id field specifies a unique ID for this Candidate Indicator Collection.</xs:documentation></xs:annotation></xs:attribute></xs:extension></xs:complexContent></xs:complexType>
Simple Type maecBundle:BundleContentTypeEnum
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The BundleContentTypeEnum is a non-exhaustive enumeration of the general types of content that a Bundle can contain.
Diagram
Type
restriction of xs:string
Facets
enumeration
dynamic analysis tool output
The dynamic analysis tool output value specifies that the Bundle primarily captures some form of dynamic analysis tool output, such as from a sandbox.
enumeration
static analysis tool output
The static analysis tool output value specifies that the Bundle primarily captures some form of static analysis tool output, such as from a packer detection tool.
enumeration
manual analysis output
The manual analysis output value specifies that the Bundle primarily captures some form of manual analysis output, which may or may not involve the use of tools.
enumeration
extracted from subject
The extracted from subject value specifies that the Bundle primarily captures some data that extracted from the Malware Subject, such as some PE Header fields.
enumeration
mixed
The mixed value specifies that the Bundle captures some mixed forms of analysis or tool output for the Malware Subject, such as both dynamic and static analysis tool output.
enumeration
other
The other value specifies that the Bundle captures some other form of analysis or tool output that is not represented by the other enumeration values.
<xs:simpleType name="BundleContentTypeEnum"><xs:annotation><xs:documentation>The BundleContentTypeEnum is a non-exhaustive enumeration of the general types of content that a Bundle can contain.</xs:documentation></xs:annotation><xs:restriction base="xs:string"><xs:enumeration value="dynamic analysis tool output"><xs:annotation><xs:documentation>The dynamic analysis tool output value specifies that the Bundle primarily captures some form of dynamic analysis tool output, such as from a sandbox.</xs:documentation></xs:annotation></xs:enumeration><xs:enumeration value="static analysis tool output"><xs:annotation><xs:documentation>The static analysis tool output value specifies that the Bundle primarily captures some form of static analysis tool output, such as from a packer detection tool.</xs:documentation></xs:annotation></xs:enumeration><xs:enumeration value="manual analysis output"><xs:annotation><xs:documentation>The manual analysis output value specifies that the Bundle primarily captures some form of manual analysis output, which may or may not involve the use of tools.</xs:documentation></xs:annotation></xs:enumeration><xs:enumeration value="extracted from subject"><xs:annotation><xs:documentation>The extracted from subject value specifies that the Bundle primarily captures some data that extracted from the Malware Subject, such as some PE Header fields.</xs:documentation></xs:annotation></xs:enumeration><xs:enumeration value="mixed"><xs:annotation><xs:documentation>The mixed value specifies that the Bundle captures some mixed forms of analysis or tool output for the Malware Subject, such as both dynamic and static analysis tool output.</xs:documentation></xs:annotation></xs:enumeration><xs:enumeration value="other"><xs:annotation><xs:documentation>The other value specifies that the Bundle captures some other form of analysis or tool output that is not represented by the other enumeration values.</xs:documentation></xs:annotation></xs:enumeration></xs:restriction></xs:simpleType>
Complex Type maecBundle:BehaviorReferenceListType
Namespace
http://maec.mitre.org/XMLSchema/maec-bundle-4
Annotations
The BehaviorReferenceListType captures a list of Behavior References.
<xs:complexType name="BehaviorReferenceListType"><xs:annotation><xs:documentation>The BehaviorReferenceListType captures a list of Behavior References.</xs:documentation></xs:annotation><xs:sequence><xs:element maxOccurs="unbounded" name="Behavior_Reference" type="maecBundle:BehaviorReferenceType"><xs:annotation><xs:documentation>The Behavior_Reference field specifies a reference to a single Behavior.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:complexType>
<xs:attribute name="bundle_idref" type="xs:QName" use="required"><xs:annotation><xs:documentation>The bundle_idref field references the ID of a Bundle contained inside the current MAEC document.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="object_idref" type="xs:QName" use="required"><xs:annotation><xs:documentation>The object_idref field specifies the id of a CybOX Object being referenced in the current MAEC Bundle.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="id" type="xs:QName" use="required"><xs:annotation><xs:documentation>The required id field specifies a unique ID for the Process Node.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="parent_action_idref" type="xs:QName"><xs:annotation><xs:documentation>The parent_action_idref field specifies the id of the action that created or injected this process.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="ordinal_position" type="xs:positiveInteger"><xs:annotation><xs:documentation>The ordinal_position field specifies the ordinal position of the process with respect to the other processes spawned or injected by the malware.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="behavior_idref" type="xs:QName" use="required"><xs:annotation><xs:documentation>The behavior_idref field specifies the id of the Behavior being referenced; this Behavior must be present in the current Bundle.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="objective_idref" type="xs:QName" use="required"><xs:annotation><xs:documentation>The objective_idref field references the ID of a Capability Objective (either Strategic or Tactical) contained inside the current MAEC document.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="id" use="required" type="xs:QName"><xs:annotation><xs:documentation>The required id field specifies a unique ID for this Capability Objective.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="capability_idref" type="xs:QName" use="required"><xs:annotation><xs:documentation>The capability_idref field references the ID of a Capability contained inside the current MAEC document.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="id" use="required" type="xs:QName"><xs:annotation><xs:documentation>The required id field specifies a unique ID for this MAEC Capability.</xs:documentation></xs:annotation></xs:attribute>
The 'command and control' (C2) Capability indicates that the malware instance is able to receive and execute remotely submitted commands.
