diff --git a/_includes/multisitenav.html b/_includes/multisitenav.html index 245964b5..1bb37ded 100644 --- a/_includes/multisitenav.html +++ b/_includes/multisitenav.html @@ -1,14 +1,5 @@
-
- - -
diff --git a/_includes/nav.html b/_includes/nav.html index 6946c297..f6fca36d 100644 --- a/_includes/nav.html +++ b/_includes/nav.html @@ -8,82 +8,53 @@ - {{ site.name }} +
+
  • - EMA + Encyclopedia of Malware Attributes (EMA)
    • - - -
    - -
    + +
    diff --git a/about-maec/index.md b/about-maec/index.md index 913c1192..8b4f04c5 100644 --- a/about-maec/index.md +++ b/about-maec/index.md @@ -3,22 +3,22 @@ layout: flat title: About MAEC --- -[Malware Attribute Enumeration and Characterization (MAEC™)](/releases/4.1) (pronounced “mike”) is a community-developed structured language for encoding and communicating high-fidelity information about malware based upon attributes such as behaviors, artifacts, and attack patterns. +[Malware Attribute Enumeration and Characterization (MAEC™)](/releases/5.0) (pronounced “mike”) is a community-developed structured language for encoding and sharing high-fidelity information about malware based upon attributes such as behaviors, artifacts, and relationships between malware samples. By eliminating the ambiguity and inaccuracy that currently exists in malware descriptions and by reducing reliance on signatures, MAEC aims to: +* Enable correlation, integration, and automation. * Improve human-to-human, human-to-tool, tool-to-tool, and tool-to-human communication about malware. * Allow for the faster development of countermeasures by enabling the ability to leverage responses to previously observed malware instances. -* Enable correlation, integration, and automation. * Reduce potential duplication of malware analysis efforts by researchers. ## Malware -Malicious software — also called "malware" — has existed in one form or another since the advent of the first PC virus in 1971. It is presently responsible for a host of malicious activities, ranging from the vast majority of spam email distribution through botnets to the theft of sensitive information via targeted social engineering attacks. Whether the attackers are script kiddies, "hacktivists," criminals, or nation states, all may use malware of some variety to negatively impact or gain access to an organization's network and infrastructure. Effectively an autonomous agent operating on behalf of the attacker, malware has the ability to perform any action capable of being expressed in code, and as such represents a prodigious threat to cyber security. +Malicious software—also called "malware"—is responsible for a variety of malicious activities, ranging from spam email distribution via botnets to the theft of sensitive information via targeted social engineering attacks. Effectively an autonomous agent operating on behalf of an attacker, malware can perform any action that can be expressed in code, and consequently, poses a significant threat to cybersecurity. -The protection of computer systems from malware is therefore currently one of the most important information security concerns for organizations and individuals, because even a single instance of uncaught malware can result in damaged systems and compromised data. Being disconnected from a computer network does not completely mitigate this risk of infection, as exemplified by malware that makes use of USB as its insertion vector. As such, the main focus of the majority of anti-malware efforts to date has been on preventing damaging effects through early detection. +Therefore, the protection of computer systems from malware is a primary cybersecurity concern for organizations and individuals, as even a single instance of uncaught malware can result in damaged systems and compromised data. -There are currently several common methods utilized for malware detection, based mainly on physical signatures and heuristics. These methods are effective in terms of their narrow scope, although they have their own individual drawbacks, such as the fact that signatures are unsuitable for dealing with zero-day, targeted, polymorphic, and other forms of emerging malware. Similarly, heuristic detection may be able to generically detect certain types of malware while missing those for which it does not have patterns, such as kernel-level rootkits. Therefore, it would be safe to say that these methods, while still useful, cannot be exclusively relied upon to deal with the current influx of malware. +To date, the majority of anti-malware efforts focus on early detection, where the most common methods are based on physical signatures and heuristics. While often effective, such methods have significant drawbacks. For example, signatures are unsuitable for dealing with zero-day, targeted, polymorphic, and other forms of emerging malware. Similarly, heuristic detection may generically detect certain types of malware, but it will miss those for which it does not have a pattern, such as kernel-level rootkits. Therefore, these methods cannot be exclusively relied upon to deal with the current influx of malware. ## Why MAEC @@ -26,49 +26,35 @@ There are currently several common methods utilized for malware detection, based Modern methods for detecting and combating malware often rely on the characterization of malware attributes and behaviors. -Typically, such behaviors and attributes are discovered through the use of static and dynamic analysis techniques. The combination of the two allows for an encompassing profile of malware to be constructed based upon its disassembled binary and observed run-time behavior. +Typically, such behaviors and attributes are discovered via static and dynamic analysis techniques. The combination of the two allows for an encompassing profile of malware to be constructed based upon the malware’s disassembled binary and observed run-time behavior. -Yet, the lack of an accepted standard for unambiguously characterizing malware before [MAEC](/releases/4.1) meant there was no clear method for communicating the specific malware attributes detected in malware by the analyses, nor for enumerating its fundamental makeup. The results were non-interoperable and disparate malware reporting between organizations, disjointed or inaccurate malware attribution, the duplication of malware analysis efforts, increased difficulty in determining the severity of a malware threat, and a greater period of time between malware infection and detection/response, among others. +Before [MAEC](/releases/5.0), the lack of an accepted standard for unambiguously characterizing malware meant there was no clear method for communicating the specific malware attributes detected in malware by the analyses, nor for enumerating its fundamental makeup. The results included non-interoperable and disparate malware reporting between organizations, disjointed or inaccurate malware attribution, the duplication of malware analysis efforts, increased difficulty in determining the severity of a malware threat, and a greater delay between malware infection and detection/response. ### Solution -[MAEC](/releases/4.1) solves these problems. The characterization of malware using abstract patterns offers a wide range of benefits over the usage of physical signatures, and allows for the accurate encoding of how malware operates and the specific actions that it performs. Such information can not only be used for malware detection, but also for assessing the end-goal the malware is pursuing and the corresponding threat that it represents. +[MAEC](/releases/5.0) solves these problems. The characterization of malware using abstract patterns offers a wide range of benefits over the useage of physical signatures, and allows for the accurate encoding of how malware operates and the specific actions that it performs. Such information can not only be used for malware detection, but also for assessing the malware’s end-goal the malware is pursuing and the corresponding threat that it represents. Focusing on the attributes and behaviors of malware facilitates detection and analysis of emerging, sophisticated malware threats that circumvent the traditional signature-based and heuristic approaches. Characterizing malware in a standard way supports collaboration across organizations and the identification of common behavior, functionality, and code bases across instances of malware. -MAEC achieves this end result by utilizing three community-developed components to define the structured MAEC Language: - -* Element dictionaries. - -* Schemas for defining vocabulary syntax. - -* Standard output formats based on schemas. - ## The MAEC Language -The [MAEC Language](/releases/4.1) is comprised of the following: - -* **MAEC Dictionaries** – a series of dictionaries for defining three distinct levels of malware elements—low-level actions, mid-level behaviors, and high-level mechanisms. - -* **MAEC Schemas** – a syntax for the vocabulary of actions, behaviors, and taxonomies, and an interchange format for structured information about these elements. - -* **MAEC Output Formats** – standard output formats that can be used for particular use cases, including the description of a malware instance, malware intrusion set, or malware families in terms of MAEC’s dictionaries and schemas. +The MAEC Language is defined by two specification documents. The [core concepts](http://maecproject.github.io/releases/5.0/#specifications) document introduces MAEC, provides high-level use cases, and defines MAEC data types and top-level objects. The [vocabularies](http://maecproject.github.io/releases/5.0/#specifications) document provides explicit values for each of the open vocabularies referenced in the core concepts document. In addition, non-normative [JSON schemas and examples](http://maecproject.github.io/releases/5.0/#json-schemas) are also available. -The MAEC Language is extremely flexible. Aside from a unique identifier and specifying the MAEC schema version, all objects are optional in MAEC. Users are able to capture exactly what they want and nothing more. +The MAEC schema was developed to enable analysts to capture a full gamut of information about malware. However, a MAEC Package is valid with minimal information. It is only necessary to define four properties: the type (“package”), a unique identifier, the MAEC schema version, and one MAEC Object. All other properties are optional. -Learn about the [MAEC data models](/documentation/data_model_overview/), or go to the [current release](/releases/4.1) of the MAEC Language. +Learn about the [MAEC Language](/documentation/overview/), or go to the [current release](/releases/5.0). ## Benefits The adoption of MAEC for encoding high-fidelity information about malware has major benefits for the community: -* **Elimination of ambiguity and inaccuracy in malware descriptions** – MAEC allows for a vastly improved level of human-to-human, human-to-tool, tool-to-tool, and tool-to-human communication about anti-malware related information. This will positively impact all major stakeholders, including producers and consumers of malware analysis and related malware data, as well as the end-users of tools for malware prevention and mitigation. +* **Elimination of ambiguity and inaccuracy in malware descriptions** – MAEC improves human-to-human, human-to-tool, tool-to-tool, and tool-to-human communication about anti-malware related information. This will positively impact all major stakeholders, including producers and consumers of malware analysis and related malware data, as well as the end-users of tools for malware prevention and mitigation. -* **Reduced duplication of malware analysis efforts** – A common method of characterizing malware along with a corresponding standard for malware analysis reporting will allow researchers and analysts to easily determine whether or not a particular malware instance has already been analyzed. +* **Reduced duplication of malware analysis efforts** – A common method of characterizing malware, along with a corresponding standard for malware analysis reporting, will allow researchers and analysts to determine whether a particular malware instance has already been analyzed. -* **Improved general awareness of malware** – An adopted standard for characterizing malware will allow for increased public awareness of malware threats and activity due to its widespread usage throughout the entire anti-malware data producer to consumer chain. +* **Improved general awareness of malware** – A widely adopted standard for characterizing malware will allow for increased public awareness of malware threats and activity. -* **Decreased overall response time to malware threats** – The standard method of describing malware behavior provided by MAEC will allow for the faster development of countermeasures based upon those developed for previously observed malware instances. +* **Decreased overall response time to malware threats** – MAEC’s standard method of describing malware behavior will enable countermeasures for previously observed malware instances to be leveraged, resulting in faster mitigation and response. ## MAEC Community diff --git a/community/index.md b/community/index.md index 0c2136bf..4e8decd8 100644 --- a/community/index.md +++ b/community/index.md @@ -35,7 +35,7 @@ The MAECProject GitHub Repositories are the central location for MAEC Community ### Working Calls -The MAEC Community is working on [MAEC 5.0](/documentation/roadmap/), the next version of the Malware Attribute Enumeration and Characterization (MAEC™) Language. Community members participated by joining our MAEC Community teleconference working call meetings, an archive of which is available for review. +The MAEC Community participated in teleconference working call meetings to participate in the development of [MAEC 5.0](/releases/5.0/), the current version of the Malware Attribute Enumeration and Characterization (MAEC™) Language, an archive of which is available for review. * [MAEC working calls archive](/working-call/) diff --git a/community/supporters/index.md b/community/supporters/index.md index dbaf2823..34c08b12 100644 --- a/community/supporters/index.md +++ b/community/supporters/index.md @@ -5,7 +5,7 @@ title: MAEC Supporters The vendors below have implemented MAEC in their products or services. To add your product to the list, please email us at [maec@mitre.org](mailto:maec@mitre.org). -## Sandboxes +## Sandboxes and Malware Analysis Services @@ -18,26 +18,33 @@ The vendors below have implemented MAEC in their products or services. To add yo - + - + + + + + + + + - +
    Joe Sandbox Joe Security LLCJoe Sandbox Cloud generates reports in MAEC, as well as other formatsJoe Sandbox Cloud generates reports in MAEC, as well as other formats. Cited on Key Features and FAQs pages on website, and in Product Brochure
    VXStream Sandbox Payload SecurityVXStream Sandbox includes malware indicator sharing using MAECVXStream Sandbox includes malware indicator sharing using MAEC. Cited on Product page and Features Chart on website
    WildFirePalo Alto Networks, Inc.The cloud-delivered WildFire® malware analysis service uses data and threat intelligence and applies advanced analysis to automatically identify unknown threats.Cited on WildFire Datasheet
    Cuckoo Sandbox Cuckoo FoundationThe MAEC Cuckoo reporting module enables Cuckoo v1.x to output MAEC output natively. MAEC output in 2.x is forthcoming via a MITRE-developed output moduleThe MAEC Cuckoo reporting module enables Cuckoo v1.x to output MAEC output natively. MAEC output in 2.x is forthcoming via a MITRE-developed output module. Cited in User Documentation on Cuckoo's website; (NOTE: Our own MAEC Cuckoo Sandbox Module is available on our MAECProject GitHub site)
    -## Virtualization Sandboxing +## Static Analysis @@ -48,14 +55,14 @@ The vendors below have implemented MAEC in their products or services. To add yo - - - - + + + +
    Bromium LAVABromium, Inc.Bromium LAVA's malware intelligence can be shared via standardized STIX/MAEC reportsCited in White PaperTitanium CoreReversingLabsTitanium Core results can be exported in MAEC, STIX, and IOC formats.Cited as feature on Product page on website
    -## Static Analysis +## Virtualization Sandboxing @@ -66,10 +73,10 @@ The vendors below have implemented MAEC in their products or services. To add yo - - - - + + + +
    Titanium CoreReversingLabsTitanium Core results can be exported in MAEC, STIX, and IOC formatsCited as feature on Product page on websiteBromium LAVABromium, Inc.Bromium LAVA's malware intelligence can be shared via standardized STIX/MAEC reports.Cited in White Paper
    @@ -86,14 +93,14 @@ The vendors below have implemented MAEC in their products or services. To add yo AutoFocus Palo Alto Networks, Inc. -AutoFocus includes support for MAEC and STIX; to effectively provide the volume of data available through AutoFocus, responses contain embedded MAEC content +AutoFocus includes support for MAEC and STIX; to effectively provide the volume of data available through AutoFocus, responses contain embedded MAEC content. Cited on AutoFocus API STIX Support product page on website EclecticIQ Platform EclecticIQ -EclecticIQ Platform includes support for industry standards MAEC, STIX, TAXII, CIQ and CEF +EclecticIQ Platform includes support for industry standards MAEC, STIX, TAXII, CIQ and CEF. Cited on EclecticIQ Platform technology overview page on website diff --git a/data-model/index.md b/data-model/index.md index a7fdd694..af4d3912 100644 --- a/data-model/index.md +++ b/data-model/index.md @@ -1,6 +1,6 @@ --- layout: flat -title: Data Model Documentation +title: Data Model Documentation for MAEC Version 4.1 --- @@ -35,4 +35,4 @@ A [Capability](/data-model/{{site.current_version}}/maecBundle/CapabilityType) i An [Object](/data-model/{{site.current_version}}/cybox/ObjectType) is a CybOX entity for capturing the characteristics of a specific cyber-relevant object, including its particular properties and relationships to other Objects. Examples: file, registry key, or process (which are typically captured in MAEC using further defined object models). #### Process Tree A [Process Tree](/data-model/{{site.current_version}}/maecBundle/ProcessTreeType) is a MAEC entity for capturing the the hierarchy of processes created, modified, or affected by the execution of the malware instance. The fields of a MAEC Process Tree include parent process information and spawned or injected process information, along with any initiated Actions. - \ No newline at end of file + diff --git a/documentation/archive/common_features/index.md b/documentation/archive/common_features/index.md new file mode 100644 index 00000000..3798e57f --- /dev/null +++ b/documentation/archive/common_features/index.md @@ -0,0 +1,1003 @@ +--- +layout: flat +title: Common Features for MAEC Version 4.1 +--- + +This page contains an alphabetized list of commonly characterized features - whether statically, dynamically, or manually identified in malware - along with their mappings to MAEC/Cyber Observable eXpression (CybOX™) object elements, the associated MAEC/CybOX types, the typical MAEC schema locations of the object elements (specified via a quasi-XPath like expression), and an explicit XML representation example. Note that all object elements are characterized through their Properties field, and that only the most commonly used object elements are listed for each feature (please refer to the applicable schemas for the complete lists). + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    AV Classifications
    MAEC/CybOX Object ElementsMAEC/CybOX Types
    +
      +
    • MAEC_Bundle/AV_Classifications/AV_Classification/Engine_Version
      • +
    • MAEC_Bundle/AV_Classifications/AV_Classification/Definition_Version
      • +
    • MAEC_Bundle/AV_Classifications/AV_Classification/Classification_Name
      • +
    +     		+ +
    Typical MAEC Schema LocationsDescription
    ------
    MAEC/CybOX XML Representation Example
    +{% highlight xml %} + + + AhnLab-V3 + Win32/IRCBot.worm.variant + + + Kaspersky + Packed.Win32.Katusha.a + + +{% endhighlight %} +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Code Attributes
    MAEC/CybOX Object ElementsMAEC/CybOX Types
    +
      +
    • CodeObj/Purpose
      • +
    • CodeObj/Code_Language
      • +
    • CodeObj/Code_Segment
      • +
    +     		+ +
    Typical MAEC Schema LocationsDescription
    MAEC_Bundle/Actions/Action/Associated_Objects/Associated_Object/Related_Objects/Related_ObjectUsed to capture code attributes related to an Action associated with a malware instance.
    MAEC_Bundle/Objects/ObjectUsed to capture a code attributes related to an Object associated with a malware instance.
    MAEC/CybOX XML Representation Example
    +{% highlight xml %} + + + Shellcode + Assembly + + + +{% endhighlight %} +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Common Vulnerabilities and Exposures (CVE®) Identifier
    MAEC/CybOX Object ElementsMAEC/CybOX Types
    +
      +
    • MAEC_Bundle/Behaviors/Behavior/Purpose/Vulnerability_Exploit/CVE
      • +
    +     		+ +
    Typical MAEC Schema LocationsDescription
    ------
    MAEC/CybOX XML Representation Example
    +{% highlight xml %} + + + + + + + +{% endhighlight %} +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    File Attributes
    MAEC/CybOX Object ElementsMAEC/CybOX Types
    +
      +
    • File/File_Name
      • +
    • File/File_Path
      • +
    • File/Size_In_Bytes
      • +
    +     		+ +
    Typical MAEC Schema LocationsDescription
    MAEC_Package/Malware_Subjects/Malware_Subject/Malware_Subject/Malware_Instance_Object_AttributesUsed to capture information about a single file associated with a malware instance.
    MAEC_Bundle/Malware_Instance_Object_AttributesUsed to capture information about a single file associated with a malware instance.
    MAEC_Bundle/Actions/Action/Associated_Objects/Associated_ObjectUsed to capture information about a single file related to an Action associated with a malware instance.
    MAEC_Bundle/Objects/ObjectUsed to capture information about a single file related to an Object associated with a malware instance, including an Object that represents some extracted feature (e.g., strings).
    MAEC_Bundle/Collections/Action_Collections/Action_Collection/Action_List/Action/Associated_Objects/Associated_ObjectUsed to capture information about a single file related to an Action in an Action Collection.
    MAEC_Bundle/Collections/Object_Collections/Object_Collection/Object_List/ObjectUsed to capture information about a single file related to an Object in an Object Collection.
    MAEC/CybOX XML Representation Example
    +{% highlight xml %} + + + ws2help.PNF + C:\Documents and Settings\user\Local Settings\Application\Data + 196608 + + +{% endhighlight %} +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    File Attributes - Windows PE File Attributes
    MAEC/CybOX Object ElementsMAEC/CybOX Types
    +
      +
    • Windows_Executable_File/Headers
      • +
    • Windows_Executable_File/PE_Checksum
      • +
    • Windows_Executable_File/Build_Information
      • +
    • Windows_Executable_File/Type
      • +
    +     		+ +
    Typical MAEC Schema LocationsDescription
    MAEC_Package/Malware_Subjects/Malware_Subject/Malware_Subject/Malware_Instance_Object_AttributesUsed to capture information about a single Windows PE file associated with a malware instance.
    MAEC_Bundle/Malware_Instance_Object_AttributesUsed to capture information about a single Windows PE file associated with a malware instance.
    MAEC_Bundle/Actions/Action/Associated_Objects/Associated_ObjectUsed to capture information about a single Windows PE file related to an Action associated with a malware instance.
    MAEC_Bundle/Objects/ObjectUsed to capture information about a single Windows PE file related to an Object associated with a malware instance, including an Object that represents some extracted feature (e.g., strings).
    MAEC_Bundle/Collections/Action_Collections/Action_Collection/Action_List/Action/Associated_Objects/Associated_ObjectUsed to capture information about a single Windows PE file related to an Action in an Action Collection.
    MAEC_Bundle/Collections/Object_Collections/Object_Collection/Object_List/ObjectUsed to capture information about a single Windows PE file related to an Object in an Object Collection.
    MAEC/CybOX XML Representation Example
    +{% highlight xml %} + + + + + 06 + 00 + 036418 + Windows_GUI + + + Executable + + +{% endhighlight %} +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Hash - Fuzzy Hash
    MAEC/CybOX Object ElementsMAEC/CybOX Types
    +
      +
    • File/Hashes/Hash/Type[xsi:type=”cyboxVocabs:HashNameVocab-1.0”]={hash name} (e.g., SSDEEP)
      • +
    • File/Hashes/Hash/Fuzzy_Hash_Value
      • +
    +     		+ +
    Typical MAEC Schema LocationsDescription
    MAEC_Package/Malware_Subjects/Malware_Subject/Malware_Subject/Malware_Instance_Object_AttributesUsed to capture fuzzy hash information associated with a malware instance.
    MAEC_Bundle/Malware_Instance_Object_AttributesUsed to capture fuzzy hash information associated with a malware instance.
    MAEC_Bundle/Actions/Action/Associated_Objects/Associated_ObjectUsed to capture fuzzy hash information related to an Action associated with a malware instance.
    MAEC_Bundle/Objects/ObjectUsed to capture fuzzy hash information related to an Object associated with a malware instance.
    MAEC_Bundle/Collections/Action_Collections/Action_Collection/Action_List/Action/Associated_Objects/Associated_ObjectUsed to capture fuzzy hash information related to an Action in an Action Collection.
    MAEC_Bundle/Collections/Object_Collections/Object_Collection/Object_List/ObjectUsed to capture fuzzy hash information related to an Object in an Object Collection.
    MAEC/CybOX XML Representation Example
    +{% highlight xml %} + + + + + + SSDEEP + 768:McAQ8tPlH25e85Q2OiYpD08NvHmjJ97UfPMO47sekO:uN9M553OiiN/OJ9MM+e3 + + + + + +{% endhighlight %} +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Hash - Simple Hash
    MAEC/CybOX Object ElementsMAEC/CybOX Types
    +
      +
    • File/Hashes/Hash/Type[xsi:type=”cyboxVocabs:HashNameVocab-1.0”]={hash name} (e.g., MD5)
      • +
    • File/Hashes/Hash/Simple_Hash_Value
      • +
    +     		+ +
    Typical MAEC Schema LocationsDescription
    MAEC_Package/Malware_Subjects/Malware_Subject/Malware_Subject/Malware_Instance_Object_AttributesUsed to capture simple hash information associated with a malware instance.
    MAEC_Bundle/Malware_Instance_Object_AttributesUsed to capture simple hash information associated with a malware instance.
    MAEC_Bundle/Actions/Action/Associated_Objects/Associated_ObjectUsed to capture simple hash information related to an Action associated with a malware instance.
    MAEC_Bundle/Objects/ObjectUsed to capture simple hash information related to an Object associated with a malware instance.
    MAEC_Bundle/Collections/Action_Collections/Action_Collection/Action_List/Action/Associated_Objects/Associated_ObjectUsed to capture simple hash information related to an Action in an Action Collection.
    MAEC_Bundle/Collections/Object_Collections/Object_Collection/Object_List/ObjectUsed to capture simple hash information related to an Object in an Object Collection.
    MAEC/CybOX XML Representation Example
    +{% highlight xml %} + + + + + + MD5 + 32530b68d78e5bcbd73a138276f45490 + + + + + +{% endhighlight %} +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    HTTP Session
    MAEC/CybOX Object ElementsMAEC/CybOX Types
    +
      +
    • HTTP_Session/HTTP_Request_Response/HTTP_Client_Request/ HTTP_Request_Line/HTTP_Method
      • +
    • HTTP_Session/HTTP_Request_Response/HTTP_Client_Request/ HTTP_Request_Line/Value
      • +
    • HTTP_Session/HTTP_Request_Response/HTTP_Client_Request/ HTTP_Request_Line/Version
      • +
    • HTTP_Session/HTTP_Request_Response/HTTP_Client_Request/ HTTP_Message_Body/Message_Body
      • +
    +     		+ +
    Typical MAEC Schema LocationsDescription
    MAEC_Bundle/Actions/Action/Associated_Objects/Associated_ObjectUsed to capture information about a single HTTP session related to an Action associated with a malware instance.
    MAEC_Bundle/Objects/ObjectUsed to capture information about a single HTTP session related to an Object associated with a malware instance.
    MAEC_Bundle/Collections/Action_Collections/Action_Collection/Action_List/Action/Associated_Objects/Associated_ObjectUsed to capture information about a single HTTP session related to an Action in an Action Collection.
    MAEC_Bundle/Collections/Object_Collections/Object_Collection/Object_List/ObjectUsed to capture information about a single HTTP session related to an Object in an Object Collection.
    MAEC/CybOX XML Representation Example
    +{% highlight xml %} + + + + + + POST + http://www.dailyinfonews.net/reportdatas.php + HTTP/1.0 + + + + +{% endhighlight %} +
    + + + + + + + + + + + + + + + + + + + + + + + + +
    Malware Family Name (as a CybOX Object custom property)
    MAEC/CybOX Object ElementsMAEC/CybOX Types
    +
      +
    • Custom_Properties/Property
      • +
    +     		+ +
    Typical MAEC Schema LocationsDescription
    MAEC_Bundle/Malware_Instance_Object_Attributes/PropertiesUsed to capture a malware family name associated with a malware instance.
    +{% highlight xml %} + + + + + + + +{% endhighlight %} +
    + + + + + + + + + + + + + + + + + + + + + + + + +
    Malware Family Name (as a grouping relationship)
    MAEC/CybOX Object ElementsMAEC/CybOX Types
    +
      +
    • MAEC_Package/Grouping_Relationship/Type[xsi:type=”maecVocabs:GroupingRelationshipTypeVocab-1.0”]=same malware family
      • +
    • MAEC_Package/Grouping_Relationships/Grouping_Relationship/ Malware_Family_Name
      • +
    +     		+ +
    Typical MAEC Schema LocationsDescription
    ----
    +{% highlight xml %} + + + same malware family + Zeus + + +{% endhighlight %} +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Mutex
    MAEC/CybOX Object ElementsMAEC/CybOX Types
    +
      +
    • Mutex/Name
      • +
    +     		+ +
    Typical MAEC Schema LocationsDescription
    MAEC_Bundle/Actions/Action/Associated_Objects/Associated_ObjectUsed to capture the name of a single mutex related to an Action associated with a malware instance.
    MAEC_Bundle/Objects/ObjectUsed to capture the name of a single mutex related to an Object associated with a malware instance.
    MAEC_Bundle/Collections/Action_Collections/Action_Collection/Action_List/Action/Associated_Objects/Associated_ObjectUsed to capture the name of a single mutex related to an Action in an Action Collection.
    MAEC_Bundle/Collections/Object_Collections/Object_Collection/Object_List/ObjectUsed to capture the name of a single mutex related to an Object in an Object Collection.
    MAEC/CybOX XML Representation Example
    +{% highlight xml %} + + create mutex + + + + redem-Mutex + + output + + + +{% endhighlight %} +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Packer Information
    MAEC/CybOX Object ElementsMAEC/CybOX Types
    +
      +
    • File/Packer_List/Packer/Name
      • +
    • File/Packer_List/Packer/Version
      • +
    • File/Packer_List/Entry_Point
      • +
    +     		+ +
    Typical MAEC Schema LocationsDescription
    MAEC_Package/Malware_Subjects/Malware_Subject/Malware_Subject/Malware_Instance_Object_AttributesUsed to capture information about a single packer associated with a malware instance.
    MAEC_Bundle/Malware_Instance_Object_AttributesUsed to capture information about a single packer associated with a malware instance.
    MAEC_Bundle/Actions/Action/Associated_Objects/Associated_ObjectUsed to capture information about a single packer related to an Action associated with a malware instance.
    MAEC_Bundle/Objects/ObjectUsed to capture information about a single packer related to an Object associated with a malware instance.
    MAEC_Bundle/Collections/Action_Collections/Action_Collection/Action_List/Action/Associated_Objects/Associated_ObjectUsed to capture information about a single packer related to an Action in an Action Collection.
    MAEC_Bundle/Collections/Object_Collections/Object_Collection/Object_List/ObjectUsed to capture information about a single packer related to an Object in an Object Collection.
    MAEC/CybOX XML Representation Example
    +{% highlight xml %} + + + + + + UPX + UPX v3.0.2 + + + + + +{% endhighlight %} +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Process
    MAEC/CybOX Object ElementsMAEC/CybOX Types
    +
      +
    • Process/Name
      • +
    • Process/Image_Info/Path
      • +
    +     		+ +
    Typical MAEC Schema LocationsDescription
    MAEC_Bundle/Actions/Action/Associated_Objects/Associated_ObjectUsed to capture information about a single process related to an Action associated with a malware instance.
    MAEC_Bundle/Objects/ObjectUsed to capture information about a single process related to an Object associated with a malware instance.
    MAEC_Bundle/Process_Tree/Root_ProcessUsed to capture information about the root process of a process tree.
    MAEC_Bundle/Process_Tree/Root_Process/Injected_ProcessUsed to capture information about a single process that was injected by the root process of a process tree.
    MAEC_Bundle/Process_Tree/Root_Process/Spawned_ProcessUsed to capture information about a single child process spawned by the root process of a process tree.
    MAEC_Bundle/Collections/Action_Collections/Action_Collection/Action_List/Action/Associated_Objects/Associated_ObjectUsed to capture information about a single process related to an Action in an Action Collection.
    MAEC_Bundle/Collections/Object_Collections/Object_Collection/Object_List/ObjectUsed to capture information about a single process related to an Object in an Object Collection.
    MAEC/CybOX XML Representation Example
    +{% highlight xml %} + + allocate process virtual memory + + + + services.exe + + %System%\services.exe + + + output + + + +{% endhighlight %} +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Raw Artifact Data
    MAEC/CybOX Object ElementsMAEC/CybOX Types
    +
      +
    • Artifact/Raw_Artifact
      • +
    +     		+ +
    Typical MAEC Schema LocationsDescription
    MAEC_Bundle/Objects/ObjectUsed to capture raw artifact data related to an Object associated with a malware instance.
    MAEC_Bundle/Actions/Action/Associated_Objects/Associated_Object/Related_Objects/Related_Object/Used to capture raw artifact data related to an Object that is associated with an Action (which is associated with a malware instance).
    MAEC/CybOX XML Representation Example
    +{% highlight xml %} + + + + + + + +{% endhighlight %} +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Registry Key Attributes
    MAEC/CybOX Object ElementsMAEC/CybOX Types
    +
      +
    • WinRegistryKeyObj/Key
      • +
    • WinRegistryKeyObj/Hive
      • +
    • WinRegistryKeyObj/Values/Value/Name
      • +
    • WinRegistryKeyObj/Values/Value/Data
      • +
    +     		+ +
    Typical MAEC Schema LocationsDescription
    MAEC_Bundle/Actions/Action/Associated_Objects/Associated_ObjectUsed to capture attributes of a single registry key related to an Action associated with a malware instance.
    MAEC_Bundle/Objects/ObjectUsed to capture attributes of a single registry key related to an Object associated with a malware instance.
    MAEC_Bundle/Collections/Action_Collections/Action_Collection/Action_List/Action/Associated_Objects/Associated_ObjectUsed to capture attributes of a single registry key related to an Action in an Action Collection.
    MAEC_Bundle/Collections/Object_Collections/Object_Collection/Object_List/ObjectUsed to capture attributes of a single registry key related to an Object in an Object Collection.
    MAEC/CybOX XML Representation Example
    +{% highlight xml %} + + + Software\Microsoft\Windows\CurrentVersion\Run + HKEY_CURRENT_USER + + + Zcxaxz + %AppData%\Zcxaxz.exe + + + + +{% endhighlight %} +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Universal Resource Indicator (URI)
    MAEC/CybOX Object ElementsMAEC/CybOX Types
    +
      +
    • URI/Value
      • +
    +     		+ +
    Typical MAEC Schema LocationsDescription
    MAEC_Package/Malware_Subjects/Malware_Subject/Malware_Subject/Malware_Instance_Object_AttributesUsed to capture a single URI associated with a malware instance.
    MAEC_Bundle/Malware_Instance_Object_AttributesUsed to capture a single URI associated with a malware instance.
    MAEC_Bundle/Actions/Action/Associated_Objects/Associated_ObjectUsed to capture a single URI related to an Action associated with a malware instance.
    MAEC_Bundle/Objects/ObjectUsed to capture a single URI related to an Object associated with a malware instance.
    MAEC_Bundle/Collections/Action_Collections/Action_Collection/Action_List/Action/Associated_Objects/Associated_ObjectUsed to capture a single URI related to an Action in an Action Collection.
    MAEC_Bundle/Collections/Object_Collections/Object_Collection/Object_List/ObjectUsed to capture a single URI related to an Object in an Object Collection.
    MAEC/CybOX XML Representation Example
    +{% highlight xml %} + + + http://samsonikonyou.ru:8080/navigator/jueoaritjuir.php + + +{% endhighlight %} +
    + + + + + + + + + + + + + + + + diff --git a/documentation/archive/data_model_overview/index.md b/documentation/archive/data_model_overview/index.md new file mode 100644 index 00000000..ca18ed85 --- /dev/null +++ b/documentation/archive/data_model_overview/index.md @@ -0,0 +1,43 @@ +--- +layout: flat +title: Overview of the MAEC Data Models for MAEC Version 4.1 +--- + + + + + + + + + +
    Version 4.1 of the MAEC Language is defined by three data models, each of which is implemented in its own XML schema. There is also a default vocabularies schema, which defines a default set of controlled vocabularies used within MAEC. +
    +As illustrated, “MAEC Bundle” is the (lowest) Tier 1 data model; “MAEC Package” is the (middle) Tier 2 data model; and “MAEC Container” is the (highest) Tier 3 data model. All three data models offer a stand-alone output format, so a lower level model can be used without the higher tier data model (although each model level requires all lower tiers). This three-tiered structure provides flexibility in the type and amount of information that can be shared. + +MAEC data models +
    + +

    + +
    +
    +
    +

    MAEC Bundle Data Model for MAEC Version 4.1

    +

    The MAEC Bundle data model provides the ability to capture and share data obtained from the analysis of a single malware instance.

    + MAEC Bundle » +
    +
    +

    MAEC Package Data Model for MAEC Version 4.1

    +

    The MAEC Package data model enables a user to share MAEC characterized data for one or more Malware Subjects.

    + MAEC Package » +
    +
    +
    +
    +

    MAEC Container Data Model for MAEC Version 4.1

    +

    The MAEC Container data model enables a user to share any collection of MAEC characterized data.

    + MAEC Container » +
    +
    +
    diff --git a/documentation/archive/idioms/index.md b/documentation/archive/idioms/index.md new file mode 100644 index 00000000..67b39d47 --- /dev/null +++ b/documentation/archive/idioms/index.md @@ -0,0 +1,88 @@ +--- +layout: flat +title: Suggested Practices for MAEC Version 4.1 +--- + +This page contains suggested practices (sometimes called best practices) for producing and consuming MAEC content. Following these practices will ensure the best conformance with the design goals of MAEC and the best compatibility with other MAEC tools. These are not requirements, however: in some cases, technical or business requirements will mean you can't comply with them and that's fine. Think of them as "do it this way unless you have a good reason not to." + +## General Practices + +General practices apply across MAEC. + +### Formatting IDs + +MAEC IDs are [XML QNames](http://en.wikipedia.org/wiki/QName). Each ID includes both a namespace portion (optional) and an ID portion (required) separated by a colon (:). The recommend approach to creating MAEC IDs is to define a producer namespace and namespace prefix, then use the form: + +`[ns prefix]:[construct type]-[GUID]` + +The "ns prefix" should be a namespace prefix bound to a namespace owned/controlled by the producer of the content. + +Some examples: + + acme:package-ce431003-ad07-4c96-bd7a-a50a3196e2a0 + acme:bundle-bf8bc5d5-c7e6-46b0-8d22-7500fea77196 + acme:behavior-79090715-8d6a-46b7-943b-c0bb9e063788 + +In order to use this approach, you will need to define that namespace prefix in the head of your XML document: + +```xml + +
    +
    +

    MAEC Version 4.1 Overview

    +

    This document provides a detailed introduction to Version 4.1 of the Malware Attribute Enumeration and Characterization (MAEC™) Language, an overview of the MAEC Version 4.1 data models, a discussion of high-level use cases, requirements for Version 4.1 of the MAEC Language, and a discussion of open issues and challenges.

    + Go » +
    +
    +

    Idioms for MAEC Version 4.1

    +

    MAEC idioms describe how common patterns in malware analysis (for instance, capturing dynamic analysis results) are represented in MAEC Version 4.1. They're similar to programming language idioms in that they document common patterns for representing content in MAEC.

    + Go » +
    +
    +

    Suggested Practices for MAEC Version 4.1

    +

    MAEC suggested practices (often called best practices) are guidelines that will help you create MAEC Version 4.1 content that conforms to the MAEC design goals and ensures the best compatibility with other MAEC tooling.

    + Go » +
    +
    +
    +
    +

    Data Model Overview for MAEC Version 4.1

    +

    Version 4.1 of the MAEC Language is defined by three data models and a default set of controlled vocabularies.

    + Go » +
    +
    +

    Common Features for MAEC Version 4.1

    +

    We list malware features - whether statically, dynamically, and manually identified - that are commonly characterized with MAEC Version 4.1 and CybOX.

    + Go » +
    +
    +

    Characterizing Malware with MAEC Version 4.1 and STIX

    +

    This document describes the use of the Malware Attribute Enumeration and Characterization (MAEC™) and Structured Threat Information eXpression (STIX™) languages in the context of malware characterization and malware metadata exchange. By describing the relationships between the languages and by providing details on each language's ability to capture malware-related information, this document answers the "When should I use MAEC Version 4.1, when should I use STIX, and when should I use both?" questions.

    + Go » +
    +
    +
    diff --git a/documentation/archive/suggested_practices/index.md b/documentation/archive/suggested_practices/index.md new file mode 100644 index 00000000..f25d790b --- /dev/null +++ b/documentation/archive/suggested_practices/index.md @@ -0,0 +1,88 @@ +--- +layout: flat +title: Suggested Practices for MAEC Version 4.1 +--- + +This page contains suggested practices (sometimes called best practices) for producing and consuming MAEC content. Following these practices will ensure the best conformance with the design goals of MAEC and the best compatibility with other MAEC tools. These are not requirements, however: in some cases, technical or business requirements will mean you can't comply with them and that's fine. Think of them as "do it this way unless you have a good reason not to." + +## General Practices + +General practices apply across MAEC. + +### Formatting IDs + +MAEC IDs are [XML QNames](http://en.wikipedia.org/wiki/QName). Each ID includes both a namespace portion (optional) and an ID portion (required) separated by a colon (:). The recommend approach to creating MAEC IDs is to define a producer namespace and namespace prefix, then use the form: + +`[ns prefix]:[construct type]-[GUID]` + +The "ns prefix" should be a namespace prefix bound to a namespace owned/controlled by the producer of the content. + +Some examples: + + acme:package-ce431003-ad07-4c96-bd7a-a50a3196e2a0 + acme:bundle-bf8bc5d5-c7e6-46b0-8d22-7500fea77196 + acme:behavior-79090715-8d6a-46b7-943b-c0bb9e063788 + +In order to use this approach, you will need to define that namespace prefix in the head of your XML document: + +```xml +Cyber Observable eXpression (CybOX™) object elements, the associated MAEC/CybOX types, the typical MAEC schema locations of the object elements (specified via a quasi-XPath like expression), and an explicit XML representation example. Note that all object elements are characterized through their Properties field, and that only the most commonly used object elements are listed for each feature (please refer to the applicable schemas for the complete lists). diff --git a/documentation/data_model_overview/bundle/index.md b/documentation/data_model_overview/bundle/index.md index eb685d59..0e298df5 100644 --- a/documentation/data_model_overview/bundle/index.md +++ b/documentation/data_model_overview/bundle/index.md @@ -1,6 +1,6 @@ --- layout: flat -title: Overview of the MAEC Bundle Data Model +title: Overview of the MAEC Bundle Data Model for MAEC Version 4.1 --- The MAEC Bundle data model provides the ability to capture and share data obtained from the analysis of a single malware instance. In terms of its most elemental structure, the MAEC Bundle data model can be thought of as having three interconnected layers as illustrated in the figure. diff --git a/documentation/data_model_overview/container/index.md b/documentation/data_model_overview/container/index.md index 36a34722..521999de 100644 --- a/documentation/data_model_overview/container/index.md +++ b/documentation/data_model_overview/container/index.md @@ -1,6 +1,6 @@ --- layout: flat -title: Overview of the MAEC Container Data Model +title: Overview of the MAEC Container Data Model for MAEC Version 4.1 --- The MAEC Container data model enables a user to share any collection of MAEC characterized data. Currently, the data model simply enables a user to share a collection of MAEC Packages. The data model will be expanded and further defined to include other components as dictated by future needs. @@ -14,4 +14,4 @@ The MAEC Container XML schema is currently the standard output format that can b
    MAEC Container schema overview
    -The structure of the MAEC Container schema is provided in detail in the MAEC Container Specification. \ No newline at end of file +The structure of the MAEC Container schema is provided in detail in the MAEC Container Specification. diff --git a/documentation/data_model_overview/index.md b/documentation/data_model_overview/index.md index ea7f06ef..66abbaff 100644 --- a/documentation/data_model_overview/index.md +++ b/documentation/data_model_overview/index.md @@ -1,11 +1,11 @@ --- layout: flat -title: Overview of the MAEC Data Models +title: Overview of the MAEC Data Models for MAEC Version 4.1 --- - @@ -23,21 +23,21 @@ As illustrated, “MAEC Bundle” is the (lowest) Tier 1 data model; “MAEC Pac
    -

    MAEC Bundle Data Model

    +

    MAEC Bundle Data Model for MAEC Version 4.1

    The MAEC Bundle data model provides the ability to capture and share data obtained from the analysis of a single malware instance.

    MAEC Bundle »
    -

    MAEC Package Data Model

    +

    MAEC Package Data Model for MAEC Version 4.1

    The MAEC Package data model enables a user to share MAEC characterized data for one or more Malware Subjects.

    MAEC Package »
    -

    MAEC Container Data Model

    +

    MAEC Container Data Model for MAEC Version 4.1

    The MAEC Container data model enables a user to share any collection of MAEC characterized data.

    MAEC Container »
    -
    \ No newline at end of file + diff --git a/documentation/data_model_overview/package/index.md b/documentation/data_model_overview/package/index.md index 02cd3db5..279e8685 100644 --- a/documentation/data_model_overview/package/index.md +++ b/documentation/data_model_overview/package/index.md @@ -1,6 +1,6 @@ --- layout: flat -title: Overview of the MAEC Package Data Model +title: Overview of the MAEC Package Data Model for MAEC Version 4.1 --- Before we discuss the MAEC Package data model, we must define the Malware Subject entity. A Malware Subject contains details of a particular malware instance (e.g., a file as identified by MD5 and/or SHA1 hash), any minor variants of the same instance that may have been observed (e.g., the same file but with different names), along with all of the analyses that were performed on the instance, any findings generated from the analyses, and any other metadata. As such, the Malware Subject is MAEC’s representation of a malware instance and all of the known data associated with it. diff --git a/documentation/faqs/index.md b/documentation/faqs/index.md index fe81a094..c723edf0 100644 --- a/documentation/faqs/index.md +++ b/documentation/faqs/index.md @@ -21,28 +21,23 @@ title: Frequently Asked Questions (FAQs)
  • B3. Where can I find examples of what I can capture and do with MAEC?
  • B4. What tools or utilities are available to help me use or develop MAEC content?
  • B5. Is there a GUI of some sort that will help me select MAEC elements?
    • -
  • B6. Are there plans to support other forms of data interchange for MAEC (e.g., JSON, YAML, etc.)?
    • +
  • B6. Are there plans to support other forms of data interchange for MAEC (e.g., YAML, etc.)?
  • B7. Where can I find examples of MAEC data? Are there any MAEC repositories?
  • B8. What is included in a MAEC release?
    • ### Using MAEC ### Relationships to Other Efforts ### MAEC Community @@ -56,7 +51,7 @@ MAEC? #### A1. What is MAEC? -Malware Attribute Enumeration and Characterization (MAEC™) is a structured language for encoding and communicating high fidelity information about malware based upon attributes such as behaviors, artifacts, and attack patterns. +[Malware Attribute Enumeration and Characterization (MAEC™)](/releases/5.0) is a structured language for encoding and communicating high fidelity information about malware based upon attributes such as behaviors, artifacts, and relationships between malware samples. #### A2. How is "MAEC" pronounced? @@ -66,11 +61,11 @@ MAEC is pronounced as "mike." This pronunciation stems from classical Latin, in MAEC was developed to eliminate the ambiguity and inaccuracy that currently exists in malware descriptions. By reducing reliance on signatures, MAEC aims to improve human-to-tool, tool-to-tool, and tool-to-human communication about malware; allow for faster development of countermeasures by enabling the ability to leverage responses to previously observed malware instances; and reduce potential duplication of malware analysis efforts by researchers. -MAEC is a community-developed effort and has received input from members of various communities, including those from industry, academia, and government. [The MITRE Corporation](http://www.mitre.org/) maintains MAEC and its public website presence and provides impartial technical guidance to the [MAEC Community](/community) throughout the process to ensure MAEC serves the public interest. MAEC is sponsored by the office of [Cybersecurity and Communications](http://www.dhs.gov/office-cybersecurity-and-communications/) at the [U.S. Department of Homeland Security](http://www.dhs.gov/). +MAEC is a community-developed effort and has received input from members of various communities, including those from industry, academia, and government. [The MITRE Corporation](https://www.mitre.org/) maintains MAEC and its public website presence and provides impartial technical guidance to the [MAEC Community](/community) throughout the process to ensure MAEC serves the public interest. MAEC is sponsored by the office of [Cybersecurity and Communications](https://www.dhs.gov/office-cybersecurity-and-communications/) at the [U.S. Department of Homeland Security](https://www.dhs.gov/). #### A4. Is MAEC a formal standard? -MAEC is not currently being pursued in a formal standards body. However, once an appropriate level of maturity, stability, and use is achieved, international standardization will be sought. +MAEC is not currently being pursued in a formal standards body. However, once an appropriate level of maturity, stability, and use is achieved, international standardization may be sought. #### A5. How is MAEC licensed? @@ -79,95 +74,65 @@ See the "License" section of the [Terms of Use](/Legal). #### A6. How can I get involved? How can I make contributions to MAEC development? There are several opportunities to get involved. See the [MAEC Community](/community) page for details, or contact us directly at [maec@mitre.org](mailto:maec@mitre.org). -**NOTE:** The MAEC Community is actively working on [MAEC 5.0](/documentation/roadmap), the next version of the Malware Attribute Enumeration and Characterization (MAEC™) Language. Community members are encouraged to participate by joining in on our MAEC Community teleconference [working call](/working-call) meetings. - ### MAEC Language #### B1. Where can I get the current version of MAEC? -The current version of the Malware Attribute Enumeration and Characterization (MAEC™) Language is available on the [Current Release](/releases/4.1) page. In addition, the current MAEC schema, as well as example files, schematron rules, and related documentation, are available in the [MAEC Schemas in the MAECProject repository](https://github.com/MAECProject/schemas) on GitHub.com. - -**NOTE:** The MAEC Community is actively working on [MAEC 5.0](/documentation/roadmap), the next version of MAEC. We encourage you to participate by joining in on our regular MAEC Community teleconference [working call](/working-call) meetings. +The current version of the Malware Attribute Enumeration and Characterization (MAEC™) Language is available on the [Current Release](/releases/5.0) page. In addition, non-normative JSON schemas and examples are available in the [MAECProject GitHub repository](https://github.com/MAECProject/schemas). #### B2. Is a specification available for the MAEC Language? -Both PDF and Word versions of the current [MAEC Language Specifications](https://github.com/MAECProject/specifications) are available. +See the [Specifications](https://maecproject.github.io/releases/5.0/#specifications) section on the [Current Release](/releases/5.0) page. #### B3. Where can I find examples of what I can capture and do with MAEC? -Examples can be found in the [MAEC Schemas MAECProject repository](https://github.com/MAECProject/schemas/tree/master/examples) on GitHub.com. +Examples can be found in the [MAECProject repository](https://github.com/MAECProject/schemas/tree/master/examples) on GitHub.com. Additional examples are given in the [MAEC 5.0 Core Specification](https://maecproject.github.io/releases/5.0/MAEC_Core_Specification.pdf). #### B4. What tools or utilities are available to help me use or develop MAEC content? -MAEC can be manipulated manually or programmatically. If using MAEC manually, such as to capture malware analysis results, no tools are currently provided, but use of an XML editor is recommended. +MAEC can be manipulated manually or programmatically. If using MAEC manually, such as to capture malware analysis results, no tools are provided. Use of a JSON editor is recommended. -For programmatic development and use, some MAEC scripts and translator utilities are hosted in separate [MAECProject GitHub repositories](https://github.com/MAECProject/). In addition, a Python API for parsing, manipulating, and generating MAEC content is hosted in the [MAECProject Python-MAEC GitHub repository](https://github.com/MAECProject/python-maec). +For programmatic development and use, some MAEC scripts and translator utilities are hosted in separate [MAECProject GitHub repositories](https://github.com/MAECProject/). -#### B5. Is there a GUI of some sort that will help me select MAEC elements? -A GUI is not available at this time, but such a tool could be available in the future. +Also see [MAEC Supporters](/community/supporters/) for a list of vendors that have implemented MAEC in their products or services. -#### B6. Are there plans to support other forms of data interchange for MAEC (e.g., JSON, YAML, etc.)? -Yes. Eventually, a formal MAEC implementation-independent specification will be produced, to include guidance for developing technology-specific implementations such as JavaScript Object Notation (JSON), Resource Description Framework (RDF)/Web Ontology Language (OWL), YAML Ain't Markup Language (YMAL), or other implementations. XML was used in the initial release to enable rapid development and implementation. +#### B5. Is there a GUI of some sort that will help me select MAEC elements? +A GUI is not available, however, such a tool could be available in the future. -Visit the [MAEC Version 5.0 Roadmap](/documentation/roadmap) for additional information. +#### B6. Are there plans to support other forms of data interchange for MAEC (e.g., YAML, etc.)? +No. Rather than producing additional MAEC serializations or a formal implementation-independent specification, MAEC concepts will likely be migrated into the [Structured Threat Information Expression (STIX™)](https://oasis-open.github.io/cti-documentation/) 2.x Malware Object. #### B7. Where can I find examples of MAEC data? Are there any MAEC repositories? -Visit the [Current Release](/releases/4.1) page for examples. +Visit the [Current Release](/releases/5.0) page for additional information. -At present, there are no public repositories of MAEC data, nor are there plans by MITRE to establish one. However, community members interested in hosting a MAEC data repository are strongly encouraged to do so. +At present, there are no public repositories of MAEC data, nor are there plans by MITRE to establish one. However, community members interested in hosting a MAEC data repository are encouraged to do so. #### B8. What is included in a MAEC release? -A MAEC release includes individually-versioned MAEC schemas (i.e., Bundle, Package, and Container schemas) and the latest versions of the independently-versioned MAEC vocabulary schemas. - -MAEC releases are packaged in two different ways: -
      -
    1. A zipped bundle to support local development, with local references and including copies of all imported or utilized schemas.
      2. -
    2. A zipped bundle to support development with Internet access, with only remote references to imported schemas.
      3. -
    +[MAEC 5.0](/releases/5.0) includes two specification documents (core concepts and vocabularies) and a corresponding set of non-normative JSON schemas and examples. ### Using MAEC -Some of the FAQs in this section are somewhat technical in nature. Please refer to the [MAEC Language Specifications](/documentation/specs/) for further information. +Some of the FAQs in this section are somewhat technical in nature. Please refer to the [MAEC Language Specifications](/releases/5.0/#specifications) for further information. -#### C1. MAEC seems complicated – is it too expansive for my use? -The MAEC schema was developed to enable analysts to capture a full gamut of information about malware. However, a MAEC Bundle is valid with very little information: it is only necessary to define a unique identifier and to specify the MAEC schema version. All other fields are optional. +#### C1. Why are so many things optional in MAEC? +Many properties are optional in MAEC to make the language as flexible as possible, enabling users to capture exactly what they want and nothing more. -#### C2. Why are so many things optional in MAEC? -Aside from a unique identifier and the MAEC schema version, all objects are optional in MAEC. This was done to make the language as flexible as possible: a user is able to capture exactly what they want and nothing more. +#### C2. What if I need to define something that isn't part of the MAEC schema? +MAEC cannot be directly customized, but because a MAEC Package can include relevant [Structured Threat Information Expression (STIX™)](https://oasis-open.github.io/cti-documentation/) Observable Objects, custom STIX Properties and Objects can be used to capture some content that is not defined in MAEC. -#### C3. How does the xsi:type extension mechanism work? -The xsi:type XML schema extension mechanism works by allowing for the substitution of types that are created as derivatives of an existing abstract type. As such, one must simply include the xsi:type attribute on an element that uses the parent abstract type, and accordingly specify the name of the type that one wishes to substitute for this element inside this attribute. For example, if one wishes to use the FileObj:FileObjectType type from [Cyber Observables Expression (CybOX™)](https://cyboxproject.github.io/) in the Properties element (which uses the abstract cyboxCommon:ObjectPropertiesType) of the Malware Instance Object Attributes in a MAEC Bundle, they would specify the xsi:type attribute on this element with the name of the object type inside: +In addition, the MAEC development team encourages the community to engage in the ongoing discussion so that new properties can be defined and integrated into future versions of MAEC as necessary. Please consider participating in the [MAEC Community](/community) to help with the development of MAEC. -```xml - - -dg003_improve_8080_V132.exe -196608 - - -``` - -#### C4. What if I need to define something that isn't part of the MAEC schema? -MAEC is very flexible and can accommodate custom fields and objects. For example, one can use the Custom Properties/Property fields at the root level of the larger [Cyber Observables Expression (CybOX™)](https://cyboxproject.github.io/) ObjectType specify a set of custom attributes that are not defined elsewhere. Accordingly, it is possible to define a new type of CybOX Object that can then be plugged into the Property field of the CybOX ObjectType using the xsi:type extension mechanism (e.g., xsi:type="CustomObj:CustomObjectType"). - -In addition, the MAEC development team encourages the community to engage in the ongoing discussion so that new fields can be defined and integrated into future versions of MAEC as necessary. Please consider participating in the [MAEC Community](/community) to help with the development of MAEC. - -#### C5. Can the same information be captured in multiple places in MAEC? -Yes. MAEC is very flexible and there are often a multiple places that the same characterized information, e.g., a particular Action or Behavior, can be captured. +#### C3. Can the same information be captured in multiple places in MAEC? +In earlier versions of MAEC, it was possible to express the same concept in multiple ways, but rather than being a feature, the flexibility led to confusion. [MAEC 5.0](/releases/5.0/) recognizes the need for flexibility, but also recognizes the importance of simplicity, standardization, and reduced optionality. Therefore, MAEC 5.0 aims to have a single way of capturing any particular facet of malware information. ### Relationships to Other Efforts -#### D1. What is the relationship between MAEC and CybOX? - [Cyber Observable eXpression (CybOX™)](https://cyboxproject.github.io/) provides a structured language for describing elements within the cyber operational environment. MAEC uses components of the CybOX language for characterizing cyber observables associated with malware. In particular, MAEC makes use of CybOX's Object and Action fields (which are extended in MAEC's MalwareActionType type) to characterize malware-related system artifacts and low-level behaviors, respectively. - -#### D2. What is the relationship between MAEC and STIX? -[Structured Threat Information eXpression (STIX™)](https://stixproject.github.io/) characterizes a rich set of cyber threat information in a standardized and structured manner. STIX can describe malware using MAEC characterizations through use of the MAEC schema extension for the TTP schema and can also characterize indicators in a fashion similar to MAEC's Candidate Indicators. - -#### D3. When would STIX be used to capture malware information and when would MAEC be used? -[STIX](https://stixproject.github.io/) is used to describe high-level cyber threat information to include indicators, as well as information about threat actors, campaigns, incidents, and other related entities. On the other hand, MAEC is used to describe malware attributes of one or more malware instances at various levels of abstraction. Certainly, there is overlap between the two languages, particularly when it comes to capturing indicator information (e.g., file sizes, file hashes) through the common use of [Cyber Observable eXpression (CybOX™)](https://cyboxproject.github.io/). +#### D1. What is the relationship between MAEC and STIX? +The MAEC Language directly imports and uses components of the OASIS [Structured Threat Information eXpression (STIX™)](https://oasis-open.github.io/cti-documentation/) language. More specifically, MAEC’s malware characterization relies on the common implementation (structure and content) that STIX Cyber Observables provide for expressing cyber observables. Thus, whereas MAEC provides coverage of malware analysis context, behaviors, and capabilities, STIX Cyber Observables provide the underpinnings necessary to broadly cover objects, such as files and network connections, used in the context of malware. -While there are no definite rules for what is most appropriately captured with MAEC versus STIX, MAEC will typically be used to capture malware information that is gathered through the analysis process, and STIX will be used to capture information related to the interpretation of the analysis results in a broader, threat-based context. For example, while MAEC would capture the particular details of the behaviors and artifacts associated with a malware instance, STIX would be used to capture additional details regarding the particular threat actors that may make use of the malware instance. Thus, when malware analysis information beyond simple indicator information is to be captured by STIX, the STIX schema extension for MAEC should be used to leverage the MAEC data model. +#### D2. When would STIX be used to capture malware information and when would MAEC be used? +MAEC is targeted toward malware analysts, and therefore provides a comprehensive, structured way of capturing detailed information about malware samples. By contrast, [STIX](https://oasis-open.github.io/cti-documentation/) targets a more diverse audience by capturing a broad spectrum of cyber-threat related information, including basic malware information. Consequently, an organization performing cyber threat analysis must consider their specific use case to determine whether the extensive malware characterization ability of MAEC or the more basic STIX Malware Object is most appropriate. -#### D4. What is the relationship between MAEC and TAXII? -[Trusted Automated eXchange of Indicator Information (TAXII™)](https://taxiiproject.github.io/) defines a set of services and message exchanges for securely sharing automated cyber threat information. TAXII uses [Structured Threat Information eXpression (STIX™)](https://stixproject.github.io/) to represent cyber threat information in a standardized and structured manner (STIX characterizes what is being shared, while TAXII defines how the STIX payload is shared). STIX is one payload that TAXII can convey, and STIX can describe malware using MAEC. +#### D3. What is the relationship between MAEC and TAXII? +The OASIS [Trusted Automated eXchange of Indicator Information (TAXII™)](https://oasis-open.github.io/cti-documentation/) defines a set of services and message exchanges for securely sharing automated cyber threat information. Most commonly, TAXII uses [STIX](https://oasis-open.github.io/cti-documentation/) to represent cyber threat information where STIX characterizes what is being shared and TAXII defines how the STIX payload is shared. However, TAXII could use MAEC as its payload instead of STIX. ### MAEC Community @@ -175,14 +140,14 @@ While there are no definite rules for what is most appropriately captured with M The [MAEC Community](/community) includes representatives from antivirus vendors, operating system vendors, software vendors, IT users, security services providers, and others from across the international cyber security community who have come together to help build this growing, open-source industry effort. There are multiple options available for involvement including participating in the conversations -on our [dedicated email discussion list](/community/#discussion-lists--archives), contributing to the [MediaWiki](https://collaborate.mitre.org/maec/index.php/Malware_Attribute_Enumeration_and_Characterization) on MITRE’s collaboration website, contributing to the development of [MAEC tools and utilities](/community/#tool--utility-development) on GitHub, and/or joining us on the [working calls to help develop MAEC Version 5.0](/community/#working-calls). +on our [dedicated email discussion list](/community/#discussion-lists--archives), contributing to the [Encyclopedia of Malware Attributes](https://collaborate.mitre.org/ema/index.php/ema:Main_Page) on MITRE’s collaboration website, and/or contributing to the development of [MAEC tools and utilities](/community/#tool--utility-development) on GitHub. Visit the [MAEC Community](/community) page to learn more or to [join](/community) the MAEC effort. #### E2. What is MITRE's role in MAEC? How long does MITRE plan to maintain it? -The [MITRE Corporation (MITRE)](http://www.mitre.org/) manages and maintains the development of the MAEC Language, MAEC website, community engagement, and discussion lists to enable open and public collaboration with all stakeholders and provides neutral guidance throughout the process to ensure that MAEC serves the public interest. +The [MITRE Corporation (MITRE)](https://www.mitre.org/) manages and maintains the development of the MAEC Language, MAEC website, community engagement, and discussion lists to enable open and public collaboration with all stakeholders and provides neutral guidance throughout the process to ensure that MAEC serves the public interest. In accordance with its mission, MITRE has traditionally acted in the public interest. Its unique role allows it to provide an objective perspective to this effort. MITRE will maintain MAEC as long as it serves the community to do so. #### E3. Who sponsors MAEC? What is the relationship between MAEC and DHS? -MAEC is a DHS-led and sponsored effort of the office of [Cybersecurity and Communications](http://www.dhs.gov/office-cybersecurity-and-communications/) at the [U.S. Department of Homeland Security (DHS)](http://www.dhs.gov/). [MITRE](http://www.mitre.org/), operating as DHS's Federally Funded Research and Development Center (FFRDC), manages the development of the MAEC Language, this MAEC website, community engagement, and discussion lists to enable open and public collaboration with all stakeholders. +MAEC is a DHS-led and sponsored effort of the office of [Cybersecurity and Communications](https://www.dhs.gov/office-cybersecurity-and-communications/) at the [U.S. Department of Homeland Security (DHS)](https://www.dhs.gov/). [MITRE](https://www.mitre.org/), operating as DHS's Federally Funded Research and Development Center (FFRDC), manages the development of the MAEC Language, this MAEC website, community engagement, and discussion lists to enable open and public collaboration with all stakeholders. diff --git a/documentation/idioms/index.md b/documentation/idioms/index.md index 1f9f1065..9037921a 100644 --- a/documentation/idioms/index.md +++ b/documentation/idioms/index.md @@ -1,39 +1,39 @@ --- layout: flat -title: Idioms +title: Idioms for MAEC Version 4.1 ---
    -

    Basic Analysis Data Capture

    +

    Basic Analysis Data Capture MAEC Version 4.1

    This Idiom demonstrates how to capture analysis-derived data relating to a single malware instance, such as the actions that it performed, through the use of the MAEC Bundle entity.

    Go »
    -

    Basic Malware Instance Characterization

    +

    Basic Malware Instance Characterization MAEC Version 4.1

    This Idiom demonstrates how to capture basic information about a single malware instance using the MAEC Package, through the use of its Malware Subject entity.

    Go »
    -

    Basic Analysis Metadata Capture

    +

    Basic Analysis Metadata Capture MAEC Version 4.1

    This Idiom demonstrates how to capture basic metadata associated with a particular analysis performed on a malware instance, through the use of the Analysis entity.

    Go »
    -

    Static Analysis Capture

    +

    Static Analysis Capture MAEC Version 4.1

    This Idiom describes the process of capturing the results of static analysis performed on some malware instance, such as through the use of a PE file analysis tool.

