User Account Object Type Name: user-account The User Account Object represents an instance of any type of user account, including but not limited to operating system, device, messaging service, and social media platform accounts. Properties Common Properties type, description, extensions User Account Object Specific Properties user_id, account_login, account_type, display_name, is_service_account, is_privileged, can_escalate_privs, is_disabled, account_created, account_expires, password_last_changed, account_first_login, account_last_login Property Name Type Description type (required) string The value of this property MUST be account. extensions (optional) dictionary The User Account Object defines the following extensions. In addition to these, producers MAY create their own. unix-account-ext Dictionary keys MUST identify the extension type by name. The corresponding dictionary values MUST contain the contents of the extension instance. user_id (required) string Specifies the identifier of the account. The format of the identifier depends on the system the user account is maintained in, and may be a numeric ID, a GUID, an account name, an email address, etc. The user_id property should be populated with whatever field is the unique identifier for the system the account is a member of. For example, for UNIX systems it would be populated with the UID. account_login (optional) string Specifies the account login string, used in cases where the user_id property specifies something other than what a user would type when they login. For example, in the case of a Unix account with user_id 0, the account_login might be “root”. account_type (optional) open-vocab Specifies the type of the This is an open vocabulary and values SHOULD come from the account-type-ov vocabulary.
User Account Object Type Name: user-account The User Account Object represents an instance of any type of user account, including but not limited to operating system, device, messaging service, and social media platform accounts. Properties Common Properties type, description, extensions User Account Object Specific Properties user_id, account_login, account_type, display_name, is_service_account, is_privileged, can_escalate_privs, is_disabled, account_created, account_expires, password_last_changed, account_first_login, account_last_login Property Name Type Description type (required) string The value of this property MUST be extensions (optional) dictionary The User Account Object defines the following extensions. In addition to these, producers MAY create their own. unix-account-ext Dictionary keys MUST identify the extension type by name. The corresponding dictionary values MUST contain the contents of the extension instance. user_id (required) string Specifies the identifier of the account. The format of the identifier depends on the system the user account is maintained in, and may be a numeric ID, a GUID, an account name, an email address, etc. The user_id property should be populated with whatever field is the unique identifier for the system the account is a member of. For example, for UNIX systems it would be populated with the UID. account_login (optional) string Specifies the account login string, used in cases where the user_id property specifies something other than what a user would type when they login. For example, in the case of a Unix account with user_id 0, the account_login might be “root”. account_type (optional) open-vocab Specifies the type of the This is an open vocabulary and values SHOULD come from the account-type-ov vocabulary. account.
stix-v2.0-csprd01-part4-cyber-observable-objects.docx