Name Type Multiplicity Description basicDataTypes: The property specifies a globally unique identifier for the malware instance. id 0..1 id QualifiedName The property specifies an identifier reference to a malware instance idref basicDataTypes: specified elsewhere. When the property is used, the property idref id 0..1 MUST NOT also be specified and the other properties of the QualifiedName class SHOULD NOT hold any content. MalwareInstanceType The property specifies the type of the malware instance being Type characterized. Examples of potential types include bot, exploit kit, and ransomware (these specific values are only provided to help explain the property: they are neither recommended types nor necessarily part of any stixCommon: Type 0..* existing vocabulary). The content creator may choose any arbitrary value or VocabularyStringType may constrain the set of possible values by referencing an externally-defined vocabulary or leveraging a formally defined vocabulary extending from the class. The STIX stixCommon:ControlledVocabularyStringType default vocabulary class for use in the property is ‘MalwareTypeVocab-1.0.’ The property is used to specify a single name or alias that identifies the Name malware instance. The content creator may choose any arbitrary name or may stixCommon: constrain the set of possible names by referencing an externally-defined Name 0..* vocabulary or leveraging a formally defined vocabulary extending from the VocabularyStringType class. No default stixCommon:ControlledVocabularyStringType vocabulary class for use in the property has been defined for STIX 1.2. The property captures a title for the malware instance and reflects basicDataTypes: what the content producer thinks the malware instance as a whole should be Title 0..1 called. The property is typically used by humans to reference a Title BasicString particular malware instance; however, it is not suggested for correlation. The property captures a textual description of the malware Description stixCommon: Description 0..* instance. Any length is permitted. Optional formatting is supported via the StructuredTextType property of the class. structuring_format StructuredTextType stixCommon: The property captures a short textual description of Short_Description 0..* Short_Description StructuredTextType the malware instance. This property is secondary and should only be used if
Name Type Multiplicity Description id basicDataTypes: QualifiedName 0..1 The id property specifies a globally unique identifier for the malware instance. basicDataTypes: QualifiedName 0..1 The idref property specifies an identifier reference to a malware instance specified elsewhere. When the idref property is used, the id property MUST NOT also be specified and the other properties of the MalwareInstanceType class SHOULD NOT hold any content. Type stixCommon: VocabularyStringType 0..* The Type property specifies the type of the malware instance being characterized. Examples of potential types include bot, exploit kit, and ransomware (these specific values are only provided to help explain the property: they are neither recommended types nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an externally-defined vocabulary or leveraging a formally defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in the property is ‘MalwareTypeVocab-1.0.’ Name stixCommon: VocabularyStringType 0..* The Name property is used to specify a single name or alias that identifies the malware instance. The content creator may choose any arbitrary name or may constrain the set of possible names by referencing an externally-defined vocabulary or leveraging a formally defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. No default vocabulary class for use in the property has been defined for STIX 1.2. Title basicDataTypes: BasicString 0..1 The property captures a title for the malware instance and reflects what the content producer thinks the malware instance as a whole should be called. The Title property is typically used by humans to reference a particular malware instance; however, it is not suggested for correlation. Description stixCommon: StructuredTextType 0..* The Description property captures a textual description of the malware instance. Any length is permitted. Optional formatting is supported via the structuring_format property of the StructuredTextType class. Short_Description stixCommon: StructuredTextType 0..* The Short_Description property captures a short textual description of the malware instance. This property is secondary and should only be used if