    Go »
    -

    Dynamic Analysis Capture

    +

    Dynamic Analysis Capture MAEC Version 4.1

    This Idiom describes the process of capturing the results of dynamic analysis performed on some malware instance, such as through the use of a malware sandbox tool.

    Go »
    -

    Capturing In-depth Analysis Results

    +

    Capturing In-depth Analysis Results MAEC Version 4.1

    This Idiom describes the process of capturing results of in-depth malware analysis, such as that which characterizes the capabilities or behaviors exhibited by the malware.

    Go »
    @@ -41,18 +41,18 @@ title: Idioms

    AV Classification Capture

    -

    This Idiom describes the process of capturing the classifications as reported by anti-virus (AV) tools when executed against a particular malware instance.

    +

    This Idiom describes the process of capturing the class MAEC Version 4.1ifications as reported by anti-virus (AV) tools when executed against a particular malware instance.

    Go »
    -

    Process Tree Capture

    +

    Process Tree Capture MAEC Version 4.1

    This Idiom describes the process of an observed process tree of execution for a malware instance, as reported through a dynamic analysis or similar tool.

    Go »
    -

    Capturing Related Malware

    +

    Capturing Related Malware MAEC Version 4.1

    This Idiom describes the process of characterizing multiple malware instances and the relationships between them.

    Go »
    -
    \ No newline at end of file +
    diff --git a/documentation/index.md b/documentation/index.md index 9bdd3061..55947c6b 100644 --- a/documentation/index.md +++ b/documentation/index.md @@ -6,53 +6,35 @@ title: Documentation
    -

    MAEC Overview

    -

    This document provides a detailed introduction to the Malware Attribute Enumeration and Characterization (MAEC™) Language, an overview of the MAEC data models, a discussion of high-level use cases, requirements for the MAEC Language, and a discussion of open issues and challenges.

    - Go » +

    MAEC Overview

    +

    This document provides a brief introduction to Version 5.0 of the Malware Attribute Enumeration and Characterization (MAEC™) Language, an overview of the MAEC data models, a discussion of top-level objects, and an example MAEC Package.

    + Go »
    -

    Specifications

    -

    Specification documents are available for the MAEC data models.

    - Go » +

    Specifications

    +

    MAEC Version 5.0 includes two specifications, the “Core” Specification and the “Vocabularies” Specification.

    + Go »
    -

    Idioms

    -

    MAEC idioms describe how common patterns in malware analysis (for instance, capturing dynamic analysis results) are represented in MAEC. They're similar to programming language idioms in that they document common patterns for representing content in MAEC.

    - Go » -
    -
    -

    Use Cases

    -

    MAEC use cases illustrate how MAEC can be used in cyber security. High level use cases are provided in four general areas: malware analysis, cyber threat analysis, intrusion detection, and incident management.

    - Go » -
    -
    -

    Suggested Practices

    -

    MAEC suggested practices (often called best practices) are guidelines that will help you create MAEC content that conforms to the MAEC design goals and ensures the best compatibility with other MAEC tooling.

    - Go » +

    Idioms

    +

    MAEC idioms describe how common patterns in malware analysis (for instance, capturing dynamic analysis results) are represented in MAEC. They're similar to programming language idioms in that they document common patterns for representing content in MAEC. +

    + Idioms are included as an Appendix in the MAEC Version 5.0 “Core” Specification.

    + Go »
    -
    -

    Data Model Overview

    -

    The MAEC Language is defined by three data models and a default set of controlled vocabularies.

    - Go » -
    -
    -

    Common Features

    -

    We list malware features - whether statically, dynamically, and manually identified - that are commonly characterized with MAEC and CybOX.

    - Go » +
    +

    Use Cases

    +

    MAEC use cases illustrate how MAEC can be used in cybersecurity. High-level use cases are provided in three general areas: malware analysis, cyber threat analysis, and incident management.

    + Go »
    -
    +

    Utilities and Developer Resources

    -

    Various utilities and other developer resources have been developed for working with MAEC. The collection includes translators as well as bindings and APIs.

    +

    Various utilities and other developer resources have been developed for working with MAEC. The collection includes translators as well as bindings and APIs.

    Go »
    -
    -

    Characterizing Malware with MAEC and STIX

    -

    This document describes the use of the Malware Attribute Enumeration and Characterization (MAEC™) and Structured Threat Information eXpression (STIX™) languages in the context of malware characterization and malware metadata exchange. By describing the relationships between the languages and by providing details on each language's ability to capture malware-related information, this document answers the "When should I use MAEC, when should I use STIX, and when should I use both?" questions.

    - Go » -
    -
    +

    FAQs

    We provide answers to frequently asked questions.

    Go » diff --git a/documentation/maec4.1-xsddocs/.DS_Store b/documentation/maec4.1-xsddocs/.DS_Store new file mode 100644 index 00000000..5008ddfc Binary files /dev/null and b/documentation/maec4.1-xsddocs/.DS_Store differ diff --git a/documentation/maec4.1-xsddocs/NO_NAMESPACE.html b/documentation/maec4.1-xsddocs/NO_NAMESPACE.html new file mode 100644 index 00000000..30d2b3e3 --- /dev/null +++ b/documentation/maec4.1-xsddocs/NO_NAMESPACE.html @@ -0,0 +1,2063 @@ + + + + + Schema documentation for "No namespace" + + +
    +
    The MAEC Language is defined by three data models, each of which is implemented in its own XML schema. There is also a default vocabularies schema, which defines a default set of controlled vocabularies used within MAEC. +Version 4.1 of the MAEC Language is defined by three data models, each of which is implemented in its own XML schema. There is also a default vocabularies schema, which defines a default set of controlled vocabularies used within MAEC.
    + + + + + + + + + + + + + + + +
    +

    Showing:

    + + + + + + + +
    Annotations
    Facets
    +
    +
    +
    Attribute maecPackage:MalwareConfigurationObfuscationAlgorithmType / @ordinal_position
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ordinal_position field specifies the explicit ordering of the usage of the algorithm with respect to the other algorithms used to encrypt or encode the malware configuration parameters, for cases where more than one algorithm was used.
    +
    +
    +
    Typexs:positiveInteger
    +
    Attribute maecPackage:MalwareConfigurationObfuscationDetailsType / @is_encoded
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The is_encoded field specifies that the malware configuration parameters are encoded with the algorithm captured in the Algorithm_Details field.
    +
    +
    +
    Typexs:boolean
    +
    Attribute maecPackage:MalwareConfigurationObfuscationDetailsType / @is_encrypted
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The is_encrypted field specifies that the malware configuration parameters are encrypted with the algorithm captured in the Algorithm_Details field.
    +
    +
    +
    Typexs:boolean
    +
    Attribute maecPackage:CommentType / @author
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The author field specifies the name of the author that added the comment.
    +
    +
    +
    Typexs:string
    +
    Attribute maecPackage:CommentType / @timestamp
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The timestamp field specifies the date/time that the comment was added.
    +
    +
    +
    Typexs:dateTime
    +
    Attribute maecPackage:CommentType / @observation_name
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The observation_name field captures the name, type, or identifier of an observation, for comments that refer to the observation of particular entities. For example, a comment that refers to a command and control (C2) encryption key could have an observation_name of "C2 Encryption Key".
    +
    +
    +
    Typexs:string
    +
    Attribute maecPackage:MalwareExceptionType / @is_fatal
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The is_fatal field specifies whether the exception is fatal; that is, whether it caused the malware instance to terminate.
    +
    +
    +
    Typexs:boolean
    +
    Attribute maecPackage:CapturedProtocolType / @layer7_protocol
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The layer7_protocol field specifies the name of the Layer 7 network protocol (OSI model) captured or manipulated by the analysis environment.
    +
    +
    +
    TypemaecPackage:Layer7ProtocolEnum
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationhttp +
    + + + + + 
    The http value specifies the Hypertext Transfer Protocol (HTTP).
    +
    +
    enumerationhttps +
    + + + + + 
    The https value specifies the Hypertext Transfer Protocol Secure (HTTPS).
    +
    +
    enumerationftp +
    + + + + + 
    The ftp value specifies the File Transfer Protocol (FTP).
    +
    +
    enumerationftps +
    + + + + + 
    The ftps value specifies the File Transfer Protocol Secure (FTPS).
    +
    +
    enumerationsmtp +
    + + + + + 
    The smtp value specifies the Simple Mail Transfer Protocol (SMTP).
    +
    +
    enumerationsmtps +
    + + + + + 
    The smtps value specifies the Simple Mail Transfer Protocol Secure (SMTPS).
    +
    +
    enumerationpop3 +
    + + + + + 
    The pop3 value specifies the Post Office Protocol version 3 (POP3).
    +
    +
    enumerationpop3s +
    + + + + + 
    The pop3s value specifies the Post Office Protocol version 3 Secure (POP3S).
    +
    +
    enumerationirc +
    + + + + + 
    The irc value specifies the Internet Relay Chat (IRC) protocol.
    +
    +
    enumerationdns +
    + + + + + 
    The dns value specifies the Domain Name System (DNS) protocol.
    +
    +
    enumerationrdp +
    + + + + + 
    The rdp value specifies the Remote Desktop Protocol (RDP).
    +
    +
    enumerationrpc +
    + + + + + 
    The rpc value specifies some Remote Procedure Call (RPC) protocol, such as MSRPC.
    +
    +
    enumerationssh +
    + + + + + 
    The ssh value specifies the Secure Shell (SSH) protocol.
    +
    +
    enumerationtelnet +
    + + + + + 
    The telnet value specifies the Telnet protocol.
    +
    +
    +
    +
    +
    Attribute maecPackage:CapturedProtocolType / @layer4_protocol
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The layer4_protocol field specifies the name of the Layer 4 network protocol (OSI model) captured or manipulated by the analysis environment.
    +
    +
    +
    TypemaecPackage:Layer4ProtocolEnum
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + +
    enumerationtcp +
    + + + + + 
    The tcp value specifies the Transport Control Protocol (TCP).
    +
    +
    enumerationudp +
    + + + + + 
    The udp value specifies the User Datagram Protocol (UDP).
    +
    +
    +
    +
    +
    Attribute maecPackage:CapturedProtocolType / @port_number
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The port_number field specifies the port number for this network protocol that is captured or manipulated by the analysis environment.
    +
    +
    +
    Typexs:positiveInteger
    +
    Attribute maecPackage:CapturedProtocolType / @interaction_level
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The interaction_level field specifies the relative level of interaction that the analysis environment has with the specified network protocol.
    +
    +
    +
    TypemaecPackage:InteractionLevelEnum
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationhigh +
    + + + + + 
    The high value specifies that, for the specified protocol, the analysis environment will establish the connection and attempt to decode/identify any common protocols used by the malware. The level of decode/protocol support can be subjective and dependent on the particular environment.
    +
    +
    enumerationlow +
    + + + + + 
    The low value specifies that, for the specified protocol, the analysis environment will accept the packets and will identify the initial connection request. No further interaction is performed.
    +
    +
    enumerationhoneytrap +
    + + + + + 
    The honeytrap value specifies that, for the specified protocol, the analysis environment will establish the connection and attempt to interact with outgoing requests. The level of interaction can be subjective and dependent on the particular environment.
    +
    +
    enumerationlive +
    + + + + + 
    The live value specifies that, for the specified protocol, the analysis environment allows the malware to connect out to the real (unemulated) IP.
    +
    +
    enumerationnone +
    + + + + + 
    The none value specifies that, for the specified protocol, the analysis environment does not support or perform any level of interaction.
    +
    +
    +
    +
    +
    Attribute maecPackage:AnalysisType / @id
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The required id field specifies a unique ID for this Analysis.
    +
    +
    +
    Typexs:QName
    +
    Attribute maecPackage:AnalysisType / @type
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The type field specifies the type of malware analysis being performed.
    +
    +
    +
    TypemaecPackage:AnalysisTypeEnum
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + +
    enumerationtriage +
    + + + + + 
    The Triage value specifies an cursory, or triage type of malware analysis, commonly automated in conjunction with one or more tools.
    +
    +
    enumerationin-depth +
    + + + + + 
    The in-depth value specifies a detailed type of malware analysis that is typically performed by a human analyst.
    +
    +
    +
    +
    +
    Attribute maecPackage:AnalysisType / @method
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The method field specifies the analysis method used in the analysis.
    +
    +
    +
    TypemaecPackage:AnalysisMethodEnum
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + +
    enumerationstatic +
    + + + + + 
    The static value specifies a static malware analysis method, which is achieved by inspecting but not executing the malware instance.
    +
    +
    enumerationdynamic +
    + + + + + 
    The dynamic value specifies a dynamic malware analysis method, which is achieved by executing but not inspecting the malware instance.
    +
    +
    enumerationcombination +
    + + + + + 
    The combination value specifies a combination of dynamic and static malware analysis, achieved by both inspecting and executing the malware instance.
    +
    +
    +
    +
    +
    Attribute maecPackage:AnalysisType / @ordinal_position
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ordinal_position field specifies the ordering of the analysis with respect to the other analyses performed on the Malware Subject.
    +
    +
    +
    Typexs:positiveInteger
    +
    Attribute maecPackage:AnalysisType / @start_datetime
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The start_datetime field specifies the date/time the analysis was started.
    +
    +
    +
    Typexs:dateTime
    +
    Attribute maecPackage:AnalysisType / @complete_datetime
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The complete_datetime field specifies the date/time the analysis was completed.
    +
    +
    +
    Typexs:dateTime
    +
    Attribute maecPackage:AnalysisType / @lastupdate_datetime
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The lastupdate_datetime field specifies the date/time the analysis was last updated.
    +
    +
    +
    Typexs:dateTime
    +
    Attribute maecPackage:ActionEquivalenceType / @id
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The required id field specifies a unique ID for the Action Equivalence.
    +
    +
    +
    Typexs:QName
    +
    Attribute maecPackage:ObjectEquivalenceType / @id
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The required id field specifies a unique ID for the Object Equivalence.
    +
    +
    +
    Typexs:QName
    +
    Attribute maecPackage:MalwareSubjectReferenceType / @malware_subject_idref
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The malware_subject_idref field provides a reference to a Malware Subject contained in the Package, via its ID.
    +
    +
    +
    Typexs:QName
    +
    Attribute maecPackage:MalwareSubjectType / @id
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The required id field specifies a unique ID for this Malware Subject.
    +
    +
    +
    Typexs:QName
    +
    Attribute maecPackage:ClusterEdgeNodePairType / @similarity_index
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The similarity_index field specifies the similarity index  between the two Malware Subjects being referenced (indicating how similar they are), as a decimal value. This value should be equivalent to 1 minus the similarity distance value (if included).
    +
    +
    +
    Typexs:decimal
    +
    Attribute maecPackage:ClusterEdgeNodePairType / @similarity_distance
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The similarity_index field specifies the similarity distance between the two Malware Subjects being referenced (indicating how dissimilar they are), as a decimal value. This value should be equivalent to 1 minus the similarity index value (if included).
    +
    +
    +
    Typexs:decimal
    +
    Attribute maecPackage:ClusterCompositionType / @score_type
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    For clustering algorithms that may capture different types of scores, the score_type attribute specifies the type of score used to define the composition of this malware cluster.
    +
    +
    +
    Typexs:string
    +
    Attribute maecPackage:PackageType / @id
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The required id field specifies a unique ID for this Package.
    +
    +
    +
    Typexs:QName
    +
    Attribute maecPackage:PackageType / @schema_version
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The required schema_version field specifies the version of the MAEC Package schema that the document has been written in and that should be used for validation.
    +
    +
    +
    Typexs:string
    +
    Attribute maecPackage:PackageType / @timestamp
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    NamespaceNo namespace
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The timestamp field specifies the date/time that the Package was generated.
    +
    +
    +
    Typexs:dateTime
    +
    +
    +
    +
    XML Schema documentation generated by ® XML Editor. +
    +
    + \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/default_vocabularies-1.html b/documentation/maec4.1-xsddocs/default_vocabularies-1.html new file mode 100644 index 00000000..358dda2f --- /dev/null +++ b/documentation/maec4.1-xsddocs/default_vocabularies-1.html @@ -0,0 +1,21501 @@ + + + + + Schema documentation for namespace http://maec.mitre.org/default_vocabularies-1 + + +
    + + + + + + + + + + + + + + + + +
    +

    Showing:

    + + + + + + + + + + +
    Annotations
    Diagrams
    Facets
    +
    +
    +
    Main schema maec_default_vocabularies.xsd
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    This schema was originally developed by The MITRE Corporation. The MAEC XML Schema implementation is maintained by The MITRE Corporation and developed by the open MAEC Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the MAEC website at http://maec.mitre.org.
    +
    +
    +
    +
    Complex Type maecVocabs:ActionObjectAssociationTypeVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ActionObjectAssocationVocab is the default MAEC vocabulary for Action-Object association types, captured via the AssociatedObjectType/Association_Type element in CybOX Core.
    +
    +
    + + + + + 
    It should be used in place of the CybOX ActionObjectAssociationVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:ActionObjectAssociationTypeEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    ActionObjectAssociationTypeEnum is a (non-exhaustive) enumeration of types of action-object associations.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + +
    enumerationinput +
    + + + + + 
    The 'input' value specifies that the associated object serves as an input to the action. This includes cases where an object is used by the action or an existing object is modified by the action.
    +
    +
    enumerationoutput +
    + + + + + 
    The 'output' value specifies that the associated object serves as an output to the action. This includes cases where the object is created anew by the action or otherwise returned by the action.
    +
    +
    enumerationside-effect +
    + + + + + 
    The 'side-effect' value specifies that the associated object serves as a side-effect resulting from the action. This includes cases where the object is modified indirectly by the action.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:ImportanceTypeVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ImportanceTypeVocab is the default MAEC vocabulary for relative importance measures, captured via the CandidateIndicatorType/Importance element in the MAEC Bundle.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:ImportanceTypeEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ImportanceTypeEnum is a (non-exhaustive) enumeration of relative importance measures.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationhigh +
    + + + + + 
    The 'high' value specifies that the field is of relative high importance.
    +
    +
    enumerationmedium +
    + + + + + 
    The 'medium' value specifies that the field is of relative medium importance.
    +
    +
    enumerationlow +
    + + + + + 
    The 'low' value specifies that the field is of relative low importance.
    +
    +
    enumerationinformational +
    + + + + + 
    The 'informational' value specifies that the field is only informational in its importance.
    +
    +
    enumerationnumeric +
    + + + + + 
    The 'numeric' value specifies that the field has a numeric importance value, which is defined in another attribute or element.
    +
    +
    enumerationunknown +
    + + + + + 
    The 'unknown' value specifies that the relative importance for the field is unknown.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:MalwareEntityTypeVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareEntityTypeVocab is the default MAEC vocabulary for malware entity types, captured via the CandidateIndicatorType/Malware_Entity/Type element in the MAEC Bundle.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:MalwareEntityTypeEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareEntityTypeEnum is a (non-exhaustive) enumeration of the different types of entities that a malware indicator or signature may be written against.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + +
    enumerationinstance +
    + + + + + 
    The 'instance' value specifies that the particular malware entity being referred to is a single malware instance.
    +
    +
    enumerationfamily +
    + + + + + 
    The 'family' value specifies that the particular malware entity being referred to is a single malware family.
    +
    +
    enumerationclass +
    + + + + + 
    The 'class' value specifies that the particular malware entity being referred to is a single class of malware.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:DeviceDriverActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DeviceDriverActionNameVocab is the default MAEC vocabulary for device driver action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For device driver action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    + + + + + 
    Deprecated as of MAEC 4.1.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:DeviceDriverActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DeviceDriverActionNameEnum is a (non-exhaustive) enumeration of the different types of actions associated with device drivers.
    +
    +
    + + + + + 
    Deprecated as of MAEC 4.1.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + +
    enumerationload and call driver +
    + + + + + 
    The 'load and call' value specifies the defined action of loading a driver into a system and then calling the loaded driver.
    +
    +
    enumerationload driver +
    + + + + + 
    The 'load driver' value specifies the defined action of loading a driver into a system.
    +
    +
    enumerationunload driver +
    + + + + + 
    The 'unload driver' value specifies the defined action of unloading a driver from a system.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:DeviceDriverActionNameVocab-1.1
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DeviceDriverActionNameVocab is the default MAEC vocabulary for device driver action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For device driver action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    + + + + + 
    Starting with MAEC 4.1, it should be used in place of the deprecated DeviceDriverActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:DeviceDriverActionNameEnum-1.1
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DeviceDriverActionNameEnum is a (non-exhaustive) enumeration of the different types of actions associated with device drivers.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    enumerationload and call driver +
    + + + + + 
    The 'load and call' value specifies the defined action of loading a driver into a system and then calling the loaded driver.
    +
    +
    enumerationload driver +
    + + + + + 
    The 'load driver' value specifies the defined action of loading a driver into a system.
    +
    +
    enumerationunload driver +
    + + + + + 
    The 'unload driver' value specifies the defined action of unloading a driver from a system.
    +
    +
    enumerationemulate driver +
    + + + + + 
    The 'emulate driver' value specifies the defined action of emulating an existing driver on a system.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:DebuggingActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DebuggingActionNameVocab is the default MAEC vocabulary for debugging action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For debugging action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:DebuggingActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DebuggingActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with debugging.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + +
    enumerationcheck for remote debugger +
    + + + + + 
    The 'check for remote debugger' value specifies the defined action of checking for the presence of a remote debugger.
    +
    +
    enumerationcheck for kernel debugger +
    + + + + + 
    The 'check for kernel debugger' value specifies the defined action of checking for the presence of a kernel debugger.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:LibraryActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The LibraryActionNameVocab is the default MAEC vocabulary for library action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For library action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    + + + + + 
    Deprecated as of MAEC 4.1.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:LibraryActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The LibraryActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with libraries.
    +
    +
    + + + + + 
    Deprecated as of MAEC 4.1.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    enumerationenumerate libraries +
    + + + + + 
    The 'enumerate libraries' value specifies the defined action of enumerating the libraries used by a process.
    +
    +
    enumerationfree library +
    + + + + + 
    The 'free library' value specifies the defined action of freeing a library previously loaded into the address space of the calling process.
    +
    +
    enumerationload library +
    + + + + + 
    The 'load library' value specifies the defined action of loading a library into the address space of the calling process.
    +
    +
    enumerationget function address +
    + + + + + 
    The 'get function address' value specifies the defined action of getting the address of an exported function or variable from a library.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:LibraryActionNameVocab-1.1
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The LibraryActionNameVocab is the default MAEC vocabulary for library action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For library action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    + + + + + 
    Starting with MAEC 4.1, it should be used in place of the deprecated LibraryActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:LibraryActionNameEnum-1.1
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The LibraryActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with libraries.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationenumerate libraries +
    + + + + + 
    The 'enumerate libraries' value specifies the defined action of enumerating the libraries used by a process.
    +
    +
    enumerationfree library +
    + + + + + 
    The 'free library' value specifies the defined action of freeing a library previously loaded into the address space of the calling process.
    +
    +
    enumerationload library +
    + + + + + 
    The 'load library' value specifies the defined action of loading a library into the address space of the calling process.
    +
    +
    enumerationget function address +
    + + + + + 
    The 'get function address' value specifies the defined action of getting the address of an exported function or variable from a library.
    +
    +
    enumerationcall library function +
    + + + + + 
    The 'call library function' value specifies the defined action of calling a function exported by a library.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:DirectoryActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DirectoryActionNameVocab is the default MAEC vocabulary for directory action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For directory action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    + + + + + 
    Deprecated as of MAEC 4.1
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:DirectoryActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DirectoryActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with a file directories.
    +
    +
    + + + + + 
    Deprecated as of MAEC 4.1
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + +
    enumerationcreate directory +
    + + + + + 
    The 'create directory' value specifies the defined action of creating a new directory on the filesystem.
    +
    +
    enumerationdelete directory +
    + + + + + 
    The 'delete directory' value specifies the defined action of deleting an existing directory on the filesystem.
    +
    +
    enumerationmonitor directory +
    + + + + + 
    The 'monitor directory' value specifies the defined action of monitoring an existing directory on the filesystem for changes.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:DirectoryActionNameVocab-1.1
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DirectoryActionNameVocab is the default MAEC vocabulary for directory action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For directory action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    + + + + + 
    Starting with MAEC 4.1, it should be used in place of the deprecated DirectoryActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:DirectoryActionNameEnum-1.1
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DirectoryActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with a file directories.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    enumerationcreate directory +
    + + + + + 
    The 'create directory' value specifies the defined action of creating a new directory on the filesystem.
    +
    +
    enumerationdelete directory +
    + + + + + 
    The 'delete directory' value specifies the defined action of deleting an existing directory on the filesystem.
    +
    +
    enumerationmonitor directory +
    + + + + + 
    The 'monitor directory' value specifies the defined action of monitoring an existing directory on the filesystem for changes.
    +
    +
    enumerationhide directory +
    + + + + + 
    The 'hide directory' value specifies the defined action of hiding an existing directory.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:DiskActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DiskActionNameVocab is the default MAEC vocabulary for disk action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For disk action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    + + + + + 
    Deprecated as of MAEC 4.1.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:DiskActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DiskActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with hard disks.
    +
    +
    + + + + + 
    Deprecated as of MAEC 4.1.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    enumerationget disk type +
    + + + + + 
    The 'get disk type' value specifies the defined action of getting the disk type.
    +
    +
    enumerationget disk attributes +
    + + + + + 
    The 'get disk attributes' value specifies the defined action of querying the attributes of a disk, such as the amount of available free space.
    +
    +
    enumerationmount disk +
    + + + + + 
    The 'mount disk' value specifies the defined action of mounting an existing file system to a mounting point.
    +
    +
    enumerationunmount disk +
    + + + + + 
    The 'unmount disk' value specifies the defined action of unmounting an existing file system from a mounting point.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:DiskActionNameVocab-1.1
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DiskActionNameVocab is the default MAEC vocabulary for disk action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For disk action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    + + + + + 
    Starting with MAEC 4.1, it should be used in place of the deprecated DiskActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:DiskActionNameEnum-1.1
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DiskActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with hard disks.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationget disk type +
    + + + + + 
    The 'get disk type' value specifies the defined action of getting the disk type.
    +
    +
    enumerationget disk attributes +
    + + + + + 
    The 'get disk attributes' value specifies the defined action of querying the attributes of a disk, such as the amount of available free space.
    +
    +
    enumerationmount disk +
    + + + + + 
    The 'mount disk' value specifies the defined action of mounting an existing file system to a mounting point.
    +
    +
    enumerationunmount disk +
    + + + + + 
    The 'unmount disk' value specifies the defined action of unmounting an existing file system from a mounting point.
    +
    +
    enumerationemulate disk +
    + + + + + 
    The 'emulate disk' value specifies the defined action of emulating an existing disk.
    +
    +
    enumerationlist disks +
    + + + + + 
    The 'list disks' value specifies the defined action of listing all disks available on a system.
    +
    +
    enumerationmonitor disk +
    + + + + + 
    The 'monitor disk' value specifies the defined action of monitoring an existing disk for changes.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:FileActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The FileActionNameVocab is the default MAEC vocabulary for file action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For file action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    + + + + + 
    Deprecated as of MAEC 4.1.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:FileActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The FileActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with a file.
    +
    +
    + + + + + 
    Deprecated as of MAEC 4.1.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationcreate file +
    + + + + + 
    The 'create file' value specifies the defined action of creating a new file.
    +
    +
    enumerationdelete file +
    + + + + + 
    The 'delete file' value specifies the defined action of deleting an existing file.
    +
    +
    enumerationcopy file +
    + + + + + 
    The 'copy file' value specifies the defined action of copying an existing file from one location to another.
    +
    +
    enumerationcreate file symbolic link +
    + + + + + 
    The 'create file symbolic link' value specifies the defined action of creating a symbolic link to an existing file.
    +
    +
    enumerationfind file +
    + + + + + 
    The 'find file' value specifies the defined action of searching for an existing file.
    +
    +
    enumerationget file attributes +
    + + + + + 
    The 'get file attributes' value specifies the defined action of getting the attributes of an existing file.
    +
    +
    enumerationset file attributes +
    + + + + + 
    The 'set file attributes' value specifies the defined action of setting the file attributes for an existing file.
    +
    +
    enumerationlock file +
    + + + + + 
    The 'lock file' value specifies the defined action of locking an existing file.
    +
    +
    enumerationunlock file +
    + + + + + 
    The 'unlock file' value specifies the defined action of unlocking an existing file.
    +
    +
    enumerationmodify file +
    + + + + + 
    The 'modify file' value specifies the defined action of modifying an existing file in some manner.
    +
    +
    enumerationmove file +
    + + + + + 
    The 'move file' value specifies the defined action of moving an existing file from one location to another.
    +
    +
    enumerationopen file +
    + + + + + 
    The 'open file' value specifies the defined action of opening an existing file for reading or writing.
    +
    +
    enumerationread from file +
    + + + + + 
    The 'read from file' value specifies the defined action of reading from an existing file.
    +
    +
    enumerationwrite to file +
    + + + + + 
    The 'write to file' value specifies the defined action of writing to an existing file.
    +
    +
    enumerationrename file +
    + + + + + 
    The 'rename file' value specifies the defined action of renaming an existing file.
    +
    +
    enumerationcreate file alternate data stream +
    + + + + + 
    The 'create file alternate data stream' value specifies the defined action of creating an alternate data stream in an existing file.
    +
    +
    enumerationsend control code to file +
    + + + + + 
    The 'send control code to file' value specifies the defined action of sending a control code to a file.
    +
    +
    enumerationcreate file mapping +
    + + + + + 
    The 'create file mapping' value specifies the defined action of creating a new file mapping object.
    +
    +
    enumerationopen file mapping +
    + + + + + 
    The 'open file mapping' value specifies the defined action of opening an existing file mapping object.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:FileActionNameVocab-1.1
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The FileActionNameVocab is the default MAEC vocabulary for file action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For file action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    + + + + + 
    Starting with MAEC 4.1, it should be used in place of the deprecated FileActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:FileActionNameEnum-1.1
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The FileActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with a file.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationcreate file +
    + + + + + 
    The 'create file' value specifies the defined action of creating a new file.
    +
    +
    enumerationdelete file +
    + + + + + 
    The 'delete file' value specifies the defined action of deleting an existing file.
    +
    +
    enumerationcopy file +
    + + + + + 
    The 'copy file' value specifies the defined action of copying an existing file from one location to another.
    +
    +
    enumerationcreate file symbolic link +
    + + + + + 
    The 'create file symbolic link' value specifies the defined action of creating a symbolic link to an existing file.
    +
    +
    enumerationfind file +
    + + + + + 
    The 'find file' value specifies the defined action of searching for an existing file.
    +
    +
    enumerationget file attributes +
    + + + + + 
    The 'get file attributes' value specifies the defined action of getting the attributes of an existing file.
    +
    +
    enumerationset file attributes +
    + + + + + 
    The 'set file attributes' value specifies the defined action of setting the file attributes for an existing file.
    +
    +
    enumerationlock file +
    + + + + + 
    The 'lock file' value specifies the defined action of locking an existing file.
    +
    +
    enumerationunlock file +
    + + + + + 
    The 'unlock file' value specifies the defined action of unlocking an existing file.
    +
    +
    enumerationmodify file +
    + + + + + 
    The 'modify file' value specifies the defined action of modifying an existing file in some manner.
    +
    +
    enumerationmove file +
    + + + + + 
    The 'move file' value specifies the defined action of moving an existing file from one location to another.
    +
    +
    enumerationopen file +
    + + + + + 
    The 'open file' value specifies the defined action of opening an existing file for reading or writing.
    +
    +
    enumerationread from file +
    + + + + + 
    The 'read from file' value specifies the defined action of reading from an existing file.
    +
    +
    enumerationwrite to file +
    + + + + + 
    The 'write to file' value specifies the defined action of writing to an existing file.
    +
    +
    enumerationrename file +
    + + + + + 
    The 'rename file' value specifies the defined action of renaming an existing file.
    +
    +
    enumerationcreate file alternate data stream +
    + + + + + 
    The 'create file alternate data stream' value specifies the defined action of creating an alternate data stream in an existing file.
    +
    +
    enumerationsend control code to file +
    + + + + + 
    The 'send control code to file' value specifies the defined action of sending a control code to a file.
    +
    +
    enumerationcreate file mapping +
    + + + + + 
    The 'create file mapping' value specifies the defined action of creating a new file mapping object.
    +
    +
    enumerationopen file mapping +
    + + + + + 
    The 'open file mapping' value specifies the defined action of opening an existing file mapping object.
    +
    +
    enumerationexecute file +
    + + + + + 
    The 'execute file' value specifies the defined action of executing an existing file.
    +
    +
    enumerationhide file +
    + + + + + 
    The 'hide file' value specifies the defined action of hiding an existing file.
    +
    +
    enumerationclose file +
    + + + + + 
    The 'close file' value specifies the defined action of closing an existing file that previously opened for reading or writing.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:HookingActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The HookingActionNameVocab is the default MAEC vocabulary for hooking action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For hooking action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    + + + + + 
    Deprecated as of MAEC 4.1.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:HookingActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The HookingActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with various kinds of hooking.
    +
    +
    + + + + + 
    Deprecated as of MAEC 4.1.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + +
    enumerationadd system call hook +
    + + + + + 
    The 'add system call hook' value specifies the defined action of adding a new system call hook.
    +
    +
    enumerationadd windows hook +
    + + + + + 
    The 'add windows hook' value specifies the defined action of adding a new Windows application-defined hook procedure.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:HookingActionNameVocab-1.1
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The HookingActionNameVocab is the default MAEC vocabulary for hooking action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For hooking action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    + + + + + 
    Starting with MAEC 4.1, it should be used in place of the deprecated HookingActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:HookingActionNameEnum-1.1
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The HookingActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with various kinds of hooking.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + +
    enumerationadd system call hook +
    + + + + + 
    The 'add system call hook' value specifies the defined action of adding a new system call hook.
    +
    +
    enumerationadd windows hook +
    + + + + + 
    The 'add windows hook' value specifies the defined action of adding a new Windows application-defined hook procedure.
    +
    +
    enumerationhide hook +
    + + + + + 
    The 'hide hook' value specifies the defined action of hiding an existing hook.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:DNSActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DNSActionNameVocab is the default MAEC vocabulary for DNS action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For DNS action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:DNSActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DNSActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with the Domain Name System (DNS).
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + +
    enumerationsend dns query +
    + + + + + 
    The 'send dns query' value specifies the defined action of sending a DNS query.
    +
    +
    enumerationsend reverse dns lookup +
    + + + + + 
    The 'send reverse dns lookup' value specifies the defined action of sending a reverse DNS lookup.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:IRCActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The IRCActionNameVocab is the default MAEC vocabulary for IRC action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For IRC action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:IRCActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The IRCActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with the Internet Relay Chat (IRC).
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationconnect to irc server +
    + + + + + 
    The 'connect to irc server' value specifies the defined action of connecting to an existing IRC server.
    +
    +
    enumerationdisconnect from irc server +
    + + + + + 
    The 'disconnect from irc server' value specifies the defined action of disconnecting from an existing IRC server.
    +
    +
    enumerationset irc nickname +
    + + + + + 
    The 'set irc nickname' value specifies the defined action of setting an IRC nickname on an IRC server.
    +
    +
    enumerationjoin irc channel +
    + + + + + 
    The 'join irc channel' value specifies the defined action of joining a channel on an IRC server.
    +
    +
    enumerationleave irc channel +
    + + + + + 
    The 'leave irc channel' value specifies the defined action of leaving a channel on an IRC server.
    +
    +
    enumerationsend irc private message +
    + + + + + 
    The 'send irc private message' value specifies the defined action of sending a private message to another user on an IRC server.
    +
    +
    enumerationreceive irc private message +
    + + + + + 
    The 'receive irc private message' value specifies the defined action of receiving a private message from another user on an IRC server.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:FTPActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The FTPActionNameVocab is the default MAEC vocabulary for FTP action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For FTP action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:FTPActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The FTPActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with the File Transfer Protocol (FTP).
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + +
    enumerationconnect to ftp server +
    + + + + + 
    The 'connect to ftp server' value specifies the defined action of connecting to an existing FTP server.
    +
    +
    enumerationdisconnect from ftp server +
    + + + + + 
    The 'disconnect from ftp server' value specifies the defined action of disconnecting from an existing FTP server.
    +
    +
    enumerationsend ftp command +
    + + + + + 
    The 'send ftp command' value specifies the defined action of sending a command on an FTP server connection.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:HTTPActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The HTTPActionNameVocab is the default MAEC vocabulary for HTTP action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For HTTP action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:HTTPActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The HTTPActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with the Hypertext Transfer Protocol (HTTP).
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationsend http get request +
    + + + + + 
    Specifies the defined action of sending an HTTP GET client request to an existing server.
    +
    +
    enumerationsend http head request +
    + + + + + 
    The 'send http head request' value specifies the defined action of sending an HTTP HEAD client request to an existing server.
    +
    +
    enumerationsend http post request +
    + + + + + 
    The 'send http post request' value specifies the defined action of sending an HTTP HEAD client request to an existing server.
    +
    +
    enumerationsend http put request +
    + + + + + 
    The 'send http put request' value specifies the defined action of sending an HTTP PUT client request to an existing server.
    +
    +
    enumerationsend http delete request +
    + + + + + 
    The 'send http delete request' value specifies the defined action of sending an HTTP DELETE client request to an existing server.
    +
    +
    enumerationsend http trace request +
    + + + + + 
    The 'send http trace request' value specifies the defined action of sending an HTTP TRACE client request to an existing server.
    +
    +
    enumerationsend http options request +
    + + + + + 
    The 'send http options request' value specifies the defined action of sending an HTTP OPTIONS client request to an existing server.
    +
    +
    enumerationsend http connect request +
    + + + + + 
    The 'send http connect request' value specifies the defined action of sending an HTTP CONNECT client request to an existing server.
    +
    +
    enumerationsend http patch request +
    + + + + + 
    The 'send http patch request' value specifies the defined action of sending an HTTP PATCH client request to an existing server.
    +
    +
    enumerationreceive http response +
    + + + + + 
    The 'receive http response' value specifies the defined action of receiving an HTTP server response for a prior HTTP request.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:NetworkActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The NetworkActionNameVocab is the default MAEC vocabulary for network action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For network action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    + + + + + 
    Deprecated as of MAEC 4.1.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:NetworkActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The NetworkActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with networking.
    +
    +
    + + + + + 
    Deprecated as of MAEC 4.1.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationopen port +
    + + + + + 
    The 'open port' value specifies the defined action of opening a network port.
    +
    +
    enumerationclose port +
    + + + + + 
    The 'close port' value specifies the defined action of closing a network port.
    +
    +
    enumerationconnect to ip +
    + + + + + 
    The 'connect to ip' value specifies the defined action of connecting to an IP address.
    +
    +
    enumerationdisconnect from ip +
    + + + + + 
    The 'disconnect from ip' value specifies the defined action of disconnecting from a previously established connection to an IP address.
    +
    +
    enumerationconnect to url +
    + + + + + 
    The 'connect to url' value specifies the defined action of connecting to a URL.
    +
    +
    enumerationconnect to socket address +
    + + + + + 
    The 'connect to socket address' value specifies the defined action of connecting to a socket address, consisting of an IP address and port number.
    +
    +
    enumerationdownload file +
    + + + + + 
    The 'download file' value specifies the defined action of downloading a file from a remote location.
    +
    +
    enumerationupload file +
    + + + + + 
    The 'upload file' value specifies the defined action of uploading a file to a remote location.
    +
    +
    enumerationlisten on port +
    + + + + + 
    The 'listen on port' value specifies the defined action of listening on a specific port.
    +
    +
    enumerationsend email message +
    + + + + + 
    The 'send email message' value specifies the defined action of sending an email message.
    +
    +
    enumerationsend icmp request +
    + + + + + 
    The 'send icmp request' value specifies the defined action of sending an ICMP request.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:NetworkActionNameVocab-1.1
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The NetworkActionNameVocab is the default MAEC vocabulary for network action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For network action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    + + + + + 
    Starting with MAEC 4.1, it should be used in place of the deprecated NetworkActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:NetworkActionNameEnum-1.1
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The NetworkActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with networking.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationopen port +
    + + + + + 
    The 'open port' value specifies the defined action of opening a network port.
    +
    +
    enumerationclose port +
    + + + + + 
    The 'close port' value specifies the defined action of closing a network port.
    +
    +
    enumerationconnect to ip +
    + + + + + 
    The 'connect to ip' value specifies the defined action of connecting to an IP address.
    +
    +
    enumerationdisconnect from ip +
    + + + + + 
    The 'disconnect from ip' value specifies the defined action of disconnecting from a previously established connection to an IP address.
    +
    +
    enumerationconnect to url +
    + + + + + 
    The 'connect to url' value specifies the defined action of connecting to a URL.
    +
    +
    enumerationconnect to socket address +
    + + + + + 
    The 'connect to socket address' value specifies the defined action of connecting to a socket address, consisting of an IP address and port number.
    +
    +
    enumerationdownload file +
    + + + + + 
    The 'download file' value specifies the defined action of downloading a file from a remote location.
    +
    +
    enumerationupload file +
    + + + + + 
    The 'upload file' value specifies the defined action of uploading a file to a remote location.
    +
    +
    enumerationlisten on port +
    + + + + + 
    The 'listen on port' value specifies the defined action of listening on a specific port.
    +
    +
    enumerationsend email message +
    + + + + + 
    The 'send email message' value specifies the defined action of sending an email message.
    +
    +
    enumerationsend icmp request +
    + + + + + 
    The 'send icmp request' value specifies the defined action of sending an ICMP request.
    +
    +
    enumerationsend network packet +
    + + + + + 
    The 'send network packet' value specifies the defined action of sending a packet on a network.
    +
    +
    enumerationreceive network packet +
    + + + + + 
    The 'receive network packet' value specifies the defined action of receiving a packet on a network.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:NetworkShareActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The NetworkShareActionNameVocab is the default MAEC vocabulary for Windows network share action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For network share action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:NetworkShareActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The NetworkShareActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with Windows network shares.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationadd connection to network share +
    + + + + + 
    The 'add connection to network share' value specifies the defined action of adding a connection to an existing network share.
    +
    +
    enumerationadd network share +
    + + + + + 
    The 'add network share' value specifies the defined action of adding a new network share on a server.
    +
    +
    enumerationdelete network share +
    + + + + + 
    The 'delete network share' value specifies the defined action of deleting an existing network share on a server.
    +
    +
    enumerationconnect to network share +
    + + + + + 
    The 'connect to network share' value specifies the defined action of connecting to an existing network share.
    +
    +
    enumerationdisconnect from network share +
    + + + + + 
    The 'disconnect from network share' value specifies the defined action of disconnecting from an existing network share.
    +
    +
    enumerationenumerate network shares +
    + + + + + 
    The 'enumerate network shares' value specifies the defined action of enumerating the available shared resources on a server.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:SocketActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SocketActionNameVocab is the default MAEC vocabulary for socket action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For socket action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:SocketActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SocketActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with network sockets.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationaccept socket connection +
    + + + + + 
    The 'accept socket connection' value specifies the defined action of accepting a socket connection.
    +
    +
    enumerationbind address to socket +
    + + + + + 
    The 'bind address to socket' value specifies the defined action of binding a socket address to a socket.
    +
    +
    enumerationcreate socket +
    + + + + + 
    The 'create socket' value specifies the defined action of creating a new socket.
    +
    +
    enumerationclose socket +
    + + + + + 
    The 'close socket' value specifies the defined action of closing an existing socket.
    +
    +
    enumerationconnect to socket +
    + + + + + 
    The 'connect to socket' value specifies the defined action of connecting to an existing socket.
    +
    +
    enumerationdisconnect from socket +
    + + + + + 
    The 'disconnect from socket' value specifies the defined action of disconnecting from an existing socket.
    +
    +
    enumerationlisten on socket +
    + + + + + 
    The 'listen on socket' value specifies the defined action of listening on an existing socket.
    +
    +
    enumerationsend data on socket +
    + + + + + 
    The 'send data on socket' value specifies the defined action of sending data on an existing, connected socket.
    +
    +
    enumerationreceive data on socket +
    + + + + + 
    The 'receive data on socket' value specifies the defined action of receiving data on an existing socket.
    +
    +
    enumerationsend data to address on socket +
    + + + + + 
    The 'send data to address on socket' value specifies the defined action of sending data to a specified IP address on an existing, unconnected socket.
    +
    +
    enumerationget host by address +
    + + + + + 
    The 'get host by address' value specifies the defined action of getting information on a host from a local or remote host database by its IP address.
    +
    +
    enumerationget host by name +
    + + + + + 
    The 'get host by name' value specifies the defined action of getting information on a host from a local or remote host database by its name.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:RegistryActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The RegistryActionNameVocab is the default MAEC vocabulary for registry action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For registry action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:RegistryActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The RegistryActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with the Windows registry.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationcreate registry key +
    + + + + + 
    The 'create registry key' value specifies the defined action of creating a new registry key.
    +
    +
    enumerationdelete registry key +
    + + + + + 
    The 'delete registry key' value specifies the defined action of deleting an existing registry key.
    +
    +
    enumerationopen registry key +
    + + + + + 
    The 'open registry key' value specifies the defined action of opening an existing registry key.
    +
    +
    enumerationclose registry key +
    + + + + + 
    The 'close registry key' value specifies the defined action of closing a handle to an existing registry key.
    +
    +
    enumerationcreate registry key value +
    + + + + + 
    The 'create registry key value' value specifies the defined action of creating a new named value under an existing registry key.
    +
    +
    enumerationdelete registry key value +
    + + + + + 
    The 'delete registry key value' value specifies the defined action of deleting an existing named value under an existing registry key.
    +
    +
    enumerationenumerate registry key subkeys +
    + + + + + 
    The 'enumerate registry key subkeys' value specifies the defined action of enumerating the registry key subkeys under an existing registry key.
    +
    +
    enumerationenumerate registry key values +
    + + + + + 
    The 'enumerate registry key values' value specifies the defined action of enumerating the named values under an existing registry key.
    +
    +
    enumerationget registry key attributes +
    + + + + + 
    The 'get registry key attributes' value specifies the defined action of getting the attributes of an existing registry key.
    +
    +
    enumerationread registry key value +
    + + + + + 
    The 'read registry key value' value specifies the defined action of reading an existing named value of an existing registry key.
    +
    +
    enumerationmodify registry key value +
    + + + + + 
    The 'modify registry key value' value specifies the defined action of modifying an existing named value of an existing registry key.
    +
    +
    enumerationmodify registry key +
    + + + + + 
    The 'modify registry key' value specifies the defined action of modifying an existing registry key.
    +
    +
    enumerationmonitor registry key +
    + + + + + 
    The 'monitor registry key' value specifies the defined action of monitoring an existing registry key for changes.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:UserActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The UserActionNameVocab is the default MAEC vocabulary for user action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For user action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    + + + + + 
    Deprecated as of MAEC 4.1.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:UserActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The UserActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with users.
    +
    +
    + + + + + 
    Deprecated as of MAEC 4.1.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationadd user +
    + + + + + 
    The 'add user' value specifies the defined action of adding a new user.
    +
    +
    enumerationdelete user +
    + + + + + 
    The 'delete user' value specifies the defined action of deleting an existing user.
    +
    +
    enumerationenumerate users +
    + + + + + 
    The 'enumerate users' value specifies the defined action of enumerating all users.
    +
    +
    enumerationget user attributes +
    + + + + + 
    The 'get user attributes' value specifies the defined action of getting the attributes of an existing user.
    +
    +
    enumerationlogon as user +
    + + + + + 
    The 'logon as user' value specifies the defined action of logging on as a specific user.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:UserActionNameVocab-1.1
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The UserActionNameVocab is the default MAEC vocabulary for user action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For user action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    + + + + + 
    Starting with MAEC 4.1, it should be used in place of the deprecated UserActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:UserActionNameEnum-1.1
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The UserActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with users.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationadd user +
    + + + + + 
    The 'add user' value specifies the defined action of adding a new user.
    +
    +
    enumerationdelete user +
    + + + + + 
    The 'delete user' value specifies the defined action of deleting an existing user.
    +
    +
    enumerationenumerate users +
    + + + + + 
    The 'enumerate users' value specifies the defined action of enumerating all users.
    +
    +
    enumerationget user attributes +
    + + + + + 
    The 'get user attributes' value specifies the defined action of getting the attributes of an existing user.
    +
    +
    enumerationlogon as user +
    + + + + + 
    The 'logon as user' value specifies the defined action of logging on as a specific user.
    +
    +
    enumerationchange password +
    + + + + + 
    The 'change password' value specifies the defined action of changing an existing user's password.
    +
    +
    enumerationadd user to group +
    + + + + + 
    The 'add user to group' value specifies the defined action of adding an existing user to an existing group.
    +
    +
    enumerationremove user from group +
    + + + + + 
    The 'remove user from group' value specifies the defined action of removing an existing user from existing group.
    +
    +
    enumerationinvoke user privilege +
    + + + + + 
    The 'invoke user privilege' value specifies the defined action of invoking a privilege given to an existing user.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:IPCActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The IPCActionNameVocab is the default MAEC vocabulary for inter-process communication action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For IPC action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:IPCActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The IPCActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with entities related to Inter-Process Communication (IPC).
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationcreate named pipe +
    + + + + + 
    The 'create named pipe' value specifies the defined action of creating a new named pipe.
    +
    +
    enumerationdelete named pipe +
    + + + + + 
    The 'delete named pipe' value specifies the defined action of deleting an existing named pipe.
    +
    +
    enumerationconnect to named pipe +
    + + + + + 
    The 'connected to named pipe' value specifies the defined action of connecting to an existing named pipe.
    +
    +
    enumerationdisconnect from named pipe +
    + + + + + 
    The 'disconnect from named pipe' value specifies the defined action of disconnecting from an existing named pipe.
    +
    +
    enumerationread from named pipe +
    + + + + + 
    The 'read from named pipe' value specifies the defined action of reading some data from an existing named pipe.
    +
    +
    enumerationwrite to named pipe +
    + + + + + 
    The 'write to named pipe' value specifies the defined action of writing some data to an existing named pipe.
    +
    +
    enumerationcreate mailslot +
    + + + + + 
    The 'create mailslot' value specifies the defined action of creating a new named mailslot.
    +
    +
    enumerationread from mailslot +
    + + + + + 
    The 'read from mailslot' value specifies the defined action of reading some data from an existing named mailslot.
    +
    +
    enumerationwrite to mailslot +
    + + + + + 
    The 'write to mailslot' value specifies the defined action of writing some data to an existing named mailslot.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:ProcessMemoryActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ProcessMemoryActionNameVocab is the default MAEC vocabulary for process memory action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For process memory action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:ProcessMemoryActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ProcessMemoryActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with the memory regions of a process.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationallocate process virtual memory +
    + + + + + 
    The 'allocate process virtual memory' value specifies the defined action of allocating some virtual memory region in an existing process.
    +
    +
    enumerationfree process virtual memory +
    + + + + + 
    The 'free process virtual memory' value specifies the defined action of freeing some virtual memory region from an existing process.
    +
    +
    enumerationmodify process virtual memory protection +
    + + + + + 
    The 'modify process virtual memory protection' value specifies the defined action of modifying the protection on a memory region in the virtual address space of an existing process.
    +
    +
    enumerationread from process memory +
    + + + + + 
    The 'read from process memory' value specifies the defined action of reading from a memory region of an existing process.
    +
    +
    enumerationwrite to process memory +
    + + + + + 
    The 'write to process memory' value specifies the defined action of writing to a memory region of an existing process.
    +
    +
    enumerationmap file into process +
    + + + + + 
    The 'map file into process' value specifies the defined action of mapping an existing file into the address space of the calling process.
    +
    +
    enumerationunmap file from process +
    + + + + + 
    The 'unmap file from process' value specifies the defined action of unmapping an existing file from the address space of the calling process.
    +
    +
    enumerationmap library into process +
    + + + + + 
    The 'map library into process' value specifies the defined action of mapping a library into the address space of the calling process.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:ProcessActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ProcessActionNameVocab is the default MAEC vocabulary for process action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For process action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:ProcessActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ProcessActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with processes.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationcreate process +
    + + + + + 
    The 'create process' value specifies the defined action of creating a new process.
    +
    +
    enumerationkill process +
    + + + + + 
    The 'kill process' value specifies the defined action of killing an existing process.
    +
    +
    enumerationcreate process as user +
    + + + + + 
    The 'create process as user' value specifies the defined action of creating a new process in the security context of a specified user.
    +
    +
    enumerationenumerate processes +
    + + + + + 
    The 'enumerate processes' value specifies the defined action of enumerating all of the running processes on a system.
    +
    +
    enumerationopen process +
    + + + + + 
    The 'open process' value specifies the defined action of opening an existing process.
    +
    +
    enumerationflush process instruction cache +
    + + + + + 
    The 'flush process instruction cache' value specifies the defined action of flushing the instruction cache of an existing process.
    +
    +
    enumerationget process current directory +
    + + + + + 
    The 'get process current directory' value specifies the defined action of getting the current directory of an existing process.
    +
    +
    enumerationset process current directory +
    + + + + + 
    The 'set process current directory' value specifies the defined action of setting the current directory of an existing process.
    +
    +
    enumerationget process environment variable +
    + + + + + 
    The 'get process environment variable' value specifies the defined action of getting an environment variable used by an existing process.
    +
    +
    enumerationset process environment variable +
    + + + + + 
    The 'set process environment variable' value specifies the defined action of setting an environment variable used by an existing process.
    +
    +
    enumerationsleep process +
    + + + + + 
    The 'sleep process' value specifies the defined action of sleeping an existing process for some period of time.
    +
    +
    enumerationget process startupinfo +
    + + + + + 
    The 'get process startupinfo' value specifies the defined action of getting the STARTUPINFO struct associated with an existing process.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:ProcessThreadActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ProcessThreadActionNameVocab is the default MAEC vocabulary for process thread action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For process thread action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:ProcessThreadActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ProcessThreadActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with process threads.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationcreate thread +
    + + + + + 
    The 'create thread' value specifies the defined action of creating a new thread in the virtual address space of the calling process.
    +
    +
    enumerationkill thread +
    + + + + + 
    The 'kill thread' value specifies the defined action of killing a thread existing in the virtual address space of the calling process.
    +
    +
    enumerationcreate remote thread in process +
    + + + + + 
    The 'create remote thread in process' value specifies the defined action of creating a thread that runs in the virtual address space of another existing process.
    +
    +
    enumerationenumerate threads +
    + + + + + 
    The 'enumerate threads' value specifies the defined action of enumerating all threads in the calling process.
    +
    +
    enumerationget thread username +
    + + + + + 
    The 'get thread username' value specifies the defined action of getting the name or ID of the user associated with an existing thread.
    +
    +
    enumerationimpersonate process +
    + + + + + 
    The 'impersonate process' value specifies the defined action of a thread in the calling process impersonating the security context of another existing process.
    +
    +
    enumerationrevert thread to self +
    + + + + + 
    The 'revert thread to self' value specifies the defined action of reverting an existing thread to its own security context.
    +
    +
    enumerationget thread context +
    + + + + + 
    The 'get thread context' value specifies the defined action of getting the context structure (containing processor-specific register data) of an existing thread.
    +
    +
    enumerationset thread context +
    + + + + + 
    The 'set thread context' value specifies the defined action of setting the context structure (containing processor-specific register data) for an existing thread.
    +
    +
    enumerationqueue apc in thread +
    + + + + + 
    The 'queue apc in thread' value specifies the defined action of queing a new Asynchronized Procedure Call (APC) in the context of an existing thread.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:ServiceActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ServiceActionNameVocab is the default MAEC vocabulary for service action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For service action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    + + + + + 
    Deprecated as of MAEC 4.1.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:ServiceActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ServiceActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with services or daemons.
    +
    +
    + + + + + 
    Deprecated as of MAEC 4.1.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationcreate service +
    + + + + + 
    The 'create service' value specifies the defined action of creating a new service.
    +
    +
    enumerationdelete service +
    + + + + + 
    The 'delete service' value specifies the defined action of deleting an existing service.
    +
    +
    enumerationstart service +
    + + + + + 
    The 'start service' value specifies the defined action of starting an existing service.
    +
    +
    enumerationenumerate services +
    + + + + + 
    The 'enumerate services' value specifies the defined action of enumerating a specific set of services on a system.
    +
    +
    enumerationmodify service configuration +
    + + + + + 
    The 'modify service configuration' value specifies the defined action of modifying the configuration parameters of an existing service.
    +
    +
    enumerationopen service +
    + + + + + 
    The 'open service' value specifies the defined action of opening an existing service.
    +
    +
    enumerationsend control code to service +
    + + + + + 
    The 'send control code to service' value specifies the defined action of sending a control code to an existing service.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:ServiceActionNameVocab-1.1
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ServiceActionNameVocab is the default MAEC vocabulary for service action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For service action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    + + + + + 
    Starting with MAEC 4.1, it should be used in place of the deprecated ServiceActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:ServiceActionNameEnum-1.1
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ServiceActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with services or daemons.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationcreate service +
    + + + + + 
    The 'create service' value specifies the defined action of creating a new service.
    +
    +
    enumerationdelete service +
    + + + + + 
    The 'delete service' value specifies the defined action of deleting an existing service.
    +
    +
    enumerationstart service +
    + + + + + 
    The 'start service' value specifies the defined action of starting an existing service.
    +
    +
    enumerationstop service +
    + + + + + 
    The 'stop service' value specifies the defined action of stopping an existing service.
    +
    +
    enumerationenumerate services +
    + + + + + 
    The 'enumerate services' value specifies the defined action of enumerating a specific set of services on a system.
    +
    +
    enumerationmodify service configuration +
    + + + + + 
    The 'modify service configuration' value specifies the defined action of modifying the configuration parameters of an existing service.
    +
    +
    enumerationopen service +
    + + + + + 
    The 'open service' value specifies the defined action of opening an existing service.
    +
    +
    enumerationsend control code to service +
    + + + + + 
    The 'send control code to service' value specifies the defined action of sending a control code to an existing service.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:SynchronizationActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SynchronizationActionNameVocab is the default MAEC vocabulary for synchronization action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For synchronization action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:SynchronizationActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SynchronizationActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with process and thread synchronization-related entities.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationcreate mutex +
    + + + + + 
    The 'create mutex' value specifies the defined action of creating a new named mutex.
    +
    +
    enumerationdelete mutex +
    + + + + + 
    The 'delete mutex' value specifies the defined action of deleting an existing named mutex.
    +
    +
    enumerationopen mutex +
    + + + + + 
    The 'open mutex' value specifies the defined action of opening an existing named mutex.
    +
    +
    enumerationrelease mutex +
    + + + + + 
    The 'release mutex' value specifies the defined action of releasing ownership of an existing named mutex.
    +
    +
    enumerationcreate semaphore +
    + + + + + 
    The 'create semaphore' value specifies the defined action of creating a new named semaphore.
    +
    +
    enumerationdelete semaphore +
    + + + + + 
    The 'delete semaphore' value specifies the defined action of deleting an existing named semaphore.
    +
    +
    enumerationopen semaphore +
    + + + + + 
    The 'open semaphore' value specifies the defined action of opening an existing named semaphore.
    +
    +
    enumerationrelease semaphore +
    + + + + + 
    The 'release semaphore' value specifies the defined action of releasing ownership of an existing named semaphore.
    +
    +
    enumerationcreate event +
    + + + + + 
    The 'create event' value specifies the defined action of creating a new named event object.
    +
    +
    enumerationdelete event +
    + + + + + 
    The 'delete event' value specifies the defined action of deleting an existing named event object.
    +
    +
    enumerationopen event +
    + + + + + 
    The 'open event' value specifies the defined action of opening an existing named event object.
    +
    +
    enumerationreset event +
    + + + + + 
    The 'reset event' value specifies the defined action of resetting an existing named event object to the non-signaled state.
    +
    +
    enumerationcreate critical section +
    + + + + + 
    The 'create critical section' value specifies the defined action of creating a new critical section.
    +
    +
    enumerationdelete critical section +
    + + + + + 
    The 'delete critical section' value specifies the defined action of deleting an existing critical section object.
    +
    +
    enumerationopen critical section +
    + + + + + 
    The 'open critical section' value specifies the defined action of opening an existing critical section object.
    +
    +
    enumerationrelease critical section +
    + + + + + 
    The 'release critical section' value specifies the defined action of releasing an existing critical section object.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:SystemActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SystemActionNameVocab is the default MAEC vocabulary for system action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For system action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:SystemActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SystemInfoActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with system-related entities.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationadd scheduled task +
    + + + + + 
    The 'add scheduled task' value specifies the defined action of adding a scheduled task to a system.
    +
    +
    enumerationshutdown system +
    + + + + + 
    The 'shutdown system' value specifies the defined action of shutting down a system.
    +
    +
    enumerationsleep system +
    + + + + + 
    The 'sleep system' value specifies the defined action of sleeping a system for some period of time.
    +
    +
    enumerationget elapsed system up time +
    + + + + + 
    The 'get elapsed system up time' value specifies the defined action of getting the elapsed up-time for a system.
    +
    +
    enumerationget netbios name +
    + + + + + 
    The 'get netbios name' value specifies the defined action of getting the NetBIOS name of a system.
    +
    +
    enumerationset netbios name +
    + + + + + 
    The 'set netbios name' value specifies the defined action of setting the NetBIOS name of a system.
    +
    +
    enumerationget system host name +
    + + + + + 
    The 'get system host name' value specifies the defined action of getting the host name of a system.
    +
    +
    enumerationset system host name +
    + + + + + 
    The 'set system host name' value specifies the defined action of setting the system host name of a system.
    +
    +
    enumerationget system time +
    + + + + + 
    The 'get system time' value specifies the defined action of getting the system time of a system, represented in Coordinated Universal Time (UTC).
    +
    +
    enumerationset system time +
    + + + + + 
    The 'set system time' value specifies the defined action of setting the system time for a system, represented in Coordinated Universal Time (UTC).
    +
    +
    enumerationget system local time +
    + + + + + 
    The 'get system local time' value specifies the defined action of getting the local time of a system.
    +
    +
    enumerationset system local time +
    + + + + + 
    The 'set system local time' value specifies the defined action of setting the local time of a system.
    +
    +
    enumerationget username +
    + + + + + 
    The 'get username' value specifies the defined action of getting the username of the currently logged in user of a system.
    +
    +
    enumerationenumerate system handles +
    + + + + + 
    The 'enumerate system handles' value specifies the defined action of enumerating all open handles on a system.
    +
    +
    enumerationget system global flags +
    + + + + + 
    The 'get system global flags' value specifies the defined action of getting the enabled global flags on a system.
    +
    +
    enumerationset system global flags +
    + + + + + 
    The 'set system global flags' value specifies the defined action of setting system global flags on a system.
    +
    +
    enumerationget windows directory +
    + + + + + 
    The 'get windows directory' value specifies the defined action of getting the Windows installation directory on a system.
    +
    +
    enumerationget windows system directory +
    + + + + + 
    The 'get windows system directory' value specifies the defined action of getting the Windows \System directory on a system.
    +
    +
    enumerationget windows temporary files directory +
    + + + + + 
    The 'get windows temporary files directory' value specifies the defined action of getting the Windows Temporary Files Directory on a System.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:GUIActionNameVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The GUIActionNameVocab is the default MAEC vocabulary for GUI action names, captured via the ActionType/Name element in CybOX Core.
    +
    +
    + + + + + 
    For GUI action names, it should be used in place of the CybOX ActionNameVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:GUIActionNameEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The GUIActionNameEnum is a (non-exhaustive) enumeration of the different actions associated with graphical user interfaces (GUIs).
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationcreate window +
    + + + + + 
    The 'create window' value specifies the defined action of creating a new window.
    +
    +
    enumerationkill window +
    + + + + + 
    The 'kill window' value specifies the defined action of killing an existing window.
    +
    +
    enumerationcreate dialog box +
    + + + + + 
    The 'create dialog box' value specifies the defined action of creating a new dialog box.
    +
    +
    enumerationenumerate windows +
    + + + + + 
    The 'enumerate windows' value specifies the defined action of enumerating all open windows.
    +
    +
    enumerationfind window +
    + + + + + 
    The 'find window' value specifies the defined action of search for a particular window.
    +
    +
    enumerationhide window +
    + + + + + 
    The 'hide window' value specifies the defined action of hiding an existing window.
    +
    +
    enumerationshow window +
    + + + + + 
    The 'show window' value specifies the defined action of showing an existing window.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:GroupingRelationshipTypeVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The GroupingRelationshipTypeVocab is the default MAEC vocabulary for the grouping relatonships in a Package, captured via the GroupingRelationshipType/Type element in the MAEC Package.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:GroupingRelationshipEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The GroupingRelationshipEnum is a non-exhaustive enumeration of Malware Subject grouping relationships.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationsame malware family +
    + + + + + 
    The 'same malware family' value indicates that the Malware Subjects in the Package are all part of the same malware family.
    +
    +
    enumerationclustered together +
    + + + + + 
    The 'clustered together' value indicates that the Malware Subjects in the Package were clustered together by some algorithm or other capability.
    +
    +
    enumerationobserved together +
    + + + + + 
    The 'observed together' value indicates that the Malware Subjects in the Package were abstractly observed together, such as on a host system, in some archive, etc.
    +
    +
    enumerationpart of intrusion set +
    + + + + + 
    The 'part of intrusion' set value indicates that the Malware Subjects in the Package were found as part of the same malware intrusion set.
    +
    +
    enumerationsame malware toolkit +
    + + + + + 
    The 'same malware toolkit' value indicates that the Malware Subjects in the Package were all created using the same malware toolkit, independent of toolkit version.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:MalwareConfigurationParameterVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareConfigurationParameterVocab is the default MAEC vocabulary for malware configuration parameter names, captured via the MalwareConfigurationParameterType/Name element in the MAEC Package.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:MalwareConfigurationParameterEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareConfigurationParameterEnum is a non-exhaustive enumeration of malware configuration parameter names.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationmagic number +
    + + + + + 
    The 'magic number' value refers to a configuration parameter that captures a file signature that may be used to identify or validate the content the malware instance.
    +
    +
    enumerationid +
    + + + + + 
    The 'id' value refers to a configuration parameter that captures an identifier for the malware instance.
    +
    +
    enumerationgroup id +
    + + + + + 
    The 'group id' value refers to a configuration parameter that captures an identifier for a collection of malware instances.
    +
    +
    enumerationmutex +
    + + + + + 
    The 'mutex' value refers to a configuration parameter that captures a unique mutex value associated the malware instance.
    +
    +
    enumerationfilename +
    + + + + + 
    The 'filename' value refers to a configuration parameter that captures the name of a malicious binary such as one that is downloaded or embedded within the malware instance.
    +
    +
    enumerationinstallation path +
    + + + + + 
    The 'installation path' value refers to a configuration parameter that captures a location on disk to which the malware instance is installed, copied, or moved.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:MalwareSubjectRelationshipTypeVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareSubjectRelationshipTypeVocab is the default MAEC vocabulary for the Malware Subject relationships in a Package, captured via the MalwareSubjectRelationshipType/Type element in the MAEC Package.
    +
    +
    + + + + + 
    Deprecated as of MAEC 4.1.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:MalwareSubjectRelationshipEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareSubjectRelationshipEnum is a non-exhaustive enumeration of relationships between Malware Subjects.
    +
    +
    + + + + + 
    Deprecated as of MAEC 4.1.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationdownloads +
    + + + + + 
    The 'downloads' value specifies that the Malware Subject downloads one or more other Malware Subject(s).
    +
    +
    enumerationdownloaded by +
    + + + + + 
    The 'downloaded by' value specifies that the current Malware Subject was downloaded by one or more other Malware Subject(s).
    +
    +
    enumerationdrops +
    + + + + + 
    The 'drops' value specifies that the Malware Subject drops (or writes to disk) one or more other Malware Subject(s).
    +
    +
    enumerationdropped by +
    + + + + + 
    The 'dropped by' value specifies that the current Malware Subject was dropped (or written to disk) by one or more other Malware Subject(s).
    +
    +
    enumerationextracts +
    + + + + + 
    The 'extracts' value specifies that the Malware Subject extracts (from an embedded archive or another container) one or more other Malware Subject(s).
    +
    +
    enumerationextracted from +
    + + + + + 
    The 'extracted from' value specifies that the current Malware Subject was extracted from one or more other Malware Subject(s).
    +
    +
    +
    +
    +
    Complex Type maecVocabs:MalwareSubjectRelationshipTypeVocab-1.1
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareSubjectRelationshipTypeVocab is the default MAEC vocabulary for the Malware Subject relationships in a Package, captured via the MalwareSubjectRelationshipType/Type element in the MAEC Package.
    +
    +
    + + + + + 
    Starting with MAEC 4.1, this vocabulary should be used in place of the deprecated MalwareSubjectRelationshipTypeVocab-1.0.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:MalwareSubjectRelationshipEnum-1.1
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareSubjectRelationshipEnum is a non-exhaustive enumeration of relationships between Malware Subjects.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationdownloads +
    + + + + + 
    The 'downloads' value specifies that the Malware Subject downloads one or more other Malware Subject(s).
    +
    +
    enumerationdownloaded by +
    + + + + + 
    The 'downloaded by' value specifies that the current Malware Subject was downloaded by one or more other Malware Subject(s).
    +
    +
    enumerationdrops +
    + + + + + 
    The 'drops' value specifies that the Malware Subject drops (or writes to disk) one or more other Malware Subject(s).
    +
    +
    enumerationdropped by +
    + + + + + 
    The 'dropped by' value specifies that the current Malware Subject was dropped (or written to disk) by one or more other Malware Subject(s).
    +
    +
    enumerationextracts +
    + + + + + 
    The 'extracts' value specifies that the Malware Subject extracts (from an embedded archive or another container) one or more other Malware Subject(s).
    +
    +
    enumerationextracted from +
    + + + + + 
    The 'extracted from' value specifies that the current Malware Subject was extracted from one or more other Malware Subject(s).
    +
    +
    enumerationdirect descendant of +
    + + + + + 
    The 'direct descendant of' value specifies that the current Malware Subject is a direct descendant (i.e. in terms of development lineage) of one or more other Malware Subject(s).
    +
    +
    enumerationdirect ancestor of +
    + + + + + 
    The 'direct ancestor of' value specifies that the current Malware Subject is a direct ancestor (i.e. in terms of development lineage) of one or more other Malware Subject(s).
    +
    +
    enumerationmemory image of +
    + + + + + 
    The 'memory image of' value specifies that the current Malware Subject represents a memory image associated with one or more other Malware Subject(s).
    +
    +
    enumerationcontained in memory image +
    + + + + + 
    The 'contained in memory image' value specifies that the current Malware Subject is a malware binary or component contained in one or more other Malware Subject(s) that represent memory images.
    +
    +
    enumerationdisk image of +
    + + + + + 
    The 'disk image of' value specifies that the current Malware Subject represents a disk image associated with one or more other Malware Subject(s).
    +
    +
    enumerationcontained in disk image +
    + + + + + 
    The 'contained in disk image' value specifies that the current Malware Subject is a malware binary or component contained in one or more other Malware Subject(s) that represent disk images.
    +
    +
    enumerationnetwork traffic capture of +
    + + + + + 
    The 'network traffic capture of' value specifies that the current Malware Subject represents captured network traffic associated with one or more other Malware Subject(s).
    +
    +
    enumerationcontained in network traffic capture +
    + + + + + 
    The 'contained in network traffic capture' value specifies that the current Malware Subject is a malware binary or component contained in one or more other Malware Subject(s) that represent captures of network traffic.
    +
    +
    enumerationpacked version of +
    + + + + + 
    The 'packed version of' value specifies that the current Malware Subject represents a packed version (in terms of executable binary packing) of one or more other Malware Subject(s).
    +
    +
    enumerationunpacked version of +
    + + + + + 
    The 'unpacked version of' value specifies that the current Malware Subject represents an unpacked version (in terms of executable binary packing) of one or more other Malware Subject(s).
    +
    +
    enumerationinstalls +
    + + + + + 
    The 'installs' value specifies that the current Malware Subject installs one or more other Malware Subject(s).
    +
    +
    enumerationinstalled by +
    + + + + + 
    The 'installed by' value specifies that the current Malware Subject is installed by one or more other Malware Subject(s).
    +
    +
    enumeration64-bit version of +
    + + + + + 
    The '64-bit version of' value specifies that the current Malware Subject is a 64-bit version of one or more other Malware Subject(s).
    +
    +
    enumeration32-bit version of +
    + + + + + 
    The '32-bit version of' value specifies that the current Malware Subject is a 32-bit version of one or more other Malware Subject(s).
    +
    +
    enumerationencrypted version of +
    + + + + + 
    The 'encrypted version of' value specifies that the current Malware Subject is an encrypted version of one or more other Malware Subject(s).
    +
    +
    enumerationdecrypted version of +
    + + + + + 
    The 'decrypted version of' value specifies that the current Malware Subject is a decrypted version of one or more other Malware Subject(s).
    +
    +
    +
    +
    +
    Complex Type maecVocabs:MalwareDevelopmentToolVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareDevelopmentToolVocab is the default MAEC vocabulary for the Type field in the CybOX ToolInformationType, as used in the Development_Environment/Tools/Tool field in the Malware Subject.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:MalwareDevelopmentToolEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The GroupingRelationshipEnum is a non-exhaustive enumeration tools used in the development of malware.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationbuilder +
    + + + + + 
    The 'builder' value specifies a malware builder tool (commonly used to mass-produce malware) that was used to generate the malware instance.
    +
    +
    enumerationcompiler +
    + + + + + 
    The 'compiler' value specifies a compiler tool that was used to compile the code composing the malware instance.
    +
    +
    enumerationlinker +
    + + + + + 
    The 'linker' value specifies a linker tool that was used to link the object files associated with the malware instance.
    +
    +
    enumerationpacker +
    + + + + + 
    The 'packer' value specifies a packer tool that was used to shrink the size of the executable binary associated with the malware instance. Packers are also sometimes referred to as 'compressors'.
    +
    +
    enumerationcrypter +
    + + + + + 
    The 'crypter' value specifies a crypter tool that was used to encrypt the executable binary associated with the malware instance.
    +
    +
    enumerationprotector +
    + + + + + 
    The 'protector' value specifies a protector tool that was used to obfuscate the executable binary associated with the malware instance to make it more difficult to reverse engineer.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:MalwareLabelVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareLabelVocab-1.0 is the default MAEC Vocabulary for common malware labels.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:MalwareLabelEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareLabelEnum-1.0 is a non-exhaustive enumeration of common malware labels.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationadware +
    + + + + + 
    The 'adware' value specifies any software that is funded by advertising. Some adware may install itself in such a manner as to become difficult to remove, hiding components and disabling removal techniques. Adware may also gather sensitive user information from a system.
    +
    +
    enumerationappender +
    + + + + + 
    The 'appender' value specifies a file-infecting virus that places its code at the end of the files it infects, adjusting the file's entry point to cause its code to be executed before that of the original file.
    +
    +
    enumerationbackdoor +
    + + + + + 
    The 'backdoor' value specifies a piece of software which, once running on a system, opens a communication vector to the outside so that the computer can be accessed remotely by an attacker.
    +
    +
    enumerationboot sector virus +
    + + + + + 
    The 'boot sector virus' value specifies a virus that infects the master boot record of a storage device.
    +
    +
    enumerationbot +
    + + + + + 
    The 'bot' value specifies a program which resides on an infected system, communicating with and forming part of a botnet. The bot may be implanted by a worm or trojan, which opens a backdoor. The bot then monitors the backdoor for further instructions.
    +
    +
    enumerationclicker +
    + + + + + 
    The 'clicker' value specifies a trojan that makes a system visit a specific web page, often very frequently and usually with the aim of increasing the traffic recorded by the site and thus increasing revenue from advertising. Clickers may also be used to carry out DDoS attacks.
    +
    +
    enumerationcompanion virus +
    + + + + + 
    The 'companion virus' value specifies a virus that takes the place of a particular file on a system instead of injecting code into it.
    +
    +
    enumerationcavity filler +
    + + + + + 
    The 'cavity filler' value specifies a type of file-infecting virus which seeks out unused space within the files it infects, inserting its code into these gaps to avoid changing the size of the file and thus not alerting integrity-checking software to its presence.
    +
    +
    enumerationdata diddler +
    + + + + + 
    The 'data diddler' value specifies a type of malware that makes small, random changes to data, such as data in a spreadsheet, to render the data contained in a document inaccurate and in some cases worthless.
    +
    +
    enumerationdownloader +
    + + + + + 
    The 'downloader' value specifies a small trojan file programmed to download and execute other files, usually more complex malware.
    +
    +
    enumerationdropper file +
    + + + + + 
    The 'dropper file' value specifies a type of Trojan that deposits an enclosed payload onto a destination host computer by loading itself into memory, extracting the malicious payload, and then writing it to the file system.
    +
    +
    enumerationfile infector virus +
    + + + + + 
    The 'file infector virus' value specifies a virus that infects a system by inserting itself somewhere in existing files; this is the "classic" form of virus.
    +
    +
    enumerationfork bomb +
    + + + + + 
    The 'fork bomb' value specifies a very simple form of malware, a type of rabbit which simply launches more copies of itself. Once a fork bomb is executed, it will attempt to run several identical processes, which will do the same, the number growing exponentially until the system resources are overwhelmed by the number of identical processes running, which may in some cases bring the system down and cause a denial of service.
    +
    +
    enumerationgreyware +
    + + + + + 
    The 'greyware' value specifies software that, while not definitely malicious, has a suspicious or potentially unwanted aspect.
    +
    +
    enumerationimplant +
    + + + + + 
    The 'implant' value specifies code inserted into an existing program using a code patcher or other tool.
    +
    +
    enumerationinfector +
    + + + + + 
    The 'infector' value specifies a function of malware that alters target files for the purpose of persisting and hiding the injected malware.
    +
    +
    enumerationkeylogger +
    + + + + + 
    The 'keylogger' value specifies a type of program implanted on a system to monitor the keys pressed and thus record any sensitive data, such as passwords, entered by the user.
    +
    +
    enumerationkleptographic worm +
    + + + + + 
    The 'kleptographic worm' value specifies a worm that encrypts information assets on compromised systems so they can only be decrypted by the worm's author, also known as information-stealing worm.
    +
    +
    enumerationmacro virus +
    + + + + + 
    The 'macro virus' value specifies a virus that uses a macro language, for example in Microsoft Office documents.
    +
    +
    enumerationmalcode +
    + + + + + 
    The 'malcode' value is short for malicious code, also known as malware.
    +
    +
    enumerationmass-mailer +
    + + + + + 
    The 'mass-mailer' value specifies a worm that uses email to propagate across the internet.
    +
    +
    enumerationmetamorphic virus +
    + + + + + 
    The 'metamorphic virus' value specifies a virus that changes its own code with each infection.
    +
    +
    enumerationmid-infector +
    + + + + + 
    The 'mid-infector' value specifies a type of file-infecting virus which places its code in the middle of files it infects. It may move a section of the original code to the end of the file, or simply push the code aside to make space for its own code.
    +
    +
    enumerationmobile code +
    + + + + + 
    The 'mobile code' value specifies 1. Code received from remote, possibly untrusted systems, but executed on a local system. 2. Software transferred between systems (e.g across a network) and executed on a local system without explicit installation or execution by the recipient.
    +
    +
    enumerationmultipartite virus +
    + + + + + 
    The 'multipartite virus' value specifies malware that infects boot records, boot sectors, and files.
    +
    +
    enumerationpassword stealer +
    + + + + + 
    The 'password stealer' value specifies a type of trojan designed to steal passwords, personal data and details, or other sensitive information from the infected system.
    +
    +
    enumerationpolymorphic virus +
    + + + + + 
    The 'polymorphic virus' value specifies a type of virus that encrypts its code differently with each infection, or generation of infections.
    +
    +
    enumerationpremium dialer/smser +
    + + + + + 
    The 'premium dialer/smser' value specifies a piece of malware whose primary aim is to dial or send SMS messages to premium rate numbers..
    +
    +
    enumerationprepender +
    + + + + + 
    The 'prepender' value specifies a file-infecting virus which inserts code at the beginning of the files it infects.
    +
    +
    enumerationransomware +
    + + + + + 
    The 'ransomware' value specifies a type of malware that encrypts files on a victim's system, demanding payment of ransom in return for the access codes required to unlock files.
    +
    +
    enumerationrat +
    + + + + + 
    The 'rat' value specifies a remote access trojan or RAT, which is a trojan horse capable of controlling a machine through commands issue by a remote attacker.
    +
    +
    enumerationrogue anti-malware +
    + + + + + 
    The 'rogue anti-malware' value specifies a fake security product that demands money to clean phony infections.
    +
    +
    enumerationrootkit +
    + + + + + 
    The 'rootkit' value generally refers to a method of hiding files or processes from normal methods of monitoring, and is often used by malware to conceal its presence and activities. Originally, the term applied to UNIX-based operating systems - a root kit was a collection of tools to enable a user to obtain root (administrator-level) access to a system and conceal any changes they might make. Such tools often included trojanized versions of standard monitoring software which would hide the root kit operators' activities. More recently the term has generally been applied to malware using stealth techniques. Rootkits can operate at a number of levels, from the application level - simply replacing or adjusting the settings of system software to prevent the display of certain information - through hooking certain functions or inserting modules or drivers into the operating system kernel, to the deeper level of firmware or virtualization rook kits, which are activated before the operating system and thus even harder to detect while the system is running.
    +
    +
    enumerationshellcode +
    + + + + + 
    The 'shellcode' value specifies 1. A small piece of code that activates a command-line interface to a system that can be used to disable security measures, open a backdoor, or download further malicious code. 2. A small piece of code that opens a system up for exploitation, sometimes by not necessarily involving a command-line shell.
    +
    +
    enumerationspaghetti packer +
    + + + + + 
    A packer that obfuscates programs by emitting "spaghetti" code with a complex and tangled control structure.
    +
    +
    enumerationspyware +
    + + + + + 
    The 'spyware' value specifies software that gathers information and passes it to a third-party without adequate permission from the owner of the data. It may also be used in a wider sense, to include software that makes changes to a system or any of its component software, or which makes use of system resources without the full understanding and consent of the system owner.
    +
    +
    enumerationtrojan horse +
    + + + + + 
    The 'trojan horse' value specifies a piece of malicious code disguised as something inert or benign.
    +
    +
    enumerationvariant +
    + + + + + 
    The 'variant' value refers to the fact that types of malware can be subdivided into a number of families, or groups sharing many similarities, generally based on the same blocks of code and sharing similar behaviours. Within a family, a variant signifies a single individual item that is uniquely different from other members of the same family.
    +
    +
    enumerationvirus +
    + + + + + 
    The 'virus' value specifies 1. A self-replicating malicious program that requires human interaction to replicate. 2. A self-replicating program that runs and spreads by modifying other programs or files.
    +
    +
    enumerationwabbit +
    + + + + + 
    The 'wabbit' value specifies a form of self-replicating malware that makes copies of itself on the local system. Unlike worms, rabbits do not attempt to spread across networks.
    +
    +
    enumerationweb bug +
    + + + + + 
    The 'web bug' value specifies a piece of code, generally a small file such as a tiny, transparent GIF image, which is used to track data on those viewing the page or mail in which it is hidden.
    +
    +
    enumerationwiper +
    + + + + + 
    The 'wiper' value specifies a piece of malware whose primary aim is to delete files or entire disks on a machine.
    +
    +
    enumerationworm +
    + + + + + 
    The 'worm' value specifies 1. A self-replicating malicious program that replicates using a network and does not require human interaction. 2. A self-replicating, self-propagating, self-contained program that uses networking mechanisms to spread itself.
    +
    +
    enumerationzip bomb +
    + + + + + 
    The 'zip bomb' value specifies a file compressed into some archive format and that expands to an enormous size when uncompressed, often by looping over the extraction code until the system's resources are exhausted.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:CapabilityObjectiveRelationshipTypeVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CapabilityObjectiveRelationshipTypeVocab is the default MAEC vocabulary for relationships between Malware Capability Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:CapabilityObjectiveRelationshipEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CapabilityObjectiveRelationshipEnum is a non-exhaustive enumeration of relationships between Malware Capability Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    enumerationchild of +
    + + + + + 
    The 'child of' value indicates that the Objective is a child of the Objective being referenced.
    +
    +
    enumerationparent of +
    + + + + + 
    The 'parent of' value indicates that the Objective is a parent of the Objective being referenced.
    +
    +
    enumerationincorporates +
    + + + + + 
    The 'incorporates' value indicates that the Objective incorporates the Objective being referenced in a supporting or enabling role.
    +
    +
    enumerationincorporated by +
    + + + + + 
    The 'incorporated by' value indicates that the Objective is incorporated in a supporting or enabling role by the Objective being referenced.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:AntiBehavioralAnalysisPropertiesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AntiBehavioralAnalysisPropertiesVocab-1.0 is the default MAEC Vocabulary for Anti-Behavioral Analysis Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:AntiBehavioralAnalysisPropertiesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AntiBehavioralAnalysisStrategicObjectivesEnum-1.0 is an enumeration of Anti-Behavioral Analysis Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + +
    enumerationtargeted vm +
    + + + + + 
    The 'targeted vm' value refers to the name of a virtual machine (VM) targeted by the Anti-Behavioral Analysis Capability or one of its child Objectives.
    +
    +
    enumerationtargeted sandbox +
    + + + + + 
    The 'targeted sandbox' value refers to the name of a sandbox targeted by the Anti-Behavioral Analysis Capability or one of its child Objectives.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:InfectionPropagationPropertiesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The InfectionPropagationPropertiesVocab-1.0 is the default MAEC Vocabulary for Infection/Propagation Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:InfectionPropagationPropertiesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The InfectionPropagationPropertiesEnum-1.0 is an enumeration of Infection/Propagation Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationscope +
    + + + + + 
    The 'scope' value refers to the scope of the infection or propagation performed by the malware instance via the Infection/Propagation Capability, i.e. whether it infects just the local machine or actively propagates to other machines as well.
    +
    +
    enumerationinfection targeting +
    + + + + + 
    The 'targeting' value refers to the type of targeting employed by the Infect Remote Machine Strategic Objective, i.e. whether the targeted machines are randomly selected, or chosen from some particular set.
    +
    +
    enumerationautonomy +
    + + + + + 
    The 'autonomy' value refers to the type of autonomy emplyed by the Infect Remote Machine Strategic Objective, i.e. whether the remote infection is performed autonomously.
    +
    +
    enumerationtargeted file type +
    + + + + + 
    The 'targeted file type' value refers to the types of files targeted by the Infect File Strategic Objective.
    +
    +
    enumerationtargeted file architecture type +
    + + + + + 
    The 'targeted file architecture' value refers to type of file architecture targeted by the Infect File Strategic Objective.
    +
    +
    enumerationfile infection type +
    + + + + + 
    The 'file infection type' value refers to the type of file infection employed by the Infect File Strategic Objective.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:DataTheftPropertiesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DataTheftPropertiesVocab-1.0 is the default MAEC Vocabulary for Data Theft Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:DataTheftPropertiesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DataTheftPropertiesEnum-1.0 is an enumeration of Data Theft Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + +
    enumerationtargeted application +
    + + + + + 
    The 'targeted application' value refers to the name of an application targeted by the Steal Authentication Credentials Strategic Objective.
    +
    +
    enumerationtargeted website +
    + + + + + 
    The 'targeted website' value refers to the domain name of a website targeted by the Steal Web/Network Credential Tactical Objective.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:CommandandControlPropertiesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CommandandControlPropertiesVocab-1.0 is the default MAEC Vocabulary for Command and Control Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:CommandandControlPropertiesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CommandandControlPropertiesEnum-1.0 is an enumeration of Command and Control Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + +
    enumerationfrequency +
    + + + + + 
    The 'frequency' value refers to a description of the frequency that the Receive Data from C2 Server and Send Data to C2 Server Strategic Objectives, as well as their child Tactical Objectives, are employed.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:PrivilegeEscalationPropertiesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The PrivilegeEscalationPropertiesVocab-1.0 is the default MAEC Vocabulary for Privilege Escalation Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:PrivilegeEscalationPropertiesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The PrivilegeEscalationPropertiesEnum-1.0 is an enumeration of Privilege Escalation Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + +
    enumerationuser privilege escalation type +
    + + + + + 
    The 'user privilege escalation type' value refers to the type of user privilege escalation employed by the Escalate User Privilege Strategic Objective.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:PersistencePropertiesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The PrivilegeEscalationPropertiesVocab-1.0 is the default MAEC Vocabulary for Persistence Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:PersistencePropertiesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The PersistencePropertiesEnum-1.0 is an enumeration of Persistence Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + +
    enumerationscope +
    + + + + + 
    The 'scope' value refers to the scope of persistence employed by the Persistence Capability, i.e. whether the malware instance make itself persist, or whether it makes other malware components persist.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:DestructionPropertiesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DestructionPropertiesVocab-1.0 is the default MAEC Vocabulary for Destruction Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:DestructionPropertiesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DestructionPropertiesEnum-1.0 is an enumeration of Destruction Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + +
    enumerationerasure scope +
    + + + + + 
    The 'erasure scope' value refers to the scope of the erasure performed by the Erase Data Tactical Objective.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:SecurityDegradationPropertiesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SecurityDegradationPropertiesVocab-1.0 is the default MAEC Vocabulary for Security Degradation Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:SecurityDegradationPropertiesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SecurityDegradationPropertiesEnum-1.0 is an enumeration of Security Degradation Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + +
    enumerationtargeted program +
    + + + + + 
    The 'targeted program' value refers to the name of a program targeted by the Degrade Security Programs Strategic Objective or one of its child Tactical Objectives.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:SecondaryOperationPropertiesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SecondaryOperationPropertiesVocab-1.0 is the default MAEC Vocabulary for Secondary Operation Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:SecondaryOperationPropertiesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SecondaryOperationPropertiesEnum-1.0 is an enumeration of Secondary Operation Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + +
    enumerationtrigger type +
    + + + + + 
    The 'trigger type' value refers to a description of the trigger used to wake or terminate the malware instance in the Lie Dormant or Suicide Exit Strategic Objectives, respectively.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:MachineAccessControlPropertiesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MachineAccessControlPropertiesVocab-1.0 is the default MAEC Vocabulary for Machine Access/Control Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:MachineAccessControlPropertiesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MachineAccessControlPropertiesEnum-1.0 is an enumeration of Machine Access/Control Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + +
    enumerationbackdoor type +
    + + + + + 
    The 'backdoor type' value refers to the type of backdoor, e.g. reverse shell, employed by the Install Backdoor Strategic Objective.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:DataExfiltrationPropertiesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DataExfiltrationPropertiesVocab-1.0 is the default MAEC Vocabulary for Data Exfiltration Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:DataExfiltrationPropertiesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DataExfiltrationPropertiesEnum-1.0 is an enumeration of Data Exfiltration Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + +
    enumerationarchive type +
    + + + + + 
    The 'archive type' value refers to the name of the file archive format used in the Stage Data for Exfiltration Strategic Objective and/or its Package Data Tactical Objective.
    +
    +
    enumerationfile type +
    + + + + + 
    The 'file type' value refers to the name of the file format used for storing data to be exfiltrated as part of the Data Exfiltration Capability or its child Objectives.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:AvailabilityViolationPropertiesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AvailabilityViolationPropertiesVocab-1.0 is the default MAEC Vocabulary for Availability Violation Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:AvailabilityViolationPropertiesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AvailabilityViolationPropertiesEnum-1.0 is an enumeration of Availability Violation Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + +
    enumerationcryptocurrency type +
    + + + + + 
    The 'cryptocurrency type' value refers to the type of cryptocurrency targeted by the Mine for CryptoCurrency Strategic Objective.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:CommonCapabilityPropertiesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CommonCapabilityPropertiesVocab-1.0 is the a MAEC Vocabulary of properties common to many Capabilities and their child Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:CommonCapabilityPropertiesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CommonCapabilityPropertiesEnum-1.0 is an enumeration of properties common to many Capability/Strategic Objective/Tactical Objective Properties.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + +
    enumerationencryption algorithm +
    + + + + + 
    The 'encryption algorithm' value refers to the name of the encryption algorithm used in the Capability or Objective.
    +
    +
    enumerationprotocol used +
    + + + + + 
    The 'protocol used' value refers to the name of the network protocol used in the Capability or Objective.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:MalwareCapabilityVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareCapabilyVocab-1.0 is the default MAEC Vocabulary for Malware Capabilities.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:MalwareCapabilityEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareCapabilityEnum-1.0 is an enumeration of Malware Capabilities.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationcommand and control +
    + + + + + 
    The 'command and control' (C2) Capability indicates that the malware instance is able to receive and execute remotely submitted commands.
    +
    +