enumeration
remote machine manipulation
The 'remote machine manipulation' Capability indicates that the malware instance is able to manipulate or access other remote machines.
enumeration
privilege escalation
The 'privilege escalation' Capability indicates that the malware instance is able to elevate the privileges under which it executes.
enumeration
data theft
The 'data theft' Capability indicates that the malware instance is able to steal data from the system on which it executes. This includes data stored in some form, e.g. in a file, as well as data that may be entered into some application such as a web-browser.
enumeration
spying
The 'spying' Capability indicates that the malware instance is able to capture information from a system related to user or system activity (e.g., from a system's peripheral devices).
enumeration
secondary operation
The 'secondary operation' Capability indicates that the malware instance is able to achieve secondary objectives in conjunction with or after achieving its primary objectives.
enumeration
anti-detection
The 'anti-detection' Capability indicates that the malware instance is able to prevent itself and its components from being detected on a system.
enumeration
anti-code analysis
The 'anti-code analysis' Capability indicates that the malware instance is able to prevent code analysis or make it more difficult.
enumeration
infection/propagation
The 'infection/propagation' Capability indicates that the malware instance is able to propagate through the infection of a machine or is able to infect a file after executing on a system. The malware instance may infect actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email). This Capability does not encompass any aspects of the initial infection that is done independently of the malware instance itself.
enumeration
anti-behavioral analysis
The 'anti-behavioral analysis' Capability indicates that the malware instance is able to prevent behavioral analysis or make it more difficult.
enumeration
integrity violation
The 'integrity violation' Capability indicates that the malware instance is able to compromise the integrity of a system.
enumeration
data exfiltration
The 'data exfiltration' Capability indicates that the malware instance is able to exfiltrate stolen data or perform tasks related to the exfiltration of stolen data.
enumeration
probing
The 'probing' Capability indicates that the malware instance is able to probe its host system or network environment; most often this is done to support other Capabilities and their Objectives.
enumeration
anti-removal
The 'anti-removal' Capability indicates that the malware instance is able to prevent itself and its components from being removed from a system.
enumeration
security degradation
The �security degradation� Capability indicates that the malware instance is able to bypass or disable security features and/or controls.
enumeration
availability violation
The 'availability violation' Capability indicates that the malware instance is able to compromise the availability of a system or some aspect of the system.
enumeration
destruction
The 'destruction' Capability indicates that the malware instance is able to destroy some aspect of a system.
enumeration
fraud
The 'fraud' Capability indicates that the malware instance is able to defraud a user or a system.
enumeration
persistence
The 'persistence' Capability indicates that the malware instance is able to persist and remain on a system regardless of system events.
enumeration
machine access/control
The 'machine access/control' Capability indicates that the malware instance is able to provide the means to access or control the machine on which it is resident.
<xs:attribute name="name" type="maecVocabs:MalwareCapabilityEnum-1.0"><xs:annotation><xs:documentation>The name field captures the name of the Capability. It uses the MalwareCapabilityEnum-1.0 enumeration from the MAEC Vocabularies schema.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="cve_id" type="xs:string" use="required"><xs:annotation><xs:documentation>The cve_id attribute contains the ID of the CVE that is being referenced, e.g., CVE-1999-0002.</xs:documentation></xs:annotation></xs:attribute>
The known_vulnerability field specifies whether the vulnerability that the malware is exploiting has been previously identified. If so, it should be referenced via a CVE ID in the CVE element. If not, the platform(s) targeted by the vulnerability exploitation behavior may be specified in the Targeted_Platforms element.
