specifies a set of one or more kill chain phases (from one or more kill chains defined elsewhere) for which the TTP is asserted to be representative. The kill chain property is further defined in the STIX Common specification document. The property characterizes the source Information_Source stixCommon: of the TTP information. Examples of details captured include Information_Source 0..1 identitifying characteristics, time-related attributes, and a list of InformationSourceType the tools used to collect the information. A cyber kill chain is a phase-based model to describe the stages of an attack. The property specifies a set of one Kill_Chains Kill_Chains 0..1 stixCommon:KillChainsType or more specific kill chain definitions. The kill chain property is further defined in the STIX Common specification document. The property specifies data handling markings for the Handling properties of this TTP. The marking is limited to the TTP and Handling marking:MarkingType 0..1 the content is contains. Note that data handling markings can also be specified at a higher level. stixCommon: The property specifies a set of one or Related_Packages Related_Packages 0..1 more Packages for which the TTP may be relevant. RelatedPackagesRefsType TTPVersionType Enumeration The enumeration is an inventory of all versions of the TTP data model for STIX Version 1.2.1. The enumeration literals are given in TTPVersionType Table 32. Table . Literals of the enumeration TTPVersionType Enumeration Literal Description stix-1.2.1 TTP data model for STIX v1.2.1 BehaviorType Class The class characterizes adversarial behavior by capturing details of cyber attack patterns, malware or exploits that the adversary may BehaviorType leverage.
specifies a set of one or more kill chain phases (from one or more kill chains defined elsewhere) for which the TTP is asserted to be representative. The kill chain property is further defined in the STIX Common specification document. Information_Source stixCommon: InformationSourceType 0..1 The Information_Source property characterizes the source of the TTP information. Examples of details captured include identitifying characteristics, time-related attributes, and a list of the tools used to collect the information. Kill_Chains stixCommon:KillChainsType 0..1 A cyber kill chain is a phase-based model to describe the stages of an attack. The Kill_Chains property specifies a set of one or more specific kill chain definitions. The kill chain property is further defined in the STIX Common specification document. Handling marking:MarkingType 0..1 The Handling property specifies data handling markings for the properties of this TTP. The marking is limited to the TTP and the content is contains. Note that data handling markings can also be specified at a higher level. Related_Packages stixCommon: RelatedPackagesRefsType 0..1 The Related_Packages property specifies a set of one or more Packages for which the TTP may be relevant. TTPVersionType Enumeration The TTPVersionType enumeration is an inventory of all versions of the TTP data model for STIX Version 1.2.1. The enumeration literals are given in Table 32. Table . Literals of the TTPVersionType enumeration Enumeration Literal Description stix-1.2.1 TTP data model for STIX v1.2.1 BehaviorType Class The BehaviorType class characterizes adversarial behavior by capturing details of cyber attack patterns, malware or exploits that the adversary may leverage.
stix-v1.2.1-csd01-part5-ttp.docx