    enumerationremote machine manipulation +
    + + + + + 
    The 'remote machine manipulation' Capability indicates that the malware instance is able to manipulate or access other remote machines.
    +
    +
    enumerationprivilege escalation +
    + + + + + 
    The 'privilege escalation' Capability indicates that the malware instance is able to elevate the privileges under which it executes.
    +
    +
    enumerationdata theft +
    + + + + + 
    The 'data theft' Capability indicates that the malware instance is able to steal data from the system on which it executes. This includes data stored in some form, e.g. in a file, as well as data that may be entered into some application such as a web-browser.
    +
    +
    enumerationspying +
    + + + + + 
    The 'spying' Capability indicates that the malware instance is able to capture information from a system related to user or system activity (e.g., from a system's peripheral devices).
    +
    +
    enumerationsecondary operation +
    + + + + + 
    The 'secondary operation' Capability indicates that the malware instance is able to achieve secondary objectives in conjunction with or after achieving its primary objectives.
    +
    +
    enumerationanti-detection +
    + + + + + 
    The 'anti-detection' Capability indicates that the malware instance is able to prevent itself and its components from being detected on a system.
    +
    +
    enumerationanti-code analysis +
    + + + + + 
    The 'anti-code analysis' Capability indicates that the malware instance is able to prevent code analysis or make it more difficult.
    +
    +
    enumerationinfection/propagation +
    + + + + + 
    The 'infection/propagation' Capability indicates that the malware instance is able to propagate through the infection of a machine or is able to infect a file after executing on a system.  The malware instance may infect actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email).  This Capability does not encompass any aspects of the initial infection that is done independently of the malware instance itself.
    +
    +
    enumerationanti-behavioral analysis +
    + + + + + 
    The 'anti-behavioral analysis' Capability indicates that the malware instance is able to prevent behavioral analysis or make it more difficult.
    +
    +
    enumerationintegrity violation +
    + + + + + 
    The 'integrity violation' Capability indicates that the malware instance is able to compromise the integrity of a system.
    +
    +
    enumerationdata exfiltration +
    + + + + + 
    The 'data exfiltration' Capability indicates that the malware instance is able to exfiltrate stolen data or perform tasks related to the exfiltration of stolen data.
    +
    +
    enumerationprobing +
    + + + + + 
    The 'probing' Capability indicates that the malware instance is able to probe its host system or network environment; most often this is done to support other Capabilities and their Objectives.
    +
    +
    enumerationanti-removal +
    + + + + + 
    The 'anti-removal' Capability indicates that the malware instance is able to prevent itself and its components from being removed from a system.
    +
    +
    enumerationsecurity degradation +
    + + + + + 
    The �security degradation� Capability indicates that the malware instance is able to bypass or disable security features and/or controls.
    +
    +
    enumerationavailability violation +
    + + + + + 
    The 'availability violation' Capability indicates that the malware instance is able to compromise the availability of a system or some aspect of the system.
    +
    +
    enumerationdestruction +
    + + + + + 
    The 'destruction' Capability indicates that the malware instance is able to destroy some aspect of a system.
    +
    +
    enumerationfraud +
    + + + + + 
    The 'fraud' Capability indicates that the malware instance is able to defraud a user or a system.
    +
    +
    enumerationpersistence +
    + + + + + 
    The 'persistence' Capability indicates that the malware instance is able to persist and remain on a system regardless of system events.
    +
    +
    enumerationmachine access/control +
    + + + + + 
    The 'machine access/control' Capability indicates that the malware instance is able to provide the means to access or control the machine on which it is resident.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:CommandandControlStrategicObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CommandandControlStrategicObjectivesVocab-1.0 is the default MAEC Vocabulary for Command and Control Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:CommandandControlStrategicObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CommandandControlStrategicObjectivesEnum-1.0 is an enumeration of Command and Control Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + +
    enumerationdetermine c2 server +
    + + + + + 
    The 'determine c2 server' value indicates that the malware instance is able to identify one or more command and control (C2) servers with which to communicate.
    +
    +
    enumerationreceive data from c2 server +
    + + + + + 
    The 'control behavior' value indicates that the malware instance is able to control its behavior through some external stimulus (e.g., a remotely submitted command).
    +
    +
    enumerationsend data to c2 server +
    + + + + + 
    The 'send data to c2 server' value indicates that the malware instance is able to send some data to a command and control server.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:CommandandControlTacticalObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CommandandControlTacticalObjectivesVocab-1.0 is the default MAEC Vocabulary for Command and Control Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:CommandandControlTacticalObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CommandandControlTacticalObjectivesEnum-1.0 is an enumeration of Command and Control Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationcheck for payload +
    + + + + + 
    The 'check for payload' value indicates that the mawlare instance is able to query a command and control server to check whether a new malicious payload is available for download.
    +
    +
    enumerationvalidate data +
    + + + + + 
    The 'validate data' value indicates that the malware instance is able to validate the integrity of the data it receives from a command and control server.
    +
    +
    enumerationcontrol malware via remote command +
    + + + + + 
    The 'control malware via remote command' value indicates that the malware instance is able to execute commands issued to it from a remote source such as a command and control server, for the purpose of controlling its behavior.
    +
    +
    enumerationsend system information +
    + + + + + 
    The 'send system information' value indicates that the malware instance is able to send data regarding the system on which it is executing to a command and control server.
    +
    +
    enumerationsend heartbeat data +
    + + + + + 
    The 'send heartbeat data' value indicates that the malware instance is able to send heartbeat data to a command and control server, indicating that it is still active on the host system and able to communicate.
    +
    +
    enumerationgenerate c2 domain name(s) +
    + + + + + 
    The 'generate c2 domain name(s)' value indicates that the malware instance is able to generate the domain name of the command and control server to which it connects to.
    +
    +
    enumerationupdate configuration +
    + + + + + 
    The 'update configuration' value indicates that the malware instance is able to update its configuration using data received from a command and control server.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:RemoteMachineManipulationStrategicObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The RemoteMachineManipulationStrategicObjectivesVocab-1.0 is the default MAEC Vocabulary for Remote Machine Manipulation Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:RemoteMachineManipulationStrategicObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The RemoteMachineManipulationStrategicObjectivesEnum-1.0 is an enumeration of Remote Machine Manipulation Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + +
    enumerationaccess remote machine +
    + + + + + 
    The 'access remote machine' value indicates that the malware instance is able to access a remote machine.
    +
    +
    enumerationsearch for remote machines +
    + + + + + 
    The 'search' for remote machines' value indicates that the malware instance is able to search for remote machines to target.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:RemoteMachineManipulationTacticalObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The RemoteMachineManipulationTacticalObjectivesVocab-1.0 is the default MAEC Vocabulary for Remote Machine Manipulation Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:RemoteMachineManipulationTacticalObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The RemoteMachineManipulationTacticalObjectivesEnum-1.0 is an enumeration of Remote Machine Manipulation Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + +
    enumerationcompromise remote machine +
    + + + + + 
    The 'compromise remote machine' value indicates that the malware instance is able to gain control of a remote machine through compromise.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:PrivilegeEscalationStrategicObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The PrivilegeEscalationStrategicObjectivesVocab-1.0 is the default MAEC Vocabulary for Privilege Escalation Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:PrivilegeEscalationStrategicObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The PrivilegeEscalationStrategicObjectivesEnum-1.0 is an enumeration of Privilege Escalation Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + +
    enumerationimpersonate user +
    + + + + + 
    The 'impersonate user' value indicates that the malware instance is able to impersonate another user to operate within a different security context (also known as horizontal privilege escalation).
    +
    +
    enumerationescalate user privilege +
    + + + + + 
    The 'escalate user privilege' indicates that the malware instance is able to obtain a higher level of access than intended by the system (also known as vertical privilege escalation).
    +
    +
    +
    +
    +
    Complex Type maecVocabs:PrivilegeEscalationTacticalObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The PrivilegeEscalationTacticalObjectivesVocab-1.0 is the default MAEC Vocabulary for Privilege Escalation Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:PrivilegeEscalationTacticalObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The PrivilegeEscalationTacticalObjectivesEnum-1.0 is an enumeration of Privilege Escalation Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + +
    enumerationelevate cpu mode +
    + + + + + 
    The 'elevate cpu mode' value indicates that the malware instance is able to elevate the CPU (processor) mode under which it executes.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:DataTheftStrategicObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DataTheftStrategicObjectivesVocab-1.0 is the default MAEC Vocabulary for Data Theft Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:DataTheftStrategicObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DataTheftStrategicObjectivesEnum-1.0 is an enumeration of Data Theft Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    enumerationsteal stored information +
    + + + + + 
    The 'steal stored information' value indicates that the malware instance is able to steal information stored on a system (e.g., files).
    +
    +
    enumerationsteal user data +
    + + + + + 
    The 'steal user data' value indicates that the malware instance is able to steal user data (e.g., email).
    +
    +
    enumerationsteal system information +
    + + + + + 
    The 'steal system information' value indicates that the malware instance is able to steal information about a system (e.g., network address data).
    +
    +
    enumerationsteal authentication credentials +
    + + + + + 
    The 'steal authentication credentials' value indicates that the malware instance is able to steal authentication credentials.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:DataTheftTacticalObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DataTheftTacticalObjectivesVocab-1.0 is the default MAEC Vocabulary for Data Theft Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:DataTheftTacticalObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DataTheftTacticalObjectivesEnum-1.0 is an enumeration of Data Theft Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationsteal dialed phone numbers +
    + + + + + 
    The 'steal dialed phone numbers' value indicates that the malware instance is able to steal the list of phone numbers that a user has dialed.
    +
    +
    enumerationsteal email data +
    + + + + + 
    The 'steal email data' value indicates that the malware instance is able to steal a user's email data.
    +
    +
    enumerationsteal referrer urls +
    + + + + + 
    The 'steal referer urls' value indicates that the malware instance is able to steal HTTP referrer information (URL of the webpage that linked to the resource being requested).
    +
    +
    enumerationsteal cryptocurrency data +
    + + + + + 
    The 'steal cryptocurrency data' value indicates that the malware instance is able to steal cryptocurrency data (e.g., Bitcoin wallets).
    +
    +
    enumerationsteal pki software certificate +
    + + + + + 
    The 'steal pki software certificate' value indicates that the malware instance is able to steal one or more public key infrastructure (PKI) software certficates.
    +
    +
    enumerationsteal browser cache +
    + + + + + 
    The 'steal browser cache' value indicates that the malware instance is able to steal a user's browser cache.
    +
    +
    enumerationsteal serial numbers +
    + + + + + 
    The 'steal serial numbers' values indicates that the malware instance is able to steal serial numbers stored on a system.
    +
    +
    enumerationsteal sms database +
    + + + + + 
    The 'steal sms database' value indicates that the malware instance is able to steal a user's short message service (SMS) (text messaging) database.
    +
    +
    enumerationsteal cookie +
    + + + + + 
    The 'steal cookie' value indicates that the malware instance is able to steal cookies.
    +
    +
    enumerationsteal password hash +
    + + + + + 
    The 'steal password hashes' value indicates that the malware instance is able to steal password hashes.
    +
    +
    enumerationsteal make/model +
    + + + + + 
    The 'steal make/model' value indicates that the malware instance is able to steal the information on the make and/or model of a system.
    +
    +
    enumerationsteal documents +
    + + + + + 
    The 'steal documents' value indicates that the malware instance is able to steal document files stored on a system.
    +
    +
    enumerationsteal network address +
    + + + + + 
    The 'steal network address' value indicates that the malware instance is able to steal information about the network addresses used by a system.
    +
    +
    enumerationsteal open port +
    + + + + + 
    The 'steal open port' value indicates that the malware instance is able to steal information about the open ports on a system.
    +
    +
    enumerationsteal images +
    + + + + + 
    The 'steal images' value indicates that the malware instance is able to steal image files stored on a system.
    +
    +
    enumerationsteal browser history +
    + + + + + 
    The 'steal browser history' value indicates that the malware instance is able to steal a user's browser history.
    +
    +
    enumerationsteal web/network credential +
    + + + + + 
    The 'steal web/network credential' value indicates that the malware instance is able to steal usernames, passwords, or other forms of network credentials.
    +
    +
    enumerationsteal pki key +
    + + + + + 
    The 'steal pki key' value indicates that the malware instance is able to steal one or more public key infrastructure (PKI) keys.
    +
    +
    enumerationsteal contact list data +
    + + + + + 
    The 'steal contact list data' value indicates that the malware instance is able to steal a user's contact list.
    +
    +
    enumerationsteal database content +
    + + + + + 
    The 'steal database content' value indicates that the malware instance is able to steal database content.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:SpyingStrategicObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SpyingStrategicObjectivesVocab-1.0 is the default MAEC Vocabulary for Spying Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:SpyingStrategicObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SpyingStrategicObjectivesEnum-1.0 is an enumeration of Spying Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    enumerationcapture system input peripheral data +
    + + + + + 
    The 'capture system input peripheral data' value indicates that the malware instance is able to capture data from a system's input peripheral devices.
    +
    +
    enumerationcapture system state data +
    + + + + + 
    The 'capture system state data' value indicates that the malware instance is able to capture information about a system's state (e.g., from its RAM).
    +
    +
    enumerationcapture system interface data +
    + + + + + 
    The 'capture system interface data' value indicates that the malware instance is able to capture data from a system's interfaces.
    +
    +
    enumerationcapture system output peripheral data +
    + + + + + 
    The 'capture system output peripheral data' value indicates that the malware instance is able to capture data sent to a system's output peripheral devices.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:SpyingTacticalObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SpyingTacticalObjectivesVocab-1.0 is the default MAEC Vocabulary for Spying Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:SpyingTacticalObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SpyingTacticalObjectivesEnum-1.0 is an enumeration of Spying Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationcapture system screenshot +
    + + + + + 
    The 'capture system screenshot' value indicates that the malware instance is able to capture images of what is currently being displayed on a system's screen, either locally or remotely via a remote desktop protocol.
    +
    +
    enumerationcapture camera input +
    + + + + + 
    The 'capture camera input' value indicates that the malware instance is able to capture data from a system's camera.
    +
    +
    enumerationcapture file system +
    + + + + + 
    The 'capture file system' value indicates that the malware instance is able to capture data from a system's file system.
    +
    +
    enumerationcapture printer output +
    + + + + + 
    The 'capture printer output' value indicates that the malware instance is able to capture data sent to a system's printer.
    +
    +
    enumerationcapture gps data +
    + + + + + 
    The 'capture gps data' value indicates that the malware instance is able to capture system GPS data.
    +
    +
    enumerationcapture keyboard input +
    + + + + + 
    The 'capture keyboard input' value indicates that the malware instance is able to capture data from a system's keyboard.
    +
    +
    enumerationcapture mouse input +
    + + + + + 
    The 'capture mouse input' value indicates that the malware instance is able to capture data from a system's mouse.
    +
    +
    enumerationcapture microphone input +
    + + + + + 
    The 'capture microphone input' value indicates that the malware instance is able to capture data from a system's microphone.
    +
    +
    enumerationcapture system network traffic +
    + + + + + 
    The 'capture system network traffic' value indicates that the malware instance is able to capture system network traffic.
    +
    +
    enumerationcapture touchscreen input +
    + + + + + 
    The 'capture touchscreen input' value indicates that the malware instance is able to capture data from a system's touchscreen.
    +
    +
    enumerationcapture system memory +
    + + + + + 
    The 'capture system memory' value indicates that the malware instance is able to capture data from a system's RAM.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:SecondaryOperationStrategicObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SecondaryOperationStrategicObjectivesVocab-1.0 is the default MAEC Vocabulary for Secondary Operation Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:SecondaryOperationStrategicObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SecondaryOperationStrategicObjectivesEnum-1.0 is an enumeration of Secondary Operation Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationpatch operating system file(s) +
    + + + + + 
    The 'patch operating system file(s)' value indicates that the malware instance is able to patch or modify the critical system files of the operating system under which it executes.
    +
    +
    enumerationremove traces of infection +
    + + + + + 
    The 'remove traces of infection' value indicates that the malware instance is able to remove traces of its infection of a system.
    +
    +
    enumerationlog activity +
    + + + + + 
    The 'log activity' value indicates that the malware instance is able to log its own activity.
    +
    +
    enumerationlay dormant +
    + + + + + 
    The 'lay dormant' value indicates that the malware instance is able to lay dormant on a system for some period of time.
    +
    +
    enumerationinstall other components +
    + + + + + 
    The 'install other components' value indicates that the malware instance is able to install additional components.  This encompasses the dropping/downloading of other malicious components such as libraries, other malware, and tools.
    +
    +
    enumerationsuicide exit +
    + + + + + 
    The 'suicide exit' value indicates that the malware instance is able to terminate itself based on some condition or value.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:SecondaryOperationTacticalObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SecondaryOperationTacticalObjectivesVocab-1.0 is the default MAEC Vocabulary for Secondary Operation Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:SecondaryOperationTacticalObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SecondaryOperationTacticalObjectivesEnum-1.0 is an enumeration of Secondary Operation Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationinstall secondary module +
    + + + + + 
    The 'install secondary module' value indicates that the malware instance is able to install a secondary module (typically related to itself).
    +
    +
    enumerationinstall secondary malware +
    + + + + + 
    The 'install secondary malware' value indicates that the malware instance is able to install another malware instance.
    +
    +
    enumerationinstall legitimate software +
    + + + + + 
    The 'install legitimate software' value indicates that the malware instance is able to install legitimate software.
    +
    +
    enumerationremove self +
    + + + + + 
    The 'remove self' value indicates that the malware instance is able to remove itself from the system.
    +
    +
    enumerationremove system artifacts +
    + + + + + 
    The 'remove system artifacts' value indicates that the malware instance is able to remove its artifacts from a system.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:AntiDetectionStrategicObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AntiDetectionStrategicObjectivesVocab-1.0 is the default MAEC Vocabulary for Anti-Detection Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:AntiDetectionStrategicObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AntiDetectionStrategicObjectivesEnum-1.0 is an enumeration of Anti-Detection Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationsecurity software evasion +
    + + + + + 
    The 'security software evasion' value indicates that the malware instance is able to evade security software (e.g., anti-virus tools).
    +
    +
    enumerationhide executing code +
    + + + + + 
    The 'hide executing code' value indicates that the malware instance is able to hide its executing code.
    +
    +
    enumerationself-modification +
    + + + + + 
    The 'self-modification' value indicates that the malware instance is able to modify itself.
    +
    +
    enumerationanti-memory forensics +
    + + + + + 
    The 'anti-memory forensics' value indicates that the malware instance is able to prevent or make memory forensics more difficult.
    +
    +
    enumerationhide non-executing code +
    + + + + + 
    The 'hide non-executing code' value indicates that the malware instance is able to hide its non-executing code.
    +
    +
    enumerationhide malware artifacts +
    + + + + + 
    The 'hide malware artifacts' value indicates that the malware instance is able to hide its artifacts.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:AntiDetectionTacticalObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AntiDetectionTacticalObjectivesVocab-1.0 is the default MAEC Vocabulary for Anti-Detection Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:AntiDetectionTacticalObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AntiDetectionTacticalObjectivesEnum-1.0 is an enumeration of Anti-Detection Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationhide open network ports +
    + + + + + 
    The 'hide open network ports' value indicates that the malware instance is able to hide its open network ports.
    +
    +
    enumerationexecute before/external to kernel/hypervisor +
    + + + + + 
    The 'execute before/external to kernel/hypervisor' value indicates that the malware instance is able to execute some or all of its code before or external to the system's kernel or hypervisor (e.g., through the BIOS).
    +
    +
    enumerationencrypt self +
    + + + + + 
    The 'encrypt self' value indicates that the malware is able to encrypt itself.
    +
    +
    enumerationhide processes +
    + + + + + 
    The 'hide processes' value indicates that the malware instance is able to hide its processes.
    +
    +
    enumerationhide network traffic +
    + + + + + 
    The 'hide network traffic' value indicates that the malware instance is able to hide its network traffic.
    +
    +
    enumerationchange/add content +
    + + + + + 
    The 'change/add content' value indicates that the malware instance is able to change or add to its content.
    +
    +
    enumerationexecute stealthy code +
    + + + + + 
    The 'execute stealthy code' value indicates that the malware instance is able to execute some or all of its code in a hidden manner (e.g., by injecting it into a benign process).
    +
    +
    enumerationhide registry artifacts +
    + + + + + 
    The 'hide registry artifacts' value indicates that the malware instance is able to hide its Windows registry artifacts.
    +
    +
    enumerationhide userspace libraries +
    + + + + + 
    The 'hide userspace libraries' value indicates that the malware instance is able to hide its usage of userspace libraries.
    +
    +
    enumerationhide arbitrary virtual memory +
    + + + + + 
    The 'hide arbitrary virtual memory' value indicates that the malware instance is able to hide arbitrary virtual memory to prevent retrieval.
    +
    +
    enumerationexecute non-main cpu code +
    + + + + + 
    The 'execute non-main cpu code' value indicates that the malware instance is able to execute some or all of its code on a secondary, non CPU processor (e.g., a GPU).
    +
    +
    enumerationfeed misinformation during physical memory acquisition +
    + + + + + 
    The 'feed misinformation during physical memory acquisition' value indicates that the malware instance is able to report inaccurate data when the content of physical memory is retrieved.
    +
    +
    enumerationprevent physical memory acquisition +
    + + + + + 
    The 'prevent physical memory acquisition' value indicates that the malware instance is able to prevent the contents of a system's physical memory from being retrieved.
    +
    +
    enumerationprevent native api hooking +
    + + + + + 
    The 'prevent native api hooking' value indicates that the malware instance is able to prevent other software from hooking native APIs.
    +
    +
    enumerationobfuscate artifact properties +
    + + + + + 
    The 'obfuscate artifact properties' value indicates that the malware instance is able to hide the properties of its artifacts (e.g., by altering timestamps).
    +
    +
    enumerationhide kernel modules +
    + + + + + 
    The 'hide kernel modules' value indicates that the malware instance is able to hide its usage of kernel modules.
    +
    +
    enumerationhide code in file +
    + + + + + 
    The 'hide code in file' value indicates that the malware instance is able to hide its code in a file.
    +
    +
    enumerationhide services +
    + + + + + 
    The 'hide services' value indicates that the malware instance is able to hide any system services it creates or injects itself into.
    +
    +
    enumerationhide file system artifacts +
    + + + + + 
    The 'hide file system artifacts' value indicates that the malware instance is able to hide its file system artifacts.
    +
    +
    enumerationhide threads +
    + + + + + 
    The 'hide threads' value indicates that the malware instance is able to hide its threads.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:AntiCodeAnalysisStrategicObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AntiCodeAnalysisStrategicObjectivesVocab-1.0 is the default MAEC Vocabulary for Anti-Code Analysis Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:AntiCodeAnalysisStrategicObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AntiCodeAnalysisStrategicObjectivesEnum-1.0 is an enumeration of Anti-Code Analysis Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + +
    enumerationanti-debugging +
    + + + + + 
    The 'anti-debugging' value indicates that the malware instance is able to prevent itself from being debugged and/or from being run in a debugger or is able to make debugging more difficult.
    +
    +
    enumerationcode obfuscation +
    + + + + + 
    The 'code obfuscation' value indicates that the malware instance is able to obfuscate its code.
    +
    +
    enumerationanti-disassembly +
    + + + + + 
    The 'anti-disassembly' value indicates that the malware instance is able to prevent itself from being disassembled or make disassembly more difficult.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:AntiCodeAnalysisTacticalObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AntiCodeAnalysisTacticalObjectivesVocab-1.0 is the default MAEC Vocabulary for Anti-Code Analysis Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:AntiCodeAnalysisTacticalObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AntiCodeAnalysisTacticalObjectivesEnum-1.0 is an enumeration of Anti-Code Analysis Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationtransform control flow +
    + + + + + 
    The 'transform control flow' value indicates that the malware instance is able to transform its control flow.
    +
    +
    enumerationrestructure arrays +
    + + + + + 
    The 'restructure arrays' value indicates that the malware instance is able to restructure its arrays, making disassembly more difficult.
    +
    +
    enumerationdetect debugging +
    + + + + + 
    The 'detect debugging' value indicates that the malware instance is able to detect its execution in a debugger.
    +
    +
    enumerationprevent debugging +
    + + + + + 
    The 'prevent debugging' value indicates that the malware instance is able to prevent its execution in a debugger.
    +
    +
    enumerationdefeat flow-oriented (recursive traversal) disassembler +
    + + + + + 
    The 'defeat flow-oriented disassembler' value indicates that the malware instance is able to defeat its disassembly in a flow-oriented (recursive traversal) disassembler.
    +
    +
    enumerationdefeat linear disassembler +
    + + + + + 
    The 'defeat linear disassembler' value indicates that the malware instance is able to prevent its disassembly in a linear disassembler.
    +
    +
    enumerationobfuscate instructions +
    + + + + + 
    The 'obfuscate instructions' value indicates that the malware instance obfuscates its instructions.
    +
    +
    enumerationobfuscate imports +
    + + + + + 
    The 'obfuscate imports' value indicates that the malware instance is able to obfuscate its import table, making disassembly more difficult.
    +
    +
    enumerationdefeat call graph generation +
    + + + + + 
    The 'defeat call graph generation' value indicates that the malware instance is able to defeat accurate call graph generation during disassembly.
    +
    +
    enumerationobfuscate runtime code +
    + + + + + 
    The 'obfuscate runtime code' value indicates that the malware instance is able to obfuscate its runtime code.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:InfectionPropagationStrategicObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The InfectionPropagationStrategicObjectivesVocab-1.0 is the default MAEC Vocabulary for Infection/Propagation Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:InfectionPropagationStrategicObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The InfectionPropagationStrategicObjectivesEnum-1.0 is an enumeration of Infection/Propagation Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + +
    enumerationprevent duplicate infection +
    + + + + + 
    The 'prevent duplicate infection' value indicates that the malware instance is able to prevent itself from infecting a machine multiple times.
    +
    +
    enumerationinfect file +
    + + + + + 
    The 'infect file' value denotes that the malware instance is able to infect a file.
    +
    +
    enumerationinfect remote machine +
    + + + + + 
    The 'infect remote machine' value indicates that the malware instance is able to self-propagate or infect a machine with malware that is different than itself.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:InfectionPropagationTacticalObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The InfectionPropagationTacticalObjectivesVocab-1.0 is the default MAEC Vocabulary for Infection/Propagation Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:InfectionPropagationTacticalObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The InfectionPropagationTacticalObjectivesEnum-1.0 is an enumeration of Infection/Propagation Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationidentify file +
    + + + + + 
    The 'identify file' value indicates that the malware instance is able to identify a file or files on a local, removable, and/or network drive for infection.
    +
    +
    enumerationperform autonomous remote infection +
    + + + + + 
    The 'perform autonomous remote infection' value indicates that the malware instance is able to infect a remote machine autonomously, without the involvement of any end user (e.g., through the exploitation of a remote procedure call vulnerability).
    +
    +
    enumerationidentify target machine(s) +
    + + + + + 
    The 'identify target machine(s)' value indicates that the malware instance is able to identify one or more machines to be targeted for infection via some remote means (e.g., via email or the network).
    +
    +
    enumerationperform social-engineering based remote infection +
    + + + + + 
    The 'perform social-engineering based remote infection' value indicates that the malware instance is able to infect remote machines via some method that involves social engineering (e.g., sending an email with a malicious attachment).
    +
    +
    enumerationinventory victims +
    + + + + + 
    The 'inventory victims' value indicates that the malware instance is able to keep an inventory of the victims that it remotely infects.
    +
    +
    enumerationwrite code into file +
    + + + + + 
    The 'write code into file' value indicates that the malware instance is able to write code into a file.
    +
    +
    enumerationmodify file +
    + + + + + 
    The 'modify file' value indicates that the malware instance is able to modify a file in some other manner than writing code to it, such as packing it (in terms of binary executable packing).
    +
    +
    +
    +
    +
    Complex Type maecVocabs:AntiBehavioralAnalysisStrategicObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AntiBehavioralAnalysisStrategicObjectivesVocab-1.0 is the default MAEC Vocabulary for Anti-Behavioral Analysis Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:AntiBehavioralAnalysisStrategicObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AntiBehavioralAnalysisStrategicObjectivesEnum-1.0 is an enumeration of Anti-Behavioral Analysis Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + +
    enumerationanti-vm +
    + + + + + 
    The 'anti-vm' value indicates that the malware instance is able to prevent virtual machine (VM) based behavioral analysis or make it more difficult.
    +
    +
    enumerationanti-sandbox +
    + + + + + 
    The 'anti-sandbox' value specifies that the malware instance is able to prevent sandbox-based behavioral analysis or make it more difficult.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:AntiBehavioralAnalysisTacticalObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AntiBehavioralAnalysisTacticalObjectivesVocab-1.0 is the default MAEC Vocabulary for Anti-Behavioral Analysis Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:AntiBehavioralAnalysisTacticalObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AntiBehavioralAnalysisTacticalObjectivesEnum-1.0 is an enumeration of Anti-Behavioral Analysis Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationdetect vm environment +
    + + + + + 
    The 'detect vm environment' value indicates that the malware instance is able to detect whether it is being executed in a virtual machine (VM).
    +
    +
    enumerationoverload sandbox +
    + + + + + 
    The 'overload sandbox' value indicates that the malware instance is able to overload a sandbox (e.g., by generating a flood of meaningless behavioral data).
    +
    +
    enumerationprevent execution in sandbox +
    + + + + + 
    The 'prevent execution in sandbox' value indicates that the malware instance is able to prevent its execution in a sandbox.
    +
    +
    enumerationdetect sandbox environment +
    + + + + + 
    The 'detect sandbox environment' value indicates that the malware instance is able to detect whether it is being executed in a sandbox environment.
    +
    +
    enumerationprevent execution in vm +
    + + + + + 
    The 'prevent execution in wm' value indicates that the malware instance is able to prevent its execution in a virtual machine (VM).
    +
    +
    +
    +
    +
    Complex Type maecVocabs:IntegrityViolationStrategicObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The IntegrityViolationStrategicObjectivesVocab-1.0 is the default MAEC Vocabulary for Integrity Violation Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:IntegrityViolationStrategicObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The IntegrityViolationStrategicObjectivesEnum-1.0 is an enumeration of Integrity Violation Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationcompromise system operational integrity +
    + + + + + 
    The 'compromise system operational integrity' value indicates that the malware instance is able to compromise the operational integrity of a system.
    +
    +
    enumerationcompromise user data integrity +
    + + + + + 
    The 'compromise user data integrity' value indicates that the malware instance is able to compromise a system's user data.
    +
    +
    enumerationannoy user +
    + + + + + 
    The 'annoy user' value indicates that the malware instance is able to annoy the users of a system.
    +
    +
    enumerationcompromise network operational integrity +
    + + + + + 
    The 'compromise network operational integrity' value indicates that the malware instance is able to compromise the operational integrity of a network.
    +
    +
    enumerationcompromise system data integrity +
    + + + + + 
    The 'compromise system data integrity' value indicates that the malware instance is able to compromise the integrity of a system's data.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:IntegrityViolationTacticalObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The IntegrityViolationTacticalObjectivesVocab-1.0 is the default MAEC Vocabulary for Integrity Violation Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:IntegrityViolationTacticalObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The IntegrityViolationTacticalObjectivesEnum-1.0 is an enumeration of Integrity Violation Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationsubvert system +
    + + + + + 
    The 'subvert system' value indicates that the malware instance is able to subvert a system to perform beyond its operational boundaries or to perform tasks for which it was not originally intended.
    +
    +
    enumerationcorrupt system data +
    + + + + + 
    The 'corrupt system data' value indicates that the malware instance is able to corrupt a system's data.
    +
    +
    enumerationannoy local system user +
    + + + + + 
    The 'annoy local system user' value indicates that the malware instance is able to annoy local system users.
    +
    +
    enumerationintercept/manipulate network traffic +
    + + + + + 
    The 'intercept/manipulate network traffic' value indicates that the malware is able to intercept and/or manipulate traffic on a network.
    +
    +
    enumerationannoy remote user +
    + + + + + 
    The 'annoy remote user' value indicates that the malware instance is able to annoy a remote user.
    +
    +
    enumerationcorrupt user data +
    + + + + + 
    The 'corrupt user data' value indicates that the malware instance is able to corrupt a system's user data.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:DataExfiltrationStrategicObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DataExfiltrationStrategicObjectivesVocab-1.0 is the default MAEC Vocabulary for Data Exfiltration Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:DataExfiltrationStrategicObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DataExfiltrationStrategicObjectivesEnum-1.0 is an enumeration of Data Exfiltration Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + +
    enumerationperform data exfiltration +
    + + + + + 
    The 'perform data exfiltration' value indicates that the malware instance is able to perform data exfiltration via some physical or virtual means.
    +
    +
    enumerationobfuscate data for exfiltration +
    + + + + + 
    The 'obfuscate data for exfiltration' value indicates that the malware is able to obfuscate data that will be exfiltrated.
    +
    +
    enumerationstage data for exfiltration +
    + + + + + 
    The 'stage data for exfiltration' value indicates that the malware instance is able to gather and prepare data for exfiltration.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:DataExfiltrationTacticalObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DataExfiltrationTacticalObjectivesVocab-1.0 is the default MAEC Vocabulary for Data Exfiltration Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:DataExfiltrationTacticalObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DataExfiltrationTacticalObjectivesEnum-1.0 is an enumeration of Data Exfiltration Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationexfiltrate via covert channel +
    + + + + + 
    The 'exfiltrate via covert channel' value indicates that the malware instance is able to exfiltrate data using a covert channel.
    +
    +
    enumerationexfiltrate via fax +
    + + + + + 
    The 'exfiltrate via fax' value indicates that the malware instance is able to exfiltrate data using a fax system.
    +
    +
    enumerationexfiltrate via physical media +
    + + + + + 
    The 'exfiltrate via physical media' value indicates that the malware instance is able to exfiltrate data using physical media (e.g., a USB drive).
    +
    +
    enumerationencrypt data +
    + + + + + 
    The 'encrypt data' value indicates that the malware instance is able to encrypt data that will be exfiltrated.
    +
    +
    enumerationexfiltrate via network +
    + + + + + 
    The 'exfiltrate via network' value indicates that the malware instance is able to exfiltrate data across the network.
    +
    +
    enumerationhide data +
    + + + + + 
    The 'hide data in other formats' value indicates that the malware instance is able to hide data that will be exfiltrated in other formats (also known as steganography).
    +
    +
    enumerationpackage data +
    + + + + + 
    The 'package data' value indicates that the malware instance is able to package data for exfiltration.
    +
    +
    enumerationexfiltrate via dumpster dive +
    + + + + + 
    The 'exfiltrate via dumpster dive' value indicates that the malware instance is able to exfiltrate data via dumpster dive (i.e., encoded data printed by malware is viewed as garbage and thrown away to then be physically picked up).
    +
    +
    enumerationmove data to staging server +
    + + + + + 
    The 'move data to staging server' value indicates that the malware instance is able to move data to be exfiltrated to a particular server to prepare for exfiltration.
    +
    +
    enumerationexfiltrate via voip/phone +
    + + + + + 
    The 'exfiltrate via VoIP/phone' value indicates that the malware instance is able to exfiltrate data (encoded as audio) using a phone system.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:AntiRemovalStrategicObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AntiRemovalStrategicObjectivesVocab-1.0 is the default MAEC Vocabulary for Anti-Removal Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:AntiRemovalStrategicObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AntiRemovalStrategicObjectivesEnum-1.0 is an enumeration of Anti-Removal Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + +
    enumerationprevent malware artifact access +
    + + + + + 
    The 'prevent malware artifact access' value indicates that the malware instance is able to prevent its artifacts from being accessed.
    +
    +
    enumerationprevent malware artifact deletion +
    + + + + + 
    The 'prevent malware artifact deletion' value indicates that the malware instance is able to prevent its artifacts from being deleted from a system.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:AntiRemovalTacticalObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AntiRemovalTacticalObjectivesVocab-1.0 is the default MAEC Vocabulary for Anti-Removal Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:AntiRemovalTacticalObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AntiRemovalTacticalObjectivesEnum-1.0 is an enumeration of Anti-Removal Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationprevent registry deletion +
    + + + + + 
    The 'prevent registry deletion' value indicates that the malware instance is able to prevent its Windows registry entries from being deleted from a system.
    +
    +
    enumerationprevent api unhooking +
    + + + + + 
    The 'prevent api unhooking' value indicates that the malware instance is able to prevent its API hooks from being removed.
    +
    +
    enumerationprevent file access +
    + + + + + 
    The 'prevent file access' value indicates that the malware instance is able to prevent access to the file system.
    +
    +
    enumerationprevent memory access +
    + + + + + 
    The 'prevent memory access' value indicates that the malware instance is able to prevent access to system memory where it may be storing code or data.
    +
    +
    enumerationprevent registry access +
    + + + + + 
    The 'prevent registry access' value indicates that the malware instance is able to prevent access to the Windows registry.
    +
    +
    enumerationprevent file deletion +
    + + + + + 
    The 'prevent file deletion' value indicates that the malware instance is able to prevent its files from being deleted from a system.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:SecurityDegradationStrategicObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SecurityDegradationStrategicObjectivesVocab-1.0 is the default MAEC Vocabulary for Security Degradation Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:SecurityDegradationStrategicObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SecurityDegradationStrategicObjectivesEnum-1.0 is an enumeration of Security Degradation Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationdisable service provider security features +
    + + + + + 
    The 'disable service provider security features' value indicates that the malware instance is able to bypass or disable third-party security features that would otherwise identify or notify users of its presence.
    +
    +
    enumerationdegrade security programs +
    + + + + + 
    The 'degrade security programs' value indicates that the malware instance is able to degrade security programs running on a system, either by stopping them from executing or by making changes to their code or configuration parameters.
    +
    +
    enumerationdisable system updates +
    + + + + + 
    The 'disable system updates' values indicates that the malware instance is able to disable the downloading and installation of system updates.
    +
    +
    enumerationdisable os security features +
    + + + + + 
    The 'disable os security features' value indicates that the malware instance is able to bypass inherent operating system security mechanisms that typically involve elevated privileges.
    +
    +
    enumerationdisable [host-based or os] access controls +
    + + + + + 
    The 'disable access controls' value indicates that the malware instance is able to bypass access control mechanisms designed to prevent unauthorized or unprivileged use or execution of applications or files.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:SecurityDegradationTacticalObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SecurityDegradationTacticalObjectivesVocab-1.0 is the default MAEC Vocabulary for Security Degradation Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:SecurityDegradationTacticalObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SecurityDegradationTacticalObjectivesEnum-1.0 is an enumeration of Security Degradation Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationstop execution of security program +
    + + + + + 
    The 'stop execution of security program' value indicates that the malware instance is able to stop one or more security programs that may already be executing on a system.
    +
    +
    enumerationdisable firewall +
    + + + + + 
    The 'disable firewall' value indicates that the malware instance is able to evade or disable the host-based firewall or otherwise prevent the blocking of network communications.
    +
    +
    enumerationdisable access right checking +
    + + + + + 
    The 'disable access right checking' value indicates that the malware instance is able to bbypass, disable, or modify the access tokens or access control lists, thereby enabling the malware to read, write, or execute a file with one or more of these controls set.
    +
    +
    enumerationdisable kernel patching protection +
    + + + + + 
    The 'disable kernel patch protection' value indicates that the malware instance is able to bypass or disable PatchGuard; thus it is capable of operating at the same level as the kernel and kernel mode drivers (KMD).
    +
    +
    enumerationprevent access to security websites +
    + + + + + 
    The 'prevent access to security websites' value indicates that the malware instance is able to prevent access from a system to one or more security vendor or security-related websites.
    +
    +
    enumerationremove sms warning messages +
    + + + + + 
    The 'remove sms warning messages' value indicates that the malware instance is able to capture the message body of incoming SMS messages and abort the broadcasting of a message that meets a certain criteria.
    +
    +
    enumerationmodify security program configuration +
    + + + + + 
    The 'modify security program configuration' value indicates that the malware instance is able to modify the configuration of one or more security programs running on a system in order to hamper their usefulness and ability to detect the malware instance.
    +
    +
    enumerationprevent security program from running +
    + + + + + 
    The 'prevent security program from running' value indicates that the malware instance is able to prevent one or more security programs from running on a system.
    +
    +
    enumerationdisable system update services/daemons +
    + + + + + 
    The 'disable system update services/daemons' value indicates that the malware instance is able to disable system update services or daemons that may be running on a system.
    +
    +
    enumerationdisable system service pack/patch installation +
    + + + + + 
    The 'disable system service pack/patch installation' value indicates that the malware instance is able to disable the system's ability to install service packs or patches.
    +
    +
    enumerationdisable system file overwrite protection +
    + + + + + 
    The 'disable system file overwrite protection' value indicates that the malware instance is able to bypass or disable the Windows file protection feature; thus, enabling system files to be modified or replaced.
    +
    +
    enumerationdisable privilege limiting +
    + + + + + 
    The 'disable privilege limiting' value indicates that the malware instance is able to bypass controls that limit the privileges that can be granted to a user or entity.
    +
    +
    enumerationgather security product info +
    + + + + + 
    The 'gather security product info' value indicates that the malware instance is able to gather information about the security products installed or running on a system.
    +
    +
    enumerationdisable os security alerts +
    + + + + + 
    The 'disable os security alerts' value indicates that the malware instance is able to evade or disable identification and/or notification of its presence by inherent features of the operating system.
    +
    +
    enumerationdisable user account control +
    + + + + + 
    The 'disable user account control' value indicates that the malware instance is able to bypass or disable user account control (UAC); thus, enabling a user to run an application with elevated privileges.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:AvailabilityViolationStrategicObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AvailabilityViolationStrategicObjectivesVocab-1.0 is the default MAEC Vocabulary for Availability Violation Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:AvailabilityViolationStrategicObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AvailabilityViolationStrategicObjectivesEnum-1.0 is an enumeration of Availability Violation Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + +
    enumerationcompromise data availability +
    + + + + + 
    The 'compromise data availabilty' value indicates that the malware instance is able to compromise the availability of data on a system.
    +
    +
    enumerationcompromise system availability +
    + + + + + 
    The 'compromise system availability' value indicates that the malware instance compromises the availability of the system.
    +
    +
    enumerationconsume system resources +
    + + + + + 
    The 'consume system resources' value indicates that the malware instance is able to consume system resources for its own purposes.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:AvailabilityViolationTacticalObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AvailabilityViolationTacticalObjectivesVocab-1.0 is the default MAEC Vocabulary for Availability Violation Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:AvailabilityViolationTacticalObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AvailabilityViolationTacticalObjectivesEnum-1.0 is an enumeration of Availability Violation Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationdenial of service +
    + + + + + 
    The 'denial of service' value indicates that the malware instance is able to cause a server to be unavailable, otherwise known as a denial of service (DOS).
    +
    +
    enumerationcompromise local system availability +
    + + + + + 
    The 'compromise local system availability' value indicates that the malware instance is able to cause the local system to be unavailable.
    +
    +
    enumerationcrack passwords +
    + + + + + 
    The 'crack passwords' value indicates that the malware instance is able to consume system resources for password cracking.
    +
    +
    enumerationmine for cryptocurrency +
    + + + + + 
    The 'mine for cryptocurrency' value indicates that the malware instance is able to consume system resources for cryptocurrency mining.
    +
    +
    enumerationcompromise access to information assets +
    + + + + + 
    The 'compromise access to information assets' value indicates that the malware instance is able to prevent data from being accessed (e.g., by encrypting user data on a compromised system).
    +
    +
    +
    +
    +
    Complex Type maecVocabs:DestructionStrategicObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DestructionStrategicObjectivesVocab-1.0 is the default MAEC Vocabulary for Destruction Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:DestructionStrategicObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DestructionStrategicObjectivesEnum-1.0 is an enumeration of Destruction Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + +
    enumerationdestroy physical entity +
    + + + + + 
    The 'destroy physical entity' value indicates that the malware instance is able to destroy a physical entity.
    +
    +
    enumerationdestroy virtual entity +
    + + + + + 
    The 'destroy virtual entity' value indicates that the malware instance is able to destroy a virtual entity.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:DestructionTacticalObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DestructionTacticalObjectivesVocab-1.0 is the default MAEC Vocabulary for Destruction Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:DestructionTacticalObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DestructionTacticalObjectivesEnum-1.0 is an enumeration of Destruction Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + +
    enumerationerase data +
    + + + + + 
    The 'erase data' value indicates that the malware instance is able to destroy data by erasure.
    +
    +
    enumerationdestroy firmware +
    + + + + + 
    The 'destroy firmware' value indicates that the malware instance is able to destroy a system's firmware.
    +
    +
    enumerationdestroy hardware +
    + + + + + 
    The 'destroy hardware' value indicates that the malware instance is able to destroy a system's hardware.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:FraudStrategicObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The FraudStrategicObjectivesVocab-1.0 is the default MAEC Vocabulary for Fraud Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:FraudStrategicObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The FraudStrategicObjectivesEnum-1.0 is an enumeration of Fraud Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + +
    enumerationperform premium rate fraud +
    + + + + + 
    The 'perform premium rate fraud' value indicates that the malware instance is able to send text messages or dial phone numbers that are charged at premium rates.
    +
    +
    enumerationperform click fraud +
    + + + + + 
    The 'perform click fraud' value indicates that the malware instance is able to simulate clicks on website advertisements for the purpose of revenue generation.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:FraudTacticalObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The FraudTacticalObjectivesVocab-1.0 is the default MAEC Vocabulary for Fraud Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:FraudTacticalObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The FraudTacticalObjectivesEnum-1.0 is an enumeration of Fraud Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + +
    enumerationaccess premium service +
    + + + + + 
    The 'access premium service' value indicates that the malware instance is able to access a premium service.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:PersistenceStrategicObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The PersistenceStrategicObjectivesVocab-1.0 is the default MAEC Vocabulary for Persistence Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:PersistenceStrategicObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The PersistenceStrategicObjectivesEnum-1.0 is an enumeration of Persistence Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    enumerationpersist to re-infect system +
    + + + + + 
    The 'persist to re-infect system' value indicates that the malware instance is able to re-infect a system after some of its components have been removed.
    +
    +
    enumerationgather information for improvement +
    + + + + + 
    The 'gather information for improvement' value indicates that the malware instance is able to gather information from its environment to make itself less likely to be detected.
    +
    +
    enumerationensure compatibility +
    + + + + + 
    The 'ensure compatibility' value indicates that the malware instance is able to manipulate or modify the system on which it executes to ensure that it is able to continue executing.
    +
    +
    enumerationpersist to continuously execute on system +
    + + + + + 
    The 'persist to continuously execute on system' value indicates that the malware instance is able to continue to execute on a system after significant system events (e.g., after a reboot).
    +
    +
    +
    +
    +
    Complex Type maecVocabs:PersistenceTacticalObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The PersistenceTacticalObjectivesVocab-1.0 is the default MAEC Vocabulary for Persistence Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:PersistenceTacticalObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The PersistenceTacticalObjectivesEnum-1.0 is an enumeration of Persistence Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationreinstantiate self after initial detection +
    + + + + + 
    The 'reinstantiate self after initial detection' value indicates that the malware instance is able to re-establish itself on the system after it is initially detected.
    +
    +
    enumerationlimit application type/version +
    + + + + + 
    The 'limit application type/version' value indicates that the malware instance is able to limit the type or version of an application that runs on a system in order to ensure that it is able to continue executing.
    +
    +
    enumerationpersist after os install/reinstall +
    + + + + + 
    The 'persist after os install/reinstall' value indicates that the malware instance is able to continue to execute after the operating system is installed or reinstalled.
    +
    +
    enumerationdrop/retrieve debug log file +
    + + + + + 
    The 'drop/retrieve debug log file' value indicates that the malware instance is able to generate and retrieve a log file of errors associated with the malware.
    +
    +
    enumerationpersist independent of hard disk/os changes +
    + + + + + 
    The 'persist independent of hard disk/os changes' value indicates that the malware instance is able to continue to execute after changes to the hard disk or the operating system have been made.
    +
    +
    enumerationpersist after system reboot +
    + + + + + 
    The 'persist after system reboot' value indicates that the malware instance is able to continue to execute after a system reboot.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:MachineAccessControlStrategicObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MachineAccessControlStrategicObjectivesVocab-1.0 is the default MAEC Vocabulary for Machine Access/Control Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:MachineAccessControlStrategicObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MachineAccessControlStrategicObjectivesEnum-1.0 is an enumeration of Machine Access/Control Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + +
    enumerationcontrol local machine +
    + + + + + 
    The 'control local machine' value indicates that the malware instance is able to control the machine on which it is resident.  Examples of malware with this capability include bots, backdoors, and RATs.
    +
    +
    enumerationinstall backdoor +
    + + + + + 
    The 'install backdoor' value indicates that the malware instance is able to install a backdoor, capable of providing covert remote access to the machine on which it is resident.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:MachineAccessControlTacticalObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MachineAccessControlTacticalObjectivesVocab-1.0 is the default MAEC Vocabulary for Machine Access/Control Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:MachineAccessControlTacticalObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MachineAccessControlTacticalObjectivesEnum-1.0 is an enumeration of Machine Access/Control Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + +
    enumerationcontrol machine via remote command +
    + + + + + 
    The 'control machine via remote command' value indicates that the malware instance is able to execute commands issued to it from a remote source, for the purpose of controlling the machine on which it is resident.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:ProbingStrategicObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ProbingStrategicObjectivesVocab-1.0 is the default MAEC Vocabulary for Probing Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:ProbingStrategicObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ProbingStrategicObjectivesEnum-1.0 is an enumeration of Probing Capability Strategic Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + +
    enumerationprobe host configuration +
    + + + + + 
    The 'probe host configuration' value indicates that the malware instance is able to probe the configuration of the host system on which it executes.
    +
    +
    enumerationprobe network environment +
    + + + + + 
    The 'probe network environment' value indicates that the malware instance is able to probe the properties of its network environment, e.g. to determine whether it funnels traffic through a proxy.
    +
    +
    +
    +
    +
    Complex Type maecVocabs:ProbingTacticalObjectivesVocab-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ProbingTacticalObjectivesVocab-1.0 is the default MAEC Vocabulary for Probing Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of cyboxCommon:ControlledVocabularyStringType
    +
    Simple Type maecVocabs:ProbingTacticalObjectivesEnum-1.0
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/default_vocabularies-1
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ProbingTacticalObjectivesEnum-1.0 is an enumeration of Probing Capability Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationidentify os +
    + + + + + 
    The 'identify os' value indicates that the malware instance is able to identify the operating system under which it executes.
    +
    +
    enumerationcheck for proxy +
    + + + + + 
    The 'check for proxy' value indicates that the malware instance is able to check whether the network environment in which it executes contains a hardware or software proxy.
    +
    +
    enumerationcheck for firewall +
    + + + + + 
    The 'check for firewall' value indicates that the malware instance is able to check whether the network environment in which it executes contains a hardware or software firewall.
    +
    +
    enumerationcheck for network drives +
    + + + + + 
    The 'check for shared drive' value indicates that the malware instance is able to check for network drives that may be present in the network environment.
    +
    +
    enumerationmap local network +
    + + + + + 
    The 'map local network' value indicates that the malware instance is able to map the layout of the local network environment in which it executes.
    +
    +
    enumerationinventory system applications +
    + + + + + 
    The 'inventory system applications' value indicates that the malware instance is able to inventory the applications installed on the system on which it executes.
    +
    +
    enumerationcheck language +
    + + + + + 
    The 'check language' value indicates that the malware instance is able to check the language of the host system on which it executes.
    +
    +
    enumerationcheck for internet connectivity +
    + + + + + 
    The 'check for internet connectivity' value indicates that the malware instance is able to check whether the network environment in which it executes is connected to the internet.
    +
    +
    +
    +
    +
    +
    +
    +
    XML Schema documentation generated by ® XML Editor. +
    +
    + \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/docHtml.css b/documentation/maec4.1-xsddocs/docHtml.css new file mode 100644 index 00000000..4863c533 --- /dev/null +++ b/documentation/maec4.1-xsddocs/docHtml.css @@ -0,0 +1,599 @@ +/*---------------------------------------- + Global +-----------------------------------------*/ + +body{ +} +body, table { + font-family:arial, helvetica, sans-serif; + font-size:12px; +} + +@media print{ + body, table { + font-size:10px; + } +} + +/*-------------------------------------------- + Source code in the instance, source or + annotations. +--------------------------------------------*/ +span.tEl { + color: #000096; + background-color:inherit; +} +span.tXSLEl { + color: #0064C8; + background-color:inherit; +} +span.tAN { + color: #F5844C; + background-color:inherit; +} +span.tAV { + color: #993300; + background-color:inherit; +} +span.tI { + color: #000000; + background-color:inherit; +} +span.tT { + color: #000000; + background-color:inherit; +} +span.tC { + color: #006400; + background-color:inherit; +} +span.tCD { + color: #008C00; + background-color:inherit; +} +span.tPI { + color: #8B26C9; + background-color:inherit; +} +span.tEn { + color: #969600; + background-color:inherit; +} +span.qname{ + color:#000096; + background-color:inherit; +} + +/*----------------------------------------- + Documentation sections. +------------------------------------------*/ + +div.componentTitle, p.sHierarchyTitle { + font-size:1.4em; + font-weight:bold; + text-align:left; + margin-top:1.4em; + margin-bottom:0.7em; +} +div.componentTitle{ +/* color:rgb(255, 160, 100);*/ + color:#333333; + background-color:inherit; +} + + +/* Tables. */ + +td, th { + padding:2px 2px 2px 5px; + text-align:left; + vertical-align:top; +} + +tr > th { + background-color:#C4DAF4; + color:inherit; +} + +/* Contrast for the titles*/ +table.component { + width:100%; + border-spacing:1px; +} + +@media print{ + table.component{ + border:1px solid gray; + border-collapse:collapse; + } + + table.component td{ + border:1px solid gray; + } +} + + + +table.component td.firstColumn{ +/* pink */ + /*background-color:#FFC0C0;*/ +/*green */ + /* background-color:#C0F0A0;*/ +/*bleu*/ + /*background-color:#89C6E2;*/ +/*orange*/ + /*background-color:#FFD697;*/ +/*brown*/ + /*background-color:#D5BC8E;*/ +/*lilla*/ + /*background-color:#DDDDFF;*/ +/*gray-bleu*/ + /*background-color:#CAD0DD;*/ +/*brown-light*/ + /*background-color:#DECFB8;*/ +/*gray-green*/ + /*background-color:#C6D0CD;*/ +/*bleu-2*/ + /*background-color:#B5D5FF;*/ +/*gray*/ + /*background-color:#CCCCCC;*/ + + +/*bleu */ +background-color:#C4DAF4; + + + + color:black; + width:12%; +} + +table.component table td.firstColumn{ + border:none; + background-color:#EAF1FB; + color: inherit; +} + +td.firstColumn b{ + font-weight:normal; +} + + +/* The Name and Expand/Collapse control are on the same line + but at different ends.*/ +td.firstColumn div.floatLeft{ + float:left; +} +td.firstColumn div.floatRight{ + float:right; +} + +/* Subtables */ +table.component table{ + width:100%; +} +table.component table, +table.component table td, +table.component table th{ + border:0; +} + + +/* Properties table */ +table.propertiesTable { + border-spacing:1px; +} +table.propertiesTable td.firstColumn{ + width:140px; + text-transform:capitalize; +} +/* Used by table */ +table.usedByTable { + border-spacing:1px; +} +table.usedByTable td.firstColumn{ + width:140px; + text-transform:capitalize; +} + +/* Facets table*/ +table.facetsTable { + border-spacing:1px; +} +table.facetsTable td.firstColumn{ + width:140px; + text-transform:capitalize; +} + +/* Attributes table */ +table.attributesTable { + border-spacing:1px; +} +table.attributesTable th{ + font-weight:normal; +} +table.attributesTable tr:hover{ + color:inherit; + background-color:#EAF1FB; +} + + +/* Identity constraints table */ +table.identityConstraintsTable { + border-spacing:1px; +} +table.identityConstraintsTable th{ + font-weight:normal; +} +table.identityConstraintsTable tr:hover{ + color:inherit; + background-color:#EAF1FB; +} + + + +/*--------------------------------------- + The diagram. +----------------------------------------*/ + +table.component td.diagram { + background-color:white; + color:inherit; +} + + +/* This table is a workaround for an IE bug regarding pre-wrap */ +table.preWrapContainer, +table.preWrapContainer td{ + border:0; + margin:0; + padding:0; +} + + +/* Annotations. */ +div.annotation{ +} +div.annotation pre{ + font-family:arial, helvetica, sans-serif; + margin:0; +} +div.annotation, +div.annotation table, +div.annotation table td{ + margin:0; + padding:0; +} + +/* Hierarchy */ +ul > li{ + list-style:none; +} + +ul { + margin:2px; + padding:0; +} + +ul ul li { + padding-left:10px; + + list-style-image:url('img/hierarchy_arrow.gif'); + list-style-position:inside; +} + +ul ul li.schemaHierarchy { + padding-left:20px; + + list-style-image:none; + list-style-position:inside; +} + +ul.schemaHierarchy { + padding-left:20px; +} + +/*------------------------------------- + Rounded tables. +---------------------------------------*/ + +table.rt, +table.rt_with_bg{ + border-collapse:collapse; + border-spacing:0; + width:100%; +} +table.rt_with_bg{ + /*background-color:#C0F0A0;*/ + background-color:white; + color:inherit; +} + + +.rt_cornerTopLeft{ + background-color:transparent; + background-repeat:no-repeat; + background-position:right; + width:8px; + height:8px; + margin:0; + padding:0; +} +.rt_cornerTopLeft{ + background-image:url('img/cTL.gif'); +} + + +.rt_cornerBottomLeft{ + background-color:transparent; + background-repeat:no-repeat; + background-position:right; + width:8px; + height:8px; + margin:0; + padding:0; +} +.rt_cornerBottomLeft{ + background-image:url('img/cBL.gif'); +} + + +.rt_cornerTopRight{ + background-color:transparent; + background-repeat:no-repeat; + width:8px; + height:8px; + margin:0; + padding:0; + +} +.rt_cornerTopRight{ + background-image:url('img/cTR.gif'); +} + + +.rt_cornerBottomRight{ + background-color:transparent; + background-repeat:no-repeat; + width:8px; + height:8px; + margin:0; + padding:0; + +} +.rt_cornerBottomRight{ + background-image:url('img/cBR.gif'); +} + + +.rt_content{ + background-color:white; + color:inherit; + width:auto; + margin:0; + padding:0; +} + + +.rt_lineLeft{ + background-color:transparent; + background-repeat:repeat-y; + background-position:right; + width:8px; + margin:0; + padding:0; + +} +.rt_lineLeft{ + background-image:url('img/lL.gif'); +} + + +.rt_lineRight{ + background-repeat:repeat-y; + width:8px; + margin:0; + padding:0; +} +.rt_lineRight{ + background-image:url('img/lR.gif'); +} + + +.rt_lineTop{ + background-color:transparent; + background-repeat:repeat-x; + height:8px; + width:auto; + margin:0; + padding:0; +} +.rt_lineTop{ + background-image:url('img/lT.gif'); +} + +.rt_lineBottom{ + background-color:transparent; + background-repeat:repeat-x; + height:8px; + width:auto; + margin:0; + padding:0; +} +.rt_lineBottom{ + background-image:url('img/lB.gif'); +} + + +/* -------------------------------------- + Controls for bulk showing/hidding sections + from the documentation. +----------------------------------------*/ + +.globalControls h3{ + margin:0.1em; + font-size:1.2em; +} + +.globalControls table td{ + padding:0; + margin:0; +} + +.globalControls{ + position:fixed; + right:0; + background-color:transparent; + padding-left:0.5em; + padding-right:0.5em; + padding-bottom:0.5em; + width:190px; +} + +@media print{ + .globalControls{ + display:none; + } +} + +/* Expand/collapse of a single section. */ +input.control { + text-align:center; + vertical-align:middle; + padding:0; + padding-right:3px; + padding-bottom:2px; + +} + + +/* close button */ +td.rt_content div span input{ + font-size:0.8em; +} + +@media print{ + input.control{ + display:none; + } +} + + + + +/*----------------------------------------- + Navigation. +------------------------------------------*/ +a, a:visited { + color:rgb(0, 0, 150); + background-color:inherit; +} + +a:link, a:visited { + text-decoration:none; +} +a:hover { + text-decoration:underline; +} + +div.toTop{ + text-align:right; +} +div.toTop a{ + font-weight:normal; +} + + + + +/*------------------------------------------ + The second level of index. Floating DIVs +-------------------------------------------*/ +.toc { +} +.toc div.verticalLayout, div.horizontalLayout{ + float:left; + display:block; + + background-color:white; + color:inherit; + + min-width:130px; + min-height:50px; + + padding:0.5em; +} +/* This is not used. */ +.toc div.verticalLayout { + clear:left; +} + +/* Hack for the IE - acts like a minimum height.*/ +* html .toc div.horizontalLayout, +* html .toc div.verticalLayout { + width:120px; + height:60px; +} + +/* Namespacces or system ids in the TOC. */ +.toc .indexGroupTitle { + font-weight:bold; + margin-bottom:0.5em; +} + +/* Components group*/ + +div.componentGroupTitle { + font-weight: bold; + color: black; + background-color: inherit; +} + +div.componentGroup { + padding-top: 4px; +} + +table.componentGroup { + border-spacing: 1px; +} + +td.componentGroup { + padding: 0px 0px 0px 0px; +} + + + +/*---------------- + The footer. +-----------------*/ +.footer{ + margin-top:3em; +} +.redX{ + color:red; + background-color:inherit; + font-size:1.2em; +} +.oXygenLogo{ + color:#1166DD; + background-color:inherit; + font-weight:bold; + font-size:1.2em; +} + + +/* List item from documentation format */ +ul > li.doc{ + list-style:disc; + margin-left:10px; +} + +/* Wrap the long lines in the 'pre' section. */ +pre { + white-space: pre-wrap; /* css-3 */ + white-space: -moz-pre-wrap; /* Mozilla, since 1999 */ + white-space: -pre-wrap; /* Opera 4-6 */ + white-space: -o-pre-wrap; /* Opera 7 */ + word-wrap: break-word; /* Internet Explorer 5.5+ */ + _white-space: pre; /* IE only hack to re-specify in addition to word-wrap */ +} \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/img/Cycle8.png b/documentation/maec4.1-xsddocs/img/Cycle8.png new file mode 100644 index 00000000..66e7a689 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/Cycle8.png differ diff --git a/documentation/maec4.1-xsddocs/img/HierarchyArrow12.jpg b/documentation/maec4.1-xsddocs/img/HierarchyArrow12.jpg new file mode 100644 index 00000000..2d3cda4d Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/HierarchyArrow12.jpg differ diff --git a/documentation/maec4.1-xsddocs/img/Import12.gif b/documentation/maec4.1-xsddocs/img/Import12.gif new file mode 100644 index 00000000..32950ba5 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/Import12.gif differ diff --git a/documentation/maec4.1-xsddocs/img/Include12.gif b/documentation/maec4.1-xsddocs/img/Include12.gif new file mode 100644 index 00000000..ed5961ae Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/Include12.gif differ diff --git a/documentation/maec4.1-xsddocs/img/Override12.gif b/documentation/maec4.1-xsddocs/img/Override12.gif new file mode 100644 index 00000000..f2c116b0 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/Override12.gif differ diff --git a/documentation/maec4.1-xsddocs/img/Redefine12.gif b/documentation/maec4.1-xsddocs/img/Redefine12.gif new file mode 100644 index 00000000..0377abed Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/Redefine12.gif differ diff --git a/documentation/maec4.1-xsddocs/img/btM.gif b/documentation/maec4.1-xsddocs/img/btM.gif new file mode 100644 index 00000000..78d309a0 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/btM.gif differ diff --git a/documentation/maec4.1-xsddocs/img/btP.gif b/documentation/maec4.1-xsddocs/img/btP.gif new file mode 100644 index 00000000..63e25353 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/btP.gif differ diff --git a/documentation/maec4.1-xsddocs/img/cBL.gif b/documentation/maec4.1-xsddocs/img/cBL.gif new file mode 100644 index 00000000..aacb1da4 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/cBL.gif differ diff --git a/documentation/maec4.1-xsddocs/img/cBR.gif b/documentation/maec4.1-xsddocs/img/cBR.gif new file mode 100644 index 00000000..48879ca2 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/cBR.gif differ diff --git a/documentation/maec4.1-xsddocs/img/cTL.gif b/documentation/maec4.1-xsddocs/img/cTL.gif new file mode 100644 index 00000000..b52ae549 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/cTL.gif differ diff --git a/documentation/maec4.1-xsddocs/img/cTR.gif b/documentation/maec4.1-xsddocs/img/cTR.gif new file mode 100644 index 00000000..136df091 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/cTR.gif differ diff --git a/documentation/maec4.1-xsddocs/img/hierarchy_arrow.gif b/documentation/maec4.1-xsddocs/img/hierarchy_arrow.gif new file mode 100644 index 00000000..739bb651 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/hierarchy_arrow.gif differ diff --git a/documentation/maec4.1-xsddocs/img/lB.gif b/documentation/maec4.1-xsddocs/img/lB.gif new file mode 100644 index 00000000..c0b44c6f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/lB.gif differ diff --git a/documentation/maec4.1-xsddocs/img/lL.gif b/documentation/maec4.1-xsddocs/img/lL.gif new file mode 100644 index 00000000..bfbef226 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/lL.gif differ diff --git a/documentation/maec4.1-xsddocs/img/lR.gif b/documentation/maec4.1-xsddocs/img/lR.gif new file mode 100644 index 00000000..cd75fdc2 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/lR.gif differ diff --git a/documentation/maec4.1-xsddocs/img/lT.gif b/documentation/maec4.1-xsddocs/img/lT.gif new file mode 100644 index 00000000..c67c5766 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/lT.gif differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_APICallType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_APICallType.png new file mode 100644 index 00000000..b772933b Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_APICallType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_AVClassificationType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_AVClassificationType.png new file mode 100644 index 00000000..177479d8 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_AVClassificationType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_AVClassificationsType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_AVClassificationsType.png new file mode 100644 index 00000000..d0ecf108 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_AVClassificationsType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ActionCollectionListType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ActionCollectionListType.png new file mode 100644 index 00000000..a4a6f1f2 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ActionCollectionListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ActionCollectionType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ActionCollectionType.png new file mode 100644 index 00000000..5cbb24e0 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ActionCollectionType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ActionImplementationType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ActionImplementationType.png new file mode 100644 index 00000000..6fb4fc4f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ActionImplementationType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ActionListType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ActionListType.png new file mode 100644 index 00000000..5b67585d Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ActionListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ActionReferenceListType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ActionReferenceListType.png new file mode 100644 index 00000000..3f5ef2d3 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ActionReferenceListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_AssociatedCodeType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_AssociatedCodeType.png new file mode 100644 index 00000000..ed184648 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_AssociatedCodeType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BaseCollectionType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BaseCollectionType.png new file mode 100644 index 00000000..cd8d99af Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BaseCollectionType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorCollectionListType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorCollectionListType.png new file mode 100644 index 00000000..a08ea853 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorCollectionListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorCollectionType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorCollectionType.png new file mode 100644 index 00000000..cea55ba9 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorCollectionType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorListType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorListType.png new file mode 100644 index 00000000..0813bcc0 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorPurposeType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorPurposeType.png new file mode 100644 index 00000000..2fb8ecc4 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorPurposeType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorReferenceListType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorReferenceListType.png new file mode 100644 index 00000000..c4e1a09f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorReferenceListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorReferenceType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorReferenceType.png new file mode 100644 index 00000000..86909f68 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorReferenceType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorRelationshipListType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorRelationshipListType.png new file mode 100644 index 00000000..3f23ff95 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorRelationshipListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorRelationshipType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorRelationshipType.png new file mode 100644 index 00000000..01c4f91c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorRelationshipType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorType.png new file mode 100644 index 00000000..2312a42f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehaviorType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehavioralActionEquivalenceReferenceType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehavioralActionEquivalenceReferenceType.png new file mode 100644 index 00000000..0ee474ea Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehavioralActionEquivalenceReferenceType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehavioralActionReferenceType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehavioralActionReferenceType.png new file mode 100644 index 00000000..d724262a Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehavioralActionReferenceType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehavioralActionType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehavioralActionType.png new file mode 100644 index 00000000..24577bf5 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehavioralActionType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehavioralActionsType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehavioralActionsType.png new file mode 100644 index 00000000..e6c960cd Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BehavioralActionsType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BundleReferenceType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BundleReferenceType.png new file mode 100644 index 00000000..1ac5306f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BundleReferenceType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BundleType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BundleType.png new file mode 100644 index 00000000..1d96e5a0 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_BundleType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CVEVulnerabilityType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CVEVulnerabilityType.png new file mode 100644 index 00000000..7b7b97ca Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CVEVulnerabilityType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CandidateIndicatorCollectionListType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CandidateIndicatorCollectionListType.png new file mode 100644 index 00000000..42548757 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CandidateIndicatorCollectionListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CandidateIndicatorCollectionType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CandidateIndicatorCollectionType.png new file mode 100644 index 00000000..8b238623 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CandidateIndicatorCollectionType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CandidateIndicatorCompositionType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CandidateIndicatorCompositionType.png new file mode 100644 index 00000000..4b581de6 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CandidateIndicatorCompositionType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CandidateIndicatorListType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CandidateIndicatorListType.png new file mode 100644 index 00000000..cd39ae97 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CandidateIndicatorListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CandidateIndicatorType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CandidateIndicatorType.png new file mode 100644 index 00000000..578ccf81 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CandidateIndicatorType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityListType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityListType.png new file mode 100644 index 00000000..ccb970aa Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityObjectiveReferenceType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityObjectiveReferenceType.png new file mode 100644 index 00000000..e5f33ad8 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityObjectiveReferenceType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityObjectiveRelationshipType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityObjectiveRelationshipType.png new file mode 100644 index 00000000..35fc67c1 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityObjectiveRelationshipType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityObjectiveType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityObjectiveType.png new file mode 100644 index 00000000..c449670c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityObjectiveType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityPropertyType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityPropertyType.png new file mode 100644 index 00000000..6cccb4df Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityPropertyType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityReferenceType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityReferenceType.png new file mode 100644 index 00000000..6f57db2c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityReferenceType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityRelationshipType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityRelationshipType.png new file mode 100644 index 00000000..37cf98f4 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityRelationshipType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityType.png new file mode 100644 index 00000000..545738a5 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CapabilityType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CollectionsType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CollectionsType.png new file mode 100644 index 00000000..04a27b63 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_CollectionsType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ExploitType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ExploitType.png new file mode 100644 index 00000000..8adf7cff Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ExploitType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_MalwareActionType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_MalwareActionType.png new file mode 100644 index 00000000..6fc0afab Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_MalwareActionType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_MalwareEntityType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_MalwareEntityType.png new file mode 100644 index 00000000..351168c9 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_MalwareEntityType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ObjectCollectionListType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ObjectCollectionListType.png new file mode 100644 index 00000000..09d3f2ac Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ObjectCollectionListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ObjectCollectionType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ObjectCollectionType.png new file mode 100644 index 00000000..a55dd10b Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ObjectCollectionType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ObjectListType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ObjectListType.png new file mode 100644 index 00000000..b6b74153 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ObjectListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ObjectReferenceListType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ObjectReferenceListType.png new file mode 100644 index 00000000..b09a0975 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ObjectReferenceListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ObjectReferenceType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ObjectReferenceType.png new file mode 100644 index 00000000..d105d910 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ObjectReferenceType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ParameterListType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ParameterListType.png new file mode 100644 index 00000000..da93504c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ParameterListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ParameterType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ParameterType.png new file mode 100644 index 00000000..a490f952 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ParameterType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_PlatformListType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_PlatformListType.png new file mode 100644 index 00000000..9f160c66 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_PlatformListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ProcessTreeNodeType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ProcessTreeNodeType.png new file mode 100644 index 00000000..4f84588e Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ProcessTreeNodeType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ProcessTreeType.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ProcessTreeType.png new file mode 100644 index 00000000..e6adbbdd Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Complex_Type_maecBundle_ProcessTreeType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_API_Call.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_API_Call.png new file mode 100644 index 00000000..4f5ef40c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_API_Call.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_AV_Classification.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_AV_Classification.png new file mode 100644 index 00000000..70af8526 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_AV_Classification.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_AV_Classifications.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_AV_Classifications.png new file mode 100644 index 00000000..14ad7776 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_AV_Classifications.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action.png new file mode 100644 index 00000000..fc5cf71a Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_1.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_1.png new file mode 100644 index 00000000..75013ce9 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_2.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_2.png new file mode 100644 index 00000000..5c1ddbe4 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_2.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Collection.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Collection.png new file mode 100644 index 00000000..8d2627de Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Collection.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Collection_1.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Collection_1.png new file mode 100644 index 00000000..6c38b52f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Collection_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Collections.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Collections.png new file mode 100644 index 00000000..c2634f5b Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Collections.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Composition.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Composition.png new file mode 100644 index 00000000..5260f9c0 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Composition.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Equivalence_Reference.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Equivalence_Reference.png new file mode 100644 index 00000000..a9aa0e60 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Equivalence_Reference.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_List.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_List.png new file mode 100644 index 00000000..56fa1c98 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_List.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Reference.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Reference.png new file mode 100644 index 00000000..b4f23594 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Reference.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Reference_1.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Reference_1.png new file mode 100644 index 00000000..a859e46f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Reference_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Reference_2.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Reference_2.png new file mode 100644 index 00000000..e1042f2f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Action_Reference_2.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Actions.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Actions.png new file mode 100644 index 00000000..72075c76 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Actions.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Address.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Address.png new file mode 100644 index 00000000..d4d8fd7e Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Address.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Affinity_Degree.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Affinity_Degree.png new file mode 100644 index 00000000..17588288 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Affinity_Degree.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Affinity_Type.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Affinity_Type.png new file mode 100644 index 00000000..fec9720e Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Affinity_Type.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Associated_Code.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Associated_Code.png new file mode 100644 index 00000000..a813d528 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Associated_Code.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Author.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Author.png new file mode 100644 index 00000000..b2cc2b23 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Author.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior.png new file mode 100644 index 00000000..bd86dd38 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_1.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_1.png new file mode 100644 index 00000000..d108de69 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Collection.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Collection.png new file mode 100644 index 00000000..247bbaec Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Collection.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Collections.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Collections.png new file mode 100644 index 00000000..35897532 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Collections.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_List.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_List.png new file mode 100644 index 00000000..c513e04c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_List.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Reference.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Reference.png new file mode 100644 index 00000000..4ffe30c7 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Reference.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Reference_1.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Reference_1.png new file mode 100644 index 00000000..79826720 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Reference_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Reference_2.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Reference_2.png new file mode 100644 index 00000000..5aa55af9 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Reference_2.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Reference_3.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Reference_3.png new file mode 100644 index 00000000..aedd2071 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Reference_3.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Reference_4.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Reference_4.png new file mode 100644 index 00000000..a5c57d2d Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behavior_Reference_4.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behaviors.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behaviors.png new file mode 100644 index 00000000..bc5ef691 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Behaviors.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_CVE.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_CVE.png new file mode 100644 index 00000000..d0b6cdc3 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_CVE.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_CWE_ID.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_CWE_ID.png new file mode 100644 index 00000000..12c394f1 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_CWE_ID.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Candidate_Indicator.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Candidate_Indicator.png new file mode 100644 index 00000000..e349ae45 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Candidate_Indicator.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Candidate_Indicator_Collection.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Candidate_Indicator_Collection.png new file mode 100644 index 00000000..449cb422 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Candidate_Indicator_Collection.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Candidate_Indicator_Collections.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Candidate_Indicator_Collections.png new file mode 100644 index 00000000..62721e4d Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Candidate_Indicator_Collections.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Candidate_Indicator_List.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Candidate_Indicator_List.png new file mode 100644 index 00000000..817f64ba Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Candidate_Indicator_List.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Candidate_Indicators.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Candidate_Indicators.png new file mode 100644 index 00000000..aa0caa34 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Candidate_Indicators.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Capabilities.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Capabilities.png new file mode 100644 index 00000000..ab040508 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Capabilities.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Capability.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Capability.png new file mode 100644 index 00000000..aeb3ec2e Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Capability.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Capability_Reference.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Capability_Reference.png new file mode 100644 index 00000000..e7a60b5e Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Capability_Reference.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Capability_Reference_1.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Capability_Reference_1.png new file mode 100644 index 00000000..e4b8b106 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Capability_Reference_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Classification_Name.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Classification_Name.png new file mode 100644 index 00000000..d82792e2 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Classification_Name.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Code.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Code.png new file mode 100644 index 00000000..330ff22f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Code.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Code_Snippet.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Code_Snippet.png new file mode 100644 index 00000000..2ba5b697 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Code_Snippet.