<xs:attribute name="known_vulnerability" type="xs:boolean"><xs:annotation><xs:documentation>The known_vulnerability field specifies whether the vulnerability that the malware is exploiting has been previously identified. If so, it should be referenced via a CVE ID in the CVE element. If not, the platform(s) targeted by the vulnerability exploitation behavior may be specified in the Targeted_Platforms element.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="name" type="xs:string"><xs:annotation><xs:documentation>The name field specifies the name of the collection.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="ordinal_position" type="xs:positiveInteger"><xs:annotation><xs:documentation>This field refers to the ordinal position of the parameter with respect to the function where it is used.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="name" type="xs:string"><xs:annotation><xs:documentation>The name field specifies the name of the parameter.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="value" type="xs:string"><xs:annotation><xs:documentation>The value field specifies the actual value of the parameter.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="function_name" type="xs:string"><xs:annotation><xs:documentation>The function_name field contains the exact name of the API function called, e.g. CreateFileEx.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="normalized_function_name" type="xs:string"><xs:annotation><xs:documentation>The normalized_function_name field contains the normalized name of the API function called, e.g. CreateFile.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="id" use="optional" type="xs:QName"><xs:annotation><xs:documentation>The id field specifies a unique ID for this Action Implementation.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="type" use="required" type="maecBundle:ActionImplementationTypeEnum"><xs:annotation><xs:documentation>The required type field refers to the type of Action Implementation being characterized in this element.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="id" use="required" type="xs:QName"><xs:annotation><xs:documentation>The id field specifies a unique ID for this Action Collection.</xs:documentation></xs:annotation></xs:attribute>
The behavioral_ordering field defines the ordering of the Action with respect to the other Actions that make up the behavior. So an action with a behavioral_ordering of "1" would come before an Action with a behavioral_ordering of "2", etc.
<xs:attribute name="behavioral_ordering" type="xs:positiveInteger"><xs:annotation><xs:documentation>The behavioral_ordering field defines the ordering of the Action with respect to the other Actions that make up the behavior. So an action with a behavioral_ordering of "1" would come before an Action with a behavioral_ordering of "2", etc.</xs:documentation></xs:annotation></xs:attribute>
The behavioral_ordering field defines the ordering of the Action with respect to the other Actions that make up the Behavior. For example, an Action with a behavioral_ordering of "1" would come before an Action with a behavioral_ordering of "2", etc.
<xs:attribute name="behavioral_ordering" type="xs:positiveInteger"><xs:annotation><xs:documentation>The behavioral_ordering field defines the ordering of the Action with respect to the other Actions that make up the Behavior. For example, an Action with a behavioral_ordering of "1" would come before an Action with a behavioral_ordering of "2", etc.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="action_equivalence_idref" type="xs:QName" use="required"><xs:annotation><xs:documentation>The action_equivalence_idref field specifies the ID of an Action Equivalence contained in the same MAEC document as the Behavior that utilizes it.</xs:documentation></xs:annotation></xs:attribute>
The behavioral_ordering field defines the ordering of the Action Equivalency with respect to the other actions that make up the behavior. So an action with a behavioral_ordering of "1" would come before an action with a behavioral_ordering of "2", etc.
<xs:attribute name="behavioral_ordering" type="xs:positiveInteger"><xs:annotation><xs:documentation>The behavioral_ordering field defines the ordering of the Action Equivalency with respect to the other actions that make up the behavior. So an action with a behavioral_ordering of "1" would come before an action with a behavioral_ordering of "2", etc.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="type" use="optional"><xs:annotation><xs:documentation>The type field specifies the nature of the relationship between Behaviors that is being captured.</xs:documentation></xs:annotation><xs:simpleType><xs:restriction base="cyboxVocabs:ActionRelationshipTypeEnum-1.0"><xs:enumeration value="Preceded_By"/><xs:enumeration value="Followed_By"/><xs:enumeration value="Related_To"/><xs:enumeration value="Dependent_On"/></xs:restriction></xs:simpleType></xs:attribute>
<xs:attribute name="id" use="required" type="xs:QName"><xs:annotation><xs:documentation>The required id field specifies a unique ID for this Behavior.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="ordinal_position" type="xs:positiveInteger"><xs:annotation><xs:documentation>The ordinal_position field specifies the ordinal position of the Behavior with respect to the execution of the malware.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="status" type="cybox:ActionStatusTypeEnum"><xs:annotation><xs:documentation>The status field specifies the execution status of the Behavior being characterized.</xs:documentation></xs:annotation></xs:attribute>
The duration field specifies the duration of the Behavior. One way to derive such a value may be to calculate the difference between the timestamps of the first and last actions that compose the behavior.
