The property captures a short textual Short_Description stixCommon: description of the TTP. This property is secondary and should Short_Description 0..* only be used if the property is already populated Description StructuredTextType and another, shorter description is available. The property characterizes the suspected Intended_Effect intended effect of the TTP, includes a property that Value specifies the type of the effect. Examples of potential types include and (these specific theft, disruption, unauthorized access values are only provided to help explain the property: Value they are neither recommended values nor necessarily part of any stixCommon: existing vocabulary). The content creator may choose any Intended_Effect 0..* arbitrary value or may constrain the set of possible values by StatementType referencing an externally-defined vocabulary or leveraging a formally defined vocabulary extending from the class. stixCommon:ControlledVocabularyStringType The STIX default vocabulary class for use in the property Value is (which is different than the default ‘IntendedEffectVocab-1.0’ vocabulary provided for the class). StatementType The property characterizes forms of adversarial Behavior Behavior 0..1 BehaviorType behavior by capturing the attack patterns, malware, and/or exploits that the adversary may leverage. The property characterizes adversarial resources by Resources Resources 0..1 ResourceType capturing the tools, infrastructure, or personas that the adversary may leverage. The property characterizes the sort of Victim_Targeting Victim_Targeting VictimTargetingType 0..1 victims that an adversary may target including details of identity, systems, and/or information types targeted. The property specifies a set of one or more Exploit_Targets Exploit_Targets 0..1 ExploitTargetsType Exploit Targets potentially targeted by the TTP. The property specifies a set of one or more Related_TTPs Related_TTPs 0..1 RelatedTTPsType other TTPs related to this TTP. A cyber kill chain is a phase-based model to describe the stages stixCommon: Kill_Chain_Phases 0..1 of an attack, and a cyber kill chain phase is an individual phase KillChainPhasesReferenceType within a kill chain definition. The property Kill_Chain_Phases
Short_Description stixCommon: StructuredTextType 0..* The Short_Description property captures a short textual description of the TTP. This property is secondary and should only be used if the Description property is already populated and another, shorter description is available. Intended_Effect stixCommon: StatementType 0..* The Intended_Effect property characterizes the suspected intended effect of the TTP, includes a Value property that specifies the type of the effect. Examples of potential types include theft, disruption, and unauthorized access (these specific values are only provided to help explain the Value property: they are neither recommended values nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an externally-defined vocabulary or leveraging a formally defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in the Value property is ‘IntendedEffectVocab-1.0’ (which is different than the default vocabulary provided for the StatementType class). Behavior BehaviorType 0..1 The Behavior property characterizes forms of adversarial behavior by capturing the attack patterns, malware, and/or exploits that the adversary may leverage. Resources ResourceType 0..1 The Resources property characterizes adversarial resources by capturing the tools, infrastructure, or personas that the adversary may leverage. Victim_Targeting VictimTargetingType 0..1 The Victim_Targeting property characterizes the sort of victims that an adversary may target including details of identity, systems, and/or information types targeted. Exploit_Targets ExploitTargetsType 0..1 The Exploit_Targets property specifies a set of one or more Exploit Targets potentially targeted by the TTP. Related_TTPs RelatedTTPsType 0..1 The Related_TTPs property specifies a set of one or more other TTPs related to this TTP. Kill_Chain_Phases stixCommon: KillChainPhasesReferenceType 0..1 A cyber kill chain is a phase-based model to describe the stages of an attack, and a cyber kill chain phase is an individual phase within a kill chain definition. The Kill_Chain_Phases property
stix-v1.2.1-part5-ttp.docx