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Collections.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Collections.png new file mode 100644 index 00000000..285278a0 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Collections.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Compatible_Platforms.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Compatible_Platforms.png new file mode 100644 index 00000000..7fc573fa Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Compatible_Platforms.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Composition.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Composition.png new file mode 100644 index 00000000..6e9e8f83 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Composition.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Definition_Version.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Definition_Version.png new file mode 100644 index 00000000..37b3bba4 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Definition_Version.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description.png new file mode 100644 index 00000000..c03caedc Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_1.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_1.png new file mode 100644 index 00000000..a0cac2a8 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_2.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_2.png new file mode 100644 index 00000000..0ca6b3f3 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_2.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_3.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_3.png new file mode 100644 index 00000000..53ca1870 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_3.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_4.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_4.png new file mode 100644 index 00000000..f2f39260 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_4.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_5.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_5.png new file mode 100644 index 00000000..b14f1299 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_5.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_6.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_6.png new file mode 100644 index 00000000..b201b3ac Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_6.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_7.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_7.png new file mode 100644 index 00000000..0e6c435c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Description_7.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Discovery_Method.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Discovery_Method.png new file mode 100644 index 00000000..b1700d63 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Discovery_Method.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Engine_Version.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Engine_Version.png new file mode 100644 index 00000000..42f1e20d Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Engine_Version.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Implementation.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Implementation.png new file mode 100644 index 00000000..9bbd54aa Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Implementation.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Importance.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Importance.png new file mode 100644 index 00000000..da369ddf Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Importance.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Initiated_Actions.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Initiated_Actions.png new file mode 100644 index 00000000..65ac5c29 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Initiated_Actions.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Injected_Process.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Injected_Process.png new file mode 100644 index 00000000..4bb06c98 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Injected_Process.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_MAEC_Bundle.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_MAEC_Bundle.png new file mode 100644 index 00000000..bc3fafa8 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_MAEC_Bundle.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Malware_Entity.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Malware_Entity.png new file mode 100644 index 00000000..89538dc6 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Malware_Entity.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Malware_Instance_Object_Attributes.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Malware_Instance_Object_Attributes.png new file mode 100644 index 00000000..9212f82e Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Malware_Instance_Object_Attributes.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Name.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Name.png new file mode 100644 index 00000000..b979d605 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Name.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Name_1.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Name_1.png new file mode 100644 index 00000000..6ede5c89 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Name_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Name_2.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Name_2.png new file mode 100644 index 00000000..a9bc0634 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Name_2.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Numeric_Importance.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Numeric_Importance.png new file mode 100644 index 00000000..17f13152 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Numeric_Importance.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Object.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Object.png new file mode 100644 index 00000000..26c8be1d Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Object.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Object_Collection.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Object_Collection.png new file mode 100644 index 00000000..bca50bbd Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Object_Collection.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Object_Collections.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Object_Collections.png new file mode 100644 index 00000000..d664b480 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Object_Collections.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Object_List.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Object_List.png new file mode 100644 index 00000000..213d3d76 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Object_List.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Object_Reference.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Object_Reference.png new file mode 100644 index 00000000..01eccf56 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Object_Reference.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Object_Reference_1.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Object_Reference_1.png new file mode 100644 index 00000000..72db38f1 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Object_Reference_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Objective_Reference.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Objective_Reference.png new file mode 100644 index 00000000..bcaeb493 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Objective_Reference.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Objects.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Objects.png new file mode 100644 index 00000000..17ecb96a Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Objects.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Parameter.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Parameter.png new file mode 100644 index 00000000..e24c2bdf Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Parameter.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Parameters.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Parameters.png new file mode 100644 index 00000000..43585164 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Parameters.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Platform.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Platform.png new file mode 100644 index 00000000..5750d796 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Platform.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Process_Tree.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Process_Tree.png new file mode 100644 index 00000000..e8e102bc Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Process_Tree.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Property.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Property.png new file mode 100644 index 00000000..ec78bea0 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Property.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Property_1.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Property_1.png new file mode 100644 index 00000000..ef8f1f9f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Property_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Purpose.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Purpose.png new file mode 100644 index 00000000..87197352 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Purpose.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Purpose_1.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Purpose_1.png new file mode 100644 index 00000000..ed30bb74 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Purpose_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Relationship.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Relationship.png new file mode 100644 index 00000000..ceebad21 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Relationship.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Relationship_1.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Relationship_1.png new file mode 100644 index 00000000..15a76feb Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Relationship_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Relationship_2.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Relationship_2.png new file mode 100644 index 00000000..0e30d204 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Relationship_2.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Relationship_Type.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Relationship_Type.png new file mode 100644 index 00000000..eea78ea3 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Relationship_Type.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Relationship_Type_1.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Relationship_Type_1.png new file mode 100644 index 00000000..07f2e2e2 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Relationship_Type_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Relationships.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Relationships.png new file mode 100644 index 00000000..e464ac35 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Relationships.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Return_Value.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Return_Value.png new file mode 100644 index 00000000..5a8a7f8e Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Return_Value.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Root_Process.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Root_Process.png new file mode 100644 index 00000000..cc07fd12 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Root_Process.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Spawned_Process.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Spawned_Process.png new file mode 100644 index 00000000..5609d6bd Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Spawned_Process.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Strategic_Objective.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Strategic_Objective.png new file mode 100644 index 00000000..77612335 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Strategic_Objective.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Sub_Composition.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Sub_Composition.png new file mode 100644 index 00000000..7bb1ac72 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Sub_Composition.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Tactical_Objective.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Tactical_Objective.png new file mode 100644 index 00000000..499e1c60 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Tactical_Objective.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Targeted_Platforms.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Targeted_Platforms.png new file mode 100644 index 00000000..e48dd244 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Targeted_Platforms.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Type.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Type.png new file mode 100644 index 00000000..aeedef65 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Type.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Value.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Value.png new file mode 100644 index 00000000..d32497d5 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Value.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Vulnerability_Exploit.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Vulnerability_Exploit.png new file mode 100644 index 00000000..41249106 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Element_maecBundle_Vulnerability_Exploit.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Simple_Type_maecBundle_ActionImplementationTypeEnum.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Simple_Type_maecBundle_ActionImplementationTypeEnum.png new file mode 100644 index 00000000..0342cb38 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Simple_Type_maecBundle_ActionImplementationTypeEnum.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Simple_Type_maecBundle_BundleContentTypeEnum.png b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Simple_Type_maecBundle_BundleContentTypeEnum.png new file mode 100644 index 00000000..0e1a3331 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_bundle_schema_xsd_Simple_Type_maecBundle_BundleContentTypeEnum.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_container_schema_xsd_Complex_Type_maecContainer_ContainerType.png b/documentation/maec4.1-xsddocs/img/maec_container_schema_xsd_Complex_Type_maecContainer_ContainerType.png new file mode 100644 index 00000000..4421cb8c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_container_schema_xsd_Complex_Type_maecContainer_ContainerType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_container_schema_xsd_Complex_Type_maecContainer_PackageListType.png b/documentation/maec4.1-xsddocs/img/maec_container_schema_xsd_Complex_Type_maecContainer_PackageListType.png new file mode 100644 index 00000000..2144808f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_container_schema_xsd_Complex_Type_maecContainer_PackageListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_container_schema_xsd_Element_maecContainer_MAEC_Container.png b/documentation/maec4.1-xsddocs/img/maec_container_schema_xsd_Element_maecContainer_MAEC_Container.png new file mode 100644 index 00000000..6f89f007 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_container_schema_xsd_Element_maecContainer_MAEC_Container.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_container_schema_xsd_Element_maecContainer_Package.png b/documentation/maec4.1-xsddocs/img/maec_container_schema_xsd_Element_maecContainer_Package.png new file mode 100644 index 00000000..8b9684df Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_container_schema_xsd_Element_maecContainer_Package.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_container_schema_xsd_Element_maecContainer_Packages.png b/documentation/maec4.1-xsddocs/img/maec_container_schema_xsd_Element_maecContainer_Packages.png new file mode 100644 index 00000000..62686710 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_container_schema_xsd_Element_maecContainer_Packages.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ActionObjectAssociationTypeVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ActionObjectAssociationTypeVocab-1_0.png new file mode 100644 index 00000000..789b6652 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ActionObjectAssociationTypeVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiBehavioralAnalysisPropertiesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiBehavioralAnalysisPropertiesVocab-1_0.png new file mode 100644 index 00000000..560ec5be Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiBehavioralAnalysisPropertiesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiBehavioralAnalysisStrategicObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiBehavioralAnalysisStrategicObjectivesVocab-1_0.png new file mode 100644 index 00000000..8ff491bd Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiBehavioralAnalysisStrategicObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiBehavioralAnalysisTacticalObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiBehavioralAnalysisTacticalObjectivesVocab-1_0.png new file mode 100644 index 00000000..5619dbe4 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiBehavioralAnalysisTacticalObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiCodeAnalysisStrategicObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiCodeAnalysisStrategicObjectivesVocab-1_0.png new file mode 100644 index 00000000..074acd3d Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiCodeAnalysisStrategicObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiCodeAnalysisTacticalObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiCodeAnalysisTacticalObjectivesVocab-1_0.png new file mode 100644 index 00000000..98601305 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiCodeAnalysisTacticalObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiDetectionStrategicObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiDetectionStrategicObjectivesVocab-1_0.png new file mode 100644 index 00000000..f336a1f2 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiDetectionStrategicObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiDetectionTacticalObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiDetectionTacticalObjectivesVocab-1_0.png new file mode 100644 index 00000000..f1c49dc1 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiDetectionTacticalObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiRemovalStrategicObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiRemovalStrategicObjectivesVocab-1_0.png new file mode 100644 index 00000000..ff3466c2 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiRemovalStrategicObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiRemovalTacticalObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiRemovalTacticalObjectivesVocab-1_0.png new file mode 100644 index 00000000..b0db4a68 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AntiRemovalTacticalObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AvailabilityViolationPropertiesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AvailabilityViolationPropertiesVocab-1_0.png new file mode 100644 index 00000000..653ae675 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AvailabilityViolationPropertiesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AvailabilityViolationStrategicObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AvailabilityViolationStrategicObjectivesVocab-1_0.png new file mode 100644 index 00000000..091f9232 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AvailabilityViolationStrategicObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AvailabilityViolationTacticalObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AvailabilityViolationTacticalObjectivesVocab-1_0.png new file mode 100644 index 00000000..32f69fa1 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_AvailabilityViolationTacticalObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_CapabilityObjectiveRelationshipTypeVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_CapabilityObjectiveRelationshipTypeVocab-1_0.png new file mode 100644 index 00000000..ccf38899 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_CapabilityObjectiveRelationshipTypeVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_CommandandControlPropertiesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_CommandandControlPropertiesVocab-1_0.png new file mode 100644 index 00000000..449ecfcd Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_CommandandControlPropertiesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_CommandandControlStrategicObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_CommandandControlStrategicObjectivesVocab-1_0.png new file mode 100644 index 00000000..c21bc6a2 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_CommandandControlStrategicObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_CommandandControlTacticalObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_CommandandControlTacticalObjectivesVocab-1_0.png new file mode 100644 index 00000000..58ef6ae2 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_CommandandControlTacticalObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_CommonCapabilityPropertiesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_CommonCapabilityPropertiesVocab-1_0.png new file mode 100644 index 00000000..52b8c171 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_CommonCapabilityPropertiesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DNSActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DNSActionNameVocab-1_0.png new file mode 100644 index 00000000..a079344a Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DNSActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DataExfiltrationPropertiesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DataExfiltrationPropertiesVocab-1_0.png new file mode 100644 index 00000000..069bfba2 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DataExfiltrationPropertiesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DataExfiltrationStrategicObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DataExfiltrationStrategicObjectivesVocab-1_0.png new file mode 100644 index 00000000..a62db783 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DataExfiltrationStrategicObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DataExfiltrationTacticalObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DataExfiltrationTacticalObjectivesVocab-1_0.png new file mode 100644 index 00000000..4b962a81 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DataExfiltrationTacticalObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DataTheftPropertiesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DataTheftPropertiesVocab-1_0.png new file mode 100644 index 00000000..ece2c95c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DataTheftPropertiesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DataTheftStrategicObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DataTheftStrategicObjectivesVocab-1_0.png new file mode 100644 index 00000000..5fe3021c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DataTheftStrategicObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DataTheftTacticalObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DataTheftTacticalObjectivesVocab-1_0.png new file mode 100644 index 00000000..91d217d8 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DataTheftTacticalObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DebuggingActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DebuggingActionNameVocab-1_0.png new file mode 100644 index 00000000..d845a394 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DebuggingActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DestructionPropertiesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DestructionPropertiesVocab-1_0.png new file mode 100644 index 00000000..120cbcdd Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DestructionPropertiesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DestructionStrategicObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DestructionStrategicObjectivesVocab-1_0.png new file mode 100644 index 00000000..1076319f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DestructionStrategicObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DestructionTacticalObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DestructionTacticalObjectivesVocab-1_0.png new file mode 100644 index 00000000..2a1ea34c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DestructionTacticalObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DeviceDriverActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DeviceDriverActionNameVocab-1_0.png new file mode 100644 index 00000000..1103b73e Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DeviceDriverActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DeviceDriverActionNameVocab-1_1.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DeviceDriverActionNameVocab-1_1.png new file mode 100644 index 00000000..b7a9c6c1 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DeviceDriverActionNameVocab-1_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DirectoryActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DirectoryActionNameVocab-1_0.png new file mode 100644 index 00000000..640d8cc7 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DirectoryActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DirectoryActionNameVocab-1_1.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DirectoryActionNameVocab-1_1.png new file mode 100644 index 00000000..c6862450 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DirectoryActionNameVocab-1_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DiskActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DiskActionNameVocab-1_0.png new file mode 100644 index 00000000..89d8b62a Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DiskActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DiskActionNameVocab-1_1.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DiskActionNameVocab-1_1.png new file mode 100644 index 00000000..991ace72 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_DiskActionNameVocab-1_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_FTPActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_FTPActionNameVocab-1_0.png new file mode 100644 index 00000000..ccf28275 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_FTPActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_FileActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_FileActionNameVocab-1_0.png new file mode 100644 index 00000000..0dd0f5ed Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_FileActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_FileActionNameVocab-1_1.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_FileActionNameVocab-1_1.png new file mode 100644 index 00000000..53203d45 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_FileActionNameVocab-1_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_FraudStrategicObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_FraudStrategicObjectivesVocab-1_0.png new file mode 100644 index 00000000..1b21ba32 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_FraudStrategicObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_FraudTacticalObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_FraudTacticalObjectivesVocab-1_0.png new file mode 100644 index 00000000..30e19da5 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_FraudTacticalObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_GUIActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_GUIActionNameVocab-1_0.png new file mode 100644 index 00000000..5525912c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_GUIActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_GroupingRelationshipTypeVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_GroupingRelationshipTypeVocab-1_0.png new file mode 100644 index 00000000..0c225f14 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_GroupingRelationshipTypeVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_HTTPActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_HTTPActionNameVocab-1_0.png new file mode 100644 index 00000000..7afdc60e Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_HTTPActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_HookingActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_HookingActionNameVocab-1_0.png new file mode 100644 index 00000000..2f73837a Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_HookingActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_HookingActionNameVocab-1_1.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_HookingActionNameVocab-1_1.png new file mode 100644 index 00000000..3b1367fa Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_HookingActionNameVocab-1_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_IPCActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_IPCActionNameVocab-1_0.png new file mode 100644 index 00000000..45c54c31 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_IPCActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_IRCActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_IRCActionNameVocab-1_0.png new file mode 100644 index 00000000..158dd413 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_IRCActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ImportanceTypeVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ImportanceTypeVocab-1_0.png new file mode 100644 index 00000000..697b28eb Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ImportanceTypeVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_InfectionPropagationPropertiesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_InfectionPropagationPropertiesVocab-1_0.png new file mode 100644 index 00000000..977217eb Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_InfectionPropagationPropertiesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_InfectionPropagationStrategicObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_InfectionPropagationStrategicObjectivesVocab-1_0.png new file mode 100644 index 00000000..f200bc03 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_InfectionPropagationStrategicObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_InfectionPropagationTacticalObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_InfectionPropagationTacticalObjectivesVocab-1_0.png new file mode 100644 index 00000000..dfdf0bed Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_InfectionPropagationTacticalObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_IntegrityViolationStrategicObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_IntegrityViolationStrategicObjectivesVocab-1_0.png new file mode 100644 index 00000000..da9b35d0 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_IntegrityViolationStrategicObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_IntegrityViolationTacticalObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_IntegrityViolationTacticalObjectivesVocab-1_0.png new file mode 100644 index 00000000..7305aed4 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_IntegrityViolationTacticalObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_LibraryActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_LibraryActionNameVocab-1_0.png new file mode 100644 index 00000000..265c8364 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_LibraryActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_LibraryActionNameVocab-1_1.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_LibraryActionNameVocab-1_1.png new file mode 100644 index 00000000..7e721fc9 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_LibraryActionNameVocab-1_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MachineAccessControlPropertiesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MachineAccessControlPropertiesVocab-1_0.png new file mode 100644 index 00000000..c0b022df Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MachineAccessControlPropertiesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MachineAccessControlStrategicObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MachineAccessControlStrategicObjectivesVocab-1_0.png new file mode 100644 index 00000000..8a37b60a Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MachineAccessControlStrategicObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MachineAccessControlTacticalObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MachineAccessControlTacticalObjectivesVocab-1_0.png new file mode 100644 index 00000000..87b065d1 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MachineAccessControlTacticalObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareCapabilityVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareCapabilityVocab-1_0.png new file mode 100644 index 00000000..76071db0 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareCapabilityVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareConfigurationParameterVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareConfigurationParameterVocab-1_0.png new file mode 100644 index 00000000..b8d31f84 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareConfigurationParameterVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareDevelopmentToolVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareDevelopmentToolVocab-1_0.png new file mode 100644 index 00000000..3b0b827f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareDevelopmentToolVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareEntityTypeVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareEntityTypeVocab-1_0.png new file mode 100644 index 00000000..cc98cae7 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareEntityTypeVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareLabelVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareLabelVocab-1_0.png new file mode 100644 index 00000000..adfdee8a Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareLabelVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareSubjectRelationshipTypeVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareSubjectRelationshipTypeVocab-1_0.png new file mode 100644 index 00000000..e4c6f6ea Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareSubjectRelationshipTypeVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareSubjectRelationshipTypeVocab-1_1.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareSubjectRelationshipTypeVocab-1_1.png new file mode 100644 index 00000000..a61493e1 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_MalwareSubjectRelationshipTypeVocab-1_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_NetworkActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_NetworkActionNameVocab-1_0.png new file mode 100644 index 00000000..b02bb2b7 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_NetworkActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_NetworkActionNameVocab-1_1.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_NetworkActionNameVocab-1_1.png new file mode 100644 index 00000000..5bb416d7 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_NetworkActionNameVocab-1_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_NetworkShareActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_NetworkShareActionNameVocab-1_0.png new file mode 100644 index 00000000..cbe3aa4c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_NetworkShareActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_PersistencePropertiesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_PersistencePropertiesVocab-1_0.png new file mode 100644 index 00000000..50236f7c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_PersistencePropertiesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_PersistenceStrategicObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_PersistenceStrategicObjectivesVocab-1_0.png new file mode 100644 index 00000000..6d6522d2 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_PersistenceStrategicObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_PersistenceTacticalObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_PersistenceTacticalObjectivesVocab-1_0.png new file mode 100644 index 00000000..d03d2b1d Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_PersistenceTacticalObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_PrivilegeEscalationPropertiesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_PrivilegeEscalationPropertiesVocab-1_0.png new file mode 100644 index 00000000..67bdee49 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_PrivilegeEscalationPropertiesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_PrivilegeEscalationStrategicObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_PrivilegeEscalationStrategicObjectivesVocab-1_0.png new file mode 100644 index 00000000..9c1e1ab3 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_PrivilegeEscalationStrategicObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_PrivilegeEscalationTacticalObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_PrivilegeEscalationTacticalObjectivesVocab-1_0.png new file mode 100644 index 00000000..061e4078 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_PrivilegeEscalationTacticalObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ProbingStrategicObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ProbingStrategicObjectivesVocab-1_0.png new file mode 100644 index 00000000..fbb3e595 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ProbingStrategicObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ProbingTacticalObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ProbingTacticalObjectivesVocab-1_0.png new file mode 100644 index 00000000..d78d067e Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ProbingTacticalObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ProcessActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ProcessActionNameVocab-1_0.png new file mode 100644 index 00000000..aaace5c7 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ProcessActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ProcessMemoryActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ProcessMemoryActionNameVocab-1_0.png new file mode 100644 index 00000000..bd1d0e70 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ProcessMemoryActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ProcessThreadActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ProcessThreadActionNameVocab-1_0.png new file mode 100644 index 00000000..447d00ba Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ProcessThreadActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_RegistryActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_RegistryActionNameVocab-1_0.png new file mode 100644 index 00000000..fde98b96 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_RegistryActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_RemoteMachineManipulationStrategicObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_RemoteMachineManipulationStrategicObjectivesVocab-1_0.png new file mode 100644 index 00000000..6a418e20 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_RemoteMachineManipulationStrategicObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_RemoteMachineManipulationTacticalObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_RemoteMachineManipulationTacticalObjectivesVocab-1_0.png new file mode 100644 index 00000000..b8672306 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_RemoteMachineManipulationTacticalObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SecondaryOperationPropertiesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SecondaryOperationPropertiesVocab-1_0.png new file mode 100644 index 00000000..474e5804 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SecondaryOperationPropertiesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SecondaryOperationStrategicObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SecondaryOperationStrategicObjectivesVocab-1_0.png new file mode 100644 index 00000000..62d6bf59 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SecondaryOperationStrategicObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SecondaryOperationTacticalObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SecondaryOperationTacticalObjectivesVocab-1_0.png new file mode 100644 index 00000000..f67da4d3 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SecondaryOperationTacticalObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SecurityDegradationPropertiesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SecurityDegradationPropertiesVocab-1_0.png new file mode 100644 index 00000000..71eaf756 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SecurityDegradationPropertiesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SecurityDegradationStrategicObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SecurityDegradationStrategicObjectivesVocab-1_0.png new file mode 100644 index 00000000..ce29f573 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SecurityDegradationStrategicObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SecurityDegradationTacticalObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SecurityDegradationTacticalObjectivesVocab-1_0.png new file mode 100644 index 00000000..885ed85f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SecurityDegradationTacticalObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ServiceActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ServiceActionNameVocab-1_0.png new file mode 100644 index 00000000..57083b03 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ServiceActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ServiceActionNameVocab-1_1.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ServiceActionNameVocab-1_1.png new file mode 100644 index 00000000..0a083d91 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_ServiceActionNameVocab-1_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SocketActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SocketActionNameVocab-1_0.png new file mode 100644 index 00000000..9c6da320 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SocketActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SpyingStrategicObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SpyingStrategicObjectivesVocab-1_0.png new file mode 100644 index 00000000..431623a3 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SpyingStrategicObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SpyingTacticalObjectivesVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SpyingTacticalObjectivesVocab-1_0.png new file mode 100644 index 00000000..f599876f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SpyingTacticalObjectivesVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SynchronizationActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SynchronizationActionNameVocab-1_0.png new file mode 100644 index 00000000..41ada910 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SynchronizationActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SystemActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SystemActionNameVocab-1_0.png new file mode 100644 index 00000000..364ca578 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_SystemActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_UserActionNameVocab-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_UserActionNameVocab-1_0.png new file mode 100644 index 00000000..fbe39705 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_UserActionNameVocab-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_UserActionNameVocab-1_1.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_UserActionNameVocab-1_1.png new file mode 100644 index 00000000..90842857 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Complex_Type_maecVocabs_UserActionNameVocab-1_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ActionObjectAssociationTypeEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ActionObjectAssociationTypeEnum-1_0.png new file mode 100644 index 00000000..8a772146 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ActionObjectAssociationTypeEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiBehavioralAnalysisPropertiesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiBehavioralAnalysisPropertiesEnum-1_0.png new file mode 100644 index 00000000..66eda229 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiBehavioralAnalysisPropertiesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiBehavioralAnalysisStrategicObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiBehavioralAnalysisStrategicObjectivesEnum-1_0.png new file mode 100644 index 00000000..255e9198 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiBehavioralAnalysisStrategicObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiBehavioralAnalysisTacticalObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiBehavioralAnalysisTacticalObjectivesEnum-1_0.png new file mode 100644 index 00000000..5237a940 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiBehavioralAnalysisTacticalObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiCodeAnalysisStrategicObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiCodeAnalysisStrategicObjectivesEnum-1_0.png new file mode 100644 index 00000000..8fffc889 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiCodeAnalysisStrategicObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiCodeAnalysisTacticalObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiCodeAnalysisTacticalObjectivesEnum-1_0.png new file mode 100644 index 00000000..c09a4eca Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiCodeAnalysisTacticalObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiDetectionStrategicObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiDetectionStrategicObjectivesEnum-1_0.png new file mode 100644 index 00000000..49619942 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiDetectionStrategicObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiDetectionTacticalObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiDetectionTacticalObjectivesEnum-1_0.png new file mode 100644 index 00000000..9bba6b27 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiDetectionTacticalObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiRemovalStrategicObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiRemovalStrategicObjectivesEnum-1_0.png new file mode 100644 index 00000000..5f3cdb6c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiRemovalStrategicObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiRemovalTacticalObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiRemovalTacticalObjectivesEnum-1_0.png new file mode 100644 index 00000000..0b2f8f80 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AntiRemovalTacticalObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AvailabilityViolationPropertiesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AvailabilityViolationPropertiesEnum-1_0.png new file mode 100644 index 00000000..0d332827 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AvailabilityViolationPropertiesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AvailabilityViolationStrategicObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AvailabilityViolationStrategicObjectivesEnum-1_0.png new file mode 100644 index 00000000..6a243af3 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AvailabilityViolationStrategicObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AvailabilityViolationTacticalObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AvailabilityViolationTacticalObjectivesEnum-1_0.png new file mode 100644 index 00000000..35b365fa Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_AvailabilityViolationTacticalObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_CapabilityObjectiveRelationshipEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_CapabilityObjectiveRelationshipEnum-1_0.png new file mode 100644 index 00000000..17dcae37 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_CapabilityObjectiveRelationshipEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_CommandandControlPropertiesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_CommandandControlPropertiesEnum-1_0.png new file mode 100644 index 00000000..3419522d Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_CommandandControlPropertiesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_CommandandControlStrategicObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_CommandandControlStrategicObjectivesEnum-1_0.png new file mode 100644 index 00000000..30b6dbca Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_CommandandControlStrategicObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_CommandandControlTacticalObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_CommandandControlTacticalObjectivesEnum-1_0.png new file mode 100644 index 00000000..566716a2 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_CommandandControlTacticalObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_CommonCapabilityPropertiesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_CommonCapabilityPropertiesEnum-1_0.png new file mode 100644 index 00000000..be32bfdc Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_CommonCapabilityPropertiesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DNSActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DNSActionNameEnum-1_0.png new file mode 100644 index 00000000..85d3d6ac Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DNSActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DataExfiltrationPropertiesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DataExfiltrationPropertiesEnum-1_0.png new file mode 100644 index 00000000..8ed71a71 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DataExfiltrationPropertiesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DataExfiltrationStrategicObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DataExfiltrationStrategicObjectivesEnum-1_0.png new file mode 100644 index 00000000..44d0fb1c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DataExfiltrationStrategicObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DataExfiltrationTacticalObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DataExfiltrationTacticalObjectivesEnum-1_0.png new file mode 100644 index 00000000..c1bddd2a Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DataExfiltrationTacticalObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DataTheftPropertiesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DataTheftPropertiesEnum-1_0.png new file mode 100644 index 00000000..e5f1daa1 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DataTheftPropertiesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DataTheftStrategicObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DataTheftStrategicObjectivesEnum-1_0.png new file mode 100644 index 00000000..a959c446 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DataTheftStrategicObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DataTheftTacticalObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DataTheftTacticalObjectivesEnum-1_0.png new file mode 100644 index 00000000..c2fd5777 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DataTheftTacticalObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DebuggingActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DebuggingActionNameEnum-1_0.png new file mode 100644 index 00000000..63154ba1 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DebuggingActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DestructionPropertiesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DestructionPropertiesEnum-1_0.png new file mode 100644 index 00000000..e1654733 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DestructionPropertiesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DestructionStrategicObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DestructionStrategicObjectivesEnum-1_0.png new file mode 100644 index 00000000..4274f5dc Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DestructionStrategicObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DestructionTacticalObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DestructionTacticalObjectivesEnum-1_0.png new file mode 100644 index 00000000..32af7551 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DestructionTacticalObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DeviceDriverActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DeviceDriverActionNameEnum-1_0.png new file mode 100644 index 00000000..438bb11e Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DeviceDriverActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DeviceDriverActionNameEnum-1_1.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DeviceDriverActionNameEnum-1_1.png new file mode 100644 index 00000000..f2753a55 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DeviceDriverActionNameEnum-1_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DirectoryActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DirectoryActionNameEnum-1_0.png new file mode 100644 index 00000000..88832a0b Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DirectoryActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DirectoryActionNameEnum-1_1.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DirectoryActionNameEnum-1_1.png new file mode 100644 index 00000000..9f71e680 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DirectoryActionNameEnum-1_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DiskActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DiskActionNameEnum-1_0.png new file mode 100644 index 00000000..1b81f576 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DiskActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DiskActionNameEnum-1_1.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DiskActionNameEnum-1_1.png new file mode 100644 index 00000000..cc3a98b4 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_DiskActionNameEnum-1_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_FTPActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_FTPActionNameEnum-1_0.png new file mode 100644 index 00000000..7c9b1242 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_FTPActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_FileActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_FileActionNameEnum-1_0.png new file mode 100644 index 00000000..17b881f3 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_FileActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_FileActionNameEnum-1_1.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_FileActionNameEnum-1_1.png new file mode 100644 index 00000000..108d1305 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_FileActionNameEnum-1_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_FraudStrategicObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_FraudStrategicObjectivesEnum-1_0.png new file mode 100644 index 00000000..24a6f458 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_FraudStrategicObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_FraudTacticalObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_FraudTacticalObjectivesEnum-1_0.png new file mode 100644 index 00000000..5348d529 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_FraudTacticalObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_GUIActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_GUIActionNameEnum-1_0.png new file mode 100644 index 00000000..edb620eb Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_GUIActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_GroupingRelationshipEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_GroupingRelationshipEnum-1_0.png new file mode 100644 index 00000000..722a51d6 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_GroupingRelationshipEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_HTTPActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_HTTPActionNameEnum-1_0.png new file mode 100644 index 00000000..2305fe71 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_HTTPActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_HookingActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_HookingActionNameEnum-1_0.png new file mode 100644 index 00000000..4523f34b Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_HookingActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_HookingActionNameEnum-1_1.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_HookingActionNameEnum-1_1.png new file mode 100644 index 00000000..fbb69b3f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_HookingActionNameEnum-1_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_IPCActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_IPCActionNameEnum-1_0.png new file mode 100644 index 00000000..07b6fbb1 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_IPCActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_IRCActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_IRCActionNameEnum-1_0.png new file mode 100644 index 00000000..bb272efa Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_IRCActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ImportanceTypeEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ImportanceTypeEnum-1_0.png new file mode 100644 index 00000000..cf9ee312 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ImportanceTypeEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_InfectionPropagationPropertiesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_InfectionPropagationPropertiesEnum-1_0.png new file mode 100644 index 00000000..178ae8ee Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_InfectionPropagationPropertiesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_InfectionPropagationStrategicObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_InfectionPropagationStrategicObjectivesEnum-1_0.png new file mode 100644 index 00000000..06e76e6c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_InfectionPropagationStrategicObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_InfectionPropagationTacticalObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_InfectionPropagationTacticalObjectivesEnum-1_0.png new file mode 100644 index 00000000..906baf88 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_InfectionPropagationTacticalObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_IntegrityViolationStrategicObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_IntegrityViolationStrategicObjectivesEnum-1_0.png new file mode 100644 index 00000000..bf6de96e Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_IntegrityViolationStrategicObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_IntegrityViolationTacticalObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_IntegrityViolationTacticalObjectivesEnum-1_0.png new file mode 100644 index 00000000..3e3efe86 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_IntegrityViolationTacticalObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_LibraryActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_LibraryActionNameEnum-1_0.png new file mode 100644 index 00000000..2a5a3d41 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_LibraryActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_LibraryActionNameEnum-1_1.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_LibraryActionNameEnum-1_1.png new file mode 100644 index 00000000..cba39958 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_LibraryActionNameEnum-1_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MachineAccessControlPropertiesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MachineAccessControlPropertiesEnum-1_0.png new file mode 100644 index 00000000..c8e9bfff Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MachineAccessControlPropertiesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MachineAccessControlStrategicObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MachineAccessControlStrategicObjectivesEnum-1_0.png new file mode 100644 index 00000000..aa6cf57a Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MachineAccessControlStrategicObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MachineAccessControlTacticalObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MachineAccessControlTacticalObjectivesEnum-1_0.png new file mode 100644 index 00000000..87859cf7 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MachineAccessControlTacticalObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareCapabilityEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareCapabilityEnum-1_0.png new file mode 100644 index 00000000..29ee2ce7 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareCapabilityEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareConfigurationParameterEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareConfigurationParameterEnum-1_0.png new file mode 100644 index 00000000..bf49d454 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareConfigurationParameterEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareDevelopmentToolEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareDevelopmentToolEnum-1_0.png new file mode 100644 index 00000000..9e16348d Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareDevelopmentToolEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareEntityTypeEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareEntityTypeEnum-1_0.png new file mode 100644 index 00000000..5f6c5d67 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareEntityTypeEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareLabelEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareLabelEnum-1_0.png new file mode 100644 index 00000000..f2763e42 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareLabelEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareSubjectRelationshipEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareSubjectRelationshipEnum-1_0.png new file mode 100644 index 00000000..c429ed41 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareSubjectRelationshipEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareSubjectRelationshipEnum-1_1.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareSubjectRelationshipEnum-1_1.png new file mode 100644 index 00000000..469b6695 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_MalwareSubjectRelationshipEnum-1_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_NetworkActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_NetworkActionNameEnum-1_0.png new file mode 100644 index 00000000..afa843ac Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_NetworkActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_NetworkActionNameEnum-1_1.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_NetworkActionNameEnum-1_1.png new file mode 100644 index 00000000..ccc3991b Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_NetworkActionNameEnum-1_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_NetworkShareActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_NetworkShareActionNameEnum-1_0.png new file mode 100644 index 00000000..2bf84b4b Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_NetworkShareActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_PersistencePropertiesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_PersistencePropertiesEnum-1_0.png new file mode 100644 index 00000000..b8b535a4 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_PersistencePropertiesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_PersistenceStrategicObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_PersistenceStrategicObjectivesEnum-1_0.png new file mode 100644 index 00000000..956ef6dd Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_PersistenceStrategicObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_PersistenceTacticalObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_PersistenceTacticalObjectivesEnum-1_0.png new file mode 100644 index 00000000..57b0cb5b Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_PersistenceTacticalObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_PrivilegeEscalationPropertiesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_PrivilegeEscalationPropertiesEnum-1_0.png new file mode 100644 index 00000000..1127402d Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_PrivilegeEscalationPropertiesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_PrivilegeEscalationStrategicObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_PrivilegeEscalationStrategicObjectivesEnum-1_0.png new file mode 100644 index 00000000..05ff6961 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_PrivilegeEscalationStrategicObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_PrivilegeEscalationTacticalObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_PrivilegeEscalationTacticalObjectivesEnum-1_0.png new file mode 100644 index 00000000..cddf656e Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_PrivilegeEscalationTacticalObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ProbingStrategicObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ProbingStrategicObjectivesEnum-1_0.png new file mode 100644 index 00000000..c05ad489 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ProbingStrategicObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ProbingTacticalObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ProbingTacticalObjectivesEnum-1_0.png new file mode 100644 index 00000000..cc9537f1 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ProbingTacticalObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ProcessActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ProcessActionNameEnum-1_0.png new file mode 100644 index 00000000..27c29d9b Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ProcessActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ProcessMemoryActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ProcessMemoryActionNameEnum-1_0.png new file mode 100644 index 00000000..a73818e5 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ProcessMemoryActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ProcessThreadActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ProcessThreadActionNameEnum-1_0.png new file mode 100644 index 00000000..a1b4f92e Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ProcessThreadActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_RegistryActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_RegistryActionNameEnum-1_0.png new file mode 100644 index 00000000..2a0107c8 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_RegistryActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_RemoteMachineManipulationStrategicObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_RemoteMachineManipulationStrategicObjectivesEnum-1_0.png new file mode 100644 index 00000000..5c108b3f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_RemoteMachineManipulationStrategicObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_RemoteMachineManipulationTacticalObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_RemoteMachineManipulationTacticalObjectivesEnum-1_0.png new file mode 100644 index 00000000..f43f3131 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_RemoteMachineManipulationTacticalObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SecondaryOperationPropertiesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SecondaryOperationPropertiesEnum-1_0.png new file mode 100644 index 00000000..910b1090 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SecondaryOperationPropertiesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SecondaryOperationStrategicObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SecondaryOperationStrategicObjectivesEnum-1_0.png new file mode 100644 index 00000000..62f8662e Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SecondaryOperationStrategicObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SecondaryOperationTacticalObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SecondaryOperationTacticalObjectivesEnum-1_0.png new file mode 100644 index 00000000..f546e322 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SecondaryOperationTacticalObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SecurityDegradationPropertiesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SecurityDegradationPropertiesEnum-1_0.png new file mode 100644 index 00000000..48169685 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SecurityDegradationPropertiesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SecurityDegradationStrategicObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SecurityDegradationStrategicObjectivesEnum-1_0.png new file mode 100644 index 00000000..64c58264 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SecurityDegradationStrategicObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SecurityDegradationTacticalObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SecurityDegradationTacticalObjectivesEnum-1_0.png new file mode 100644 index 00000000..3acf3b9e Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SecurityDegradationTacticalObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ServiceActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ServiceActionNameEnum-1_0.png new file mode 100644 index 00000000..100034c9 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ServiceActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ServiceActionNameEnum-1_1.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ServiceActionNameEnum-1_1.png new file mode 100644 index 00000000..7d74ef1e Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_ServiceActionNameEnum-1_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SocketActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SocketActionNameEnum-1_0.png new file mode 100644 index 00000000..5c4d21d8 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SocketActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SpyingStrategicObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SpyingStrategicObjectivesEnum-1_0.png new file mode 100644 index 00000000..d90b726f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SpyingStrategicObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SpyingTacticalObjectivesEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SpyingTacticalObjectivesEnum-1_0.png new file mode 100644 index 00000000..b6f89421 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SpyingTacticalObjectivesEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SynchronizationActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SynchronizationActionNameEnum-1_0.png new file mode 100644 index 00000000..a642d496 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SynchronizationActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SystemActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SystemActionNameEnum-1_0.png new file mode 100644 index 00000000..551880cc Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_SystemActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_UserActionNameEnum-1_0.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_UserActionNameEnum-1_0.png new file mode 100644 index 00000000..8fd0489a Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_UserActionNameEnum-1_0.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_UserActionNameEnum-1_1.png b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_UserActionNameEnum-1_1.png new file mode 100644 index 00000000..3198303d Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_default_vocabularies_xsd_Simple_Type_maecVocabs_UserActionNameEnum-1_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ActionEquivalenceListType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ActionEquivalenceListType.png new file mode 100644 index 00000000..5ff01061 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ActionEquivalenceListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ActionEquivalenceType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ActionEquivalenceType.png new file mode 100644 index 00000000..86cb3905 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ActionEquivalenceType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_AnalysisEnvironmentType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_AnalysisEnvironmentType.png new file mode 100644 index 00000000..56ba7e87 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_AnalysisEnvironmentType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_AnalysisListType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_AnalysisListType.png new file mode 100644 index 00000000..b1c431ea Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_AnalysisListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_AnalysisSystemListType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_AnalysisSystemListType.png new file mode 100644 index 00000000..8f5ae2ff Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_AnalysisSystemListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_AnalysisSystemType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_AnalysisSystemType.png new file mode 100644 index 00000000..fb67d43d Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_AnalysisSystemType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_AnalysisType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_AnalysisType.png new file mode 100644 index 00000000..728658f2 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_AnalysisType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_CapturedProtocolListType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_CapturedProtocolListType.png new file mode 100644 index 00000000..35aa9278 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_CapturedProtocolListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_CapturedProtocolType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_CapturedProtocolType.png new file mode 100644 index 00000000..616756a4 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_CapturedProtocolType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ClusterCompositionType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ClusterCompositionType.png new file mode 100644 index 00000000..223736e8 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ClusterCompositionType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ClusterEdgeNodePairType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ClusterEdgeNodePairType.png new file mode 100644 index 00000000..bead542d Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ClusterEdgeNodePairType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ClusteringAlgorithmParametersType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ClusteringAlgorithmParametersType.png new file mode 100644 index 00000000..fc12e5a6 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ClusteringAlgorithmParametersType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ClusteringMetadataType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ClusteringMetadataType.png new file mode 100644 index 00000000..33aecdb8 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ClusteringMetadataType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_CommentListType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_CommentListType.png new file mode 100644 index 00000000..99325b27 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_CommentListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_CommentType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_CommentType.png new file mode 100644 index 00000000..85521eaf Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_CommentType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_DynamicAnalysisMetadataType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_DynamicAnalysisMetadataType.png new file mode 100644 index 00000000..582f1db5 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_DynamicAnalysisMetadataType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_FindingsBundleListType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_FindingsBundleListType.png new file mode 100644 index 00000000..57a0321c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_FindingsBundleListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_GroupingRelationshipListType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_GroupingRelationshipListType.png new file mode 100644 index 00000000..e0e08003 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_GroupingRelationshipListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_GroupingRelationshipType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_GroupingRelationshipType.png new file mode 100644 index 00000000..2e799078 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_GroupingRelationshipType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_HypervisorHostSystemType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_HypervisorHostSystemType.png new file mode 100644 index 00000000..46ca8ce2 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_HypervisorHostSystemType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_InstalledProgramsType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_InstalledProgramsType.png new file mode 100644 index 00000000..8c733501 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_InstalledProgramsType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareBinaryConfigurationStorageDetailsType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareBinaryConfigurationStorageDetailsType.png new file mode 100644 index 00000000..9fa39496 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareBinaryConfigurationStorageDetailsType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareConfigurationDetailsType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareConfigurationDetailsType.png new file mode 100644 index 00000000..10c132e4 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareConfigurationDetailsType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareConfigurationObfuscationAlgorithmType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareConfigurationObfuscationAlgorithmType.png new file mode 100644 index 00000000..00128043 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareConfigurationObfuscationAlgorithmType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareConfigurationObfuscationDetailsType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareConfigurationObfuscationDetailsType.png new file mode 100644 index 00000000..9010cbca Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareConfigurationObfuscationDetailsType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareConfigurationParameterType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareConfigurationParameterType.png new file mode 100644 index 00000000..d65249d5 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareConfigurationParameterType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareConfigurationStorageDetailsType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareConfigurationStorageDetailsType.png new file mode 100644 index 00000000..3fb0da2a Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareConfigurationStorageDetailsType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareDevelopmentEnvironmentType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareDevelopmentEnvironmentType.png new file mode 100644 index 00000000..a2612436 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareDevelopmentEnvironmentType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareExceptionType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareExceptionType.png new file mode 100644 index 00000000..23ce8698 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareExceptionType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareSubjectListType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareSubjectListType.png new file mode 100644 index 00000000..ec2b9032 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareSubjectListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareSubjectReferenceType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareSubjectReferenceType.png new file mode 100644 index 00000000..2d1b6f59 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareSubjectReferenceType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareSubjectRelationshipListType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareSubjectRelationshipListType.png new file mode 100644 index 00000000..4a91c05b Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareSubjectRelationshipListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareSubjectRelationshipType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareSubjectRelationshipType.png new file mode 100644 index 00000000..ee4ef721 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareSubjectRelationshipType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareSubjectType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareSubjectType.png new file mode 100644 index 00000000..e1623e0f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MalwareSubjectType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MetaAnalysisType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MetaAnalysisType.png new file mode 100644 index 00000000..4d7ea51f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MetaAnalysisType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MinorVariantListType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MinorVariantListType.png new file mode 100644 index 00000000..cacdd511 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_MinorVariantListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_NetworkInfrastructureType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_NetworkInfrastructureType.png new file mode 100644 index 00000000..9b3d855c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_NetworkInfrastructureType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ObjectEquivalenceListType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ObjectEquivalenceListType.png new file mode 100644 index 00000000..0d2badad Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ObjectEquivalenceListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ObjectEquivalenceType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ObjectEquivalenceType.png new file mode 100644 index 00000000..94aced40 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ObjectEquivalenceType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_PackageType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_PackageType.png new file mode 100644 index 00000000..27fb1d14 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_PackageType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_SourceType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_SourceType.png new file mode 100644 index 00000000..9b695213 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_SourceType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ToolListType.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ToolListType.png new file mode 100644 index 00000000..d2c2cb3b Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Complex_Type_maecPackage_ToolListType.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Action_Equivalence.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Action_Equivalence.png new file mode 100644 index 00000000..18bd4a14 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Action_Equivalence.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Action_Equivalences.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Action_Equivalences.png new file mode 100644 index 00000000..584c24e8 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Action_Equivalences.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Action_Reference.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Action_Reference.png new file mode 100644 index 00000000..de2eec16 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Action_Reference.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Algorithm_Details.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Algorithm_Details.png new file mode 100644 index 00000000..f0d63ef2 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Algorithm_Details.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Algorithm_Name.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Algorithm_Name.png new file mode 100644 index 00000000..9d9fd89f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Algorithm_Name.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Algorithm_Name_1.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Algorithm_Name_1.png new file mode 100644 index 00000000..ac5bdc24 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Algorithm_Name_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Algorithm_Parameters.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Algorithm_Parameters.png new file mode 100644 index 00000000..41bf4930 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Algorithm_Parameters.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Algorithm_Version.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Algorithm_Version.png new file mode 100644 index 00000000..22bf0ac3 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Algorithm_Version.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analyses.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analyses.png new file mode 100644 index 00000000..760b0b3f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analyses.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analysis.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analysis.png new file mode 100644 index 00000000..fd368859 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analysis.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analysis_Duration.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analysis_Duration.png new file mode 100644 index 00000000..d88d52e9 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analysis_Duration.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analysis_Environment.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analysis_Environment.png new file mode 100644 index 00000000..22ce089c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analysis_Environment.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analysis_System.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analysis_System.png new file mode 100644 index 00000000..1e9dd4a5 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analysis_System.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analysis_Systems.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analysis_Systems.png new file mode 100644 index 00000000..785327b6 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analysis_Systems.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analysts.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analysts.png new file mode 100644 index 00000000..f61b2824 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Analysts.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Bundle.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Bundle.png new file mode 100644 index 00000000..deddcce3 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Bundle.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Bundle_External_Reference.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Bundle_External_Reference.png new file mode 100644 index 00000000..54adbc3f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Bundle_External_Reference.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Captured_Protocols.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Captured_Protocols.png new file mode 100644 index 00000000..279d141d Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Captured_Protocols.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Cluster_Composition.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Cluster_Composition.png new file mode 100644 index 00000000..4da6fae5 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Cluster_Composition.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Cluster_Description.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Cluster_Description.png new file mode 100644 index 00000000..12d684cf Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Cluster_Description.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Cluster_Size.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Cluster_Size.png new file mode 100644 index 00000000..c11fd32b Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Cluster_Size.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Clustering_Metadata.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Clustering_Metadata.png new file mode 100644 index 00000000..f76b8b8f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Clustering_Metadata.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Command_Line.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Command_Line.png new file mode 100644 index 00000000..6410d4b9 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Command_Line.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Comment.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Comment.png new file mode 100644 index 00000000..bab002d4 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Comment.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Comments.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Comments.png new file mode 100644 index 00000000..bcd8a6d7 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Comments.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Compatible_Platform.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Compatible_Platform.png new file mode 100644 index 00000000..f5142da7 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Compatible_Platform.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Configuration_Details.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Configuration_Details.png new file mode 100644 index 00000000..55dc436d Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Configuration_Details.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Configuration_Parameter.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Configuration_Parameter.png new file mode 100644 index 00000000..04ae19d9 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Configuration_Parameter.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Debugging_File.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Debugging_File.png new file mode 100644 index 00000000..dd89b6a8 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Debugging_File.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Description.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Description.png new file mode 100644 index 00000000..c3ebc1f7 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Description.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Development_Environment.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Development_Environment.png new file mode 100644 index 00000000..fa142659 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Development_Environment.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Distance_Threshold.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Distance_Threshold.png new file mode 100644 index 00000000..24dd10d2 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Distance_Threshold.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Dynamic_Analysis_Metadata.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Dynamic_Analysis_Metadata.png new file mode 100644 index 00000000..c9a99840 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Dynamic_Analysis_Metadata.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Edge_Node_Pair.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Edge_Node_Pair.png new file mode 100644 index 00000000..5da7b2d7 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Edge_Node_Pair.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Exception_Code.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Exception_Code.png new file mode 100644 index 00000000..11ac4f9f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Exception_Code.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Exit_Code.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Exit_Code.png new file mode 100644 index 00000000..56868b00 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Exit_Code.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Faulting_Address.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Faulting_Address.png new file mode 100644 index 00000000..a57ab0b8 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Faulting_Address.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Field_Data.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Field_Data.png new file mode 100644 index 00000000..206ca3bf Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Field_Data.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_File.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_File.png new file mode 100644 index 00000000..c6a724bd Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_File.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_File_Offset.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_File_Offset.png new file mode 100644 index 00000000..1e523cf7 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_File_Offset.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Findings_Bundle_Reference.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Findings_Bundle_Reference.png new file mode 100644 index 00000000..58a42518 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Findings_Bundle_Reference.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Findings_Bundles.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Findings_Bundles.png new file mode 100644 index 00000000..d5703b28 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Findings_Bundles.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Grouping_Relationship.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Grouping_Relationship.png new file mode 100644 index 00000000..76833780 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Grouping_Relationship.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Grouping_Relationships.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Grouping_Relationships.png new file mode 100644 index 00000000..df7b39a8 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Grouping_Relationships.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Hypervisor_Host_System.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Hypervisor_Host_System.png new file mode 100644 index 00000000..305ad032 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Hypervisor_Host_System.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Installed_Programs.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Installed_Programs.png new file mode 100644 index 00000000..d85e657b Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Installed_Programs.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Key.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Key.png new file mode 100644 index 00000000..879d3a21 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Key.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Label.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Label.png new file mode 100644 index 00000000..2e197dd4 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Label.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_MAEC_Package.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_MAEC_Package.png new file mode 100644 index 00000000..a53105f9 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_MAEC_Package.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Binary.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Binary.png new file mode 100644 index 00000000..a23fd95b Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Binary.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Family_Name.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Family_Name.png new file mode 100644 index 00000000..c9e12394 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Family_Name.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Instance_Object_Attributes.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Instance_Object_Attributes.png new file mode 100644 index 00000000..7899d6ce Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Instance_Object_Attributes.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Subject.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Subject.png new file mode 100644 index 00000000..2673bccd Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Subject.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Subject_Node_A.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Subject_Node_A.png new file mode 100644 index 00000000..e7548c12 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Subject_Node_A.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Subject_Node_B.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Subject_Node_B.png new file mode 100644 index 00000000..b04a432c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Subject_Node_B.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Subject_Reference.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Subject_Reference.png new file mode 100644 index 00000000..d02ededd Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Subject_Reference.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Subjects.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Subjects.png new file mode 100644 index 00000000..be4b6346 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Subjects.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Toolkit_Name.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Toolkit_Name.png new file mode 100644 index 00000000..9350313f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Malware_Toolkit_Name.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Meta_Analysis.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Meta_Analysis.png new file mode 100644 index 00000000..7db90a40 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Meta_Analysis.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Method.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Method.png new file mode 100644 index 00000000..6ab8e987 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Method.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Minor_Variant.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Minor_Variant.png new file mode 100644 index 00000000..8fd6f5e6 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Minor_Variant.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Minor_Variants.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Minor_Variants.png new file mode 100644 index 00000000..97d6dbb8 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Minor_Variants.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Name.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Name.png new file mode 100644 index 00000000..3ebf967e Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Name.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Name_1.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Name_1.png new file mode 100644 index 00000000..53dd9951 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Name_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Network_Infrastructure.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Network_Infrastructure.png new file mode 100644 index 00000000..6aa5bd97 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Network_Infrastructure.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Number_of_Iterations.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Number_of_Iterations.png new file mode 100644 index 00000000..f3d08c66 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Number_of_Iterations.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Obfuscation.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Obfuscation.png new file mode 100644 index 00000000..6011c23d Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Obfuscation.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Object_Equivalence.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Object_Equivalence.png new file mode 100644 index 00000000..fe22f785 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Object_Equivalence.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Object_Equivalences.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Object_Equivalences.png new file mode 100644 index 00000000..7431b365 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Object_Equivalences.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Organization.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Organization.png new file mode 100644 index 00000000..50508fce Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Organization.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Program.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Program.png new file mode 100644 index 00000000..6da008fc Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Program.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Protocol.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Protocol.png new file mode 100644 index 00000000..634df7b5 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Protocol.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Raised_Exception.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Raised_Exception.png new file mode 100644 index 00000000..748db3cd Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Raised_Exception.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Reference.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Reference.png new file mode 100644 index 00000000..2da9750d Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Reference.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Relationship.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Relationship.png new file mode 100644 index 00000000..6f473066 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Relationship.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Relationships.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Relationships.png new file mode 100644 index 00000000..4571933d Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Relationships.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Report.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Report.png new file mode 100644 index 00000000..35421aa4 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Report.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Section_Name.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Section_Name.png new file mode 100644 index 00000000..d0a3f293 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Section_Name.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Section_Offset.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Section_Offset.png new file mode 100644 index 00000000..911b2bc0 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Section_Offset.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Source.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Source.png new file mode 100644 index 00000000..316a49ea Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Source.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Storage.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Storage.png new file mode 100644 index 00000000..6cd42047 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Storage.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Summary.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Summary.png new file mode 100644 index 00000000..32c439df Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Summary.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Tool.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Tool.png new file mode 100644 index 00000000..90ce9e9f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Tool.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Tools.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Tools.png new file mode 100644 index 00000000..92bae973 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Tools.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Tools_1.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Tools_1.png new file mode 100644 index 00000000..0199ef99 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Tools_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Type.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Type.png new file mode 100644 index 00000000..055c3791 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Type.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Type_1.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Type_1.png new file mode 100644 index 00000000..7c1bdf10 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Type_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_URL.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_URL.png new file mode 100644 index 00000000..ae6b2f50 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_URL.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_URL_1.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_URL_1.png new file mode 100644 index 00000000..2e1f7b7c Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_URL_1.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_VM_Hypervisor.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_VM_Hypervisor.png new file mode 100644 index 00000000..3a2ee0d9 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_VM_Hypervisor.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Value.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Value.png new file mode 100644 index 00000000..1b0bd915 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Element_maecPackage_Value.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Simple_Type_maecPackage_AnalysisMethodEnum.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Simple_Type_maecPackage_AnalysisMethodEnum.png new file mode 100644 index 00000000..b0329995 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Simple_Type_maecPackage_AnalysisMethodEnum.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Simple_Type_maecPackage_AnalysisTypeEnum.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Simple_Type_maecPackage_AnalysisTypeEnum.png new file mode 100644 index 00000000..7967916a Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Simple_Type_maecPackage_AnalysisTypeEnum.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Simple_Type_maecPackage_InteractionLevelEnum.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Simple_Type_maecPackage_InteractionLevelEnum.png new file mode 100644 index 00000000..b384c96f Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Simple_Type_maecPackage_InteractionLevelEnum.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Simple_Type_maecPackage_Layer4ProtocolEnum.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Simple_Type_maecPackage_Layer4ProtocolEnum.png new file mode 100644 index 00000000..5fd92aa8 Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Simple_Type_maecPackage_Layer4ProtocolEnum.png differ diff --git a/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Simple_Type_maecPackage_Layer7ProtocolEnum.png b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Simple_Type_maecPackage_Layer7ProtocolEnum.png new file mode 100644 index 00000000..38b6772b Binary files /dev/null and b/documentation/maec4.1-xsddocs/img/maec_package_schema_xsd_Simple_Type_maecPackage_Layer7ProtocolEnum.png differ diff --git a/documentation/maec4.1-xsddocs/maec-bundle-4.html b/documentation/maec4.1-xsddocs/maec-bundle-4.html new file mode 100644 index 00000000..e966dbef --- /dev/null +++ b/documentation/maec4.1-xsddocs/maec-bundle-4.html @@ -0,0 +1,16957 @@ + + + + + Schema documentation for namespace http://maec.mitre.org/XMLSchema/maec-bundle-4 + + +
    + + + + + + + + + + + + + + + + +
    +