<xs:attribute name="duration" type="xs:duration"><xs:annotation><xs:documentation>The duration field specifies the duration of the Behavior. One way to derive such a value may be to calculate the difference between the timestamps of the first and last actions that compose the behavior.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="operator" type="cybox:OperatorTypeEnum"><xs:annotation><xs:documentation>The operator field specifies the Boolean operator for this level of the Candidate Indicator's composition.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="id" type="xs:QName" use="required"><xs:annotation><xs:documentation>The id field specifies a unique ID for this Candidate Indicator.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="creation_datetime" type="xs:dateTime"><xs:annotation><xs:documentation>The creation_datetime field specifies the date/time that the Candidate Indicator was created.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="lastupdate_datetime" type="xs:dateTime"><xs:annotation><xs:documentation>The lastupdate_datetime field specifies the last date/time that the Candidate Indicator was updated.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="version" type="xs:string"><xs:annotation><xs:documentation>The version field specifies the version of the Candidate Indicator.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="id" use="required" type="xs:QName"><xs:annotation><xs:documentation>The id field specifies a unique ID for this Behavior Collection.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="id" use="required" type="xs:QName"><xs:annotation><xs:documentation>The id attribute specifies a unique ID for this Object Collection.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="id" type="xs:QName" use="required"><xs:annotation><xs:documentation>The id field specifies a unique ID for this Candidate Indicator Collection.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="id" use="required" type="xs:QName"><xs:annotation><xs:documentation>The required id field specifies a unique ID for this MAEC Bundle.</xs:documentation></xs:annotation></xs:attribute>
The required schema_version field specifies the version of the MAEC Bundle Schema that the document has been written in and that should be used for validation.
<xs:attribute name="schema_version" type="xs:string" use="required" fixed="4.1"><xs:annotation><xs:documentation>The required schema_version field specifies the version of the MAEC Bundle Schema that the document has been written in and that should be used for validation.</xs:documentation></xs:annotation></xs:attribute>
The required defined_subject field specifies whether the subject attributes of the characterized malware instance are included inside this Bundle (via the top-level Malware_Instance_Object_Attributes field) or elsewhere (such as a MAEC Subject in a MAEC Package).
<xs:attribute name="defined_subject" type="xs:boolean" use="required"><xs:annotation><xs:documentation>The required defined_subject field specifies whether the subject attributes of the characterized malware instance are included inside this Bundle (via the top-level Malware_Instance_Object_Attributes field) or elsewhere (such as a MAEC Subject in a MAEC Package).</xs:documentation></xs:annotation></xs:attribute>
The content_type field specifies the general type of content contained in this Bundle, e.g. static analysis tool output, dynamic analysis tool output, etc.
The dynamic analysis tool output value specifies that the Bundle primarily captures some form of dynamic analysis tool output, such as from a sandbox.
enumeration
static analysis tool output
The static analysis tool output value specifies that the Bundle primarily captures some form of static analysis tool output, such as from a packer detection tool.
enumeration
manual analysis output
The manual analysis output value specifies that the Bundle primarily captures some form of manual analysis output, which may or may not involve the use of tools.
enumeration
extracted from subject
The extracted from subject value specifies that the Bundle primarily captures some data that extracted from the Malware Subject, such as some PE Header fields.
enumeration
mixed
The mixed value specifies that the Bundle captures some mixed forms of analysis or tool output for the Malware Subject, such as both dynamic and static analysis tool output.
enumeration
other
The other value specifies that the Bundle captures some other form of analysis or tool output that is not represented by the other enumeration values.
<xs:attribute name="content_type" type="maecBundle:BundleContentTypeEnum"><xs:annotation><xs:documentation>The content_type field specifies the general type of content contained in this Bundle, e.g. static analysis tool output, dynamic analysis tool output, etc.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute name="timestamp" type="xs:dateTime"><xs:annotation><xs:documentation>The timestamp field specifies the date/time that the bundle was generated.</xs:documentation></xs:annotation></xs:attribute>