    Showing:

    + + + + + + + + + + + + + + + + +
    Annotations
    Attributes
    Diagrams
    Facets
    Instances
    +
    +
    +
    Main schema maec_bundle_schema.xsd
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The following is a description of the elements, types, and attributes that compose Malware Attribute Enumeration and Characterization (MAEC) Bundle schema.
    +
    +
    + + + + + 
    The MAEC Bundle Schema is maintained by The Mitre Corporation. For more information, including how to get involved in the project, please visit the MAEC website at http://maec.mitre.org.
    +
    +
    + + + + + 
    This schema imports the CyBOX schema and object schemas. More info on CybOX can be found at http://cybox.mitre.org.
    +
    +
    +
    +
    Element maecBundle:MAEC_Bundle
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MAEC_Bundle element is the root element of this schema, and is of type BundleType. As such, it represents the characterization of a single malware instance, characterized in the top-level Subject_Details element, via its MAEC entities.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BundleType_id + NO_NAMESPACE.tmp#BundleType_schema_version + NO_NAMESPACE.tmp#BundleType_defined_subject + NO_NAMESPACE.tmp#BundleType_content_type + NO_NAMESPACE.tmp#BundleType_timestamp + maec-bundle-4.tmp#BundleType_Malware_Instance_Object_Attributes + maec-bundle-4.tmp#BundleType_AV_Classifications + maec-bundle-4.tmp#BundleType_Process_Tree + maec-bundle-4.tmp#BundleType_Capabilities + maec-bundle-4.tmp#BundleType_Behaviors + maec-bundle-4.tmp#BundleType_Actions + maec-bundle-4.tmp#BundleType_Objects + maec-bundle-4.tmp#BundleType_Candidate_Indicators + maec-bundle-4.tmp#BundleType_Collections + maec-bundle-4.tmp#BundleType
    +
    TypemaecBundle:BundleType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:MAEC_Bundle content_type="" defined_subject="" id="" schema_version="4.1" timestamp="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Malware_Instance_Object_Attributes has_changed="" id="" idref="">{0,1}</maecBundle:Malware_Instance_Object_Attributes>
+  <maecBundle:AV_Classifications>{0,1}</maecBundle:AV_Classifications>
+  <maecBundle:Process_Tree>{0,1}</maecBundle:Process_Tree>
+  <maecBundle:Capabilities>{0,1}</maecBundle:Capabilities>
+  <maecBundle:Behaviors>{0,1}</maecBundle:Behaviors>
+  <maecBundle:Actions>{0,1}</maecBundle:Actions>
+  <maecBundle:Objects>{0,1}</maecBundle:Objects>
+  <maecBundle:Candidate_Indicators>{0,1}</maecBundle:Candidate_Indicators>
+  <maecBundle:Collections>{0,1}</maecBundle:Collections>
+</maecBundle:MAEC_Bundle>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeFixedUseAnnotation
    content_typemaecBundle:BundleContentTypeEnumoptional +
    + + + + + 
    The content_type field specifies the general type of content contained in this Bundle, e.g. static analysis tool output, dynamic analysis tool output, etc.
    +
    +
    defined_subjectxs:booleanrequired +
    + + + + + 
    The required defined_subject field specifies whether the subject attributes of the characterized malware instance are included inside this Bundle (via the top-level Malware_Instance_Object_Attributes field) or elsewhere (such as a MAEC Subject in a MAEC Package).
    +
    +
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for this MAEC Bundle.
    +
    +
    schema_versionxs:string4.1required +
    + + + + + 
    The required schema_version field specifies the version of the MAEC Bundle Schema that the document has been written in and that should be used for validation.
    +
    +
    timestampxs:dateTimeoptional +
    + + + + + 
    The timestamp field specifies the date/time that the bundle was generated.
    +
    +
    +
    +
    +
    Element maecBundle:BundleType / maecBundle:Malware_Instance_Object_Attributes
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Malware_Instance_Object_Attributes field characterizes the attributes of the object (most typically a file) that represents the malware instance whose Behaviors, Actions, Objects, Process Tree, and Candidate Indicators are characterized in this Bundle. This is equivalent to the Malware_Instance_Object_Attributes inside of a Malware_Subject in the MAEC Package, and is therefore only required if this Bundle is to be used in a stand-alone fashion, i.e., without an accompanying MAEC Package and with the defined_subject field set to 'True'.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typecybox:ObjectType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Malware_Instance_Object_Attributes has_changed="" id="" idref="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4" xmlns:cybox="http://cybox.mitre.org/cybox-2">
+  <cybox:State apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</cybox:State>
+  <cybox:Description structuring_format="">{0,1}</cybox:Description>
+  <cybox:Properties object_reference="">{0,1}</cybox:Properties>
+  <cybox:Domain_Specific_Object_Properties>{0,1}</cybox:Domain_Specific_Object_Properties>
+  <cybox:Location id="" idref="">{0,1}</cybox:Location>
+  <cybox:Related_Objects>{0,1}</cybox:Related_Objects>
+  <cybox:Defined_Effect effect_type="">{0,1}</cybox:Defined_Effect>
+  <cybox:Discovery_Method class="" name="" sighting_count="" source_type="">{0,1}</cybox:Discovery_Method>
+</maecBundle:Malware_Instance_Object_Attributes>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    has_changedxs:booleanoptional +
    + + + + + 
    The has_changed field is optional and conveys a targeted observation pattern of whether the associated object specified has changed in some way without requiring further specific detail. This field would be leveraged within a pattern observable triggering on whether the value of an object specification has changed at all. This field is NOT intended to be used for versioning of CybOX content.
    +
    +
    idxs:QNameoptional +
    + + + + + 
    The id field specifies a unique id for this Object.
    +
    +
    idrefxs:QNameoptional +
    + + + + + 
    The idref field specifies a unique id reference to an Object defined elsewhere.
    + + + + + 
    When idref is specified, the id attribute must not be specified, and any instance of this Object should not hold content unless an extension of the Object allows it.
    +
    +
    +
    +
    +
    Element maecBundle:BundleType / maecBundle:AV_Classifications
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AV_Classifications field contains 1-n AVClassificationType objects, which capture any Anti-Virus scanner tool classifications of the malware instance object.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#AVClassificationsType_AV_Classification + maec-bundle-4.tmp#AVClassificationsType
    +
    TypemaecBundle:AVClassificationsType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:AV_Classifications xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:AV_Classification id="" idref="">{1,unbounded}</maecBundle:AV_Classification>
+</maecBundle:AV_Classifications>
    +
    +
    +
    Element maecBundle:AVClassificationsType / maecBundle:AV_Classification
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AV_Classification field captures a single AV classication of the malware instance object.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#AVClassificationType_Engine_Version + maec-bundle-4.tmp#AVClassificationType_Definition_Version + maec-bundle-4.tmp#AVClassificationType_Classification_Name + maec-bundle-4.tmp#AVClassificationType
    +
    TypemaecBundle:AVClassificationType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:AV_Classification id="" idref="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4" xmlns:cyboxCommon="http://cybox.mitre.org/common-2">
+  <cyboxCommon:Name>{0,1}</cyboxCommon:Name>
+  <cyboxCommon:Type apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,unbounded}</cyboxCommon:Type>
+  <cyboxCommon:Description structuring_format="">{0,1}</cyboxCommon:Description>
+  <cyboxCommon:References>{0,1}</cyboxCommon:References>
+  <cyboxCommon:Vendor>{0,1}</cyboxCommon:Vendor>
+  <cyboxCommon:Version>{0,1}</cyboxCommon:Version>
+  <cyboxCommon:Service_Pack>{0,1}</cyboxCommon:Service_Pack>
+  <cyboxCommon:Tool_Specific_Data>{0,1}</cyboxCommon:Tool_Specific_Data>
+  <cyboxCommon:Tool_Hashes>{0,1}</cyboxCommon:Tool_Hashes>
+  <cyboxCommon:Tool_Configuration>{0,1}</cyboxCommon:Tool_Configuration>
+  <cyboxCommon:Execution_Environment>{0,1}</cyboxCommon:Execution_Environment>
+  <cyboxCommon:Errors>{0,1}</cyboxCommon:Errors>
+  <cyboxCommon:Metadata type="">{0,unbounded}</cyboxCommon:Metadata>
+  <cyboxCommon:Compensation_Model appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</cyboxCommon:Compensation_Model>
+  <maecBundle:Engine_Version>{0,1}</maecBundle:Engine_Version>
+  <maecBundle:Definition_Version>{0,1}</maecBundle:Definition_Version>
+  <maecBundle:Classification_Name>{0,1}</maecBundle:Classification_Name>
+</maecBundle:AV_Classification>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNameoptional +
    + + + + + 
    The id field specifies a unique ID for this Tool.
    +
    +
    idrefxs:QNameoptional +
    + + + + + 
    The idref field specifies reference to a unique ID for this Tool.
    + + + + + 
    When idref is specified, the id attribute must not be specified, and any instance of this type should not hold content unless an extension of the type allows it.
    +
    +
    +
    +
    +
    Element maecBundle:AVClassificationType / maecBundle:Engine_Version
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Engine_Version field captures the version of the AV engine used by the AV scanner tool that assigned the classification to the malware instance object.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecBundle:AVClassificationType / maecBundle:Definition_Version
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Definition_Version field captures the version of the AV definitions used by the AV scanner tool that assigned the classification to the malware instance object.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecBundle:AVClassificationType / maecBundle:Classification_Name
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Classification_Name field captures the classification assigned to the malware instance object by the AV scanner tool characterized in the Company_Name and Product_Name fields.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecBundle:BundleType / maecBundle:Process_Tree
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Process_Tree field specifies the observed process tree of execution for the malware instance, along with references to any corresponding actions that were initiated, if applicable.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#ProcessTreeType_Root_Process + maec-bundle-4.tmp#ProcessTreeType
    +
    TypemaecBundle:ProcessTreeType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Process_Tree xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Root_Process id="" is_hidden="" object_reference="" ordinal_position="" parent_action_idref="">{1,1}</maecBundle:Root_Process>
+</maecBundle:Process_Tree>
    +
    +
    +
    Element maecBundle:ProcessTreeType / maecBundle:Root_Process
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Root_Process field captures the root process in the process tree.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ProcessTreeNodeType_id + NO_NAMESPACE.tmp#ProcessTreeNodeType_parent_action_idref + NO_NAMESPACE.tmp#ProcessTreeNodeType_ordinal_position + maec-bundle-4.tmp#ProcessTreeNodeType_Initiated_Actions + maec-bundle-4.tmp#ProcessTreeNodeType_Spawned_Process + maec-bundle-4.tmp#ProcessTreeNodeType_Injected_Process + maec-bundle-4.tmp#ProcessTreeNodeType
    +
    TypemaecBundle:ProcessTreeNodeType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Root_Process id="" is_hidden="" object_reference="" ordinal_position="" parent_action_idref="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" xmlns:ProcessObj="http://cybox.mitre.org/objects#ProcessObject-2">
+  <cyboxCommon:Custom_Properties>{0,1}</cyboxCommon:Custom_Properties>
+  <ProcessObj:PID appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="unsignedInt" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:PID>
+  <ProcessObj:Name appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:Name>
+  <ProcessObj:Creation_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="dateTime" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" precision="second" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:Creation_Time>
+  <ProcessObj:Parent_PID appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="unsignedInt" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:Parent_PID>
+  <ProcessObj:Child_PID_List>{0,1}</ProcessObj:Child_PID_List>
+  <ProcessObj:Image_Info>{0,1}</ProcessObj:Image_Info>
+  <ProcessObj:Argument_List>{0,1}</ProcessObj:Argument_List>
+  <ProcessObj:Environment_Variable_List>{0,1}</ProcessObj:Environment_Variable_List>
+  <ProcessObj:Kernel_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="duration" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:Kernel_Time>
+  <ProcessObj:Port_List>{0,1}</ProcessObj:Port_List>
+  <ProcessObj:Network_Connection_List>{0,1}</ProcessObj:Network_Connection_List>
+  <ProcessObj:Start_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="dateTime" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" precision="second" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:Start_Time>
+  <ProcessObj:Status>{0,1}</ProcessObj:Status>
+  <ProcessObj:Username appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:Username>
+  <ProcessObj:User_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="duration" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:User_Time>
+  <ProcessObj:Extracted_Features>{0,1}</ProcessObj:Extracted_Features>
+  <maecBundle:Initiated_Actions>{0,1}</maecBundle:Initiated_Actions>
+  <maecBundle:Spawned_Process id="" is_hidden="" object_reference="" ordinal_position="" parent_action_idref="">{0,unbounded}</maecBundle:Spawned_Process>
+  <maecBundle:Injected_Process id="" is_hidden="" object_reference="" ordinal_position="" parent_action_idref="">{0,unbounded}</maecBundle:Injected_Process>
+</maecBundle:Root_Process>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for the Process Node.
    +
    +
    is_hiddenxs:booleanoptional +
    + + + + + 
    The is_hidden field specifies whether the process is hidden or not.
    +
    +
    object_referencexs:QNameoptional +
    + + + + + 
    The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
    +
    +
    ordinal_positionxs:positiveIntegeroptional +
    + + + + + 
    The ordinal_position field specifies the ordinal position of the process with respect to the other processes spawned or injected by the malware.
    +
    +
    parent_action_idrefxs:QNameoptional +
    + + + + + 
    The parent_action_idref field specifies the id of the action that created or injected this process.
    +
    +
    +
    +
    +
    Element maecBundle:ProcessTreeNodeType / maecBundle:Initiated_Actions
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Initiated_Actions field captures, via references, the actions (found inside the top-level Actions element, or an Action Collection inside the top-level Collections element) initiated by the Process.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#ActionReferenceListType_Action_Reference + maec-bundle-4.tmp#ActionReferenceListType
    +
    TypemaecBundle:ActionReferenceListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Initiated_Actions xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Action_Reference action_id="">{1,unbounded}</maecBundle:Action_Reference>
+</maecBundle:Initiated_Actions>
    +
    +
    +
    Element maecBundle:ActionReferenceListType / maecBundle:Action_Reference
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Action_Reference field specifies a reference to a single Action.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typecybox:ActionReferenceType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    action_idxs:QNamerequired +
    + + + + + 
    The action_id field refers to the id of the action being referenced.
    +
    +
    +
    +
    +
    Element maecBundle:ProcessTreeNodeType / maecBundle:Spawned_Process
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Spawned_Process field captures a single child process spawned by this process.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ProcessTreeNodeType_id + NO_NAMESPACE.tmp#ProcessTreeNodeType_parent_action_idref + NO_NAMESPACE.tmp#ProcessTreeNodeType_ordinal_position + maec-bundle-4.tmp#ProcessTreeNodeType_Initiated_Actions + maec-bundle-4.tmp#ProcessTreeNodeType_Spawned_Process + maec-bundle-4.tmp#ProcessTreeNodeType_Injected_Process + maec-bundle-4.tmp#ProcessTreeNodeType
    +
    TypemaecBundle:ProcessTreeNodeType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Spawned_Process id="" is_hidden="" object_reference="" ordinal_position="" parent_action_idref="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" xmlns:ProcessObj="http://cybox.mitre.org/objects#ProcessObject-2">
+  <cyboxCommon:Custom_Properties>{0,1}</cyboxCommon:Custom_Properties>
+  <ProcessObj:PID appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="unsignedInt" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:PID>
+  <ProcessObj:Name appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:Name>
+  <ProcessObj:Creation_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="dateTime" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" precision="second" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:Creation_Time>
+  <ProcessObj:Parent_PID appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="unsignedInt" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:Parent_PID>
+  <ProcessObj:Child_PID_List>{0,1}</ProcessObj:Child_PID_List>
+  <ProcessObj:Image_Info>{0,1}</ProcessObj:Image_Info>
+  <ProcessObj:Argument_List>{0,1}</ProcessObj:Argument_List>
+  <ProcessObj:Environment_Variable_List>{0,1}</ProcessObj:Environment_Variable_List>
+  <ProcessObj:Kernel_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="duration" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:Kernel_Time>
+  <ProcessObj:Port_List>{0,1}</ProcessObj:Port_List>
+  <ProcessObj:Network_Connection_List>{0,1}</ProcessObj:Network_Connection_List>
+  <ProcessObj:Start_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="dateTime" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" precision="second" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:Start_Time>
+  <ProcessObj:Status>{0,1}</ProcessObj:Status>
+  <ProcessObj:Username appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:Username>
+  <ProcessObj:User_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="duration" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:User_Time>
+  <ProcessObj:Extracted_Features>{0,1}</ProcessObj:Extracted_Features>
+  <maecBundle:Initiated_Actions>{0,1}</maecBundle:Initiated_Actions>
+  <maecBundle:Spawned_Process id="" is_hidden="" object_reference="" ordinal_position="" parent_action_idref="">{0,unbounded}</maecBundle:Spawned_Process>
+  <maecBundle:Injected_Process id="" is_hidden="" object_reference="" ordinal_position="" parent_action_idref="">{0,unbounded}</maecBundle:Injected_Process>
+</maecBundle:Spawned_Process>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for the Process Node.
    +
    +
    is_hiddenxs:booleanoptional +
    + + + + + 
    The is_hidden field specifies whether the process is hidden or not.
    +
    +
    object_referencexs:QNameoptional +
    + + + + + 
    The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
    +
    +
    ordinal_positionxs:positiveIntegeroptional +
    + + + + + 
    The ordinal_position field specifies the ordinal position of the process with respect to the other processes spawned or injected by the malware.
    +
    +
    parent_action_idrefxs:QNameoptional +
    + + + + + 
    The parent_action_idref field specifies the id of the action that created or injected this process.
    +
    +
    +
    +
    +
    Element maecBundle:ProcessTreeNodeType / maecBundle:Injected_Process
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Injected_Process field captures a single process that was injected by this process.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ProcessTreeNodeType_id + NO_NAMESPACE.tmp#ProcessTreeNodeType_parent_action_idref + NO_NAMESPACE.tmp#ProcessTreeNodeType_ordinal_position + maec-bundle-4.tmp#ProcessTreeNodeType_Initiated_Actions + maec-bundle-4.tmp#ProcessTreeNodeType_Spawned_Process + maec-bundle-4.tmp#ProcessTreeNodeType_Injected_Process + maec-bundle-4.tmp#ProcessTreeNodeType
    +
    TypemaecBundle:ProcessTreeNodeType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Injected_Process id="" is_hidden="" object_reference="" ordinal_position="" parent_action_idref="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" xmlns:ProcessObj="http://cybox.mitre.org/objects#ProcessObject-2">
+  <cyboxCommon:Custom_Properties>{0,1}</cyboxCommon:Custom_Properties>
+  <ProcessObj:PID appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="unsignedInt" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:PID>
+  <ProcessObj:Name appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:Name>
+  <ProcessObj:Creation_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="dateTime" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" precision="second" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:Creation_Time>
+  <ProcessObj:Parent_PID appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="unsignedInt" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:Parent_PID>
+  <ProcessObj:Child_PID_List>{0,1}</ProcessObj:Child_PID_List>
+  <ProcessObj:Image_Info>{0,1}</ProcessObj:Image_Info>
+  <ProcessObj:Argument_List>{0,1}</ProcessObj:Argument_List>
+  <ProcessObj:Environment_Variable_List>{0,1}</ProcessObj:Environment_Variable_List>
+  <ProcessObj:Kernel_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="duration" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:Kernel_Time>
+  <ProcessObj:Port_List>{0,1}</ProcessObj:Port_List>
+  <ProcessObj:Network_Connection_List>{0,1}</ProcessObj:Network_Connection_List>
+  <ProcessObj:Start_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="dateTime" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" precision="second" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:Start_Time>
+  <ProcessObj:Status>{0,1}</ProcessObj:Status>
+  <ProcessObj:Username appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:Username>
+  <ProcessObj:User_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="duration" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</ProcessObj:User_Time>
+  <ProcessObj:Extracted_Features>{0,1}</ProcessObj:Extracted_Features>
+  <maecBundle:Initiated_Actions>{0,1}</maecBundle:Initiated_Actions>
+  <maecBundle:Spawned_Process id="" is_hidden="" object_reference="" ordinal_position="" parent_action_idref="">{0,unbounded}</maecBundle:Spawned_Process>
+  <maecBundle:Injected_Process id="" is_hidden="" object_reference="" ordinal_position="" parent_action_idref="">{0,unbounded}</maecBundle:Injected_Process>
+</maecBundle:Injected_Process>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for the Process Node.
    +
    +
    is_hiddenxs:booleanoptional +
    + + + + + 
    The is_hidden field specifies whether the process is hidden or not.
    +
    +
    object_referencexs:QNameoptional +
    + + + + + 
    The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
    +
    +
    ordinal_positionxs:positiveIntegeroptional +
    + + + + + 
    The ordinal_position field specifies the ordinal position of the process with respect to the other processes spawned or injected by the malware.
    +
    +
    parent_action_idrefxs:QNameoptional +
    + + + + + 
    The parent_action_idref field specifies the id of the action that created or injected this process.
    +
    +
    +
    +
    +
    Element maecBundle:BundleType / maecBundle:Capabilities
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Capabilities field contains 1-n CapabilityType objects, which serve to describe the high-level capabilities and objectives of the malware instance.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#CapabilityListType_Capability + maec-bundle-4.tmp#CapabilityListType_Capability_Reference + maec-bundle-4.tmp#CapabilityListType
    +
    TypemaecBundle:CapabilityListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Capabilities xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Capability id="" name="">{1,1}</maecBundle:Capability>
+  <maecBundle:Capability_Reference capability_idref="">{1,1}</maecBundle:Capability_Reference>
+</maecBundle:Capabilities>
    +
    +
    +
    Element maecBundle:CapabilityListType / maecBundle:Capability
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Capability field captures a single Capability in the list, and therefore represents a single Capability possessed by the malware instance.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CapabilityType_id + NO_NAMESPACE.tmp#CapabilityType_name + maec-bundle-4.tmp#CapabilityType_Description + maec-bundle-4.tmp#CapabilityType_Property + maec-bundle-4.tmp#CapabilityType_Strategic_Objective + maec-bundle-4.tmp#CapabilityType_Tactical_Objective + maec-bundle-4.tmp#CapabilityType_Behavior_Reference + maec-bundle-4.tmp#CapabilityType_Relationship + maec-bundle-4.tmp#CapabilityType
    +
    TypemaecBundle:CapabilityType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Capability id="" name="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Description>{0,1}</maecBundle:Description>
+  <maecBundle:Property>{0,unbounded}</maecBundle:Property>
+  <maecBundle:Strategic_Objective id="">{0,unbounded}</maecBundle:Strategic_Objective>
+  <maecBundle:Tactical_Objective id="">{0,unbounded}</maecBundle:Tactical_Objective>
+  <maecBundle:Behavior_Reference behavior_idref="">{0,unbounded}</maecBundle:Behavior_Reference>
+  <maecBundle:Relationship>{0,unbounded}</maecBundle:Relationship>
+</maecBundle:Capability>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for this MAEC Capability.
    +
    +
    namemaecVocabs:MalwareCapabilityEnum-1.0optional +
    + + + + + 
    The name field captures the name of the Capability. It uses the MalwareCapabilityEnum-1.0 enumeration from the MAEC Vocabularies schema.
    +
    +
    +
    +
    +
    Element maecBundle:CapabilityType / maecBundle:Description
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Description field captures a basic textual description of the Capability.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecBundle:CapabilityType / maecBundle:Property
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Property field permits the capture of a single property of the Capability, as a key/value pair. More than one property can be specified via multiple occurrences of this field.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#CapabilityPropertyType_Name + maec-bundle-4.tmp#CapabilityPropertyType_Value + maec-bundle-4.tmp#CapabilityPropertyType
    +
    TypemaecBundle:CapabilityPropertyType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Property xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Name apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</maecBundle:Name>
+  <maecBundle:Value appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</maecBundle:Value>
+</maecBundle:Property>
    +
    +
    +
    Element maecBundle:CapabilityPropertyType / maecBundle:Name
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Name field specifies the name of the property being captured. The name can be either free form text or a standardized value from a vocabulary included in the MAEC Default Vocabularies schema. This field uses the ControlledVocabularyStringType from the imported CybOX Common schema.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:ControlledVocabularyStringType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeDefaultUseAnnotation
    apply_conditioncyboxCommon:ConditionApplicationEnumANYoptional +
    + + + + + 
    This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
    +
    +
    bit_maskxs:hexBinaryoptional +
    + + + + + 
    Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
    +
    +
    conditioncyboxCommon:ConditionTypeEnumoptional +
    + + + + + 
    This field is optional and defines the relevant condition to apply to the value.
    +
    +
    delimiterxs:string##comma##optional +
    + + + + + 
    The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
    +
    +
    has_changedxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
    +
    +
    is_case_sensitivexs:booleantrueoptional +
    + + + + + 
    The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
    +
    +
    pattern_typecyboxCommon:PatternTypeEnumoptional +
    + + + + + 
    This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    +
    +
    regex_syntaxxs:stringoptional +
    + + + + + 
    This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    + + + + + 
    Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
    + + + + + 
    Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
    +
    +
    trendxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
    +
    +
    vocab_namexs:stringoptional +
    + + + + + 
    The vocab_name field specifies the name of the controlled vocabulary.
    +
    +
    vocab_referencexs:anyURIoptional +
    + + + + + 
    The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
    +
    +
    +
    +
    +
    Element maecBundle:CapabilityPropertyType / maecBundle:Value
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Value field specifies the value of the property being captured.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:StringObjectPropertyType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeDefaultUseAnnotation
    appears_randomxs:booleanoptional +
    + + + + + 
    This field is optional and conveys whether the associated object property value appears to somewhat random in nature. An object property with this field set to TRUE need not provide any further information including a value. If more is known about the particular variation of randomness, a regex value could be provided to outline what is known of the structure.
    +
    +
    apply_conditioncyboxCommon:ConditionApplicationEnumANYoptional +
    + + + + + 
    This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
    +
    +
    bit_maskxs:hexBinaryoptional +
    + + + + + 
    Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
    +
    +
    conditioncyboxCommon:ConditionTypeEnumoptional +
    + + + + + 
    This field is optional and defines the relevant condition to apply to the value.
    +
    +
    datatypecyboxCommon:DatatypeEnumstringoptional +
    + + + + + 
    This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.
    +
    +
    defanging_algorithm_refxs:anyURIoptional +
    + + + + + 
    This field is optional and conveys a reference to a description of the algorithm used to defang (representation changed to prevent malicious effects of handling/processing) this Object property.
    +
    +
    delimiterxs:string##comma##optional +
    + + + + + 
    The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
    +
    +
    has_changedxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
    +
    +
    idxs:QNameoptional +
    + + + + + 
    The id field specifies a unique ID for this Object Property.
    +
    +
    idrefxs:QNameoptional +
    + + + + + 
    The idref field specifies a unique ID reference for this Object Property.
    + + + + + 
    When idref is specified, the id attribute must not be specified, and any instance of this property should not hold content unless an extension of the property allows it.
    +
    +
    is_case_sensitivexs:booleantrueoptional +
    + + + + + 
    The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
    +
    +
    is_defangedxs:booleanoptional +
    + + + + + 
    This field is optional and conveys whether the associated Object property has been defanged (representation changed to prevent malicious effects of handling/processing).
    +
    +
    is_obfuscatedxs:booleanoptional +
    + + + + + 
    This field is optional and conveys whether the associated Object property has been obfuscated.
    +
    +
    obfuscation_algorithm_refxs:anyURIoptional +
    + + + + + 
    This field is optional and conveys a reference to a description of the algorithm used to obfuscate this Object property.
    +
    +
    observed_encodingxs:stringoptional +
    + + + + + 
    This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.
    + + + + + 
    It is strongly recommended that character set names should be taken from the IANA character set registry (https://www.iana.org/assignments/character-sets/character-sets.xhtml).
    + + + + + 
    This field is intended to be applicable only to fields which contain string values.
    +
    +
    pattern_typecyboxCommon:PatternTypeEnumoptional +
    + + + + + 
    This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    +
    +
    refanging_transformxs:stringoptional +
    + + + + + 
    This field is optional and specifies an automated transform that can be applied to the Object property content in order to refang it to its original format.
    +
    +
    refanging_transform_typexs:stringoptional +
    + + + + + 
    This field is optional and specifies the type (e.g. RegEx) of refanging transform specified in the optional accompanying refangingTransform property.
    +
    +
    regex_syntaxxs:stringoptional +
    + + + + + 
    This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    + + + + + 
    Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
    + + + + + 
    Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
    +
    +
    trendxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
    +
    +
    +
    +
    +
    Element maecBundle:CapabilityType / maecBundle:Strategic_Objective
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Strategic_Objective field captures a single Strategic Objective that the Capability attempts to achieve. It can be considered as a more granular way of capturing the Capabilities present in the malware instance.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CapabilityObjectiveType_id + maec-bundle-4.tmp#CapabilityObjectiveType_Name + maec-bundle-4.tmp#CapabilityObjectiveType_Description + maec-bundle-4.tmp#CapabilityObjectiveType_Property + maec-bundle-4.tmp#CapabilityObjectiveType_Behavior_Reference + maec-bundle-4.tmp#CapabilityObjectiveType_Relationship + maec-bundle-4.tmp#CapabilityObjectiveType
    +
    TypemaecBundle:CapabilityObjectiveType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Strategic_Objective id="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Name apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</maecBundle:Name>
+  <maecBundle:Description>{0,1}</maecBundle:Description>
+  <maecBundle:Property>{0,unbounded}</maecBundle:Property>
+  <maecBundle:Behavior_Reference behavior_idref="">{0,unbounded}</maecBundle:Behavior_Reference>
+  <maecBundle:Relationship>{0,unbounded}</maecBundle:Relationship>
+</maecBundle:Strategic_Objective>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for this Capability Objective.
    +
    +
    +
    +
    +
    Element maecBundle:CapabilityObjectiveType / maecBundle:Name
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Name field captures the name of the Capability Objective. There are several default vocabularies for this usage included in the MAEC Vocabularies schema. It uses the ControlledVocabularyStringType from the imported CybOX Common schema.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:ControlledVocabularyStringType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeDefaultUseAnnotation
    apply_conditioncyboxCommon:ConditionApplicationEnumANYoptional +
    + + + + + 
    This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
    +
    +
    bit_maskxs:hexBinaryoptional +
    + + + + + 
    Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
    +
    +
    conditioncyboxCommon:ConditionTypeEnumoptional +
    + + + + + 
    This field is optional and defines the relevant condition to apply to the value.
    +
    +
    delimiterxs:string##comma##optional +
    + + + + + 
    The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
    +
    +
    has_changedxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
    +
    +
    is_case_sensitivexs:booleantrueoptional +
    + + + + + 
    The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
    +
    +
    pattern_typecyboxCommon:PatternTypeEnumoptional +
    + + + + + 
    This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    +
    +
    regex_syntaxxs:stringoptional +
    + + + + + 
    This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    + + + + + 
    Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
    + + + + + 
    Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
    +
    +
    trendxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
    +
    +
    vocab_namexs:stringoptional +
    + + + + + 
    The vocab_name field specifies the name of the controlled vocabulary.
    +
    +
    vocab_referencexs:anyURIoptional +
    + + + + + 
    The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
    +
    +
    +
    +
    +
    Element maecBundle:CapabilityObjectiveType / maecBundle:Description
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Description field captures a basic textual description of the Capability Objective.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecBundle:CapabilityObjectiveType / maecBundle:Property
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Property field permits the capture of a single property of the Capability Objective, as a key/value pair. More than one property can be specified via multiple occurrences of this field.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#CapabilityPropertyType_Name + maec-bundle-4.tmp#CapabilityPropertyType_Value + maec-bundle-4.tmp#CapabilityPropertyType
    +
    TypemaecBundle:CapabilityPropertyType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Property xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Name apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</maecBundle:Name>
+  <maecBundle:Value appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</maecBundle:Value>
+</maecBundle:Property>
    +
    +
    +
    Element maecBundle:CapabilityObjectiveType / maecBundle:Behavior_Reference
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Behavior_Reference field captures a reference to a Behavior that functions as an implementation of the Capability Objective.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BehaviorReferenceType_behavior_idref + maec-bundle-4.tmp#BehaviorReferenceType
    +
    TypemaecBundle:BehaviorReferenceType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    behavior_idrefxs:QNamerequired +
    + + + + + 
    The behavior_idref field specifies the id of the Behavior being referenced; this Behavior must be present in the current Bundle.
    +
    +
    +
    +
    +
    Element maecBundle:CapabilityObjectiveType / maecBundle:Relationship
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Relationship field captures a relationship from the Capability Objective to one or more other Capability Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#CapabilityObjectiveRelationshipType_Relationship_Type + maec-bundle-4.tmp#CapabilityObjectiveRelationshipType_Objective_Reference + maec-bundle-4.tmp#CapabilityObjectiveRelationshipType
    +
    TypemaecBundle:CapabilityObjectiveRelationshipType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Relationship xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Relationship_Type apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</maecBundle:Relationship_Type>
+  <maecBundle:Objective_Reference objective_idref="">{1,unbounded}</maecBundle:Objective_Reference>
+</maecBundle:Relationship>
    +
    +
    +
    Element maecBundle:CapabilityObjectiveRelationshipType / maecBundle:Relationship_Type
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Relationship_Type field captures the type of relationship being expressed between Objectives (either Strategic or Tactical).
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:ControlledVocabularyStringType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeDefaultUseAnnotation
    apply_conditioncyboxCommon:ConditionApplicationEnumANYoptional +
    + + + + + 
    This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
    +
    +
    bit_maskxs:hexBinaryoptional +
    + + + + + 
    Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
    +
    +
    conditioncyboxCommon:ConditionTypeEnumoptional +
    + + + + + 
    This field is optional and defines the relevant condition to apply to the value.
    +
    +
    delimiterxs:string##comma##optional +
    + + + + + 
    The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
    +
    +
    has_changedxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
    +
    +
    is_case_sensitivexs:booleantrueoptional +
    + + + + + 
    The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
    +
    +
    pattern_typecyboxCommon:PatternTypeEnumoptional +
    + + + + + 
    This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    +
    +
    regex_syntaxxs:stringoptional +
    + + + + + 
    This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    + + + + + 
    Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
    + + + + + 
    Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
    +
    +
    trendxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
    +
    +
    vocab_namexs:stringoptional +
    + + + + + 
    The vocab_name field specifies the name of the controlled vocabulary.
    +
    +
    vocab_referencexs:anyURIoptional +
    + + + + + 
    The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
    +
    +
    +
    +
    +
    Element maecBundle:CapabilityObjectiveRelationshipType / maecBundle:Objective_Reference
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Objective_Reference field references a single Capability Objective (either Strategic or Objective) in the relationship.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CapabilityObjectiveReferenceType_objective_idref + maec-bundle-4.tmp#CapabilityObjectiveReferenceType
    +
    TypemaecBundle:CapabilityObjectiveReferenceType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    objective_idrefxs:QNamerequired +
    + + + + + 
    The objective_idref field references the ID of a Capability Objective (either Strategic or Tactical) contained inside the current MAEC document.
    +
    +
    +
    +
    +
    Element maecBundle:CapabilityType / maecBundle:Tactical_Objective
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Tactical_Objective field captures a single Tactical Objective that the Capability attempts to achieve, typically in the context of a broader Strategic Objective. It can be considered as a way of expounding upon Strategic Objectives to capture the Capabilities of the malware instance in more detail.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CapabilityObjectiveType_id + maec-bundle-4.tmp#CapabilityObjectiveType_Name + maec-bundle-4.tmp#CapabilityObjectiveType_Description + maec-bundle-4.tmp#CapabilityObjectiveType_Property + maec-bundle-4.tmp#CapabilityObjectiveType_Behavior_Reference + maec-bundle-4.tmp#CapabilityObjectiveType_Relationship + maec-bundle-4.tmp#CapabilityObjectiveType
    +
    TypemaecBundle:CapabilityObjectiveType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Tactical_Objective id="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Name apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</maecBundle:Name>
+  <maecBundle:Description>{0,1}</maecBundle:Description>
+  <maecBundle:Property>{0,unbounded}</maecBundle:Property>
+  <maecBundle:Behavior_Reference behavior_idref="">{0,unbounded}</maecBundle:Behavior_Reference>
+  <maecBundle:Relationship>{0,unbounded}</maecBundle:Relationship>
+</maecBundle:Tactical_Objective>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for this Capability Objective.
    +
    +
    +
    +
    +
    Element maecBundle:CapabilityType / maecBundle:Behavior_Reference
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Behavior_Reference field captures a reference to a Behavior that serves as an implementation of the Capability. For Behaviors that serve as implementations of specific Strategic or Tactical Objectives, the Behavior_Reference field under the Strategic_Objective or Tactical_Objective fields should be used, respectively.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BehaviorReferenceType_behavior_idref + maec-bundle-4.tmp#BehaviorReferenceType
    +
    TypemaecBundle:BehaviorReferenceType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    behavior_idrefxs:QNamerequired +
    + + + + + 
    The behavior_idref field specifies the id of the Behavior being referenced; this Behavior must be present in the current Bundle.
    +
    +
    +
    +
    +
    Element maecBundle:CapabilityType / maecBundle:Relationship
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Relationship field captures a relationship from the Capability to one or more other Capabilities.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#CapabilityRelationshipType_Relationship_Type + maec-bundle-4.tmp#CapabilityRelationshipType_Capability_Reference + maec-bundle-4.tmp#CapabilityRelationshipType
    +
    TypemaecBundle:CapabilityRelationshipType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Relationship xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Relationship_Type apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</maecBundle:Relationship_Type>
+  <maecBundle:Capability_Reference capability_idref="">{1,unbounded}</maecBundle:Capability_Reference>
+</maecBundle:Relationship>
    +
    +
    +
    Element maecBundle:CapabilityRelationshipType / maecBundle:Relationship_Type
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Relationship_Type field captures the type of relationship being expressed between Capabilities.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:ControlledVocabularyStringType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeDefaultUseAnnotation
    apply_conditioncyboxCommon:ConditionApplicationEnumANYoptional +
    + + + + + 
    This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
    +
    +
    bit_maskxs:hexBinaryoptional +
    + + + + + 
    Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
    +
    +
    conditioncyboxCommon:ConditionTypeEnumoptional +
    + + + + + 
    This field is optional and defines the relevant condition to apply to the value.
    +
    +
    delimiterxs:string##comma##optional +
    + + + + + 
    The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
    +
    +
    has_changedxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
    +
    +
    is_case_sensitivexs:booleantrueoptional +
    + + + + + 
    The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
    +
    +
    pattern_typecyboxCommon:PatternTypeEnumoptional +
    + + + + + 
    This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    +
    +
    regex_syntaxxs:stringoptional +
    + + + + + 
    This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    + + + + + 
    Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
    + + + + + 
    Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
    +
    +
    trendxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
    +
    +
    vocab_namexs:stringoptional +
    + + + + + 
    The vocab_name field specifies the name of the controlled vocabulary.
    +
    +
    vocab_referencexs:anyURIoptional +
    + + + + + 
    The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
    +
    +
    +
    +
    +
    Element maecBundle:CapabilityRelationshipType / maecBundle:Capability_Reference
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Capability_Reference field references a single Capability in the relationship, via its ID.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CapabilityReferenceType_capability_idref + maec-bundle-4.tmp#CapabilityReferenceType
    +
    TypemaecBundle:CapabilityReferenceType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    capability_idrefxs:QNamerequired +
    + + + + + 
    The capability_idref field references the ID of a Capability contained inside the current MAEC document.
    +
    +
    +
    +
    +
    Element maecBundle:CapabilityListType / maecBundle:Capability_Reference
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Capability_Reference field references a single Capability defined elsewhere in the MAEC document, and therefore represents a single Capability possessed by the malware instance.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CapabilityReferenceType_capability_idref + maec-bundle-4.tmp#CapabilityReferenceType
    +
    TypemaecBundle:CapabilityReferenceType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    capability_idrefxs:QNamerequired +
    + + + + + 
    The capability_idref field references the ID of a Capability contained inside the current MAEC document.
    +
    +
    +
    +
    +
    Element maecBundle:BundleType / maecBundle:Behaviors
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Behaviors field contains 1-n BehaviorType objects, which function as the MAEC representation for any behaviors that were observed for the malware instance.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#BehaviorListType_Behavior + maec-bundle-4.tmp#BehaviorListType
    +
    TypemaecBundle:BehaviorListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Behaviors xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Behavior duration="" id="" ordinal_position="" status="">{1,unbounded}</maecBundle:Behavior>
+</maecBundle:Behaviors>
    +
    +
    +
    Element maecBundle:BehaviorListType / maecBundle:Behavior
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Behavior field specifies a single Behavior in the list.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BehaviorType_id + NO_NAMESPACE.tmp#BehaviorType_ordinal_position + NO_NAMESPACE.tmp#BehaviorType_status + NO_NAMESPACE.tmp#BehaviorType_duration + maec-bundle-4.tmp#BehaviorType_Purpose + maec-bundle-4.tmp#BehaviorType_Description + maec-bundle-4.tmp#BehaviorType_Discovery_Method + maec-bundle-4.tmp#BehaviorType_Action_Composition + maec-bundle-4.tmp#BehaviorType_Associated_Code + maec-bundle-4.tmp#BehaviorType_Relationships + maec-bundle-4.tmp#BehaviorType
    +
    TypemaecBundle:BehaviorType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Behavior duration="" id="" ordinal_position="" status="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Purpose>{0,1}</maecBundle:Purpose>
+  <maecBundle:Description>{0,1}</maecBundle:Description>
+  <maecBundle:Discovery_Method class="" name="" sighting_count="" source_type="">{0,1}</maecBundle:Discovery_Method>
+  <maecBundle:Action_Composition>{0,1}</maecBundle:Action_Composition>
+  <maecBundle:Associated_Code>{0,1}</maecBundle:Associated_Code>
+  <maecBundle:Relationships>{0,1}</maecBundle:Relationships>
+</maecBundle:Behavior>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    durationxs:durationoptional +
    + + + + + 
    The duration field specifies the duration of the Behavior. One way to derive such a value may be to calculate the difference between the timestamps of the first and last actions that compose the behavior.
    +
    +
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for this Behavior.
    +
    +
    ordinal_positionxs:positiveIntegeroptional +
    + + + + + 
    The ordinal_position field specifies the ordinal position of the Behavior with respect to the execution of the malware.
    +
    +
    statuscybox:ActionStatusTypeEnumoptional +
    + + + + + 
    The status field specifies the execution status of the Behavior being characterized.
    +
    +
    +
    +
    +
    Element maecBundle:BehaviorType / maecBundle:Purpose
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Purpose field specifies the intended purpose of the Behavior. Since a Behavior is not always successful, and may not be fully observed, this is meant as way to state the nature of the Behavior apart from its constituent actions.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#BehaviorPurposeType_Description + maec-bundle-4.tmp#BehaviorPurposeType_Vulnerability_Exploit + maec-bundle-4.tmp#BehaviorPurposeType
    +
    TypemaecBundle:BehaviorPurposeType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Purpose xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Description>{0,1}</maecBundle:Description>
+  <maecBundle:Vulnerability_Exploit known_vulnerability="">{0,1}</maecBundle:Vulnerability_Exploit>
+</maecBundle:Purpose>
    +
    +
    +
    Element maecBundle:BehaviorPurposeType / maecBundle:Description
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Description field contains a prose text description of the purpose of the Behavior, whether it was successful or not.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecBundle:BehaviorPurposeType / maecBundle:Vulnerability_Exploit
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Vulnerability_Exploit field characterizes any vulnerability that a Behavior may have attempted to exploit, whether or not the exploitation was successful (where success is not necessarily known).
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ExploitType_known_vulnerability + maec-bundle-4.tmp#ExploitType_CVE + maec-bundle-4.tmp#ExploitType_CWE_ID + maec-bundle-4.tmp#ExploitType_Targeted_Platforms + maec-bundle-4.tmp#ExploitType
    +
    TypemaecBundle:ExploitType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Vulnerability_Exploit known_vulnerability="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:CVE cve_id="">{0,1}</maecBundle:CVE>
+  <maecBundle:CWE_ID>{0,unbounded}</maecBundle:CWE_ID>
+  <maecBundle:Targeted_Platforms>{0,1}</maecBundle:Targeted_Platforms>
+</maecBundle:Vulnerability_Exploit>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    known_vulnerabilityxs:booleanoptional +
    + + + + + 
    The known_vulnerability field specifies whether the vulnerability that the malware is exploiting has been previously identified. If so, it should be referenced via a CVE ID in the CVE element. If not, the platform(s) targeted by the vulnerability exploitation behavior may be specified in the Targeted_Platforms element.
    +
    +
    +
    +
    +
    Element maecBundle:ExploitType / maecBundle:CVE
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CVE field specifies the CVE ID and description of the vulnerability targeted by the exploit, if available.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CVEVulnerabilityType_cve_id + maec-bundle-4.tmp#CVEVulnerabilityType_Description + maec-bundle-4.tmp#CVEVulnerabilityType
    +
    TypemaecBundle:CVEVulnerabilityType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:CVE cve_id="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Description>{0,1}</maecBundle:Description>
+</maecBundle:CVE>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    cve_idxs:stringrequired +
    + + + + + 
    The cve_id attribute contains the ID of the CVE that is being referenced, e.g., CVE-1999-0002.
    +
    +
    +
    +
    +
    Element maecBundle:CVEVulnerabilityType / maecBundle:Description
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Description field specifies the textual description of the vulnerability referenced by the cve_id.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecBundle:ExploitType / maecBundle:CWE_ID
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CWE_ID field captures the ID of the Common Weakness Enumeration (CWE) entry that represents the type of weakness targeted by the exploit. More than one such CWE ID can be specified by using multiple occurrences of this field.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecBundle:ExploitType / maecBundle:Targeted_Platforms
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Targeted_Platforms field specifies the platforms(s) targeted by the vulnerability exploit.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#PlatformListType_Platform + maec-bundle-4.tmp#PlatformListType
    +
    TypemaecBundle:PlatformListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Targeted_Platforms xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Platform>{1,unbounded}</maecBundle:Platform>
+</maecBundle:Targeted_Platforms>
    +
    +
    +
    Element maecBundle:PlatformListType / maecBundle:Platform
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Platform field specifies a single Platform in the list via a common platform enumeration ID. It uses the PlatformSpecificationType type from the CybOX Common schema v2.0.1.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:PlatformSpecificationType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Platform xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4" xmlns:cyboxCommon="http://cybox.mitre.org/common-2">
+  <cyboxCommon:Description structuring_format="">{0,1}</cyboxCommon:Description>
+  <cyboxCommon:Identifier appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" system="" system-ref="" trend="">{0,unbounded}</cyboxCommon:Identifier>
+</maecBundle:Platform>
    +
    +
    +
    Element maecBundle:BehaviorType / maecBundle:Description
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Description field specifies a prose textual description of the Behavior.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecBundle:BehaviorType / maecBundle:Discovery_Method
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Discovery_Method field specifies the method used to discover the Behavior.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:MeasureSourceType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Discovery_Method class="" name="" sighting_count="" source_type="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4" xmlns:cyboxCommon="http://cybox.mitre.org/common-2">
+  <cyboxCommon:Information_Source_Type apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</cyboxCommon:Information_Source_Type>
+  <cyboxCommon:Tool_Type apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</cyboxCommon:Tool_Type>
+  <cyboxCommon:Description structuring_format="">{0,1}</cyboxCommon:Description>
+  <cyboxCommon:Contributors>{0,1}</cyboxCommon:Contributors>
+  <cyboxCommon:Time>{0,1}</cyboxCommon:Time>
+  <cyboxCommon:Observation_Location id="" idref="">{0,1}</cyboxCommon:Observation_Location>
+  <cyboxCommon:Tools>{0,1}</cyboxCommon:Tools>
+  <cyboxCommon:Platform>{0,1}</cyboxCommon:Platform>
+  <cyboxCommon:System object_reference="">{0,1}</cyboxCommon:System>
+  <cyboxCommon:Instance object_reference="">{0,1}</cyboxCommon:Instance>
+  <cyboxCommon:Observable_Location id="" idref="">{0,1}</cyboxCommon:Observable_Location>
+</maecBundle:Discovery_Method>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    classcyboxCommon:SourceClassTypeEnumoptional +
    + + + + + 
    The class field is optional and enables identification of the high-level class of this cyber observation source.
    +
    +
    namexs:stringoptional +
    + + + + + 
    The name field is optional and enables the assignment of a relevant name to this Discovery Method.
    +
    +
    sighting_countxs:positiveIntegeroptional +
    + + + + + 
    The sighting_count field specifies how many different identical instances of a given Observable may have been seen/sighted by the observation source.
    +
    +
    source_typecyboxCommon:SourceTypeEnumoptional +
    + + + + + 
    The source_type field is optional and enables identification of the broad type of this cyber observation source.
    +
    +
    +
    +
    +
    Element maecBundle:BehaviorType / maecBundle:Action_Composition
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Action_Composition field captures the Actions that compose the Behavior.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#BehavioralActionsType_Action_Collection + maec-bundle-4.tmp#BehavioralActionsType_Action + maec-bundle-4.tmp#BehavioralActionsType_Action_Reference + maec-bundle-4.tmp#BehavioralActionsType_Action_Equivalence_Reference + maec-bundle-4.tmp#BehavioralActionsType
    +
    TypemaecBundle:BehavioralActionsType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Action_Composition xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Action_Collection id="" name="">{1,1}</maecBundle:Action_Collection>
+  <maecBundle:Action action_status="" behavioral_ordering="" context="" id="" idref="" ordinal_position="" timestamp="" timestamp_precision="second">{1,1}</maecBundle:Action>
+  <maecBundle:Action_Reference action_id="" behavioral_ordering="">{1,1}</maecBundle:Action_Reference>
+  <maecBundle:Action_Equivalence_Reference action_equivalence_idref="" behavioral_ordering="">{1,1}</maecBundle:Action_Equivalence_Reference>
+</maecBundle:Action_Composition>
    +
    +
    +
    Element maecBundle:BehavioralActionsType / maecBundle:Action_Collection
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Action_Collection field specifies an Action Collection that is part of the behavioral composition.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BaseCollectionType_name + maec-bundle-4.tmp#BaseCollectionType_Affinity_Type + maec-bundle-4.tmp#BaseCollectionType_Affinity_Degree + maec-bundle-4.tmp#BaseCollectionType_Description + maec-bundle-4.tmp#BaseCollectionType + NO_NAMESPACE.tmp#ActionCollectionType_id + maec-bundle-4.tmp#ActionCollectionType_Action_List + maec-bundle-4.tmp#ActionCollectionType
    +
    TypemaecBundle:ActionCollectionType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Action_Collection id="" name="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Affinity_Type>{0,1}</maecBundle:Affinity_Type>
+  <maecBundle:Affinity_Degree>{0,1}</maecBundle:Affinity_Degree>
+  <maecBundle:Description>{0,1}</maecBundle:Description>
+  <maecBundle:Action_List>{1,1}</maecBundle:Action_List>
+</maecBundle:Action_Collection>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The id field specifies a unique ID for this Action Collection.
    +
    +
    namexs:stringoptional +
    + + + + + 
    The name field specifies the name of the collection.
    +
    +
    +
    +
    +
    Element maecBundle:BaseCollectionType / maecBundle:Affinity_Type
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Affinity_Type field provides an abstract way of characterizing how the objects in a collection are related.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecBundle:BaseCollectionType / maecBundle:Affinity_Degree
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Affinity_Degree field is intended to provide an abstract way of characterizing the degree to which the objects in a collection are related.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecBundle:BaseCollectionType / maecBundle:Description
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Description field contains a textual description of the collection.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecBundle:ActionCollectionType / maecBundle:Action_List
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Action_List field specifies a list of Actions that make up the collection.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#ActionListType_Action + maec-bundle-4.tmp#ActionListType
    +
    TypemaecBundle:ActionListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Action_List xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Action action_status="" context="" id="" idref="" ordinal_position="" timestamp="" timestamp_precision="second">{1,unbounded}</maecBundle:Action>
+</maecBundle:Action_List>
    +
    +
    +
    Element maecBundle:ActionListType / maecBundle:Action
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Action field specifies a single Action in the list.
    +
    +
    + + + + + 
    The recommended syntax for Action IDs is a dash-delimited format that starts with the word maec, followed by a unique string, followed by the three letter code 'act', and ending with an integer. The regular expression validating these IDs is: maec-[A-Za-z0-9_\-\.]+-act-[1-9][0-9]*.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#MalwareActionType_Implementation + maec-bundle-4.tmp#MalwareActionType
    +
    TypemaecBundle:MalwareActionType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Action action_status="" context="" id="" idref="" ordinal_position="" timestamp="" timestamp_precision="second" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4" xmlns:cybox="http://cybox.mitre.org/cybox-2">
+  <cybox:Type apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</cybox:Type>
+  <cybox:Name apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</cybox:Name>
+  <cybox:Description structuring_format="">{0,1}</cybox:Description>
+  <cybox:Action_Aliases>{0,1}</cybox:Action_Aliases>
+  <cybox:Action_Arguments>{0,1}</cybox:Action_Arguments>
+  <cybox:Location id="" idref="">{0,1}</cybox:Location>
+  <cybox:Discovery_Method class="" name="" sighting_count="" source_type="">{0,1}</cybox:Discovery_Method>
+  <cybox:Associated_Objects>{0,1}</cybox:Associated_Objects>
+  <cybox:Relationships>{0,1}</cybox:Relationships>
+  <cybox:Frequency rate="" scale="" trend="" units="">{0,1}</cybox:Frequency>
+  <maecBundle:Implementation id="" type="">{0,1}</maecBundle:Implementation>
+</maecBundle:Action>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeDefaultUseAnnotation
    action_statuscybox:ActionStatusTypeEnumoptional +
    + + + + + 
    The action_status field enables description of the status of the action being described.
    +
    +
    contextcybox:ActionContextTypeEnumoptional +
    + + + + + 
    The context field is optional and enables simple characterization of the broad operational context in which the Action is relevant.
    +
    +
    idxs:QNameoptional +
    + + + + + 
    The id field specifies a unique id for this Action.
    +
    +
    idrefxs:QNameoptional +
    + + + + + 
    The idref field specifies a unique id reference to an Action defined elsewhere.
    + + + + + 
    When idref is specified, the id attribute must not be specified, and any instance of this Action should not hold content unless an extension of the Action allows it.
    +
    +
    ordinal_positionxs:positiveIntegeroptional +
    + + + + + 
    The ordinal_position field is intended to reference the ordinal position of the action with within a series of actions.
    +
    +
    timestampxs:dateTimeoptional +
    + + + + + 
    The timestamp field represents the local or relative time at which the action occurred or was observed. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
    +
    +
    timestamp_precisioncyboxCommon:DateTimePrecisionEnumsecondoptional +
    + + + + + 
    Represents the precision of the associated timestamp value. If omitted, the default is "second", meaning the timestamp is precise to the full field value. Digits in the timestamp that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.
    +
    +
    +
    +
    +
    Element maecBundle:MalwareActionType / maecBundle:Implementation
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Implementation field is optional and serves to capture attributes that are relevant to how the Action is implemented in the malware, such as the specific API call that was used.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ActionImplementationType_id + NO_NAMESPACE.tmp#ActionImplementationType_type + maec-bundle-4.tmp#ActionImplementationType_Compatible_Platforms + maec-bundle-4.tmp#ActionImplementationType_API_Call + maec-bundle-4.tmp#ActionImplementationType_Code + maec-bundle-4.tmp#ActionImplementationType
    +
    TypemaecBundle:ActionImplementationType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Implementation id="" type="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Compatible_Platforms>{0,1}</maecBundle:Compatible_Platforms>
+  <maecBundle:API_Call function_name="" normalized_function_name="">{0,1}</maecBundle:API_Call>
+  <maecBundle:Code object_reference="">{0,unbounded}</maecBundle:Code>
+</maecBundle:Implementation>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNameoptional +
    + + + + + 
    The id field specifies a unique ID for this Action Implementation.
    +
    +
    typemaecBundle:ActionImplementationTypeEnumrequired +
    + + + + + 
    The required type field refers to the type of Action Implementation being characterized in this element.
    +
    +
    +
    +
    +
    Element maecBundle:ActionImplementationType / maecBundle:Compatible_Platforms
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Compatible_Platforms field specifies the specific platform(s) that the Action is compatible with, or in other words, capable of being successfully executed on.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#PlatformListType_Platform + maec-bundle-4.tmp#PlatformListType
    +
    TypemaecBundle:PlatformListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Compatible_Platforms xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Platform>{1,unbounded}</maecBundle:Platform>
+</maecBundle:Compatible_Platforms>
    +
    +
    +
    Element maecBundle:ActionImplementationType / maecBundle:API_Call
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The API_Call field allows for the characterization of a system-level API call that was used to implement the action. Software must make use of such calls to talk to 			hardware and perform system-specific functions.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#APICallType_function_name + NO_NAMESPACE.tmp#APICallType_normalized_function_name + maec-bundle-4.tmp#APICallType_Address + maec-bundle-4.tmp#APICallType_Return_Value + maec-bundle-4.tmp#APICallType_Parameters + maec-bundle-4.tmp#APICallType
    +
    TypemaecBundle:APICallType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:API_Call function_name="" normalized_function_name="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Address>{0,1}</maecBundle:Address>
+  <maecBundle:Return_Value>{0,1}</maecBundle:Return_Value>
+  <maecBundle:Parameters>{0,1}</maecBundle:Parameters>
+</maecBundle:API_Call>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    function_namexs:stringoptional +
    + + + + + 
    The function_name field contains the exact name of the API function called, e.g. CreateFileEx.
    +
    +
    normalized_function_namexs:stringoptional +
    + + + + + 
    The normalized_function_name field contains the normalized name of the API function called, e.g. CreateFile.
    +
    +
    +
    +
    +
    Element maecBundle:APICallType / maecBundle:Address
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Address field contains the address of the API call in the binary.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:hexBinary
    +
    Element maecBundle:APICallType / maecBundle:Return_Value
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Return_Value field contains the return value of the API call.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecBundle:APICallType / maecBundle:Parameters
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Parameter field captures any name/value pairs of the parameters passed into the API call.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#ParameterListType_Parameter + maec-bundle-4.tmp#ParameterListType
    +
    TypemaecBundle:ParameterListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Parameters xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Parameter name="" ordinal_position="" value="">{1,unbounded}</maecBundle:Parameter>
+</maecBundle:Parameters>
    +
    +
    +
    Element maecBundle:ParameterListType / maecBundle:Parameter
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Parameter field specifies a single function parameter.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ParameterType_ordinal_position + NO_NAMESPACE.tmp#ParameterType_name + NO_NAMESPACE.tmp#ParameterType_value + maec-bundle-4.tmp#ParameterType
    +
    TypemaecBundle:ParameterType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    namexs:stringoptional +
    + + + + + 
    The name field specifies the name of the parameter.
    +
    +
    ordinal_positionxs:positiveIntegeroptional +
    + + + + + 
    This field refers to the ordinal position of the parameter with respect to the function where it is used.
    +
    +
    valuexs:stringoptional +
    + + + + + 
    The value field specifies the actual value of the parameter.
    +
    +
    +
    +
    +
    Element maecBundle:ActionImplementationType / maecBundle:Code
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Code field contains any form of code that was used to implement the action.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypeCodeObj:CodeObjectType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Code object_reference="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" xmlns:CodeObj="http://cybox.mitre.org/objects#CodeObject-2">
+  <cyboxCommon:Custom_Properties>{0,1}</cyboxCommon:Custom_Properties>
+  <CodeObj:Description structuring_format="">{0,1}</CodeObj:Description>
+  <CodeObj:Type appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</CodeObj:Type>
+  <CodeObj:Purpose appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</CodeObj:Purpose>
+  <CodeObj:Code_Language appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</CodeObj:Code_Language>
+  <CodeObj:Targeted_Platforms>{0,1}</CodeObj:Targeted_Platforms>
+  <CodeObj:Processor_Family appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,unbounded}</CodeObj:Processor_Family>
+  <CodeObj:Discovery_Method class="" name="" sighting_count="" source_type="">{0,1}</CodeObj:Discovery_Method>
+  <CodeObj:Start_Address appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="hexBinary" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</CodeObj:Start_Address>
+  <CodeObj:Code_Segment appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</CodeObj:Code_Segment>
+  <CodeObj:Code_Segment_XOR appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="" xor_pattern="55AA55AA55AA55BB">{0,1}</CodeObj:Code_Segment_XOR>
+  <CodeObj:Digital_Signatures>{0,1}</CodeObj:Digital_Signatures>
+  <CodeObj:Extracted_Features>{0,1}</CodeObj:Extracted_Features>
+</maecBundle:Code>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    object_referencexs:QNameoptional +
    + + + + + 
    The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
    +
    +
    +
    +
    +
    Element maecBundle:BehavioralActionsType / maecBundle:Action
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Action field specifies a single Action that is part of the behavioral composition.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#MalwareActionType_Implementation + maec-bundle-4.tmp#MalwareActionType + NO_NAMESPACE.tmp#BehavioralActionType_behavioral_ordering + maec-bundle-4.tmp#BehavioralActionType
    +
    TypemaecBundle:BehavioralActionType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Action action_status="" behavioral_ordering="" context="" id="" idref="" ordinal_position="" timestamp="" timestamp_precision="second" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4" xmlns:cybox="http://cybox.mitre.org/cybox-2">
+  <cybox:Type apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</cybox:Type>
+  <cybox:Name apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</cybox:Name>
+  <cybox:Description structuring_format="">{0,1}</cybox:Description>
+  <cybox:Action_Aliases>{0,1}</cybox:Action_Aliases>
+  <cybox:Action_Arguments>{0,1}</cybox:Action_Arguments>
+  <cybox:Location id="" idref="">{0,1}</cybox:Location>
+  <cybox:Discovery_Method class="" name="" sighting_count="" source_type="">{0,1}</cybox:Discovery_Method>
+  <cybox:Associated_Objects>{0,1}</cybox:Associated_Objects>
+  <cybox:Relationships>{0,1}</cybox:Relationships>
+  <cybox:Frequency rate="" scale="" trend="" units="">{0,1}</cybox:Frequency>
+  <maecBundle:Implementation id="" type="">{0,1}</maecBundle:Implementation>
+</maecBundle:Action>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeDefaultUseAnnotation
    action_statuscybox:ActionStatusTypeEnumoptional +
    + + + + + 
    The action_status field enables description of the status of the action being described.
    +
    +
    behavioral_orderingxs:positiveIntegeroptional +
    + + + + + 
    The behavioral_ordering field defines the ordering of the Action with respect to the other Actions that make up the behavior. So an action with a behavioral_ordering of "1" would come before an Action with a behavioral_ordering of "2", etc.
    +
    +
    contextcybox:ActionContextTypeEnumoptional +
    + + + + + 
    The context field is optional and enables simple characterization of the broad operational context in which the Action is relevant.
    +
    +
    idxs:QNameoptional +
    + + + + + 
    The id field specifies a unique id for this Action.
    +
    +
    idrefxs:QNameoptional +
    + + + + + 
    The idref field specifies a unique id reference to an Action defined elsewhere.
    + + + + + 
    When idref is specified, the id attribute must not be specified, and any instance of this Action should not hold content unless an extension of the Action allows it.
    +
    +
    ordinal_positionxs:positiveIntegeroptional +
    + + + + + 
    The ordinal_position field is intended to reference the ordinal position of the action with within a series of actions.
    +
    +
    timestampxs:dateTimeoptional +
    + + + + + 
    The timestamp field represents the local or relative time at which the action occurred or was observed. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
    +
    +
    timestamp_precisioncyboxCommon:DateTimePrecisionEnumsecondoptional +
    + + + + + 
    Represents the precision of the associated timestamp value. If omitted, the default is "second", meaning the timestamp is precise to the full field value. Digits in the timestamp that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.
    +
    +
    +
    +
    +
    Element maecBundle:BehavioralActionsType / maecBundle:Action_Reference
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Action_Reference field specifies a reference to a single Action that is part of the behavioral composition.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BehavioralActionReferenceType_behavioral_ordering + maec-bundle-4.tmp#BehavioralActionReferenceType
    +
    TypemaecBundle:BehavioralActionReferenceType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    action_idxs:QNamerequired +
    + + + + + 
    The action_id field refers to the id of the action being referenced.
    +
    +
    behavioral_orderingxs:positiveIntegeroptional +
    + + + + + 
    The behavioral_ordering field defines the ordering of the Action with respect to the other Actions that make up the Behavior. For example, an Action with a behavioral_ordering of "1" would come before an Action with a behavioral_ordering of "2", etc.
    +
    +
    +
    +
    +
    Element maecBundle:BehavioralActionsType / maecBundle:Action_Equivalence_Reference
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Action_Equivalence_Reference field specifies a reference to a single Action Equivalence that is part of the behavioral composition.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BehavioralActionEquivalenceReferenceType_action_equivalence_idref + NO_NAMESPACE.tmp#BehavioralActionEquivalenceReferenceType_behavioral_ordering + maec-bundle-4.tmp#BehavioralActionEquivalenceReferenceType
    +
    TypemaecBundle:BehavioralActionEquivalenceReferenceType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    action_equivalence_idrefxs:QNamerequired +
    + + + + + 
    The action_equivalence_idref field specifies the ID of an Action Equivalence contained in the same MAEC document as the Behavior that utilizes it.
    +
    +
    behavioral_orderingxs:positiveIntegeroptional +
    + + + + + 
    The behavioral_ordering field defines the ordering of the Action Equivalency with respect to the other actions that make up the behavior. So an action with a behavioral_ordering of "1" would come before an action with a behavioral_ordering of "2", etc.
    +
    +
    +
    +
    +
    Element maecBundle:BehaviorType / maecBundle:Associated_Code
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Associated_Code field specifies any code snippets that may be associated with the Behavior.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#AssociatedCodeType_Code_Snippet + maec-bundle-4.tmp#AssociatedCodeType
    +
    TypemaecBundle:AssociatedCodeType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Associated_Code xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Code_Snippet object_reference="">{1,unbounded}</maecBundle:Code_Snippet>
+</maecBundle:Associated_Code>
    +
    +
    +
    Element maecBundle:AssociatedCodeType / maecBundle:Code_Snippet
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Code_Snippet field captures a single snippet of code, via the CybOX CodeObjectType.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypeCodeObj:CodeObjectType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Code_Snippet object_reference="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" xmlns:CodeObj="http://cybox.mitre.org/objects#CodeObject-2">
+  <cyboxCommon:Custom_Properties>{0,1}</cyboxCommon:Custom_Properties>
+  <CodeObj:Description structuring_format="">{0,1}</CodeObj:Description>
+  <CodeObj:Type appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</CodeObj:Type>
+  <CodeObj:Purpose appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</CodeObj:Purpose>
+  <CodeObj:Code_Language appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</CodeObj:Code_Language>
+  <CodeObj:Targeted_Platforms>{0,1}</CodeObj:Targeted_Platforms>
+  <CodeObj:Processor_Family appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,unbounded}</CodeObj:Processor_Family>
+  <CodeObj:Discovery_Method class="" name="" sighting_count="" source_type="">{0,1}</CodeObj:Discovery_Method>
+  <CodeObj:Start_Address appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="hexBinary" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</CodeObj:Start_Address>
+  <CodeObj:Code_Segment appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</CodeObj:Code_Segment>
+  <CodeObj:Code_Segment_XOR appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="" xor_pattern="55AA55AA55AA55BB">{0,1}</CodeObj:Code_Segment_XOR>
+  <CodeObj:Digital_Signatures>{0,1}</CodeObj:Digital_Signatures>
+  <CodeObj:Extracted_Features>{0,1}</CodeObj:Extracted_Features>
+</maecBundle:Code_Snippet>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    object_referencexs:QNameoptional +
    + + + + + 
    The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
    +
    +
    +
    +
    +
    Element maecBundle:BehaviorType / maecBundle:Relationships
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Relationships field specifies any relationships between this Behavior and any other Behaviors.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#BehaviorRelationshipListType_Relationship + maec-bundle-4.tmp#BehaviorRelationshipListType
    +
    TypemaecBundle:BehaviorRelationshipListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Relationships xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Relationship type="">{1,unbounded}</maecBundle:Relationship>
+</maecBundle:Relationships>
    +
    +
    +
    Element maecBundle:BehaviorRelationshipListType / maecBundle:Relationship
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Relationship field specifies a single relationship between a single Behavior and one or more other Behaviors.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BehaviorRelationshipType_type + maec-bundle-4.tmp#BehaviorRelationshipType_Behavior_Reference + maec-bundle-4.tmp#BehaviorRelationshipType
    +
    TypemaecBundle:BehaviorRelationshipType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Relationship type="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Behavior_Reference behavior_idref="">{1,unbounded}</maecBundle:Behavior_Reference>
+</maecBundle:Relationship>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    typerestriction of cyboxVocabs:ActionRelationshipTypeEnum-1.0optional +
    + + + + + 
    The type field specifies the nature of the relationship between Behaviors that is being captured.
    +
    +
    +
    +
    +
    Element maecBundle:BehaviorRelationshipType / maecBundle:Behavior_Reference
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Behavior_Reference field specifies a reference to a single Behavior in the relationship.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BehaviorReferenceType_behavior_idref + maec-bundle-4.tmp#BehaviorReferenceType
    +
    TypemaecBundle:BehaviorReferenceType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    behavior_idrefxs:QNamerequired +
    + + + + + 
    The behavior_idref field specifies the id of the Behavior being referenced; this Behavior must be present in the current Bundle.
    +
    +
    +
    +
    +
    Element maecBundle:BundleType / maecBundle:Actions
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Actions field contains 1-n ActionType objects, which function as the MAEC representation for any lower-level actions that were observed for the malware instance.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#ActionListType_Action + maec-bundle-4.tmp#ActionListType
    +
    TypemaecBundle:ActionListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Actions xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Action action_status="" context="" id="" idref="" ordinal_position="" timestamp="" timestamp_precision="second">{1,unbounded}</maecBundle:Action>
+</maecBundle:Actions>
    +
    +
    +
    Element maecBundle:BundleType / maecBundle:Objects
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Objects field contains 1-n ObjectType objects, which function as the MAEC representation for any objects associated with the malware instance.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#ObjectListType_Object + maec-bundle-4.tmp#ObjectListType
    +
    TypemaecBundle:ObjectListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Objects xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Object has_changed="" id="" idref="">{1,unbounded}</maecBundle:Object>
+</maecBundle:Objects>
    +
    +
    +
    Element maecBundle:ObjectListType / maecBundle:Object
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Object field specifies a single CybOX Object in the list. For use in MAEC, the id attribute at the top level of the Object must be utilized.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typecybox:ObjectType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Object has_changed="" id="" idref="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4" xmlns:cybox="http://cybox.mitre.org/cybox-2">
+  <cybox:State apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</cybox:State>
+  <cybox:Description structuring_format="">{0,1}</cybox:Description>
+  <cybox:Properties object_reference="">{0,1}</cybox:Properties>
+  <cybox:Domain_Specific_Object_Properties>{0,1}</cybox:Domain_Specific_Object_Properties>
+  <cybox:Location id="" idref="">{0,1}</cybox:Location>
+  <cybox:Related_Objects>{0,1}</cybox:Related_Objects>
+  <cybox:Defined_Effect effect_type="">{0,1}</cybox:Defined_Effect>
+  <cybox:Discovery_Method class="" name="" sighting_count="" source_type="">{0,1}</cybox:Discovery_Method>
+</maecBundle:Object>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    has_changedxs:booleanoptional +
    + + + + + 
    The has_changed field is optional and conveys a targeted observation pattern of whether the associated object specified has changed in some way without requiring further specific detail. This field would be leveraged within a pattern observable triggering on whether the value of an object specification has changed at all. This field is NOT intended to be used for versioning of CybOX content.
    +
    +
    idxs:QNameoptional +
    + + + + + 
    The id field specifies a unique id for this Object.
    +
    +
    idrefxs:QNameoptional +
    + + + + + 
    The idref field specifies a unique id reference to an Object defined elsewhere.
    + + + + + 
    When idref is specified, the id attribute must not be specified, and any instance of this Object should not hold content unless an extension of the Object allows it.
    +
    +
    +
    +
    +
    Element maecBundle:BundleType / maecBundle:Candidate_Indicators
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Candidate_Indicators field contains 1-n CandidateIndicatorType objects, which function as the MAEC representation of any candidate indicators associated with the malware instance.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#CandidateIndicatorListType_Candidate_Indicator + maec-bundle-4.tmp#CandidateIndicatorListType
    +
    TypemaecBundle:CandidateIndicatorListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Candidate_Indicators xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Candidate_Indicator creation_datetime="" id="" lastupdate_datetime="" version="">{1,unbounded}</maecBundle:Candidate_Indicator>
+</maecBundle:Candidate_Indicators>
    +
    +
    +
    Element maecBundle:CandidateIndicatorListType / maecBundle:Candidate_Indicator
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Candidate_Indicator field specifies a single Candidate Indicator in the list.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CandidateIndicatorType_id + NO_NAMESPACE.tmp#CandidateIndicatorType_creation_datetime + NO_NAMESPACE.tmp#CandidateIndicatorType_lastupdate_datetime + NO_NAMESPACE.tmp#CandidateIndicatorType_version + maec-bundle-4.tmp#CandidateIndicatorType_Importance + maec-bundle-4.tmp#CandidateIndicatorType_Numeric_Importance + maec-bundle-4.tmp#CandidateIndicatorType_Author + maec-bundle-4.tmp#CandidateIndicatorType_Description + maec-bundle-4.tmp#CandidateIndicatorType_Malware_Entity + maec-bundle-4.tmp#CandidateIndicatorType_Composition + maec-bundle-4.tmp#CandidateIndicatorType
    +
    TypemaecBundle:CandidateIndicatorType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Candidate_Indicator creation_datetime="" id="" lastupdate_datetime="" version="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Importance apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</maecBundle:Importance>
+  <maecBundle:Numeric_Importance>{0,1}</maecBundle:Numeric_Importance>
+  <maecBundle:Author>{0,1}</maecBundle:Author>
+  <maecBundle:Description>{0,1}</maecBundle:Description>
+  <maecBundle:Malware_Entity>{0,1}</maecBundle:Malware_Entity>
+  <maecBundle:Composition operator="">{0,1}</maecBundle:Composition>
+</maecBundle:Candidate_Indicator>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    creation_datetimexs:dateTimeoptional +
    + + + + + 
    The creation_datetime field specifies the date/time that the Candidate Indicator was created.
    +
    +
    idxs:QNamerequired +
    + + + + + 
    The id field specifies a unique ID for this Candidate Indicator.
    +
    +
    lastupdate_datetimexs:dateTimeoptional +
    + + + + + 
    The lastupdate_datetime field specifies the last date/time that the Candidate Indicator was updated.
    +
    +
    versionxs:stringoptional +
    + + + + + 
    The version field specifies the version of the Candidate Indicator.
    +
    +
    +
    +
    +
    Element maecBundle:CandidateIndicatorType / maecBundle:Importance
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Importance field specifies the relative importance of the Candidate Indicator.
    +
    +
    + + + + + 
    This field is implemented through the xsi:type controlled vocabulary extension Capability. The default vocabulary type is ImportanceTypeVocab-1.0 in the http://maec.mitre.org/default_vocabularies-1 namespace. This type is defined in the maec_default_vocabularies.xsd file or at the URL http://maec.mitre.org/XMLSchema/default_vocabularies/1.0.0/maec_default_vocabularies.xsd.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:ControlledVocabularyStringType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeDefaultUseAnnotation
    apply_conditioncyboxCommon:ConditionApplicationEnumANYoptional +
    + + + + + 
    This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
    +
    +
    bit_maskxs:hexBinaryoptional +
    + + + + + 
    Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
    +
    +
    conditioncyboxCommon:ConditionTypeEnumoptional +
    + + + + + 
    This field is optional and defines the relevant condition to apply to the value.
    +
    +
    delimiterxs:string##comma##optional +
    + + + + + 
    The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
    +
    +
    has_changedxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
    +
    +
    is_case_sensitivexs:booleantrueoptional +
    + + + + + 
    The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
    +
    +
    pattern_typecyboxCommon:PatternTypeEnumoptional +
    + + + + + 
    This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    +
    +
    regex_syntaxxs:stringoptional +
    + + + + + 
    This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    + + + + + 
    Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
    + + + + + 
    Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
    +
    +
    trendxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
    +
    +
    vocab_namexs:stringoptional +
    + + + + + 
    The vocab_name field specifies the name of the controlled vocabulary.
    +
    +
    vocab_referencexs:anyURIoptional +
    + + + + + 
    The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
    +
    +
    +
    +
    +
    Element maecBundle:CandidateIndicatorType / maecBundle:Numeric_Importance
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Numeric_Importance field specifies the specific numeric importance of the Candidate Indicator.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:positiveInteger
    +
    Element maecBundle:CandidateIndicatorType / maecBundle:Author
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Author field specifies the author of the Candidate Indicator.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecBundle:CandidateIndicatorType / maecBundle:Description
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Description field provides a brief description of the Candidate Indicator.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecBundle:CandidateIndicatorType / maecBundle:Malware_Entity
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Malware_Entity field specifies the particular malware entity that the Candidate Indicator is written against, whether it be a malware instance, family, etc.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#MalwareEntityType_Type + maec-bundle-4.tmp#MalwareEntityType_Name + maec-bundle-4.tmp#MalwareEntityType_Description + maec-bundle-4.tmp#MalwareEntityType
    +
    TypemaecBundle:MalwareEntityType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Malware_Entity xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Type apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</maecBundle:Type>
+  <maecBundle:Name>{0,1}</maecBundle:Name>
+  <maecBundle:Description>{0,1}</maecBundle:Description>
+</maecBundle:Malware_Entity>
    +
    +
    +
    Element maecBundle:MalwareEntityType / maecBundle:Type
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Type field refers to the specific type of malware entity that the indicator or signature is written against.
    +
    +
    + + + + + 
    This field is implemented through the xsi:type controlled vocabulary extension Capability. The default vocabulary type is MalwareEntityTypeVocab-1.0 in the http://maec.mitre.org/default_vocabularies-1 namespace. This type is defined in the maec_default_vocabularies.xsd file or at the URL http://maec.mitre.org/XMLSchema/default_vocabularies/1.0.0/maec_default_vocabularies.xsd.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:ControlledVocabularyStringType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeDefaultUseAnnotation
    apply_conditioncyboxCommon:ConditionApplicationEnumANYoptional +
    + + + + + 
    This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
    +
    +
    bit_maskxs:hexBinaryoptional +
    + + + + + 
    Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
    +
    +
    conditioncyboxCommon:ConditionTypeEnumoptional +
    + + + + + 
    This field is optional and defines the relevant condition to apply to the value.
    +
    +
    delimiterxs:string##comma##optional +
    + + + + + 
    The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
    +
    +
    has_changedxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
    +
    +
    is_case_sensitivexs:booleantrueoptional +
    + + + + + 
    The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
    +
    +
    pattern_typecyboxCommon:PatternTypeEnumoptional +
    + + + + + 
    This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    +
    +
    regex_syntaxxs:stringoptional +
    + + + + + 
    This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    + + + + + 
    Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
    + + + + + 
    Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
    +
    +
    trendxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
    +
    +
    vocab_namexs:stringoptional +
    + + + + + 
    The vocab_name field specifies the name of the controlled vocabulary.
    +
    +
    vocab_referencexs:anyURIoptional +
    + + + + + 
    The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
    +
    +
    +
    +
    +
    Element maecBundle:MalwareEntityType / maecBundle:Name
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Name field refers to the name of the malware instance, malware family, or malware class that the indicator or signature is written against.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecBundle:MalwareEntityType / maecBundle:Description
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Description field is intended to provide a brief description of the entity that the indicator or signature is written against.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecBundle:CandidateIndicatorType / maecBundle:Composition
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Composition field specifies the actual observables that the Candidate Indicator is composed of, via a reference to a one or more MAEC entities contained in the Bundle.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CandidateIndicatorCompositionType_operator + maec-bundle-4.tmp#CandidateIndicatorCompositionType_Behavior_Reference + maec-bundle-4.tmp#CandidateIndicatorCompositionType_Action_Reference + maec-bundle-4.tmp#CandidateIndicatorCompositionType_Object_Reference + maec-bundle-4.tmp#CandidateIndicatorCompositionType_Sub_Composition + maec-bundle-4.tmp#CandidateIndicatorCompositionType
    +
    TypemaecBundle:CandidateIndicatorCompositionType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Composition operator="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Behavior_Reference behavior_idref="">{0,1}</maecBundle:Behavior_Reference>
+  <maecBundle:Action_Reference action_id="">{0,1}</maecBundle:Action_Reference>
+  <maecBundle:Object_Reference object_idref="">{0,1}</maecBundle:Object_Reference>
+  <maecBundle:Sub_Composition operator="">{0,unbounded}</maecBundle:Sub_Composition>
+</maecBundle:Composition>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    operatorcybox:OperatorTypeEnumoptional +
    + + + + + 
    The operator field specifies the Boolean operator for this level of the Candidate Indicator's composition.
    +
    +
    +
    +
    +
    Element maecBundle:CandidateIndicatorCompositionType / maecBundle:Behavior_Reference
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Behavior_Reference field specifies a reference to a single Behavior in the Bundle that is part of the candidate indicator's composition.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BehaviorReferenceType_behavior_idref + maec-bundle-4.tmp#BehaviorReferenceType
    +
    TypemaecBundle:BehaviorReferenceType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    behavior_idrefxs:QNamerequired +
    + + + + + 
    The behavior_idref field specifies the id of the Behavior being referenced; this Behavior must be present in the current Bundle.
    +
    +
    +
    +
    +
    Element maecBundle:CandidateIndicatorCompositionType / maecBundle:Action_Reference
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Action_Reference field specifies a reference to a single Action in the Bundle that is part of the candidate indicator's composition.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typecybox:ActionReferenceType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    action_idxs:QNamerequired +
    + + + + + 
    The action_id field refers to the id of the action being referenced.
    +
    +
    +
    +
    +
    Element maecBundle:CandidateIndicatorCompositionType / maecBundle:Object_Reference
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Object_Reference field specifies a reference to a single Object in the Bundle that is part of the candidate indicator's composition.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ObjectReferenceType_object_idref + maec-bundle-4.tmp#ObjectReferenceType
    +
    TypemaecBundle:ObjectReferenceType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    object_idrefxs:QNamerequired +
    + + + + + 
    The object_idref field specifies the id of a CybOX Object being referenced in the current MAEC Bundle.
    +
    +
    +
    +
    +
    Element maecBundle:CandidateIndicatorCompositionType / maecBundle:Sub_Composition
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Sub_Composition field captures any sub-compositions in this Candidate Indicator, for expressing more complex Candidate Indicators.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CandidateIndicatorCompositionType_operator + maec-bundle-4.tmp#CandidateIndicatorCompositionType_Behavior_Reference + maec-bundle-4.tmp#CandidateIndicatorCompositionType_Action_Reference + maec-bundle-4.tmp#CandidateIndicatorCompositionType_Object_Reference + maec-bundle-4.tmp#CandidateIndicatorCompositionType_Sub_Composition + maec-bundle-4.tmp#CandidateIndicatorCompositionType
    +
    TypemaecBundle:CandidateIndicatorCompositionType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Sub_Composition operator="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Behavior_Reference behavior_idref="">{0,1}</maecBundle:Behavior_Reference>
+  <maecBundle:Action_Reference action_id="">{0,1}</maecBundle:Action_Reference>
+  <maecBundle:Object_Reference object_idref="">{0,1}</maecBundle:Object_Reference>
+  <maecBundle:Sub_Composition operator="">{0,unbounded}</maecBundle:Sub_Composition>
+</maecBundle:Sub_Composition>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    operatorcybox:OperatorTypeEnumoptional +
    + + + + + 
    The operator field specifies the Boolean operator for this level of the Candidate Indicator's composition.
    +
    +
    +
    +
    +
    Element maecBundle:BundleType / maecBundle:Collections
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Collections field contains the collection element types for Behaviors, Actions, Objects, and Candidate Indicators.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#CollectionsType_Behavior_Collections + maec-bundle-4.tmp#CollectionsType_Action_Collections + maec-bundle-4.tmp#CollectionsType_Object_Collections + maec-bundle-4.tmp#CollectionsType_Candidate_Indicator_Collections + maec-bundle-4.tmp#CollectionsType
    +
    TypemaecBundle:CollectionsType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Collections xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Behavior_Collections>{0,1}</maecBundle:Behavior_Collections>
+  <maecBundle:Action_Collections>{0,1}</maecBundle:Action_Collections>
+  <maecBundle:Object_Collections>{0,1}</maecBundle:Object_Collections>
+  <maecBundle:Candidate_Indicator_Collections>{0,1}</maecBundle:Candidate_Indicator_Collections>
+</maecBundle:Collections>
    +
    +
    +
    Element maecBundle:CollectionsType / maecBundle:Behavior_Collections
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Behavior_Collections field captures any collections of Behaviors in the Bundle.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#BehaviorCollectionListType_Behavior_Collection + maec-bundle-4.tmp#BehaviorCollectionListType
    +
    TypemaecBundle:BehaviorCollectionListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Behavior_Collections xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Behavior_Collection id="" name="">{1,unbounded}</maecBundle:Behavior_Collection>
+</maecBundle:Behavior_Collections>
    +
    +
    +
    Element maecBundle:BehaviorCollectionListType / maecBundle:Behavior_Collection
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Behavior_Collection field specifies a single collection of Behaviors in the Bundle.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BaseCollectionType_name + maec-bundle-4.tmp#BaseCollectionType_Affinity_Type + maec-bundle-4.tmp#BaseCollectionType_Affinity_Degree + maec-bundle-4.tmp#BaseCollectionType_Description + maec-bundle-4.tmp#BaseCollectionType + NO_NAMESPACE.tmp#BehaviorCollectionType_id + maec-bundle-4.tmp#BehaviorCollectionType_Purpose + maec-bundle-4.tmp#BehaviorCollectionType_Behavior_List + maec-bundle-4.tmp#BehaviorCollectionType
    +
    TypemaecBundle:BehaviorCollectionType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Behavior_Collection id="" name="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Affinity_Type>{0,1}</maecBundle:Affinity_Type>
+  <maecBundle:Affinity_Degree>{0,1}</maecBundle:Affinity_Degree>
+  <maecBundle:Description>{0,1}</maecBundle:Description>
+  <maecBundle:Purpose>{0,1}</maecBundle:Purpose>
+  <maecBundle:Behavior_List>{1,1}</maecBundle:Behavior_List>
+</maecBundle:Behavior_Collection>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The id field specifies a unique ID for this Behavior Collection.
    +
    +
    namexs:stringoptional +
    + + + + + 
    The name field specifies the name of the collection.
    +
    +
    +
    +
    +
    Element maecBundle:BehaviorCollectionType / maecBundle:Purpose
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Purpose field states the intended purpose of the collection of Behaviors. Since Behaviors are not always successful, and may not be fully observed, this is meant as way of absracting the nature of the collection of Behaviors away  from its constituent Actions.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecBundle:BehaviorCollectionType / maecBundle:Behavior_List
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Behavior_List field specifies a list of Behaviors that make up the collection.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#BehaviorListType_Behavior + maec-bundle-4.tmp#BehaviorListType
    +
    TypemaecBundle:BehaviorListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Behavior_List xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Behavior duration="" id="" ordinal_position="" status="">{1,unbounded}</maecBundle:Behavior>
+</maecBundle:Behavior_List>
    +
    +
    +
    Element maecBundle:CollectionsType / maecBundle:Action_Collections
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Action_Collections field captures any collections of Actions in the Bundle.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#ActionCollectionListType_Action_Collection + maec-bundle-4.tmp#ActionCollectionListType
    +
    TypemaecBundle:ActionCollectionListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Action_Collections xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Action_Collection id="" name="">{1,unbounded}</maecBundle:Action_Collection>
+</maecBundle:Action_Collections>
    +
    +
    +
    Element maecBundle:ActionCollectionListType / maecBundle:Action_Collection
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Action_Collection field specifies a single collection of Actions in the Bundle.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BaseCollectionType_name + maec-bundle-4.tmp#BaseCollectionType_Affinity_Type + maec-bundle-4.tmp#BaseCollectionType_Affinity_Degree + maec-bundle-4.tmp#BaseCollectionType_Description + maec-bundle-4.tmp#BaseCollectionType + NO_NAMESPACE.tmp#ActionCollectionType_id + maec-bundle-4.tmp#ActionCollectionType_Action_List + maec-bundle-4.tmp#ActionCollectionType
    +
    TypemaecBundle:ActionCollectionType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Action_Collection id="" name="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Affinity_Type>{0,1}</maecBundle:Affinity_Type>
+  <maecBundle:Affinity_Degree>{0,1}</maecBundle:Affinity_Degree>
+  <maecBundle:Description>{0,1}</maecBundle:Description>
+  <maecBundle:Action_List>{1,1}</maecBundle:Action_List>
+</maecBundle:Action_Collection>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The id field specifies a unique ID for this Action Collection.
    +
    +
    namexs:stringoptional +
    + + + + + 
    The name field specifies the name of the collection.
    +
    +
    +
    +
    +
    Element maecBundle:CollectionsType / maecBundle:Object_Collections
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Objects_Collections field captures any collections of CybOX Objects in the Bundle.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#ObjectCollectionListType_Object_Collection + maec-bundle-4.tmp#ObjectCollectionListType
    +
    TypemaecBundle:ObjectCollectionListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Object_Collections xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Object_Collection id="" name="">{1,unbounded}</maecBundle:Object_Collection>
+</maecBundle:Object_Collections>
    +
    +
    +
    Element maecBundle:ObjectCollectionListType / maecBundle:Object_Collection
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Object_Collection field specifies a single collection of CybOX Objects.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BaseCollectionType_name + maec-bundle-4.tmp#BaseCollectionType_Affinity_Type + maec-bundle-4.tmp#BaseCollectionType_Affinity_Degree + maec-bundle-4.tmp#BaseCollectionType_Description + maec-bundle-4.tmp#BaseCollectionType + NO_NAMESPACE.tmp#ObjectCollectionType_id + maec-bundle-4.tmp#ObjectCollectionType_Object_List + maec-bundle-4.tmp#ObjectCollectionType
    +
    TypemaecBundle:ObjectCollectionType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Object_Collection id="" name="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Affinity_Type>{0,1}</maecBundle:Affinity_Type>
+  <maecBundle:Affinity_Degree>{0,1}</maecBundle:Affinity_Degree>
+  <maecBundle:Description>{0,1}</maecBundle:Description>
+  <maecBundle:Object_List>{1,1}</maecBundle:Object_List>
+</maecBundle:Object_Collection>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The id attribute specifies a unique ID for this Object Collection.
    +
    +
    namexs:stringoptional +
    + + + + + 
    The name field specifies the name of the collection.
    +
    +
    +
    +
    +
    Element maecBundle:ObjectCollectionType / maecBundle:Object_List
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Object_List field specifies a list of Objects that make up the collection.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#ObjectListType_Object + maec-bundle-4.tmp#ObjectListType
    +
    TypemaecBundle:ObjectListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Object_List xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Object has_changed="" id="" idref="">{1,unbounded}</maecBundle:Object>
+</maecBundle:Object_List>
    +
    +
    +
    Element maecBundle:CollectionsType / maecBundle:Candidate_Indicator_Collections
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Candidate_Indicator_Collections field captures any collections of Candidate Indicators in the Bundle.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#CandidateIndicatorCollectionListType_Candidate_Indicator_Collection + maec-bundle-4.tmp#CandidateIndicatorCollectionListType
    +
    TypemaecBundle:CandidateIndicatorCollectionListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Candidate_Indicator_Collections xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Candidate_Indicator_Collection id="" name="">{1,unbounded}</maecBundle:Candidate_Indicator_Collection>
+</maecBundle:Candidate_Indicator_Collections>
    +
    +
    +
    Element maecBundle:CandidateIndicatorCollectionListType / maecBundle:Candidate_Indicator_Collection
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Candidate_Indicator_Collection field specifies a single collection of Candidate Indicators.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BaseCollectionType_name + maec-bundle-4.tmp#BaseCollectionType_Affinity_Type + maec-bundle-4.tmp#BaseCollectionType_Affinity_Degree + maec-bundle-4.tmp#BaseCollectionType_Description + maec-bundle-4.tmp#BaseCollectionType + NO_NAMESPACE.tmp#CandidateIndicatorCollectionType_id + maec-bundle-4.tmp#CandidateIndicatorCollectionType_Candidate_Indicator_List + maec-bundle-4.tmp#CandidateIndicatorCollectionType
    +
    TypemaecBundle:CandidateIndicatorCollectionType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Candidate_Indicator_Collection id="" name="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Affinity_Type>{0,1}</maecBundle:Affinity_Type>
+  <maecBundle:Affinity_Degree>{0,1}</maecBundle:Affinity_Degree>
+  <maecBundle:Description>{0,1}</maecBundle:Description>
+  <maecBundle:Candidate_Indicator_List>{1,1}</maecBundle:Candidate_Indicator_List>
+</maecBundle:Candidate_Indicator_Collection>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The id field specifies a unique ID for this Candidate Indicator Collection.
    +
    +
    namexs:stringoptional +
    + + + + + 
    The name field specifies the name of the collection.
    +
    +
    +
    +
    +
    Element maecBundle:CandidateIndicatorCollectionType / maecBundle:Candidate_Indicator_List
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Candidate_Indicator_List field specifies a list of Candidate Indicators that make up the collection.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#CandidateIndicatorListType_Candidate_Indicator + maec-bundle-4.tmp#CandidateIndicatorListType
    +
    TypemaecBundle:CandidateIndicatorListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Candidate_Indicator_List xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Candidate_Indicator creation_datetime="" id="" lastupdate_datetime="" version="">{1,unbounded}</maecBundle:Candidate_Indicator>
+</maecBundle:Candidate_Indicator_List>
    +
    +
    +
    Element maecBundle:Action
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Action element enables description/specification of a single malware action.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#MalwareActionType_Implementation + maec-bundle-4.tmp#MalwareActionType
    +
    TypemaecBundle:MalwareActionType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Action action_status="" context="" id="" idref="" ordinal_position="" timestamp="" timestamp_precision="second" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4" xmlns:cybox="http://cybox.mitre.org/cybox-2">
+  <cybox:Type apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</cybox:Type>
+  <cybox:Name apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</cybox:Name>
+  <cybox:Description structuring_format="">{0,1}</cybox:Description>
+  <cybox:Action_Aliases>{0,1}</cybox:Action_Aliases>
+  <cybox:Action_Arguments>{0,1}</cybox:Action_Arguments>
+  <cybox:Location id="" idref="">{0,1}</cybox:Location>
+  <cybox:Discovery_Method class="" name="" sighting_count="" source_type="">{0,1}</cybox:Discovery_Method>
+  <cybox:Associated_Objects>{0,1}</cybox:Associated_Objects>
+  <cybox:Relationships>{0,1}</cybox:Relationships>
+  <cybox:Frequency rate="" scale="" trend="" units="">{0,1}</cybox:Frequency>
+  <maecBundle:Implementation id="" type="">{0,1}</maecBundle:Implementation>
+</maecBundle:Action>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeDefaultUseAnnotation
    action_statuscybox:ActionStatusTypeEnumoptional +
    + + + + + 
    The action_status field enables description of the status of the action being described.
    +
    +
    contextcybox:ActionContextTypeEnumoptional +
    + + + + + 
    The context field is optional and enables simple characterization of the broad operational context in which the Action is relevant.
    +
    +
    idxs:QNameoptional +
    + + + + + 
    The id field specifies a unique id for this Action.
    +
    +
    idrefxs:QNameoptional +
    + + + + + 
    The idref field specifies a unique id reference to an Action defined elsewhere.
    + + + + + 
    When idref is specified, the id attribute must not be specified, and any instance of this Action should not hold content unless an extension of the Action allows it.
    +
    +
    ordinal_positionxs:positiveIntegeroptional +
    + + + + + 
    The ordinal_position field is intended to reference the ordinal position of the action with within a series of actions.
    +
    +
    timestampxs:dateTimeoptional +
    + + + + + 
    The timestamp field represents the local or relative time at which the action occurred or was observed. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
    +
    +
    timestamp_precisioncyboxCommon:DateTimePrecisionEnumsecondoptional +
    + + + + + 
    Represents the precision of the associated timestamp value. If omitted, the default is "second", meaning the timestamp is precise to the full field value. Digits in the timestamp that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.
    +
    +
    +
    +
    +
    Element maecBundle:Behavior
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Behavior element enables description/specification of a single malware behavior.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BehaviorType_id + NO_NAMESPACE.tmp#BehaviorType_ordinal_position + NO_NAMESPACE.tmp#BehaviorType_status + NO_NAMESPACE.tmp#BehaviorType_duration + maec-bundle-4.tmp#BehaviorType_Purpose + maec-bundle-4.tmp#BehaviorType_Description + maec-bundle-4.tmp#BehaviorType_Discovery_Method + maec-bundle-4.tmp#BehaviorType_Action_Composition + maec-bundle-4.tmp#BehaviorType_Associated_Code + maec-bundle-4.tmp#BehaviorType_Relationships + maec-bundle-4.tmp#BehaviorType
    +
    TypemaecBundle:BehaviorType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecBundle:Behavior duration="" id="" ordinal_position="" status="" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Purpose>{0,1}</maecBundle:Purpose>
+  <maecBundle:Description>{0,1}</maecBundle:Description>
+  <maecBundle:Discovery_Method class="" name="" sighting_count="" source_type="">{0,1}</maecBundle:Discovery_Method>
+  <maecBundle:Action_Composition>{0,1}</maecBundle:Action_Composition>
+  <maecBundle:Associated_Code>{0,1}</maecBundle:Associated_Code>
+  <maecBundle:Relationships>{0,1}</maecBundle:Relationships>
+</maecBundle:Behavior>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    durationxs:durationoptional +
    + + + + + 
    The duration field specifies the duration of the Behavior. One way to derive such a value may be to calculate the difference between the timestamps of the first and last actions that compose the behavior.
    +
    +
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for this Behavior.
    +
    +
    ordinal_positionxs:positiveIntegeroptional +
    + + + + + 
    The ordinal_position field specifies the ordinal position of the Behavior with respect to the execution of the malware.
    +
    +
    statuscybox:ActionStatusTypeEnumoptional +
    + + + + + 
    The status field specifies the execution status of the Behavior being characterized.
    +
    +
    +
    +
    +
    Element maecBundle:BehaviorReferenceListType / maecBundle:Behavior_Reference
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Behavior_Reference field specifies a reference to a single Behavior.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BehaviorReferenceType_behavior_idref + maec-bundle-4.tmp#BehaviorReferenceType
    +
    TypemaecBundle:BehaviorReferenceType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    behavior_idrefxs:QNamerequired +
    + + + + + 
    The behavior_idref field specifies the id of the Behavior being referenced; this Behavior must be present in the current Bundle.
    +
    +
    +
    +
    +
    Element maecBundle:ObjectReferenceListType / maecBundle:Object_Reference
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Object_Reference field specifies a reference to a single CybOX Object.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ObjectReferenceType_object_idref + maec-bundle-4.tmp#ObjectReferenceType
    +
    TypemaecBundle:ObjectReferenceType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    object_idrefxs:QNamerequired +
    + + + + + 
    The object_idref field specifies the id of a CybOX Object being referenced in the current MAEC Bundle.
    +
    +
    +
    +
    +
    Complex Type maecBundle:BundleType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The BundleType serves as the high-level construct which encapsulates all Bundle elements, and represents some characterized analysis data (from any arbitrary set of analyses) for a single malware instance in terms of its MAEC Components (e.g., Behaviors, Actions, Objects, etc.).
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BundleType_id + NO_NAMESPACE.tmp#BundleType_schema_version + NO_NAMESPACE.tmp#BundleType_defined_subject + NO_NAMESPACE.tmp#BundleType_content_type + NO_NAMESPACE.tmp#BundleType_timestamp + maec-bundle-4.tmp#BundleType_Malware_Instance_Object_Attributes + maec-bundle-4.tmp#BundleType_AV_Classifications + maec-bundle-4.tmp#BundleType_Process_Tree + maec-bundle-4.tmp#BundleType_Capabilities + maec-bundle-4.tmp#BundleType_Behaviors + maec-bundle-4.tmp#BundleType_Actions + maec-bundle-4.tmp#BundleType_Objects + maec-bundle-4.tmp#BundleType_Candidate_Indicators + maec-bundle-4.tmp#BundleType_Collections
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeFixedUseAnnotation
    content_typemaecBundle:BundleContentTypeEnumoptional +
    + + + + + 
    The content_type field specifies the general type of content contained in this Bundle, e.g. static analysis tool output, dynamic analysis tool output, etc.
    +
    +
    defined_subjectxs:booleanrequired +
    + + + + + 
    The required defined_subject field specifies whether the subject attributes of the characterized malware instance are included inside this Bundle (via the top-level Malware_Instance_Object_Attributes field) or elsewhere (such as a MAEC Subject in a MAEC Package).
    +
    +
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for this MAEC Bundle.
    +
    +
    schema_versionxs:string4.1required +
    + + + + + 
    The required schema_version field specifies the version of the MAEC Bundle Schema that the document has been written in and that should be used for validation.
    +
    +
    timestampxs:dateTimeoptional +
    + + + + + 
    The timestamp field specifies the date/time that the bundle was generated.
    +
    +
    +
    +
    +
    Complex Type maecBundle:AVClassificationsType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AVClassificationsType captures any Anti-Virus (AV) tool classifications for an Object.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#AVClassificationsType_AV_Classification
    +
    +
    Complex Type maecBundle:AVClassificationType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AVClassificationType captures information on AV scanner classifications for the malware instance object captured in the Bundle or Package.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#AVClassificationType_Engine_Version + maec-bundle-4.tmp#AVClassificationType_Definition_Version + maec-bundle-4.tmp#AVClassificationType_Classification_Name
    +
    Typeextension of cyboxCommon:ToolInformationType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNameoptional +
    + + + + + 
    The id field specifies a unique ID for this Tool.
    +
    +
    idrefxs:QNameoptional +
    + + + + + 
    The idref field specifies reference to a unique ID for this Tool.
    + + + + + 
    When idref is specified, the id attribute must not be specified, and any instance of this type should not hold content unless an extension of the type allows it.
    +
    +
    +
    +
    +
    Complex Type maecBundle:ProcessTreeType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ProcessTreeType captures the process tree for the malware instance, including the parent process and processes spawned by it, along with any Actions initiated by each.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#ProcessTreeType_Root_Process
    +
    +
    Complex Type maecBundle:ProcessTreeNodeType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ProcessTreeNodeType captures a single process, or node, in the process tree. It imports and extends the ProcessObjectType from the CybOX Process Object.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ProcessTreeNodeType_id + NO_NAMESPACE.tmp#ProcessTreeNodeType_parent_action_idref + NO_NAMESPACE.tmp#ProcessTreeNodeType_ordinal_position + maec-bundle-4.tmp#ProcessTreeNodeType_Initiated_Actions + maec-bundle-4.tmp#ProcessTreeNodeType_Spawned_Process + maec-bundle-4.tmp#ProcessTreeNodeType_Injected_Process
    +
    Typeextension of ProcessObj:ProcessObjectType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for the Process Node.
    +
    +
    is_hiddenxs:booleanoptional +
    + + + + + 
    The is_hidden field specifies whether the process is hidden or not.
    +
    +
    object_referencexs:QNameoptional +
    + + + + + 
    The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
    +
    +
    ordinal_positionxs:positiveIntegeroptional +
    + + + + + 
    The ordinal_position field specifies the ordinal position of the process with respect to the other processes spawned or injected by the malware.
    +
    +
    parent_action_idrefxs:QNameoptional +
    + + + + + 
    The parent_action_idref field specifies the id of the action that created or injected this process.
    +
    +
    +
    +
    +
    Complex Type maecBundle:ActionReferenceListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ActionReferenceListType captures a list of Action References.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#ActionReferenceListType_Action_Reference
    +
    +
    Complex Type maecBundle:CapabilityListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CapabilityListType captures a list of Capabilities.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#CapabilityListType_Capability + maec-bundle-4.tmp#CapabilityListType_Capability_Reference
    +
    +
    Complex Type maecBundle:CapabilityType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CapabilityType captures details of a Capability that may be implemented in the malware instance, along with its child Strategic and Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CapabilityType_id + NO_NAMESPACE.tmp#CapabilityType_name + maec-bundle-4.tmp#CapabilityType_Description + maec-bundle-4.tmp#CapabilityType_Property + maec-bundle-4.tmp#CapabilityType_Strategic_Objective + maec-bundle-4.tmp#CapabilityType_Tactical_Objective + maec-bundle-4.tmp#CapabilityType_Behavior_Reference + maec-bundle-4.tmp#CapabilityType_Relationship
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for this MAEC Capability.
    +
    +
    namemaecVocabs:MalwareCapabilityEnum-1.0optional +
    + + + + + 
    The name field captures the name of the Capability. It uses the MalwareCapabilityEnum-1.0 enumeration from the MAEC Vocabularies schema.
    +
    +
    +
    +
    +
    Complex Type maecBundle:CapabilityPropertyType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CapabilityPropertyType captures a single property of a Capability or Capability Objective.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#CapabilityPropertyType_Name + maec-bundle-4.tmp#CapabilityPropertyType_Value
    +
    +
    Complex Type maecBundle:CapabilityObjectiveType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CapabilityObjectiveType captures details of a Capability Strategic or Tactical Objective.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CapabilityObjectiveType_id + maec-bundle-4.tmp#CapabilityObjectiveType_Name + maec-bundle-4.tmp#CapabilityObjectiveType_Description + maec-bundle-4.tmp#CapabilityObjectiveType_Property + maec-bundle-4.tmp#CapabilityObjectiveType_Behavior_Reference + maec-bundle-4.tmp#CapabilityObjectiveType_Relationship
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for this Capability Objective.
    +
    +
    +
    +
    +
    Complex Type maecBundle:BehaviorReferenceType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The BehaviorReferenceType serves as a method for referencing existing behaviors contained in the Bundle.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BehaviorReferenceType_behavior_idref
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    behavior_idrefxs:QNamerequired +
    + + + + + 
    The behavior_idref field specifies the id of the Behavior being referenced; this Behavior must be present in the current Bundle.
    +
    +
    +
    +
    +
    Complex Type maecBundle:CapabilityObjectiveRelationshipType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CapabilityObjectiveRelationshipType captures a relationship between a Strategic or Tactical Objective and one or more other Strategic or Tactical Objectives.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#CapabilityObjectiveRelationshipType_Relationship_Type + maec-bundle-4.tmp#CapabilityObjectiveRelationshipType_Objective_Reference
    +
    +
    Complex Type maecBundle:CapabilityObjectiveReferenceType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CapabilityObjectiveReferenceType serves as a method for referencing existing Capability Objectives (either Strategic or Tactical) contained in the Bundle.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CapabilityObjectiveReferenceType_objective_idref
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    objective_idrefxs:QNamerequired +
    + + + + + 
    The objective_idref field references the ID of a Capability Objective (either Strategic or Tactical) contained inside the current MAEC document.
    +
    +
    +
    +
    +
    Complex Type maecBundle:CapabilityRelationshipType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CapabilityObjectiveRelationshipType captures a relationship between a Capability and one or more other Capabilitys.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#CapabilityRelationshipType_Relationship_Type + maec-bundle-4.tmp#CapabilityRelationshipType_Capability_Reference
    +
    +
    Complex Type maecBundle:CapabilityReferenceType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CapabilityReferenceType serves as a method for referencing existing Capabilities contained in the MAEC document.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CapabilityReferenceType_capability_idref
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    capability_idrefxs:QNamerequired +
    + + + + + 
    The capability_idref field references the ID of a Capability contained inside the current MAEC document.
    +
    +
    +
    +
    +
    Complex Type maecBundle:BehaviorListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The BehaviorListType captures a list of Behaviors.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#BehaviorListType_Behavior
    +
    +
    Complex Type maecBundle:BehaviorType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The BehaviorType is one of the foundational MAEC types, and serves as a method for the characterization of malicious behaviors found or observed in malware. Behaviors can be thought of as representing the purpose behind groups of MAEC Actions, and are therefore representative of distinct portions of higher-level malware functionality. Thus, while a malware instance may perform some multitude of Actions, it is likely that these Actions represent only a few distinct behaviors. Some examples include vulnerability exploitation, email address harvesting, the disabling of a security service, etc.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BehaviorType_id + NO_NAMESPACE.tmp#BehaviorType_ordinal_position + NO_NAMESPACE.tmp#BehaviorType_status + NO_NAMESPACE.tmp#BehaviorType_duration + maec-bundle-4.tmp#BehaviorType_Purpose + maec-bundle-4.tmp#BehaviorType_Description + maec-bundle-4.tmp#BehaviorType_Discovery_Method + maec-bundle-4.tmp#BehaviorType_Action_Composition + maec-bundle-4.tmp#BehaviorType_Associated_Code + maec-bundle-4.tmp#BehaviorType_Relationships
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    durationxs:durationoptional +
    + + + + + 
    The duration field specifies the duration of the Behavior. One way to derive such a value may be to calculate the difference between the timestamps of the first and last actions that compose the behavior.
    +
    +
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for this Behavior.
    +
    +
    ordinal_positionxs:positiveIntegeroptional +
    + + + + + 
    The ordinal_position field specifies the ordinal position of the Behavior with respect to the execution of the malware.
    +
    +
    statuscybox:ActionStatusTypeEnumoptional +
    + + + + + 
    The status field specifies the execution status of the Behavior being characterized.
    +
    +
    +
    +
    +
    Complex Type maecBundle:BehaviorPurposeType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The BehaviorPurposeType captures the purpose behind a malware Behavior.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#BehaviorPurposeType_Description + maec-bundle-4.tmp#BehaviorPurposeType_Vulnerability_Exploit
    +
    +
    Complex Type maecBundle:ExploitType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ExploitType characterizes any exploitable weakness that may be targeted for exploitation by a malware instance through a Behavior. Most commonly, this refers to a known and identifiable vulnerability, but it may also refer to one or more weaknesses.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ExploitType_known_vulnerability + maec-bundle-4.tmp#ExploitType_CVE + maec-bundle-4.tmp#ExploitType_CWE_ID + maec-bundle-4.tmp#ExploitType_Targeted_Platforms
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    known_vulnerabilityxs:booleanoptional +
    + + + + + 
    The known_vulnerability field specifies whether the vulnerability that the malware is exploiting has been previously identified. If so, it should be referenced via a CVE ID in the CVE element. If not, the platform(s) targeted by the vulnerability exploitation behavior may be specified in the Targeted_Platforms element.
    +
    +
    +
    +
    +
    Complex Type maecBundle:CVEVulnerabilityType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CVEVulnerabilityType provides a way of referencing specific vulnerabilities that malware exploits or attempts to exploit via a Common Vulnerabilities and Exposures (CVE) identifier. For more information on CVE please see http://cve.mitre.org.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CVEVulnerabilityType_cve_id + maec-bundle-4.tmp#CVEVulnerabilityType_Description
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    cve_idxs:stringrequired +
    + + + + + 
    The cve_id attribute contains the ID of the CVE that is being referenced, e.g., CVE-1999-0002.
    +
    +
    +
    +
    +
    Complex Type maecBundle:PlatformListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The PlatformListType captures a list of software or hardware platforms.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#PlatformListType_Platform
    +
    +
    Complex Type maecBundle:BehavioralActionsType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The BehavioralActionsType is intended to capture the Actions or Action Collections that make up a Behavior.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#BehavioralActionsType_Action_Collection + maec-bundle-4.tmp#BehavioralActionsType_Action + maec-bundle-4.tmp#BehavioralActionsType_Action_Reference + maec-bundle-4.tmp#BehavioralActionsType_Action_Equivalence_Reference
    +
    +
    Complex Type maecBundle:ActionCollectionType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ActionCollectionType provides a method for characterizing collections of actions. This can be useful for organizing actions that may be related and where the exact relationship is unknown, as well as actions whose associated behavior has not yet been established.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BaseCollectionType_name + maec-bundle-4.tmp#BaseCollectionType_Affinity_Type + maec-bundle-4.tmp#BaseCollectionType_Affinity_Degree + maec-bundle-4.tmp#BaseCollectionType_Description + maec-bundle-4.tmp#BaseCollectionType + NO_NAMESPACE.tmp#ActionCollectionType_id + maec-bundle-4.tmp#ActionCollectionType_Action_List
    +
    Typeextension of maecBundle:BaseCollectionType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The id field specifies a unique ID for this Action Collection.
    +
    +
    namexs:stringoptional +
    + + + + + 
    The name field specifies the name of the collection.
    +
    +
    +
    +
    +
    Complex Type maecBundle:BaseCollectionType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The BaseCollectionType is the base type for other MAEC collection types.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BaseCollectionType_name + maec-bundle-4.tmp#BaseCollectionType_Affinity_Type + maec-bundle-4.tmp#BaseCollectionType_Affinity_Degree + maec-bundle-4.tmp#BaseCollectionType_Description
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    namexs:stringoptional +
    + + + + + 
    The name field specifies the name of the collection.
    +
    +
    +
    +
    +
    Complex Type maecBundle:ActionListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ActionListType captures a list of Actions.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#ActionListType_Action
    +
    +
    Complex Type maecBundle:MalwareActionType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareActionType is one of the foundational MAEC types, and serves as a method for the characterization of actions found or observed in malware. Actions can be thought of as system state changes and similar operations that represent the fundamental low-level operation of malware. Some examples include the creation of a file, deletion of a registry key, and the sending of some  data on a socket. It imports and extends the CybOX ActionType. For MAEC, the id attribute is required.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#MalwareActionType_Implementation
    +
    Typeextension of cybox:ActionType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeDefaultUseAnnotation
    action_statuscybox:ActionStatusTypeEnumoptional +
    + + + + + 
    The action_status field enables description of the status of the action being described.
    +
    +
    contextcybox:ActionContextTypeEnumoptional +
    + + + + + 
    The context field is optional and enables simple characterization of the broad operational context in which the Action is relevant.
    +
    +
    idxs:QNameoptional +
    + + + + + 
    The id field specifies a unique id for this Action.
    +
    +
    idrefxs:QNameoptional +
    + + + + + 
    The idref field specifies a unique id reference to an Action defined elsewhere.
    + + + + + 
    When idref is specified, the id attribute must not be specified, and any instance of this Action should not hold content unless an extension of the Action allows it.
    +
    +
    ordinal_positionxs:positiveIntegeroptional +
    + + + + + 
    The ordinal_position field is intended to reference the ordinal position of the action with within a series of actions.
    +
    +
    timestampxs:dateTimeoptional +
    + + + + + 
    The timestamp field represents the local or relative time at which the action occurred or was observed. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
    +
    +
    timestamp_precisioncyboxCommon:DateTimePrecisionEnumsecondoptional +
    + + + + + 
    Represents the precision of the associated timestamp value. If omitted, the default is "second", meaning the timestamp is precise to the full field value. Digits in the timestamp that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.
    +
    +
    +
    +
    +
    Complex Type maecBundle:ActionImplementationType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ActionImplementationType serves as a method for the characterization of Action Implementations. Currently supported are implementations achieved through API function calls and abstractly defined code.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ActionImplementationType_id + NO_NAMESPACE.tmp#ActionImplementationType_type + maec-bundle-4.tmp#ActionImplementationType_Compatible_Platforms + maec-bundle-4.tmp#ActionImplementationType_API_Call + maec-bundle-4.tmp#ActionImplementationType_Code
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNameoptional +
    + + + + + 
    The id field specifies a unique ID for this Action Implementation.
    +
    +
    typemaecBundle:ActionImplementationTypeEnumrequired +
    + + + + + 
    The required type field refers to the type of Action Implementation being characterized in this element.
    +
    +
    +
    +
    +
    Complex Type maecBundle:APICallType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The APICallType provides a method for the  characterization of API calls, including functions and their parameters.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#APICallType_function_name + NO_NAMESPACE.tmp#APICallType_normalized_function_name + maec-bundle-4.tmp#APICallType_Address + maec-bundle-4.tmp#APICallType_Return_Value + maec-bundle-4.tmp#APICallType_Parameters
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    function_namexs:stringoptional +
    + + + + + 
    The function_name field contains the exact name of the API function called, e.g. CreateFileEx.
    +
    +
    normalized_function_namexs:stringoptional +
    + + + + + 
    The normalized_function_name field contains the normalized name of the API function called, e.g. CreateFile.
    +
    +
    +
    +
    +
    Complex Type maecBundle:ParameterListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ParametersType captures a list of function parameters.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#ParameterListType_Parameter
    +
    +
    Complex Type maecBundle:ParameterType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ParameterType characterizes function parameters.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ParameterType_ordinal_position + NO_NAMESPACE.tmp#ParameterType_name + NO_NAMESPACE.tmp#ParameterType_value
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    namexs:stringoptional +
    + + + + + 
    The name field specifies the name of the parameter.
    +
    +
    ordinal_positionxs:positiveIntegeroptional +
    + + + + + 
    This field refers to the ordinal position of the parameter with respect to the function where it is used.
    +
    +
    valuexs:stringoptional +
    + + + + + 
    The value field specifies the actual value of the parameter.
    +
    +
    +
    +
    +
    Simple Type maecBundle:ActionImplementationTypeEnum
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ActionImplementationTypeEnum represents an enumeration of action implementation types.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + +
    enumerationapi call +
    + + + + + 
    The api call value specifies that the action was implemented using some particular API call, details of which may be captured in the API_Call element.
    +
    +
    enumerationcode +
    + + + + + 
    The Code value specifies that the action was implemented using some particular code snippet, details of which may be captured in the Code element
    +
    +
    +
    +
    +
    Complex Type maecBundle:BehavioralActionType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The BehavioralActionType type defines an Action field that can be used as part of a Behavior.  It extends the MAEC MalwareActionType type, which in turn extends the CybOX ActionType type.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#MalwareActionType_Implementation + maec-bundle-4.tmp#MalwareActionType + NO_NAMESPACE.tmp#BehavioralActionType_behavioral_ordering
    +
    Typeextension of maecBundle:MalwareActionType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeDefaultUseAnnotation
    action_statuscybox:ActionStatusTypeEnumoptional +
    + + + + + 
    The action_status field enables description of the status of the action being described.
    +
    +
    behavioral_orderingxs:positiveIntegeroptional +
    + + + + + 
    The behavioral_ordering field defines the ordering of the Action with respect to the other Actions that make up the behavior. So an action with a behavioral_ordering of "1" would come before an Action with a behavioral_ordering of "2", etc.
    +
    +
    contextcybox:ActionContextTypeEnumoptional +
    + + + + + 
    The context field is optional and enables simple characterization of the broad operational context in which the Action is relevant.
    +
    +
    idxs:QNameoptional +
    + + + + + 
    The id field specifies a unique id for this Action.
    +
    +
    idrefxs:QNameoptional +
    + + + + + 
    The idref field specifies a unique id reference to an Action defined elsewhere.
    + + + + + 
    When idref is specified, the id attribute must not be specified, and any instance of this Action should not hold content unless an extension of the Action allows it.
    +
    +
    ordinal_positionxs:positiveIntegeroptional +
    + + + + + 
    The ordinal_position field is intended to reference the ordinal position of the action with within a series of actions.
    +
    +
    timestampxs:dateTimeoptional +
    + + + + + 
    The timestamp field represents the local or relative time at which the action occurred or was observed. In order to avoid ambiguity, it is strongly suggest that all timestamps in this field include a specification of the timezone if it is known.
    +
    +
    timestamp_precisioncyboxCommon:DateTimePrecisionEnumsecondoptional +
    + + + + + 
    Represents the precision of the associated timestamp value. If omitted, the default is "second", meaning the timestamp is precise to the full field value. Digits in the timestamp that are required by the xs:dateTime datatype but are beyond the specified precision should be zeroed out.
    +
    +
    +
    +
    +
    Complex Type maecBundle:BehavioralActionReferenceType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The BehavioralActionReferenceType defines an action reference that can be used as part of a Behavior.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BehavioralActionReferenceType_behavioral_ordering
    +
    Typeextension of cybox:ActionReferenceType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    action_idxs:QNamerequired +
    + + + + + 
    The action_id field refers to the id of the action being referenced.
    +
    +
    behavioral_orderingxs:positiveIntegeroptional +
    + + + + + 
    The behavioral_ordering field defines the ordering of the Action with respect to the other Actions that make up the Behavior. For example, an Action with a behavioral_ordering of "1" would come before an Action with a behavioral_ordering of "2", etc.
    +
    +
    +
    +
    +
    Complex Type maecBundle:BehavioralActionEquivalenceReferenceType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The BehavioralActionEquivalenceReferenceType defines an Action Equivalence reference that can be used as part of a Behavior. Since the Action Equivalency equates two or more actions to a single one, this can be thought of as specifying one of the aforementioned Actions as part of the composition of the Behavior.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BehavioralActionEquivalenceReferenceType_action_equivalence_idref + NO_NAMESPACE.tmp#BehavioralActionEquivalenceReferenceType_behavioral_ordering
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    action_equivalence_idrefxs:QNamerequired +
    + + + + + 
    The action_equivalence_idref field specifies the ID of an Action Equivalence contained in the same MAEC document as the Behavior that utilizes it.
    +
    +
    behavioral_orderingxs:positiveIntegeroptional +
    + + + + + 
    The behavioral_ordering field defines the ordering of the Action Equivalency with respect to the other actions that make up the behavior. So an action with a behavioral_ordering of "1" would come before an action with a behavioral_ordering of "2", etc.
    +
    +
    +
    +
    +
    Complex Type maecBundle:AssociatedCodeType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AssociatedCodeType serves as generic way of specifying any code snippets associated with a MAEC entity, such as a Behavior.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#AssociatedCodeType_Code_Snippet
    +
    +
    Complex Type maecBundle:BehaviorRelationshipListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The BehaviorRelationshipListType captures any relationships between a Behavior and other Behaviors.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#BehaviorRelationshipListType_Relationship
    +
    +
    Complex Type maecBundle:BehaviorRelationshipType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The BehaviorRelationshipType provides a method for the characterization of relationships between Behaviors.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BehaviorRelationshipType_type + maec-bundle-4.tmp#BehaviorRelationshipType_Behavior_Reference
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    typerestriction of cyboxVocabs:ActionRelationshipTypeEnum-1.0optional +
    + + + + + 
    The type field specifies the nature of the relationship between Behaviors that is being captured.
    +
    +
    +
    +
    +
    Complex Type maecBundle:ObjectListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ObjectListType captures a list of CybOX Objects.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#ObjectListType_Object
    +
    +
    Complex Type maecBundle:CandidateIndicatorListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CandidateIndicatorListType captures a list of Candidate Indicators.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#CandidateIndicatorListType_Candidate_Indicator
    +
    +
    Complex Type maecBundle:CandidateIndicatorType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CandidateIndicatorType provides a way of defining a MAEC entity-based Candidate Indicator, which specifies the particular components that may signify the presence of the malware instance on a host system or network.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CandidateIndicatorType_id + NO_NAMESPACE.tmp#CandidateIndicatorType_creation_datetime + NO_NAMESPACE.tmp#CandidateIndicatorType_lastupdate_datetime + NO_NAMESPACE.tmp#CandidateIndicatorType_version + maec-bundle-4.tmp#CandidateIndicatorType_Importance + maec-bundle-4.tmp#CandidateIndicatorType_Numeric_Importance + maec-bundle-4.tmp#CandidateIndicatorType_Author + maec-bundle-4.tmp#CandidateIndicatorType_Description + maec-bundle-4.tmp#CandidateIndicatorType_Malware_Entity + maec-bundle-4.tmp#CandidateIndicatorType_Composition
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    creation_datetimexs:dateTimeoptional +
    + + + + + 
    The creation_datetime field specifies the date/time that the Candidate Indicator was created.
    +
    +
    idxs:QNamerequired +
    + + + + + 
    The id field specifies a unique ID for this Candidate Indicator.
    +
    +
    lastupdate_datetimexs:dateTimeoptional +
    + + + + + 
    The lastupdate_datetime field specifies the last date/time that the Candidate Indicator was updated.
    +
    +
    versionxs:stringoptional +
    + + + + + 
    The version field specifies the version of the Candidate Indicator.
    +
    +
    +
    +
    +
    Complex Type maecBundle:MalwareEntityType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareEntityType provides a Capability for characterizing the particular entity that an indicator or signature is written against, whether it is a particular malware instance, family, etc.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#MalwareEntityType_Type + maec-bundle-4.tmp#MalwareEntityType_Name + maec-bundle-4.tmp#MalwareEntityType_Description
    +
    +
    Complex Type maecBundle:CandidateIndicatorCompositionType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CandidateIndicatorCompositionType captures the composition of a Candidate Indicator, via references to any corresponding MAEC entities contained in the Bundle.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CandidateIndicatorCompositionType_operator + maec-bundle-4.tmp#CandidateIndicatorCompositionType_Behavior_Reference + maec-bundle-4.tmp#CandidateIndicatorCompositionType_Action_Reference + maec-bundle-4.tmp#CandidateIndicatorCompositionType_Object_Reference + maec-bundle-4.tmp#CandidateIndicatorCompositionType_Sub_Composition
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    operatorcybox:OperatorTypeEnumoptional +
    + + + + + 
    The operator field specifies the Boolean operator for this level of the Candidate Indicator's composition.
    +
    +
    +
    +
    +
    Complex Type maecBundle:ObjectReferenceType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ObjectReferenceType serves as a method for linking to CybOX Objects embedded in the MAEC Bundle.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ObjectReferenceType_object_idref
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    object_idrefxs:QNamerequired +
    + + + + + 
    The object_idref field specifies the id of a CybOX Object being referenced in the current MAEC Bundle.
    +
    +
    +
    +
    +
    Complex Type maecBundle:CollectionsType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CollectionsType captures the various types of MAEC entity collections.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#CollectionsType_Behavior_Collections + maec-bundle-4.tmp#CollectionsType_Action_Collections + maec-bundle-4.tmp#CollectionsType_Object_Collections + maec-bundle-4.tmp#CollectionsType_Candidate_Indicator_Collections
    +
    +
    Complex Type maecBundle:BehaviorCollectionListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The BehaviorCollectionListType captures a list of Behaviors Collections.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#BehaviorCollectionListType_Behavior_Collection
    +
    +
    Complex Type maecBundle:BehaviorCollectionType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The BehaviorCollectionType provides a Capability for characterizing collections of behaviors.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BaseCollectionType_name + maec-bundle-4.tmp#BaseCollectionType_Affinity_Type + maec-bundle-4.tmp#BaseCollectionType_Affinity_Degree + maec-bundle-4.tmp#BaseCollectionType_Description + maec-bundle-4.tmp#BaseCollectionType + NO_NAMESPACE.tmp#BehaviorCollectionType_id + maec-bundle-4.tmp#BehaviorCollectionType_Purpose + maec-bundle-4.tmp#BehaviorCollectionType_Behavior_List
    +
    Typeextension of maecBundle:BaseCollectionType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The id field specifies a unique ID for this Behavior Collection.
    +
    +
    namexs:stringoptional +
    + + + + + 
    The name field specifies the name of the collection.
    +
    +
    +
    +
    +
    Complex Type maecBundle:ActionCollectionListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ActionCollectionListType captures a list of Actions Collections.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#ActionCollectionListType_Action_Collection
    +
    +
    Complex Type maecBundle:ObjectCollectionListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ObjectCollectionListType captures a list of Object Collections.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#ObjectCollectionListType_Object_Collection
    +
    +
    Complex Type maecBundle:ObjectCollectionType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ObjectCollectionType provides a Capability for characterizing collections of Objects. For instance, it can be used to group all of the Objects that are associated with a specific behavior.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BaseCollectionType_name + maec-bundle-4.tmp#BaseCollectionType_Affinity_Type + maec-bundle-4.tmp#BaseCollectionType_Affinity_Degree + maec-bundle-4.tmp#BaseCollectionType_Description + maec-bundle-4.tmp#BaseCollectionType + NO_NAMESPACE.tmp#ObjectCollectionType_id + maec-bundle-4.tmp#ObjectCollectionType_Object_List
    +
    Typeextension of maecBundle:BaseCollectionType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The id attribute specifies a unique ID for this Object Collection.
    +
    +
    namexs:stringoptional +
    + + + + + 
    The name field specifies the name of the collection.
    +
    +
    +
    +
    +
    Complex Type maecBundle:CandidateIndicatorCollectionListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CandidateIndicatorCollectionListType captures a list of Candidate Indicators.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#CandidateIndicatorCollectionListType_Candidate_Indicator_Collection
    +
    +
    Complex Type maecBundle:CandidateIndicatorCollectionType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CandidateIndicatorCollectionType provides a Capability for characterizing collections of Candidate Indicators.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BaseCollectionType_name + maec-bundle-4.tmp#BaseCollectionType_Affinity_Type + maec-bundle-4.tmp#BaseCollectionType_Affinity_Degree + maec-bundle-4.tmp#BaseCollectionType_Description + maec-bundle-4.tmp#BaseCollectionType + NO_NAMESPACE.tmp#CandidateIndicatorCollectionType_id + maec-bundle-4.tmp#CandidateIndicatorCollectionType_Candidate_Indicator_List
    +
    Typeextension of maecBundle:BaseCollectionType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The id field specifies a unique ID for this Candidate Indicator Collection.
    +
    +
    namexs:stringoptional +
    + + + + + 
    The name field specifies the name of the collection.
    +
    +
    +
    +
    +
    Simple Type maecBundle:BundleContentTypeEnum
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The BundleContentTypeEnum is a non-exhaustive enumeration of the general types of content that a Bundle can contain.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationdynamic analysis tool output +
    + + + + + 
    The dynamic analysis tool output value specifies that the Bundle primarily captures some form of dynamic analysis tool output, such as from a sandbox.
    +
    +
    enumerationstatic analysis tool output +
    + + + + + 
    The static analysis tool output value specifies that the Bundle primarily captures some form of static analysis tool output, such as from a packer detection tool.
    +
    +
    enumerationmanual analysis output +
    + + + + + 
    The manual analysis output value specifies that the Bundle primarily captures some form of manual analysis output, which may or may not involve the use of tools.
    +
    +
    enumerationextracted from subject +
    + + + + + 
    The extracted from subject value specifies that the Bundle primarily captures some data that extracted from the Malware Subject, such as some PE Header fields.
    +
    +
    enumerationmixed +
    + + + + + 
    The mixed value specifies that the Bundle captures some mixed forms of analysis or tool output for the Malware Subject, such as both dynamic and static analysis tool output.
    +
    +
    enumerationother +
    + + + + + 
    The other value specifies that the Bundle captures some other form of analysis or tool output that is not represented by the other enumeration values.
    +
    +
    +
    +
    +
    Complex Type maecBundle:BehaviorReferenceListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The BehaviorReferenceListType captures a list of Behavior References.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#BehaviorReferenceListType_Behavior_Reference
    +
    +
    Complex Type maecBundle:ObjectReferenceListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ObjectReferenceListType captures a list of references to CybOX Objects.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-bundle-4.tmp#ObjectReferenceListType_Object_Reference
    +
    +
    Complex Type maecBundle:BundleReferenceType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-bundle-4
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The BundleReferenceType serves as a method for linking to Bundles embedded in other locations.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#BundleReferenceType_bundle_idref
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    bundle_idrefxs:QNamerequired +
    + + + + + 
    The bundle_idref field references the ID of a Bundle contained inside the current MAEC document.
    +
    +
    +
    +
    +
    +
    +
    +
    XML Schema documentation generated by ® XML Editor. +
    +
    + \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/maec-container-2.html b/documentation/maec4.1-xsddocs/maec-container-2.html new file mode 100644 index 00000000..22191ac2 --- /dev/null +++ b/documentation/maec4.1-xsddocs/maec-container-2.html @@ -0,0 +1,923 @@ + + + + + Schema documentation for namespace http://maec.mitre.org/XMLSchema/maec-container-2 + + +
    + + + + + + + + + + + + + + + + +
    +

    Showing:

    + + + + + + + + + + + + + +
    Annotations
    Attributes
    Diagrams
    Instances
    +
    +
    +
    Main schema maec_container_schema.xsd
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-container-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The following is a description of the elements, types, and attributes that compose the Malware Attribute Enumeration and Characterization (MAEC) container schema.
    +
    +
    + + + + + 
    The MAEC Container Schema is maintained by The Mitre Corporation. For more information, including how to get involved in the project, please visit the MAEC website at http://maec.mitre.org.
    +
    +
    +
    +
    Element maecContainer:MAEC_Container
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-container-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The root element of the MAEC Container schema is MAEC_Container, which captures one or more Packages.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ContainerType_id + NO_NAMESPACE.tmp#ContainerType_schema_version + NO_NAMESPACE.tmp#ContainerType_timestamp + maec-container-2.tmp#ContainerType_Packages + maec-container-2.tmp#ContainerType
    +
    TypemaecContainer:ContainerType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecContainer:MAEC_Container id="" schema_version="2.1" timestamp="" xmlns:maecContainer="http://maec.mitre.org/XMLSchema/maec-container-2">
+  <maecContainer:Packages>{1,1}</maecContainer:Packages>
+</maecContainer:MAEC_Container>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeFixedUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for this Container.
    +
    +
    schema_versionxs:string2.1required +
    + + + + + 
    The required schema_version field specifies the version of the MAEC Container Schema that the document has been written in and that should be used for validation.
    +
    +
    timestampxs:dateTimeoptional +
    + + + + + 
    The timestamp field specifies the date/time that the Container was generated.
    +
    +
    +
    +
    +
    Element maecContainer:ContainerType / maecContainer:Packages
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-container-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Packages field captures a list of MAEC Packages.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-container-2.tmp#PackageListType_Package + maec-container-2.tmp#PackageListType
    +
    TypemaecContainer:PackageListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecContainer:Packages xmlns:maecContainer="http://maec.mitre.org/XMLSchema/maec-container-2">
+  <maecContainer:Package id="" schema_version="2.1" timestamp="">{1,unbounded}</maecContainer:Package>
+</maecContainer:Packages>
    +
    +
    +
    Element maecContainer:PackageListType / maecContainer:Package
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-container-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Package field specifies a single Package, which encompasses 1-n Malware Subjects and any associated metadata.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypemaecPackage:PackageType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecContainer:Package id="" schema_version="2.1" timestamp="" xmlns:maecContainer="http://maec.mitre.org/XMLSchema/maec-container-2" xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Malware_Subjects>{1,1}</maecPackage:Malware_Subjects>
+  <maecPackage:Grouping_Relationships>{0,1}</maecPackage:Grouping_Relationships>
+</maecContainer:Package>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeFixedUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for this Package.
    +
    +
    schema_versionxs:string2.1required +
    + + + + + 
    The required schema_version field specifies the version of the MAEC Package schema that the document has been written in and that should be used for validation.
    +
    +
    timestampxs:dateTimeoptional +
    + + + + + 
    The timestamp field specifies the date/time that the Package was generated.
    +
    +
    +
    +
    +
    Complex Type maecContainer:ContainerType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-container-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ContainerType encompasses all forms of MAEC data. Currently, this entails a list of Packages.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ContainerType_id + NO_NAMESPACE.tmp#ContainerType_schema_version + NO_NAMESPACE.tmp#ContainerType_timestamp + maec-container-2.tmp#ContainerType_Packages
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeFixedUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for this Container.
    +
    +
    schema_versionxs:string2.1required +
    + + + + + 
    The required schema_version field specifies the version of the MAEC Container Schema that the document has been written in and that should be used for validation.
    +
    +
    timestampxs:dateTimeoptional +
    + + + + + 
    The timestamp field specifies the date/time that the Container was generated.
    +
    +
    +
    +
    +
    Complex Type maecContainer:PackageListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-container-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The PackageListType captures a list of Packages.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-container-2.tmp#PackageListType_Package
    +
    +
    +
    +
    +
    XML Schema documentation generated by ® XML Editor. +
    +
    + \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/maec-package-2.html b/documentation/maec4.1-xsddocs/maec-package-2.html new file mode 100644 index 00000000..4b027f5b --- /dev/null +++ b/documentation/maec4.1-xsddocs/maec-package-2.html @@ -0,0 +1,13237 @@ + + + + + Schema documentation for namespace http://maec.mitre.org/XMLSchema/maec-package-2 + + +
    + + + + + + + + + + + + + + + + +
    +

    Showing:

    + + + + + + + + + + + + + + + + +
    Annotations
    Attributes
    Diagrams
    Facets
    Instances
    +
    +
    +
    Main schema maec_package_schema.xsd
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The following is a description of the elements, types, and attributes that compose the Malware Attribute Enumeration and Characterization (MAEC) package schema.
    +
    +
    + + + + + 
    The MAEC Package Schema is maintained by The Mitre Corporation. For more information, including how to get involved in the project, please visit the MAEC website at http://maec.mitre.org.
    +
    +
    + + + + + 
    The imported MMDEF v1.2 schema is copyright 2013 IEEE-SA.
    +
    +
    +
    +
    Element maecPackage:MAEC_Package
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The root element of the MAEC Package schema is the MAEC_Package, which captures a single MAEC Package that encompasses one or more Malware Subjects and all of their associated MAEC entities.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#PackageType_id + NO_NAMESPACE.tmp#PackageType_schema_version + NO_NAMESPACE.tmp#PackageType_timestamp + maec-package-2.tmp#PackageType_Malware_Subjects + maec-package-2.tmp#PackageType_Grouping_Relationships + maec-package-2.tmp#PackageType
    +
    TypemaecPackage:PackageType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:MAEC_Package id="" schema_version="2.1" timestamp="" xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Malware_Subjects>{1,1}</maecPackage:Malware_Subjects>
+  <maecPackage:Grouping_Relationships>{0,1}</maecPackage:Grouping_Relationships>
+</maecPackage:MAEC_Package>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeFixedUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for this Package.
    +
    +
    schema_versionxs:string2.1required +
    + + + + + 
    The required schema_version field specifies the version of the MAEC Package schema that the document has been written in and that should be used for validation.
    +
    +
    timestampxs:dateTimeoptional +
    + + + + + 
    The timestamp field specifies the date/time that the Package was generated.
    +
    +
    +
    +
    +
    Element maecPackage:PackageType / maecPackage:Malware_Subjects
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Malware_Subjects field captures each of the Malware Subjects contained in the Package.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#MalwareSubjectListType_Malware_Subject + maec-package-2.tmp#MalwareSubjectListType
    +
    TypemaecPackage:MalwareSubjectListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Malware_Subjects xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Malware_Subject id="">{1,unbounded}</maecPackage:Malware_Subject>
+</maecPackage:Malware_Subjects>
    +
    +
    +
    Element maecPackage:MalwareSubjectListType / maecPackage:Malware_Subject
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Malware_Subject field represents a single Malware Subject (most commonly a file) and its associated metadata, such as Analyses, Bundles, relationships to other Malware Subjects, etc.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#MalwareSubjectType_id + maec-package-2.tmp#MalwareSubjectType_Malware_Instance_Object_Attributes + maec-package-2.tmp#MalwareSubjectType_Label + maec-package-2.tmp#MalwareSubjectType_Configuration_Details + maec-package-2.tmp#MalwareSubjectType_Development_Environment + maec-package-2.tmp#MalwareSubjectType_Minor_Variants + maec-package-2.tmp#MalwareSubjectType_Field_Data + maec-package-2.tmp#MalwareSubjectType_Analyses + maec-package-2.tmp#MalwareSubjectType_Findings_Bundles + maec-package-2.tmp#MalwareSubjectType_Relationships + maec-package-2.tmp#MalwareSubjectType_Compatible_Platform + maec-package-2.tmp#MalwareSubjectType
    +
    TypemaecPackage:MalwareSubjectType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Malware_Subject id="" xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Malware_Instance_Object_Attributes has_changed="" id="" idref="">{1,1}</maecPackage:Malware_Instance_Object_Attributes>
+  <maecPackage:Label apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,unbounded}</maecPackage:Label>
+  <maecPackage:Configuration_Details>{0,1}</maecPackage:Configuration_Details>
+  <maecPackage:Development_Environment>{0,1}</maecPackage:Development_Environment>
+  <maecPackage:Minor_Variants>{0,1}</maecPackage:Minor_Variants>
+  <maecPackage:Field_Data>{0,1}</maecPackage:Field_Data>
+  <maecPackage:Analyses>{0,1}</maecPackage:Analyses>
+  <maecPackage:Findings_Bundles>{0,1}</maecPackage:Findings_Bundles>
+  <maecPackage:Relationships>{0,1}</maecPackage:Relationships>
+  <maecPackage:Compatible_Platform>{0,unbounded}</maecPackage:Compatible_Platform>
+</maecPackage:Malware_Subject>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for this Malware Subject.
    +
    +
    +
    +
    +
    Element maecPackage:MalwareSubjectType / maecPackage:Malware_Instance_Object_Attributes
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Malware_Instance_Object_Attributes field characterizes the attributes of the malware instance object (most commonly a file) that is encompassed in the Malware_Subject, via its corresponding CybOX Object. For example, a file would be represented via a CybOX File field of type FileObj:FileObjectType and may have a file name, MD5 hash, etc.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typecybox:ObjectType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Malware_Instance_Object_Attributes has_changed="" id="" idref="" xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2" xmlns:cybox="http://cybox.mitre.org/cybox-2">
+  <cybox:State apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</cybox:State>
+  <cybox:Description structuring_format="">{0,1}</cybox:Description>
+  <cybox:Properties object_reference="">{0,1}</cybox:Properties>
+  <cybox:Domain_Specific_Object_Properties>{0,1}</cybox:Domain_Specific_Object_Properties>
+  <cybox:Location id="" idref="">{0,1}</cybox:Location>
+  <cybox:Related_Objects>{0,1}</cybox:Related_Objects>
+  <cybox:Defined_Effect effect_type="">{0,1}</cybox:Defined_Effect>
+  <cybox:Discovery_Method class="" name="" sighting_count="" source_type="">{0,1}</cybox:Discovery_Method>
+</maecPackage:Malware_Instance_Object_Attributes>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    has_changedxs:booleanoptional +
    + + + + + 
    The has_changed field is optional and conveys a targeted observation pattern of whether the associated object specified has changed in some way without requiring further specific detail. This field would be leveraged within a pattern observable triggering on whether the value of an object specification has changed at all. This field is NOT intended to be used for versioning of CybOX content.
    +
    +
    idxs:QNameoptional +
    + + + + + 
    The id field specifies a unique id for this Object.
    +
    +
    idrefxs:QNameoptional +
    + + + + + 
    The idref field specifies a unique id reference to an Object defined elsewhere.
    + + + + + 
    When idref is specified, the id attribute must not be specified, and any instance of this Object should not hold content unless an extension of the Object allows it.
    +
    +
    +
    +
    +
    Element maecPackage:MalwareSubjectType / maecPackage:Label
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Label field specifies a single commonly accepted label to describe the Malware Subject, e.g. "worm". The default vocabulary for this field is the MalwareLabelVocab-1.0 from the MAEC Default Vocabularies schema. More than one label may be specified through the use of multiple instances of this field.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:ControlledVocabularyStringType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeDefaultUseAnnotation
    apply_conditioncyboxCommon:ConditionApplicationEnumANYoptional +
    + + + + + 
    This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
    +
    +
    bit_maskxs:hexBinaryoptional +
    + + + + + 
    Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
    +
    +
    conditioncyboxCommon:ConditionTypeEnumoptional +
    + + + + + 
    This field is optional and defines the relevant condition to apply to the value.
    +
    +
    delimiterxs:string##comma##optional +
    + + + + + 
    The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
    +
    +
    has_changedxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
    +
    +
    is_case_sensitivexs:booleantrueoptional +
    + + + + + 
    The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
    +
    +
    pattern_typecyboxCommon:PatternTypeEnumoptional +
    + + + + + 
    This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    +
    +
    regex_syntaxxs:stringoptional +
    + + + + + 
    This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    + + + + + 
    Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
    + + + + + 
    Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
    +
    +
    trendxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
    +
    +
    vocab_namexs:stringoptional +
    + + + + + 
    The vocab_name field specifies the name of the controlled vocabulary.
    +
    +
    vocab_referencexs:anyURIoptional +
    + + + + + 
    The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
    +
    +
    +
    +
    +
    Element maecPackage:MalwareSubjectType / maecPackage:Configuration_Details
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Configuration_Details field captures details of the configuration specified for the Malware Subject, such as configuration parameters.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#MalwareConfigurationDetailsType_Storage + maec-package-2.tmp#MalwareConfigurationDetailsType_Obfuscation + maec-package-2.tmp#MalwareConfigurationDetailsType_Configuration_Parameter + maec-package-2.tmp#MalwareConfigurationDetailsType
    +
    TypemaecPackage:MalwareConfigurationDetailsType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Configuration_Details xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Storage>{0,1}</maecPackage:Storage>
+  <maecPackage:Obfuscation is_encoded="" is_encrypted="">{0,1}</maecPackage:Obfuscation>
+  <maecPackage:Configuration_Parameter>{0,unbounded}</maecPackage:Configuration_Parameter>
+</maecPackage:Configuration_Details>
    +
    +
    +
    Element maecPackage:MalwareConfigurationDetailsType / maecPackage:Storage
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Storage field captures details of the how the malware configuration parameters may be stored, e.g. in a separate file, in memory, etc.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#MalwareConfigurationStorageDetailsType_Malware_Binary + maec-package-2.tmp#MalwareConfigurationStorageDetailsType_File + maec-package-2.tmp#MalwareConfigurationStorageDetailsType_URL + maec-package-2.tmp#MalwareConfigurationStorageDetailsType
    +
    TypemaecPackage:MalwareConfigurationStorageDetailsType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Storage xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Malware_Binary>{0,1}</maecPackage:Malware_Binary>
+  <maecPackage:File is_masqueraded="" is_packed="" object_reference="">{0,1}</maecPackage:File>
+  <maecPackage:URL object_reference="" type="">{0,unbounded}</maecPackage:URL>
+</maecPackage:Storage>
    +
    +
    +
    Element maecPackage:MalwareConfigurationStorageDetailsType / maecPackage:Malware_Binary
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Malware_Binary field captures properties related to the storage of malware configuration parameters inside the malware binary captured in the Malware_Instance_Object_Attributes field.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#MalwareBinaryConfigurationStorageDetailsType_File_Offset + maec-package-2.tmp#MalwareBinaryConfigurationStorageDetailsType_Section_Name + maec-package-2.tmp#MalwareBinaryConfigurationStorageDetailsType_Section_Offset + maec-package-2.tmp#MalwareBinaryConfigurationStorageDetailsType
    +
    TypemaecPackage:MalwareBinaryConfigurationStorageDetailsType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Malware_Binary xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:File_Offset>{0,1}</maecPackage:File_Offset>
+  <maecPackage:Section_Name>{0,1}</maecPackage:Section_Name>
+  <maecPackage:Section_Offset>{0,1}</maecPackage:Section_Offset>
+</maecPackage:Malware_Binary>
    +
    +
    +
    Element maecPackage:MalwareBinaryConfigurationStorageDetailsType / maecPackage:File_Offset
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The File_Offset field specifies the offset to the start of the malware configuration parameters in the malware binary.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:hexBinary
    +
    Element maecPackage:MalwareBinaryConfigurationStorageDetailsType / maecPackage:Section_Name
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Section_Name field specifies the name of the PE section in the malware binary thta contains the malware configuration parameters, for PE file malware binaries.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecPackage:MalwareBinaryConfigurationStorageDetailsType / maecPackage:Section_Offset
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Section_Offset field specifies the offset in the PE section in the malware binary that contains the malware configuration parameters to the start of the parameters themselves, for PE file malware binaries.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:hexBinary
    +
    Element maecPackage:MalwareConfigurationStorageDetailsType / maecPackage:File
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The File field captures the properties of a configuration file, for cases where the Malware Subject stores its configuration parameters in a separate file.
    +
    +
    + + + + + 
    This field uses the FileObjectType from the imported CybOX File Object.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypeFileObj:FileObjectType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:File is_masqueraded="" is_packed="" object_reference="" xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2">
+  <cyboxCommon:Custom_Properties>{0,1}</cyboxCommon:Custom_Properties>
+  <FileObj:File_Name appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:File_Name>
+  <FileObj:File_Path appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" fully_qualified="" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:File_Path>
+  <FileObj:Device_Path appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Device_Path>
+  <FileObj:Full_Path appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Full_Path>
+  <FileObj:File_Extension appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:File_Extension>
+  <FileObj:Size_In_Bytes appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="unsignedLong" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Size_In_Bytes>
+  <FileObj:Magic_Number appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="hexBinary" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Magic_Number>
+  <FileObj:File_Format appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:File_Format>
+  <FileObj:Hashes>{0,1}</FileObj:Hashes>
+  <FileObj:Digital_Signatures>{0,1}</FileObj:Digital_Signatures>
+  <FileObj:Modified_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="dateTime" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" precision="second" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Modified_Time>
+  <FileObj:Accessed_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="dateTime" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" precision="second" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Accessed_Time>
+  <FileObj:Created_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="dateTime" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" precision="second" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Created_Time>
+  <FileObj:File_Attributes_List>{0,1}</FileObj:File_Attributes_List>
+  <FileObj:Permissions>{0,1}</FileObj:Permissions>
+  <FileObj:User_Owner appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:User_Owner>
+  <FileObj:Packer_List>{0,1}</FileObj:Packer_List>
+  <FileObj:Peak_Entropy appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="double" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Peak_Entropy>
+  <FileObj:Sym_Links>{0,1}</FileObj:Sym_Links>
+  <FileObj:Byte_Runs>{0,1}</FileObj:Byte_Runs>
+  <FileObj:Extracted_Features>{0,1}</FileObj:Extracted_Features>
+  <FileObj:Encryption_Algorithm appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Encryption_Algorithm>
+  <FileObj:Decryption_Key appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Decryption_Key>
+  <FileObj:Compression_Method appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Compression_Method>
+  <FileObj:Compression_Version appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Compression_Version>
+  <FileObj:Compression_Comment appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Compression_Comment>
+</maecPackage:File>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    is_masqueradedxs:booleanoptional +
    + + + + + 
    The is_masqueraded field specifies whether the file is masqueraded as another type of file; e.g., a PDF file that has had its extension changed to TXT to masquerade itself as a text file.
    +
    +
    is_packedxs:booleanoptional +
    + + + + + 
    The is_packed field is used to indicate whether the file is packed or not.
    +
    +
    object_referencexs:QNameoptional +
    + + + + + 
    The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
    +
    +
    +
    +
    +
    Element maecPackage:MalwareConfigurationStorageDetailsType / maecPackage:URL
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The URL field captures a URL at which the configuration parameters for the Malware Subject may be stored. More than one such URL may be specified by using multiple occurrences of this field.
    +
    +
    + + + + + 
    This field uses the URIObjectType from the import CybOX URI Object.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypeURIObj:URIObjectType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:URL object_reference="" type="" xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2">
+  <cyboxCommon:Custom_Properties>{0,1}</cyboxCommon:Custom_Properties>
+  <URIObj:Value appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="anyURI" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</URIObj:Value>
+</maecPackage:URL>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    object_referencexs:QNameoptional +
    + + + + + 
    The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
    +
    +
    typeURIObj:URITypeEnumoptional +
    + + + + + 
    The type field specifies the type of URI that is being defined.
    +
    +
    +
    +
    +
    Element maecPackage:MalwareConfigurationDetailsType / maecPackage:Obfuscation
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Encryption field captures details of how the malware configuration parameters may be obfuscated, if applicable.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#MalwareConfigurationObfuscationDetailsType_is_encoded + NO_NAMESPACE.tmp#MalwareConfigurationObfuscationDetailsType_is_encrypted + maec-package-2.tmp#MalwareConfigurationObfuscationDetailsType_Algorithm_Details + maec-package-2.tmp#MalwareConfigurationObfuscationDetailsType
    +
    TypemaecPackage:MalwareConfigurationObfuscationDetailsType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Obfuscation is_encoded="" is_encrypted="" xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Algorithm_Details ordinal_position="">{0,unbounded}</maecPackage:Algorithm_Details>
+</maecPackage:Obfuscation>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    is_encodedxs:booleanoptional +
    + + + + + 
    The is_encoded field specifies that the malware configuration parameters are encoded with the algorithm captured in the Algorithm_Details field.
    +
    +
    is_encryptedxs:booleanoptional +
    + + + + + 
    The is_encrypted field specifies that the malware configuration parameters are encrypted with the algorithm captured in the Algorithm_Details field.
    +
    +
    +
    +
    +
    Element maecPackage:MalwareConfigurationObfuscationDetailsType / maecPackage:Algorithm_Details
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Algorithm_Details field captures an the details of the algorithm used to encode or encrypt the malware configuration parameters, including the name of the algorithm and its key. More than one encryption or encoding algorithm may be specified by using multiple occurrences of this field.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#MalwareConfigurationObfuscationAlgorithmType_ordinal_position + maec-package-2.tmp#MalwareConfigurationObfuscationAlgorithmType_Key + maec-package-2.tmp#MalwareConfigurationObfuscationAlgorithmType_Algorithm_Name + maec-package-2.tmp#MalwareConfigurationObfuscationAlgorithmType
    +
    TypemaecPackage:MalwareConfigurationObfuscationAlgorithmType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Algorithm_Details ordinal_position="" xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Key>{0,1}</maecPackage:Key>
+  <maecPackage:Algorithm_Name apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</maecPackage:Algorithm_Name>
+</maecPackage:Algorithm_Details>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    ordinal_positionxs:positiveIntegeroptional +
    + + + + + 
    The ordinal_position field specifies the explicit ordering of the usage of the algorithm with respect to the other algorithms used to encrypt or encode the malware configuration parameters, for cases where more than one algorithm was used.
    +
    +
    +
    +
    +
    Element maecPackage:MalwareConfigurationObfuscationAlgorithmType / maecPackage:Key
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Key field captures the hexadecimal key used to decrypt the configuration parameters.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:hexBinary
    +
    Element maecPackage:MalwareConfigurationObfuscationAlgorithmType / maecPackage:Algorithm_Name
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Algorithm_Name field captures the name of the encoding or encryption algorithm used to obfuscate the malware configuration parameters.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:ControlledVocabularyStringType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeDefaultUseAnnotation
    apply_conditioncyboxCommon:ConditionApplicationEnumANYoptional +
    + + + + + 
    This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
    +
    +
    bit_maskxs:hexBinaryoptional +
    + + + + + 
    Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
    +
    +
    conditioncyboxCommon:ConditionTypeEnumoptional +
    + + + + + 
    This field is optional and defines the relevant condition to apply to the value.
    +
    +
    delimiterxs:string##comma##optional +
    + + + + + 
    The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
    +
    +
    has_changedxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
    +
    +
    is_case_sensitivexs:booleantrueoptional +
    + + + + + 
    The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
    +
    +
    pattern_typecyboxCommon:PatternTypeEnumoptional +
    + + + + + 
    This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    +
    +
    regex_syntaxxs:stringoptional +
    + + + + + 
    This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    + + + + + 
    Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
    + + + + + 
    Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
    +
    +
    trendxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
    +
    +
    vocab_namexs:stringoptional +
    + + + + + 
    The vocab_name field specifies the name of the controlled vocabulary.
    +
    +
    vocab_referencexs:anyURIoptional +
    + + + + + 
    The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
    +
    +
    +
    +
    +
    Element maecPackage:MalwareConfigurationDetailsType / maecPackage:Configuration_Parameter
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Configuration_Parameter field captures a single configuration parameter that may be defined for the Malware Subject. More than one configuration parameter may be specified by using multiple occurrences of this field.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#MalwareConfigurationParameterType_Name + maec-package-2.tmp#MalwareConfigurationParameterType_Value + maec-package-2.tmp#MalwareConfigurationParameterType
    +
    TypemaecPackage:MalwareConfigurationParameterType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Configuration_Parameter xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Name apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</maecPackage:Name>
+  <maecPackage:Value>{0,1}</maecPackage:Value>
+</maecPackage:Configuration_Parameter>
    +
    +
    +
    Element maecPackage:MalwareConfigurationParameterType / maecPackage:Name
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Name field specifies the name of the malware configuration parameter. It uses the MalwareConfigurationParameterVocab vocabulary from the MAEC Default Vocabularies schemas as its default vocabulary. Parameters that are not included in this vocabulary may also be specified, in which case it is recommended to use the exact name of the parameter.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:ControlledVocabularyStringType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeDefaultUseAnnotation
    apply_conditioncyboxCommon:ConditionApplicationEnumANYoptional +
    + + + + + 
    This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
    +
    +
    bit_maskxs:hexBinaryoptional +
    + + + + + 
    Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
    +
    +
    conditioncyboxCommon:ConditionTypeEnumoptional +
    + + + + + 
    This field is optional and defines the relevant condition to apply to the value.
    +
    +
    delimiterxs:string##comma##optional +
    + + + + + 
    The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
    +
    +
    has_changedxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
    +
    +
    is_case_sensitivexs:booleantrueoptional +
    + + + + + 
    The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
    +
    +
    pattern_typecyboxCommon:PatternTypeEnumoptional +
    + + + + + 
    This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    +
    +
    regex_syntaxxs:stringoptional +
    + + + + + 
    This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    + + + + + 
    Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
    + + + + + 
    Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
    +
    +
    trendxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
    +
    +
    vocab_namexs:stringoptional +
    + + + + + 
    The vocab_name field specifies the name of the controlled vocabulary.
    +
    +
    vocab_referencexs:anyURIoptional +
    + + + + + 
    The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
    +
    +
    +
    +
    +
    Element maecPackage:MalwareConfigurationParameterType / maecPackage:Value
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Value field captures the value of the malware configuration parameter.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecPackage:MalwareSubjectType / maecPackage:Development_Environment
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Development_Environment field captures details of the development environment used in the creation of the malware instance characterized by the Malware Subject.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#MalwareDevelopmentEnvironmentType_Tools + maec-package-2.tmp#MalwareDevelopmentEnvironmentType_Debugging_File + maec-package-2.tmp#MalwareDevelopmentEnvironmentType
    +
    TypemaecPackage:MalwareDevelopmentEnvironmentType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Development_Environment xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Tools>{0,1}</maecPackage:Tools>
+  <maecPackage:Debugging_File is_masqueraded="" is_packed="" object_reference="">{0,unbounded}</maecPackage:Debugging_File>
+</maecPackage:Development_Environment>
    +
    +
    +
    Element maecPackage:MalwareDevelopmentEnvironmentType / maecPackage:Tools
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Tools field captures the properties of one or more tools used in the development of the malware instance. For the Type field in each Tool, the MAEC MalwareDevelopmentToolVocab (from the MAEC Default Vocabularies Schema) should be used as the default vocabulary.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:ToolsInformationType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Tools xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2">
+  <cyboxCommon:Tool id="" idref="">{1,unbounded}</cyboxCommon:Tool>
+</maecPackage:Tools>
    +
    +
    +
    Element maecPackage:MalwareDevelopmentEnvironmentType / maecPackage:Debugging_File
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Debugging_File field captures the properties of a debugging file associated with the malware instance, such as a PDB file. It uses the FileObjectType from the imported File Object Schema. More than one Debugging_File can be specified by using multiple instances of this field.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypeFileObj:FileObjectType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Debugging_File is_masqueraded="" is_packed="" object_reference="" xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2">
+  <cyboxCommon:Custom_Properties>{0,1}</cyboxCommon:Custom_Properties>
+  <FileObj:File_Name appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:File_Name>
+  <FileObj:File_Path appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" fully_qualified="" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:File_Path>
+  <FileObj:Device_Path appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Device_Path>
+  <FileObj:Full_Path appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Full_Path>
+  <FileObj:File_Extension appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:File_Extension>
+  <FileObj:Size_In_Bytes appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="unsignedLong" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Size_In_Bytes>
+  <FileObj:Magic_Number appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="hexBinary" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Magic_Number>
+  <FileObj:File_Format appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:File_Format>
+  <FileObj:Hashes>{0,1}</FileObj:Hashes>
+  <FileObj:Digital_Signatures>{0,1}</FileObj:Digital_Signatures>
+  <FileObj:Modified_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="dateTime" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" precision="second" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Modified_Time>
+  <FileObj:Accessed_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="dateTime" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" precision="second" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Accessed_Time>
+  <FileObj:Created_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="dateTime" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" precision="second" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Created_Time>
+  <FileObj:File_Attributes_List>{0,1}</FileObj:File_Attributes_List>
+  <FileObj:Permissions>{0,1}</FileObj:Permissions>
+  <FileObj:User_Owner appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:User_Owner>
+  <FileObj:Packer_List>{0,1}</FileObj:Packer_List>
+  <FileObj:Peak_Entropy appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="double" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Peak_Entropy>
+  <FileObj:Sym_Links>{0,1}</FileObj:Sym_Links>
+  <FileObj:Byte_Runs>{0,1}</FileObj:Byte_Runs>
+  <FileObj:Extracted_Features>{0,1}</FileObj:Extracted_Features>
+  <FileObj:Encryption_Algorithm appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Encryption_Algorithm>
+  <FileObj:Decryption_Key appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Decryption_Key>
+  <FileObj:Compression_Method appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Compression_Method>
+  <FileObj:Compression_Version appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Compression_Version>
+  <FileObj:Compression_Comment appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</FileObj:Compression_Comment>
+</maecPackage:Debugging_File>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    is_masqueradedxs:booleanoptional +
    + + + + + 
    The is_masqueraded field specifies whether the file is masqueraded as another type of file; e.g., a PDF file that has had its extension changed to TXT to masquerade itself as a text file.
    +
    +
    is_packedxs:booleanoptional +
    + + + + + 
    The is_packed field is used to indicate whether the file is packed or not.
    +
    +
    object_referencexs:QNameoptional +
    + + + + + 
    The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
    +
    +
    +
    +
    +
    Element maecPackage:MalwareSubjectType / maecPackage:Minor_Variants
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Minor_Variants field captures any minor variants of the malware instance object, such as the same file but with different filenames.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#MinorVariantListType_Minor_Variant + maec-package-2.tmp#MinorVariantListType
    +
    TypemaecPackage:MinorVariantListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Minor_Variants xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Minor_Variant has_changed="" id="" idref="">{1,unbounded}</maecPackage:Minor_Variant>
+</maecPackage:Minor_Variants>
    +
    +
    +
    Element maecPackage:MinorVariantListType / maecPackage:Minor_Variant
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Minor_Variant field captures a single minor variant of the malware instance object.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typecybox:ObjectType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Minor_Variant has_changed="" id="" idref="" xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2" xmlns:cybox="http://cybox.mitre.org/cybox-2">
+  <cybox:State apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</cybox:State>
+  <cybox:Description structuring_format="">{0,1}</cybox:Description>
+  <cybox:Properties object_reference="">{0,1}</cybox:Properties>
+  <cybox:Domain_Specific_Object_Properties>{0,1}</cybox:Domain_Specific_Object_Properties>
+  <cybox:Location id="" idref="">{0,1}</cybox:Location>
+  <cybox:Related_Objects>{0,1}</cybox:Related_Objects>
+  <cybox:Defined_Effect effect_type="">{0,1}</cybox:Defined_Effect>
+  <cybox:Discovery_Method class="" name="" sighting_count="" source_type="">{0,1}</cybox:Discovery_Method>
+</maecPackage:Minor_Variant>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    has_changedxs:booleanoptional +
    + + + + + 
    The has_changed field is optional and conveys a targeted observation pattern of whether the associated object specified has changed in some way without requiring further specific detail. This field would be leveraged within a pattern observable triggering on whether the value of an object specification has changed at all. This field is NOT intended to be used for versioning of CybOX content.
    +
    +
    idxs:QNameoptional +
    + + + + + 
    The id field specifies a unique id for this Object.
    +
    +
    idrefxs:QNameoptional +
    + + + + + 
    The idref field specifies a unique id reference to an Object defined elsewhere.
    + + + + + 
    When idref is specified, the id attribute must not be specified, and any instance of this Object should not hold content unless an extension of the Object allows it.
    +
    +
    +
    +
    +
    Element maecPackage:MalwareSubjectType / maecPackage:Field_Data
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Field_Data field captures field data and prevalance information relating to the Malware Subject. It uses the fieldDataEntry type from the MMDEF v1.2 schema.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypefieldDataEntry
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Field_Data xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2" xmlns:metadata="http://xml/metadataSharing.xsd">
+  <metadata:references>{1,1}</metadata:references>
+  <metadata:startDate>{1,1}</metadata:startDate>
+  <metadata:endDate>{1,1}</metadata:endDate>
+  <metadata:firstSeenDate>{0,1}</metadata:firstSeenDate>
+  <metadata:origin>{1,1}</metadata:origin>
+  <metadata:commonality>{0,1}</metadata:commonality>
+  <metadata:volume units="">{0,unbounded}</metadata:volume>
+  <metadata:importance>{0,1}</metadata:importance>
+  <metadata:location type="">{0,1}</metadata:location>
+</maecPackage:Field_Data>
    +
    +
    +
    Element maecPackage:MalwareSubjectType / maecPackage:Analyses
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Analyses field captures any Analyses (including their associated metadata such as tools used, etc.) that were performed on the Malware Subject.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#AnalysisListType_Analysis + maec-package-2.tmp#AnalysisListType
    +
    TypemaecPackage:AnalysisListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Analyses xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Analysis complete_datetime="" id="" lastupdate_datetime="" method="" ordinal_position="" start_datetime="" type="">{1,unbounded}</maecPackage:Analysis>
+</maecPackage:Analyses>
    +
    +
    +
    Element maecPackage:AnalysisListType / maecPackage:Analysis
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Analysis field represents the metadata regarding a single analysis that was performed on a Malware Subject.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#AnalysisType_id + NO_NAMESPACE.tmp#AnalysisType_type + NO_NAMESPACE.tmp#AnalysisType_method + NO_NAMESPACE.tmp#AnalysisType_ordinal_position + NO_NAMESPACE.tmp#AnalysisType_start_datetime + NO_NAMESPACE.tmp#AnalysisType_complete_datetime + NO_NAMESPACE.tmp#AnalysisType_lastupdate_datetime + maec-package-2.tmp#AnalysisType_Source + maec-package-2.tmp#AnalysisType_Analysts + maec-package-2.tmp#AnalysisType_Summary + maec-package-2.tmp#AnalysisType_Comments + maec-package-2.tmp#AnalysisType_Findings_Bundle_Reference + maec-package-2.tmp#AnalysisType_Tools + maec-package-2.tmp#AnalysisType_Dynamic_Analysis_Metadata + maec-package-2.tmp#AnalysisType_Analysis_Environment + maec-package-2.tmp#AnalysisType_Report + maec-package-2.tmp#AnalysisType
    +
    TypemaecPackage:AnalysisType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Analysis complete_datetime="" id="" lastupdate_datetime="" method="" ordinal_position="" start_datetime="" type="" xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Source>{0,1}</maecPackage:Source>
+  <maecPackage:Analysts>{0,1}</maecPackage:Analysts>
+  <maecPackage:Summary structuring_format="">{0,1}</maecPackage:Summary>
+  <maecPackage:Comments>{0,1}</maecPackage:Comments>
+  <maecPackage:Findings_Bundle_Reference bundle_idref="">{0,unbounded}</maecPackage:Findings_Bundle_Reference>
+  <maecPackage:Tools>{0,1}</maecPackage:Tools>
+  <maecPackage:Dynamic_Analysis_Metadata>{0,1}</maecPackage:Dynamic_Analysis_Metadata>
+  <maecPackage:Analysis_Environment>{0,1}</maecPackage:Analysis_Environment>
+  <maecPackage:Report structuring_format="">{0,1}</maecPackage:Report>
+</maecPackage:Analysis>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    complete_datetimexs:dateTimeoptional +
    + + + + + 
    The complete_datetime field specifies the date/time the analysis was completed.
    +
    +
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for this Analysis.
    +
    +
    lastupdate_datetimexs:dateTimeoptional +
    + + + + + 
    The lastupdate_datetime field specifies the date/time the analysis was last updated.
    +
    +
    methodmaecPackage:AnalysisMethodEnumoptional +
    + + + + + 
    The method field specifies the analysis method used in the analysis.
    +
    +
    ordinal_positionxs:positiveIntegeroptional +
    + + + + + 
    The ordinal_position field specifies the ordering of the analysis with respect to the other analyses performed on the Malware Subject.
    +
    +
    start_datetimexs:dateTimeoptional +
    + + + + + 
    The start_datetime field specifies the date/time the analysis was started.
    +
    +
    typemaecPackage:AnalysisTypeEnumoptional +
    + + + + + 
    The type field specifies the type of malware analysis being performed.
    +
    +
    +
    +
    +
    Element maecPackage:AnalysisType / maecPackage:Source
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Source field specifies information about the internal or external source of the analysis, if applicable.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#SourceType_Name + maec-package-2.tmp#SourceType_Method + maec-package-2.tmp#SourceType_Reference + maec-package-2.tmp#SourceType_Organization + maec-package-2.tmp#SourceType_URL + maec-package-2.tmp#SourceType
    +
    TypemaecPackage:SourceType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Source xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Name>{0,1}</maecPackage:Name>
+  <maecPackage:Method>{0,1}</maecPackage:Method>
+  <maecPackage:Reference>{0,1}</maecPackage:Reference>
+  <maecPackage:Organization>{0,1}</maecPackage:Organization>
+  <maecPackage:URL>{0,1}</maecPackage:URL>
+</maecPackage:Source>
    +
    +
    +
    Element maecPackage:SourceType / maecPackage:Name
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Name field refers to the name of the person linked to the source.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecPackage:SourceType / maecPackage:Method
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Method field provides an abstract way of specifying the method used to obtain the data that the Source element refers to.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecPackage:SourceType / maecPackage:Reference
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Reference field provides an abstract way of specifying a reference name or ID for the source.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecPackage:SourceType / maecPackage:Organization
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Organization field specifies the name of the organization from which the source originated.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecPackage:SourceType / maecPackage:URL
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The URL field specifies the the Uniform Resource Locator (URL) of the external source, if applicable.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:anyURI
    +
    Element maecPackage:AnalysisType / maecPackage:Analysts
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Analysts field specifies the analyst(s) who performed the analysis.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:PersonnelType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Analysts xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2">
+  <cyboxCommon:Contributor>{1,unbounded}</cyboxCommon:Contributor>
+</maecPackage:Analysts>
    +
    +
    +
    Element maecPackage:AnalysisType / maecPackage:Summary
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Summary field specifies a summary of the analysis that was performed.  It should be high-level and concise.  It should summarize the contents of the Report field, if present, and otherwise should provide a brief synopsis of the analysis that was performed and any highlights.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:StructuredTextType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    structuring_formatxs:stringoptional +
    + + + + + 
    Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
    +
    +
    +
    +
    +
    Element maecPackage:AnalysisType / maecPackage:Comments
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Comments field specifies any comments regarding the analysis that was performed. A comment should be attributable to a specific analyst and should reflect particular insights of the author that are significant from an analysis standpoint.  The contents of comments are typically not contained in the Report.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#CommentListType_Comment + maec-package-2.tmp#CommentListType
    +
    TypemaecPackage:CommentListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Comments xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Comment author="" observation_name="" structuring_format="" timestamp="">{1,unbounded}</maecPackage:Comment>
+</maecPackage:Comments>
    +
    +
    +
    Element maecPackage:CommentListType / maecPackage:Comment
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Comment field specifies a single comment pertaining to a particular MAEC entity.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CommentType_author + NO_NAMESPACE.tmp#CommentType_timestamp + NO_NAMESPACE.tmp#CommentType_observation_name + maec-package-2.tmp#CommentType
    +
    TypemaecPackage:CommentType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    authorxs:stringoptional +
    + + + + + 
    The author field specifies the name of the author that added the comment.
    +
    +
    observation_namexs:stringoptional +
    + + + + + 
    The observation_name field captures the name, type, or identifier of an observation, for comments that refer to the observation of particular entities. For example, a comment that refers to a command and control (C2) encryption key could have an observation_name of "C2 Encryption Key".
    +
    +
    structuring_formatxs:stringoptional +
    + + + + + 
    Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
    +
    +
    timestampxs:dateTimeoptional +
    + + + + + 
    The timestamp field specifies the date/time that the comment was added.
    +
    +
    +
    +
    +
    Element maecPackage:AnalysisType / maecPackage:Findings_Bundle_Reference
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Findings_Bundle_Reference field specifies a reference to the Bundle which encompasses the results and output of the Analysis in terms of its corresponding MAEC entities, such as Behaviors and Actions. More than one Bundle may be referenced by using multiple occurrences of this field.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypemaecBundle:BundleReferenceType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    bundle_idrefxs:QNamerequired +
    + + + + + 
    The bundle_idref field references the ID of a Bundle contained inside the current MAEC document.
    +
    +
    +
    +
    +
    Element maecPackage:AnalysisType / maecPackage:Tools
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Tools field specifies information about the tool(s) used in the analysis, via the CybOX ToolInformationType. If only a single Tool is specified, then this implies that this tool was responsible for all of the findings contained in the Bundle referenced by the Findings_Bundle_Reference element.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#ToolListType_Tool + maec-package-2.tmp#ToolListType
    +
    TypemaecPackage:ToolListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Tools xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Tool id="" idref="">{1,unbounded}</maecPackage:Tool>
+</maecPackage:Tools>
    +
    +
    +
    Element maecPackage:ToolListType / maecPackage:Tool
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Tool field specifies a single tool in the list.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:ToolInformationType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Tool id="" idref="" xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2">
+  <cyboxCommon:Name>{0,1}</cyboxCommon:Name>
+  <cyboxCommon:Type apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,unbounded}</cyboxCommon:Type>
+  <cyboxCommon:Description structuring_format="">{0,1}</cyboxCommon:Description>
+  <cyboxCommon:References>{0,1}</cyboxCommon:References>
+  <cyboxCommon:Vendor>{0,1}</cyboxCommon:Vendor>
+  <cyboxCommon:Version>{0,1}</cyboxCommon:Version>
+  <cyboxCommon:Service_Pack>{0,1}</cyboxCommon:Service_Pack>
+  <cyboxCommon:Tool_Specific_Data>{0,1}</cyboxCommon:Tool_Specific_Data>
+  <cyboxCommon:Tool_Hashes>{0,1}</cyboxCommon:Tool_Hashes>
+  <cyboxCommon:Tool_Configuration>{0,1}</cyboxCommon:Tool_Configuration>
+  <cyboxCommon:Execution_Environment>{0,1}</cyboxCommon:Execution_Environment>
+  <cyboxCommon:Errors>{0,1}</cyboxCommon:Errors>
+  <cyboxCommon:Metadata type="">{0,unbounded}</cyboxCommon:Metadata>
+  <cyboxCommon:Compensation_Model appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</cyboxCommon:Compensation_Model>
+</maecPackage:Tool>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNameoptional +
    + + + + + 
    The id field specifies a unique ID for this Tool.
    +
    +
    idrefxs:QNameoptional +
    + + + + + 
    The idref field specifies reference to a unique ID for this Tool.
    + + + + + 
    When idref is specified, the id attribute must not be specified, and any instance of this type should not hold content unless an extension of the type allows it.
    +
    +
    +
    +
    +
    Element maecPackage:AnalysisType / maecPackage:Dynamic_Analysis_Metadata
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Dynamic_Analysis_Metadata field specifies metadata pertaining to the dynamic analysis of the subject binary, such as the command line used, the duration of the analysis, etc.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#DynamicAnalysisMetadataType_Command_Line + maec-package-2.tmp#DynamicAnalysisMetadataType_Analysis_Duration + maec-package-2.tmp#DynamicAnalysisMetadataType_Exit_Code + maec-package-2.tmp#DynamicAnalysisMetadataType_Raised_Exception + maec-package-2.tmp#DynamicAnalysisMetadataType
    +
    TypemaecPackage:DynamicAnalysisMetadataType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Dynamic_Analysis_Metadata xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Command_Line>{0,1}</maecPackage:Command_Line>
+  <maecPackage:Analysis_Duration>{0,1}</maecPackage:Analysis_Duration>
+  <maecPackage:Exit_Code>{0,1}</maecPackage:Exit_Code>
+  <maecPackage:Raised_Exception is_fatal="">{0,unbounded}</maecPackage:Raised_Exception>
+</maecPackage:Dynamic_Analysis_Metadata>
    +
    +
    +
    Element maecPackage:DynamicAnalysisMetadataType / maecPackage:Command_Line
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Command_Line field specifies the command line used to launch the subject binary.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecPackage:DynamicAnalysisMetadataType / maecPackage:Analysis_Duration
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Analysis_Duration field specifies the duration of the overall dynamic analysis process, in seconds.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:float
    +
    Element maecPackage:DynamicAnalysisMetadataType / maecPackage:Exit_Code
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Exit_Code field specifies the exit code with which the subject binary exited.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:integer
    +
    Element maecPackage:DynamicAnalysisMetadataType / maecPackage:Raised_Exception
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Raised_Exception field captures a single exception that was raised (or thrown) during the execution of the malware instance. More than one exception may be captured through the use of multiple instances of this field.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#MalwareExceptionType_is_fatal + maec-package-2.tmp#MalwareExceptionType_Exception_Code + maec-package-2.tmp#MalwareExceptionType_Faulting_Address + maec-package-2.tmp#MalwareExceptionType_Description + maec-package-2.tmp#MalwareExceptionType
    +
    TypemaecPackage:MalwareExceptionType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Raised_Exception is_fatal="" xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2">
+  <cyboxCommon:Error_Type>{1,1}</cyboxCommon:Error_Type>
+  <cyboxCommon:Error_Count>{0,1}</cyboxCommon:Error_Count>
+  <cyboxCommon:Error_Instances>{0,1}</cyboxCommon:Error_Instances>
+  <maecPackage:Exception_Code>{0,1}</maecPackage:Exception_Code>
+  <maecPackage:Faulting_Address>{0,1}</maecPackage:Faulting_Address>
+  <maecPackage:Description>{0,1}</maecPackage:Description>
+</maecPackage:Raised_Exception>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    is_fatalxs:booleanoptional +
    + + + + + 
    The is_fatal field specifies whether the exception is fatal; that is, whether it caused the malware instance to terminate.
    +
    +
    +
    +
    +
    Element maecPackage:MalwareExceptionType / maecPackage:Exception_Code
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Exception_Code field captures the particular code that identifies the type of exception that occurred.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecPackage:MalwareExceptionType / maecPackage:Faulting_Address
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Faulting_Address field captures the memory address where the exception occurred.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:hexBinary
    +
    Element maecPackage:MalwareExceptionType / maecPackage:Description
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Description field captures the textual description of the exception.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:short
    +
    Element maecPackage:AnalysisType / maecPackage:Analysis_Environment
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Analysis_Environment field specifies attributes for characterizing the analysis environment in which the analysis was performed.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#AnalysisEnvironmentType_Hypervisor_Host_System + maec-package-2.tmp#AnalysisEnvironmentType_Analysis_Systems + maec-package-2.tmp#AnalysisEnvironmentType_Network_Infrastructure + maec-package-2.tmp#AnalysisEnvironmentType
    +
    TypemaecPackage:AnalysisEnvironmentType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Analysis_Environment xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Hypervisor_Host_System object_reference="">{0,1}</maecPackage:Hypervisor_Host_System>
+  <maecPackage:Analysis_Systems>{0,1}</maecPackage:Analysis_Systems>
+  <maecPackage:Network_Infrastructure>{0,1}</maecPackage:Network_Infrastructure>
+</maecPackage:Analysis_Environment>
    +
    +
    +
    Element maecPackage:AnalysisEnvironmentType / maecPackage:Hypervisor_Host_System
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Hypervisor_Host_System field characterizes the (physical) host system used in the analysis on which the VM Hypervisor runs. This element imports and extends the CybOX System Object.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#HypervisorHostSystemType_VM_Hypervisor + maec-package-2.tmp#HypervisorHostSystemType
    +
    TypemaecPackage:HypervisorHostSystemType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Hypervisor_Host_System object_reference="" xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" xmlns:SystemObj="http://cybox.mitre.org/objects#SystemObject-2">
+  <cyboxCommon:Custom_Properties>{0,1}</cyboxCommon:Custom_Properties>
+  <SystemObj:Available_Physical_Memory appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="unsignedLong" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Available_Physical_Memory>
+  <SystemObj:BIOS_Info>{0,1}</SystemObj:BIOS_Info>
+  <SystemObj:Date appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="date" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" precision="day" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Date>
+  <SystemObj:Hostname appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Hostname>
+  <SystemObj:Local_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="time" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" precision="second" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Local_Time>
+  <SystemObj:Network_Interface_List>{0,1}</SystemObj:Network_Interface_List>
+  <SystemObj:OS>{0,1}</SystemObj:OS>
+  <SystemObj:Processor appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Processor>
+  <SystemObj:Processor_Architecture appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Processor_Architecture>
+  <SystemObj:System_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="time" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" precision="second" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:System_Time>
+  <SystemObj:Timezone_DST appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Timezone_DST>
+  <SystemObj:Timezone_Standard appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Timezone_Standard>
+  <SystemObj:Total_Physical_Memory appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="unsignedLong" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Total_Physical_Memory>
+  <SystemObj:Uptime appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="duration" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Uptime>
+  <SystemObj:Username appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Username>
+  <maecPackage:VM_Hypervisor>{0,1}</maecPackage:VM_Hypervisor>
+</maecPackage:Hypervisor_Host_System>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    object_referencexs:QNameoptional +
    + + + + + 
    The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
    +
    +
    +
    +
    +
    Element maecPackage:HypervisorHostSystemType / maecPackage:VM_Hypervisor
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The VM_Hypervisor field refers to the name of the VM Hypervisor that hosts the operating system(s) on which the analysis was performed, if applicable, via a Common Platform Enumeration (CPE) identifier. See http://cpe.mitre.org for more information on CPE.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:PlatformSpecificationType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:VM_Hypervisor xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2">
+  <cyboxCommon:Description structuring_format="">{0,1}</cyboxCommon:Description>
+  <cyboxCommon:Identifier appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" system="" system-ref="" trend="">{0,unbounded}</cyboxCommon:Identifier>
+</maecPackage:VM_Hypervisor>
    +
    +
    +
    Element maecPackage:AnalysisEnvironmentType / maecPackage:Analysis_Systems
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Analysis_Systems field characterizes the system(s) (real or virtual) on which the actual analysis was performed, including information about both the hardware and software, such as the properties of its BIOS, processor architecture, and operating system. This element imports and extends the CybOX System Object.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#AnalysisSystemListType_Analysis_System + maec-package-2.tmp#AnalysisSystemListType
    +
    TypemaecPackage:AnalysisSystemListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Analysis_Systems xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Analysis_System object_reference="">{1,unbounded}</maecPackage:Analysis_System>
+</maecPackage:Analysis_Systems>
    +
    +
    +
    Element maecPackage:AnalysisSystemListType / maecPackage:Analysis_System
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Analysis_System field captures a single analysis system.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#AnalysisSystemType_Installed_Programs + maec-package-2.tmp#AnalysisSystemType
    +
    TypemaecPackage:AnalysisSystemType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Analysis_System object_reference="" xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" xmlns:SystemObj="http://cybox.mitre.org/objects#SystemObject-2">
+  <cyboxCommon:Custom_Properties>{0,1}</cyboxCommon:Custom_Properties>
+  <SystemObj:Available_Physical_Memory appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="unsignedLong" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Available_Physical_Memory>
+  <SystemObj:BIOS_Info>{0,1}</SystemObj:BIOS_Info>
+  <SystemObj:Date appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="date" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" precision="day" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Date>
+  <SystemObj:Hostname appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Hostname>
+  <SystemObj:Local_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="time" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" precision="second" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Local_Time>
+  <SystemObj:Network_Interface_List>{0,1}</SystemObj:Network_Interface_List>
+  <SystemObj:OS>{0,1}</SystemObj:OS>
+  <SystemObj:Processor appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Processor>
+  <SystemObj:Processor_Architecture appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Processor_Architecture>
+  <SystemObj:System_Time appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="time" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" precision="second" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:System_Time>
+  <SystemObj:Timezone_DST appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Timezone_DST>
+  <SystemObj:Timezone_Standard appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Timezone_Standard>
+  <SystemObj:Total_Physical_Memory appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="unsignedLong" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Total_Physical_Memory>
+  <SystemObj:Uptime appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="duration" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Uptime>
+  <SystemObj:Username appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" trend="">{0,1}</SystemObj:Username>
+  <maecPackage:Installed_Programs>{0,1}</maecPackage:Installed_Programs>
+</maecPackage:Analysis_System>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    object_referencexs:QNameoptional +
    + + + + + 
    The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
    +
    +
    +
    +
    +
    Element maecPackage:AnalysisSystemType / maecPackage:Installed_Programs
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Installed_Programs field specifies the programs installed on the OS that was used to perform the analysis. This can be useful for clarifying the nature of the analysis environment, for instance for determining whether an exploited piece of software was present, as well as for specifying any tools that may have been installed.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#InstalledProgramsType_Program + maec-package-2.tmp#InstalledProgramsType
    +
    TypemaecPackage:InstalledProgramsType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Installed_Programs xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Program>{1,unbounded}</maecPackage:Program>
+</maecPackage:Installed_Programs>
    +
    +
    +
    Element maecPackage:InstalledProgramsType / maecPackage:Program
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Program field specifies a single program that is installed on the system. It uses the PlatformSpecificationType from the CybOX Common schema.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:PlatformSpecificationType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Program xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2">
+  <cyboxCommon:Description structuring_format="">{0,1}</cyboxCommon:Description>
+  <cyboxCommon:Identifier appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" system="" system-ref="" trend="">{0,unbounded}</cyboxCommon:Identifier>
+</maecPackage:Program>
    +
    +
    +
    Element maecPackage:AnalysisEnvironmentType / maecPackage:Network_Infrastructure
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Network_Infrastructure field captures details of the network infrastructure used in the analysis environment, such as any network protocols that are captured or manipulated.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#NetworkInfrastructureType_Captured_Protocols + maec-package-2.tmp#NetworkInfrastructureType
    +
    TypemaecPackage:NetworkInfrastructureType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Network_Infrastructure xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Captured_Protocols>{1,1}</maecPackage:Captured_Protocols>
+</maecPackage:Network_Infrastructure>
    +
    +
    +
    Element maecPackage:NetworkInfrastructureType / maecPackage:Captured_Protocols
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Captured_Protocols field specifies a list of network protocols, along with the particular level of interaction, that the malware analysis environment captures or interacts with in some fashion.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#CapturedProtocolListType_Protocol + maec-package-2.tmp#CapturedProtocolListType
    +
    TypemaecPackage:CapturedProtocolListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Captured_Protocols xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Protocol interaction_level="" layer4_protocol="" layer7_protocol="" port_number="">{1,unbounded}</maecPackage:Protocol>
+</maecPackage:Captured_Protocols>
    +
    +
    +
    Element maecPackage:CapturedProtocolListType / maecPackage:Protocol
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Protocol field specifies a single layer 4 or layer 7 network protocol captured or interacted with by the analysis environment.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CapturedProtocolType_layer7_protocol + NO_NAMESPACE.tmp#CapturedProtocolType_layer4_protocol + NO_NAMESPACE.tmp#CapturedProtocolType_port_number + NO_NAMESPACE.tmp#CapturedProtocolType_interaction_level + maec-package-2.tmp#CapturedProtocolType
    +
    TypemaecPackage:CapturedProtocolType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    interaction_levelmaecPackage:InteractionLevelEnumoptional +
    + + + + + 
    The interaction_level field specifies the relative level of interaction that the analysis environment has with the specified network protocol.
    +
    +
    layer4_protocolmaecPackage:Layer4ProtocolEnumoptional +
    + + + + + 
    The layer4_protocol field specifies the name of the Layer 4 network protocol (OSI model) captured or manipulated by the analysis environment.
    +
    +
    layer7_protocolmaecPackage:Layer7ProtocolEnumoptional +
    + + + + + 
    The layer7_protocol field specifies the name of the Layer 7 network protocol (OSI model) captured or manipulated by the analysis environment.
    +
    +
    port_numberxs:positiveIntegeroptional +
    + + + + + 
    The port_number field specifies the port number for this network protocol that is captured or manipulated by the analysis environment.
    +
    +
    +
    +
    +
    Element maecPackage:AnalysisType / maecPackage:Report
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Report field specifies the textual report regarding the analysis performed on the malware. The Report should correspond to the human-readable prose document that captures key aspects and outcomes of the analysis.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:StructuredTextType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    structuring_formatxs:stringoptional +
    + + + + + 
    Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
    +
    +
    +
    +
    +
    Element maecPackage:MalwareSubjectType / maecPackage:Findings_Bundles
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Findings_Bundles field specifies any MAEC Bundles pertaining to the Malware Subject, thus capturing any observed or discovered Behaviors, Actions, or Objects. These Bundles can either be abstract, or referenced as the result of an analysis that was performed on the malware.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#FindingsBundleListType_Meta_Analysis + maec-package-2.tmp#FindingsBundleListType_Bundle + maec-package-2.tmp#FindingsBundleListType_Bundle_External_Reference + maec-package-2.tmp#FindingsBundleListType
    +
    TypemaecPackage:FindingsBundleListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Findings_Bundles xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Meta_Analysis>{0,1}</maecPackage:Meta_Analysis>
+  <maecPackage:Bundle content_type="" defined_subject="" id="" schema_version="4.1" timestamp="">{0,unbounded}</maecPackage:Bundle>
+  <maecPackage:Bundle_External_Reference>{0,unbounded}</maecPackage:Bundle_External_Reference>
+</maecPackage:Findings_Bundles>
    +
    +
    +
    Element maecPackage:FindingsBundleListType / maecPackage:Meta_Analysis
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Meta_Analysis field captures any meta-analysis related entities for the Bundles captured for a Malware Subject, such as equivalencies.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#MetaAnalysisType_Action_Equivalences + maec-package-2.tmp#MetaAnalysisType_Object_Equivalences + maec-package-2.tmp#MetaAnalysisType
    +
    TypemaecPackage:MetaAnalysisType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Meta_Analysis xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Action_Equivalences>{0,1}</maecPackage:Action_Equivalences>
+  <maecPackage:Object_Equivalences>{0,1}</maecPackage:Object_Equivalences>
+</maecPackage:Meta_Analysis>
    +
    +
    +
    Element maecPackage:MetaAnalysisType / maecPackage:Action_Equivalences
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Action_Equivalences field captures any equivalences between Actions contained in one or more Bundles.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#ActionEquivalenceListType_Action_Equivalence + maec-package-2.tmp#ActionEquivalenceListType
    +
    TypemaecPackage:ActionEquivalenceListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Action_Equivalences xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Action_Equivalence id="">{1,unbounded}</maecPackage:Action_Equivalence>
+</maecPackage:Action_Equivalences>
    +
    +
    +
    Element maecPackage:ActionEquivalenceListType / maecPackage:Action_Equivalence
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Action_Equivalence field captures a single Action Equivalence in the list.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ActionEquivalenceType_id + maec-package-2.tmp#ActionEquivalenceType_Action_Reference + maec-package-2.tmp#ActionEquivalenceType
    +
    TypemaecPackage:ActionEquivalenceType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Action_Equivalence id="" xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Action_Reference action_id="">{1,unbounded}</maecPackage:Action_Reference>
+</maecPackage:Action_Equivalence>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for the Action Equivalence.
    +
    +
    +
    +
    +
    Element maecPackage:ActionEquivalenceType / maecPackage:Action_Reference
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Action_Reference field specifies a reference to a single Action that is part of the Action Equivalency.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typecybox:ActionReferenceType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    action_idxs:QNamerequired +
    + + + + + 
    The action_id field refers to the id of the action being referenced.
    +
    +
    +
    +
    +
    Element maecPackage:MetaAnalysisType / maecPackage:Object_Equivalences
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Object_Equivalences field captures any equivalences between Objects contained in one or more Bundles.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#ObjectEquivalenceListType_Object_Equivalence + maec-package-2.tmp#ObjectEquivalenceListType
    +
    TypemaecPackage:ObjectEquivalenceListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Object_Equivalences xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Object_Equivalence id="">{1,unbounded}</maecPackage:Object_Equivalence>
+</maecPackage:Object_Equivalences>
    +
    +
    +
    Element maecPackage:ObjectEquivalenceListType / maecPackage:Object_Equivalence
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Object_Equivalence field specifies a single Object Equivalence in the list.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ObjectEquivalenceType_id + maec-package-2.tmp#ObjectEquivalenceType
    +
    TypemaecPackage:ObjectEquivalenceType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Object_Equivalence id="" xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Object_Reference object_idref="">{1,unbounded}</maecBundle:Object_Reference>
+</maecPackage:Object_Equivalence>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for the Object Equivalence.
    +
    +
    +
    +
    +
    Element maecPackage:FindingsBundleListType / maecPackage:Bundle
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Bundle field captures a single MAEC Bundle, representing some set of characterized entities resulting from  analysis of the Malware Subject.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypemaecBundle:BundleType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Bundle content_type="" defined_subject="" id="" schema_version="4.1" timestamp="" xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2" xmlns:maecBundle="http://maec.mitre.org/XMLSchema/maec-bundle-4">
+  <maecBundle:Malware_Instance_Object_Attributes has_changed="" id="" idref="">{0,1}</maecBundle:Malware_Instance_Object_Attributes>
+  <maecBundle:AV_Classifications>{0,1}</maecBundle:AV_Classifications>
+  <maecBundle:Process_Tree>{0,1}</maecBundle:Process_Tree>
+  <maecBundle:Capabilities>{0,1}</maecBundle:Capabilities>
+  <maecBundle:Behaviors>{0,1}</maecBundle:Behaviors>
+  <maecBundle:Actions>{0,1}</maecBundle:Actions>
+  <maecBundle:Objects>{0,1}</maecBundle:Objects>
+  <maecBundle:Candidate_Indicators>{0,1}</maecBundle:Candidate_Indicators>
+  <maecBundle:Collections>{0,1}</maecBundle:Collections>
+</maecPackage:Bundle>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeFixedUseAnnotation
    content_typemaecBundle:BundleContentTypeEnumoptional +
    + + + + + 
    The content_type field specifies the general type of content contained in this Bundle, e.g. static analysis tool output, dynamic analysis tool output, etc.
    +
    +
    defined_subjectxs:booleanrequired +
    + + + + + 
    The required defined_subject field specifies whether the subject attributes of the characterized malware instance are included inside this Bundle (via the top-level Malware_Instance_Object_Attributes field) or elsewhere (such as a MAEC Subject in a MAEC Package).
    +
    +
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for this MAEC Bundle.
    +
    +
    schema_versionxs:string4.1required +
    + + + + + 
    The required schema_version field specifies the version of the MAEC Bundle Schema that the document has been written in and that should be used for validation.
    +
    +
    timestampxs:dateTimeoptional +
    + + + + + 
    The timestamp field specifies the date/time that the bundle was generated.
    +
    +
    +
    +
    +
    Element maecPackage:FindingsBundleListType / maecPackage:Bundle_External_Reference
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Bundle_External_Reference field specifies a single externally located MAEC Bundle (such as a file or URL) via a URI, representing some set of results from analysis of the Malware Subject.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:anyURI
    +
    Element maecPackage:MalwareSubjectType / maecPackage:Relationships
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Relationships field captures any relationships between the Malware Subject and other Malware Subjects.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#MalwareSubjectRelationshipListType_Relationship + maec-package-2.tmp#MalwareSubjectRelationshipListType
    +
    TypemaecPackage:MalwareSubjectRelationshipListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Relationships xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Relationship>{1,unbounded}</maecPackage:Relationship>
+</maecPackage:Relationships>
    +
    +
    +
    Element maecPackage:MalwareSubjectRelationshipListType / maecPackage:Relationship
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Relationship field specifies a relationship that relates the Malware Subject to one or more other Malware Subjects contained in the Package.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#MalwareSubjectRelationshipType_Type + maec-package-2.tmp#MalwareSubjectRelationshipType_Malware_Subject_Reference + maec-package-2.tmp#MalwareSubjectRelationshipType
    +
    TypemaecPackage:MalwareSubjectRelationshipType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Relationship xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Type apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{1,1}</maecPackage:Type>
+  <maecPackage:Malware_Subject_Reference malware_subject_idref="">{1,unbounded}</maecPackage:Malware_Subject_Reference>
+</maecPackage:Relationship>
    +
    +
    +
    Element maecPackage:MalwareSubjectRelationshipType / maecPackage:Type
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Type field specifies the type of relationship being captured.
    +
    +
    + + + + + 
    This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is MalwareSubjectRelationshipTypeVocab-1.0 in the http://maec.mitre.org/default_vocabularies-1 namespace. This type is defined in the maec_default_vocabularies.xsd file or at the URL http://maec.mitre.org/XMLSchema/default_vocabularies/1.0.0/maec_default_vocabularies.xsd.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:ControlledVocabularyStringType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeDefaultUseAnnotation
    apply_conditioncyboxCommon:ConditionApplicationEnumANYoptional +
    + + + + + 
    This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
    +
    +
    bit_maskxs:hexBinaryoptional +
    + + + + + 
    Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
    +
    +
    conditioncyboxCommon:ConditionTypeEnumoptional +
    + + + + + 
    This field is optional and defines the relevant condition to apply to the value.
    +
    +
    delimiterxs:string##comma##optional +
    + + + + + 
    The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
    +
    +
    has_changedxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
    +
    +
    is_case_sensitivexs:booleantrueoptional +
    + + + + + 
    The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
    +
    +
    pattern_typecyboxCommon:PatternTypeEnumoptional +
    + + + + + 
    This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    +
    +
    regex_syntaxxs:stringoptional +
    + + + + + 
    This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    + + + + + 
    Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
    + + + + + 
    Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
    +
    +
    trendxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
    +
    +
    vocab_namexs:stringoptional +
    + + + + + 
    The vocab_name field specifies the name of the controlled vocabulary.
    +
    +
    vocab_referencexs:anyURIoptional +
    + + + + + 
    The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
    +
    +
    +
    +
    +
    Element maecPackage:MalwareSubjectRelationshipType / maecPackage:Malware_Subject_Reference
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Malware_Subject_Reference field provides a reference to a single Malware Subject that this relationship pertains to.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#MalwareSubjectReferenceType_malware_subject_idref + maec-package-2.tmp#MalwareSubjectReferenceType
    +
    TypemaecPackage:MalwareSubjectReferenceType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    malware_subject_idrefxs:QNamerequired +
    + + + + + 
    The malware_subject_idref field provides a reference to a Malware Subject contained in the Package, via its ID.
    +
    +
    +
    +
    +
    Element maecPackage:MalwareSubjectType / maecPackage:Compatible_Platform
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Compatible_Platform field specifies a single platform that the Malware Subject is compatible with (i.e. can execute on). It uses the PlatformSpecificationType from the imported CybOX Common schema. More than one compatible platform can be specified by using multiple occurrences of this field.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:PlatformSpecificationType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Compatible_Platform xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2">
+  <cyboxCommon:Description structuring_format="">{0,1}</cyboxCommon:Description>
+  <cyboxCommon:Identifier appears_random="" apply_condition="ANY" bit_mask="" condition="" datatype="string" defanging_algorithm_ref="" delimiter="##comma##" has_changed="" id="" idref="" is_case_sensitive="true" is_defanged="" is_obfuscated="" obfuscation_algorithm_ref="" observed_encoding="" pattern_type="" refanging_transform="" refanging_transform_type="" regex_syntax="" system="" system-ref="" trend="">{0,unbounded}</cyboxCommon:Identifier>
+</maecPackage:Compatible_Platform>
    +
    +
    +
    Element maecPackage:PackageType / maecPackage:Grouping_Relationships
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Grouping_Relationships field specifies the particular relationships that serve to group the Malware Subjects encompassed in this Package. This is solely for cases where more than one Malware Subject is contained within the Package.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#GroupingRelationshipListType_Grouping_Relationship + maec-package-2.tmp#GroupingRelationshipListType
    +
    TypemaecPackage:GroupingRelationshipListType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Grouping_Relationships xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Grouping_Relationship>{1,unbounded}</maecPackage:Grouping_Relationship>
+</maecPackage:Grouping_Relationships>
    +
    +
    +
    Element maecPackage:GroupingRelationshipListType / maecPackage:Grouping_Relationship
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Grouping_Relationship field specifies a single grouping relationship in the list.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#GroupingRelationshipType_Type + maec-package-2.tmp#GroupingRelationshipType_Malware_Family_Name + maec-package-2.tmp#GroupingRelationshipType_Malware_Toolkit_Name + maec-package-2.tmp#GroupingRelationshipType_Clustering_Metadata + maec-package-2.tmp#GroupingRelationshipType
    +
    TypemaecPackage:GroupingRelationshipType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Grouping_Relationship xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Type apply_condition="ANY" bit_mask="" condition="" delimiter="##comma##" has_changed="" is_case_sensitive="true" pattern_type="" regex_syntax="" trend="" vocab_name="" vocab_reference="">{0,1}</maecPackage:Type>
+  <maecPackage:Malware_Family_Name>{0,1}</maecPackage:Malware_Family_Name>
+  <maecPackage:Malware_Toolkit_Name>{0,1}</maecPackage:Malware_Toolkit_Name>
+  <maecPackage:Clustering_Metadata>{0,1}</maecPackage:Clustering_Metadata>
+</maecPackage:Grouping_Relationship>
    +
    +
    +
    Element maecPackage:GroupingRelationshipType / maecPackage:Type
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Type field specifies the type of relationship that groups the Malware Subjects in the Package.
    +
    +
    + + + + + 
    This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is GroupingRelationshipTypeVocab-1.0 in the http://maec.mitre.org/default_vocabularies-1 namespace. This type is defined in the maec_default_vocabularies.xsd file or at the URL http://maec.mitre.org/XMLSchema/default_vocabularies/1.0.0/maec_default_vocabularies.xsd.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    TypecyboxCommon:ControlledVocabularyStringType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeDefaultUseAnnotation
    apply_conditioncyboxCommon:ConditionApplicationEnumANYoptional +
    + + + + + 
    This field indicates how a condition should be applied when the field body contains a list of values. (Its value is moot if the field value contains only a single value - both possible values for this field would have the same behavior.) If this field is set to ANY, then a pattern is considered to be matched if the provided condition successfully evaluates for any of the values in the field body. If the field is set to ALL, then the patern only matches if the provided condition successfully evaluates for every value in the field body.
    +
    +
    bit_maskxs:hexBinaryoptional +
    + + + + + 
    Used to specify a bit_mask in conjunction with one of the defined binary conditions (bitwiseAnd, bitwiseOr, and bitwiseXor). This bitmask is then uses as one operand in the indicated bitwise computation.
    +
    +
    conditioncyboxCommon:ConditionTypeEnumoptional +
    + + + + + 
    This field is optional and defines the relevant condition to apply to the value.
    +
    +
    delimiterxs:string##comma##optional +
    + + + + + 
    The delimiter field specifies the delimiter used when defining lists of values. The default value is "##comma##".
    +
    +
    has_changedxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of whether the associated field value has changed. This field would be leveraged within a pattern observable triggering on whether the value of a single field value has changed.
    +
    +
    is_case_sensitivexs:booleantrueoptional +
    + + + + + 
    The is_case_sensitive field is optional and should be used when specifying the case-sensitivity of a pattern which uses an Equals, DoesNotEqual, Contains, DoesNotContain, StartsWith, EndsWith, or FitsPattern condition. The default value for this field is "true" which indicates that pattern evaluations are to be considered case-sensitive.
    +
    +
    pattern_typecyboxCommon:PatternTypeEnumoptional +
    + + + + + 
    This field is optional and defines the type of pattern used if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    +
    +
    regex_syntaxxs:stringoptional +
    + + + + + 
    This field is optional and defines the syntax format used for a regular expression, if one is specified for the field value. This is applicable only if the Condition field is set to 'FitsPattern'.
    + + + + + 
    Setting this attribute with an empty value (e.g., "") or omitting it entirely notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities, character classes, escapes, and other lexical tokens defined by the CybOX Language Specification.
    + + + + + 
    Setting this attribute with a non-empty value notifies CybOX consumers and pattern evaluators that the corresponding regular expression utilizes capabilities not defined by the CybOX Language Specification. The regular expression must be evaluated through a compatible regular expression engine in this case.
    +
    +
    trendxs:booleanoptional +
    + + + + + 
    This field is optional and conveys a targeted observation pattern of the nature of any trend in the associated field value. This field would be leveraged within a pattern observable triggering on the matching of a specified trend in the value of a single specified field.
    +
    +
    vocab_namexs:stringoptional +
    + + + + + 
    The vocab_name field specifies the name of the controlled vocabulary.
    +
    +
    vocab_referencexs:anyURIoptional +
    + + + + + 
    The vocab_reference field specifies the URI to the location of where the controlled vocabulary is defined, e.g., in an externally located XML schema file.
    +
    +
    +
    +
    +
    Element maecPackage:GroupingRelationshipType / maecPackage:Malware_Family_Name
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Malware_Family_Name field specifies the name of the malware family referred to by the 'same_malware_family' relationship type.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecPackage:GroupingRelationshipType / maecPackage:Malware_Toolkit_Name
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Malware_Toolkit_Name field specifies the name of the malware toolkit referred to by the 'same_malware_toolkit' relationship type.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecPackage:GroupingRelationshipType / maecPackage:Clustering_Metadata
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Clustering_Metadata field specifies any metadata regarding the algorithm and/or methods used for cluster the Malware Subjects in this Package.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#ClusteringMetadataType_Algorithm_Name + maec-package-2.tmp#ClusteringMetadataType_Algorithm_Version + maec-package-2.tmp#ClusteringMetadataType_Algorithm_Parameters + maec-package-2.tmp#ClusteringMetadataType_Cluster_Size + maec-package-2.tmp#ClusteringMetadataType_Cluster_Description + maec-package-2.tmp#ClusteringMetadataType_Cluster_Composition + maec-package-2.tmp#ClusteringMetadataType
    +
    TypemaecPackage:ClusteringMetadataType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Clustering_Metadata xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Algorithm_Name>{0,1}</maecPackage:Algorithm_Name>
+  <maecPackage:Algorithm_Version>{0,1}</maecPackage:Algorithm_Version>
+  <maecPackage:Algorithm_Parameters>{0,1}</maecPackage:Algorithm_Parameters>
+  <maecPackage:Cluster_Size>{0,1}</maecPackage:Cluster_Size>
+  <maecPackage:Cluster_Description>{0,1}</maecPackage:Cluster_Description>
+  <maecPackage:Cluster_Composition score_type="">{0,1}</maecPackage:Cluster_Composition>
+</maecPackage:Clustering_Metadata>
    +
    +
    +
    Element maecPackage:ClusteringMetadataType / maecPackage:Algorithm_Name
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Algorithm_Name field specifies the name of the clustering algorithm used to cluster the malware.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecPackage:ClusteringMetadataType / maecPackage:Algorithm_Version
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Algorithm_Version field specifies the version of the algorithm used to cluster the malware.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecPackage:ClusteringMetadataType / maecPackage:Algorithm_Parameters
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Algorithm_Parameters field specifies any parameters that may have been used in the clustering algorithm.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#ClusteringAlgorithmParametersType_Distance_Threshold + maec-package-2.tmp#ClusteringAlgorithmParametersType_Number_of_Iterations + maec-package-2.tmp#ClusteringAlgorithmParametersType
    +
    TypemaecPackage:ClusteringAlgorithmParametersType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Algorithm_Parameters xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Distance_Threshold>{0,1}</maecPackage:Distance_Threshold>
+  <maecPackage:Number_of_Iterations>{0,1}</maecPackage:Number_of_Iterations>
+</maecPackage:Algorithm_Parameters>
    +
    +
    +
    Element maecPackage:ClusteringAlgorithmParametersType / maecPackage:Distance_Threshold
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Distance_Threshold field specifies the minimum distance threshold for the cluster, or the minimum distance between nodes in order for them to belong to the same cluster.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:decimal
    +
    Element maecPackage:ClusteringAlgorithmParametersType / maecPackage:Number_of_Iterations
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Number_of_Iterations field specifies the number of times that the algorithm was executed in order to produce the cluster.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:positiveInteger
    +
    Element maecPackage:ClusteringMetadataType / maecPackage:Cluster_Size
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Cluster_Size field specifies the size of the malware cluster.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:positiveInteger
    +
    Element maecPackage:ClusteringMetadataType / maecPackage:Cluster_Description
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Cluster_Description field provides a textual description of the malware cluster, such as information about its composition, etc.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typexs:string
    +
    Element maecPackage:ClusteringMetadataType / maecPackage:Cluster_Composition
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Cluster_Composition field captures the composition of the malware cluster, including the similarity indices between its members, as a collection of edges and their corresponding nodes.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ClusterCompositionType_score_type + maec-package-2.tmp#ClusterCompositionType_Edge_Node_Pair + maec-package-2.tmp#ClusterCompositionType
    +
    TypemaecPackage:ClusterCompositionType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Cluster_Composition score_type="" xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Edge_Node_Pair similarity_distance="" similarity_index="">{1,unbounded}</maecPackage:Edge_Node_Pair>
+</maecPackage:Cluster_Composition>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    score_typexs:stringoptional +
    + + + + + 
    For clustering algorithms that may capture different types of scores, the score_type attribute specifies the type of score used to define the composition of this malware cluster.
    +
    +
    +
    +
    +
    Element maecPackage:ClusterCompositionType / maecPackage:Edge_Node_Pair
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Cluster_Edge_Node_Pair field specifies a single edge and its connected nodes in the malware cluster, representing the similarity index between two Malware Subjects.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ClusterEdgeNodePairType_similarity_index + NO_NAMESPACE.tmp#ClusterEdgeNodePairType_similarity_distance + maec-package-2.tmp#ClusterEdgeNodePairType_Malware_Subject_Node_A + maec-package-2.tmp#ClusterEdgeNodePairType_Malware_Subject_Node_B + maec-package-2.tmp#ClusterEdgeNodePairType
    +
    TypemaecPackage:ClusterEdgeNodePairType
    +
    Instance
    +
    +     		+
    + + + + + 
    <maecPackage:Edge_Node_Pair similarity_distance="" similarity_index="" xmlns:maecPackage="http://maec.mitre.org/XMLSchema/maec-package-2">
+  <maecPackage:Malware_Subject_Node_A malware_subject_idref="">{1,1}</maecPackage:Malware_Subject_Node_A>
+  <maecPackage:Malware_Subject_Node_B malware_subject_idref="">{1,1}</maecPackage:Malware_Subject_Node_B>
+</maecPackage:Edge_Node_Pair>
    +
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    similarity_distancexs:decimaloptional +
    + + + + + 
    The similarity_index field specifies the similarity distance between the two Malware Subjects being referenced (indicating how dissimilar they are), as a decimal value. This value should be equivalent to 1 minus the similarity index value (if included).
    +
    +
    similarity_indexxs:decimaloptional +
    + + + + + 
    The similarity_index field specifies the similarity index  between the two Malware Subjects being referenced (indicating how similar they are), as a decimal value. This value should be equivalent to 1 minus the similarity distance value (if included).
    +
    +
    +
    +
    +
    Element maecPackage:ClusterEdgeNodePairType / maecPackage:Malware_Subject_Node_A
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Malware_Subject_Node_A field represents a node connected to the edge via a reference to a Malware Subject that is part of a malware cluster.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#MalwareSubjectReferenceType_malware_subject_idref + maec-package-2.tmp#MalwareSubjectReferenceType
    +
    TypemaecPackage:MalwareSubjectReferenceType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    malware_subject_idrefxs:QNamerequired +
    + + + + + 
    The malware_subject_idref field provides a reference to a Malware Subject contained in the Package, via its ID.
    +
    +
    +
    +
    +
    Element maecPackage:ClusterEdgeNodePairType / maecPackage:Malware_Subject_Node_B
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Malware_Subject_Node_B field represents a node connected to the edge via a reference to a Malware Subject that is part of a malware cluster.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#MalwareSubjectReferenceType_malware_subject_idref + maec-package-2.tmp#MalwareSubjectReferenceType
    +
    TypemaecPackage:MalwareSubjectReferenceType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    malware_subject_idrefxs:QNamerequired +
    + + + + + 
    The malware_subject_idref field provides a reference to a Malware Subject contained in the Package, via its ID.
    +
    +
    +
    +
    +
    Complex Type maecPackage:PackageType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The PackageType is the namesake type of the MAEC Package schema, and captures either a single Malware Subject, or a collection of Malware Subjects that are related in some way (even if exact details of the relationship are unknown). Unlike the MAEC Bundle, which captures only the MAEC-characterized analysis results for a malware instance, the Package permits the capture of additional metadata relating to the analysis, relationships between Malware Subjects, and similar types of entities.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#PackageType_id + NO_NAMESPACE.tmp#PackageType_schema_version + NO_NAMESPACE.tmp#PackageType_timestamp + maec-package-2.tmp#PackageType_Malware_Subjects + maec-package-2.tmp#PackageType_Grouping_Relationships
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeFixedUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for this Package.
    +
    +
    schema_versionxs:string2.1required +
    + + + + + 
    The required schema_version field specifies the version of the MAEC Package schema that the document has been written in and that should be used for validation.
    +
    +
    timestampxs:dateTimeoptional +
    + + + + + 
    The timestamp field specifies the date/time that the Package was generated.
    +
    +
    +
    +
    +
    Complex Type maecPackage:MalwareSubjectListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareSubjectListType captures a list of Malware Subjects.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#MalwareSubjectListType_Malware_Subject
    +
    +
    Complex Type maecPackage:MalwareSubjectType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareSubjectType captures all of the details pertaining to a single malware instance, including any corresponding Analyses, Field Data, Findings Bundles, and relationships to other Malware Subjects.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#MalwareSubjectType_id + maec-package-2.tmp#MalwareSubjectType_Malware_Instance_Object_Attributes + maec-package-2.tmp#MalwareSubjectType_Label + maec-package-2.tmp#MalwareSubjectType_Configuration_Details + maec-package-2.tmp#MalwareSubjectType_Development_Environment + maec-package-2.tmp#MalwareSubjectType_Minor_Variants + maec-package-2.tmp#MalwareSubjectType_Field_Data + maec-package-2.tmp#MalwareSubjectType_Analyses + maec-package-2.tmp#MalwareSubjectType_Findings_Bundles + maec-package-2.tmp#MalwareSubjectType_Relationships + maec-package-2.tmp#MalwareSubjectType_Compatible_Platform
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for this Malware Subject.
    +
    +
    +
    +
    +
    Complex Type maecPackage:MalwareConfigurationDetailsType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareConfigurationDetailsType captures details of malware configuration parameters and associated metadata.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#MalwareConfigurationDetailsType_Storage + maec-package-2.tmp#MalwareConfigurationDetailsType_Obfuscation + maec-package-2.tmp#MalwareConfigurationDetailsType_Configuration_Parameter
    +
    +
    Complex Type maecPackage:MalwareConfigurationStorageDetailsType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareConfigurationStorageDetailsType captures details relating to the storage of malware configuration parameters.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#MalwareConfigurationStorageDetailsType_Malware_Binary + maec-package-2.tmp#MalwareConfigurationStorageDetailsType_File + maec-package-2.tmp#MalwareConfigurationStorageDetailsType_URL
    +
    +
    Complex Type maecPackage:MalwareBinaryConfigurationStorageDetailsType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareBinaryConfigurationStorageDetailsType captures details relating to the storage of malware configuration parameters inside the malware binary itself.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#MalwareBinaryConfigurationStorageDetailsType_File_Offset + maec-package-2.tmp#MalwareBinaryConfigurationStorageDetailsType_Section_Name + maec-package-2.tmp#MalwareBinaryConfigurationStorageDetailsType_Section_Offset
    +
    +
    Complex Type maecPackage:MalwareConfigurationObfuscationDetailsType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareConfigurationObfuscationDetailsType captures details relating to the obfuscation of malware configuration parameters.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#MalwareConfigurationObfuscationDetailsType_is_encoded + NO_NAMESPACE.tmp#MalwareConfigurationObfuscationDetailsType_is_encrypted + maec-package-2.tmp#MalwareConfigurationObfuscationDetailsType_Algorithm_Details
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    is_encodedxs:booleanoptional +
    + + + + + 
    The is_encoded field specifies that the malware configuration parameters are encoded with the algorithm captured in the Algorithm_Details field.
    +
    +
    is_encryptedxs:booleanoptional +
    + + + + + 
    The is_encrypted field specifies that the malware configuration parameters are encrypted with the algorithm captured in the Algorithm_Details field.
    +
    +
    +
    +
    +
    Complex Type maecPackage:MalwareConfigurationObfuscationAlgorithmType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareConfigurationObfuscationDetailsType captures of an algorithm used to encode or encrypt malware configuration parameters.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#MalwareConfigurationObfuscationAlgorithmType_ordinal_position + maec-package-2.tmp#MalwareConfigurationObfuscationAlgorithmType_Key + maec-package-2.tmp#MalwareConfigurationObfuscationAlgorithmType_Algorithm_Name
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    ordinal_positionxs:positiveIntegeroptional +
    + + + + + 
    The ordinal_position field specifies the explicit ordering of the usage of the algorithm with respect to the other algorithms used to encrypt or encode the malware configuration parameters, for cases where more than one algorithm was used.
    +
    +
    +
    +
    +
    Complex Type maecPackage:MalwareConfigurationParameterType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareConfigurationParameterType captures a single configuration parameter that may be defined for a malware instance, as a name/value pair.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#MalwareConfigurationParameterType_Name + maec-package-2.tmp#MalwareConfigurationParameterType_Value
    +
    +
    Complex Type maecPackage:MalwareDevelopmentEnvironmentType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareDevelopmentEnvironmentType captures details of the development environment used in developing the malware instance, such as information on any tools that were used.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#MalwareDevelopmentEnvironmentType_Tools + maec-package-2.tmp#MalwareDevelopmentEnvironmentType_Debugging_File
    +
    +
    Complex Type maecPackage:MinorVariantListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MinorVariantListType captures a list of minor variants of a Malware Subject's malware instance object. For example, the same binary with but with different filenames.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#MinorVariantListType_Minor_Variant
    +
    +
    Complex Type maecPackage:AnalysisListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AnalysisListType captures a list of analyses that were performed on a Malware Subject.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#AnalysisListType_Analysis
    +
    +
    Complex Type maecPackage:AnalysisType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AnalysisType provides a way of capturing the information associated with the analysis of a malware instance, such as the subject, authors, start datetime, and other relevant data.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#AnalysisType_id + NO_NAMESPACE.tmp#AnalysisType_type + NO_NAMESPACE.tmp#AnalysisType_method + NO_NAMESPACE.tmp#AnalysisType_ordinal_position + NO_NAMESPACE.tmp#AnalysisType_start_datetime + NO_NAMESPACE.tmp#AnalysisType_complete_datetime + NO_NAMESPACE.tmp#AnalysisType_lastupdate_datetime + maec-package-2.tmp#AnalysisType_Source + maec-package-2.tmp#AnalysisType_Analysts + maec-package-2.tmp#AnalysisType_Summary + maec-package-2.tmp#AnalysisType_Comments + maec-package-2.tmp#AnalysisType_Findings_Bundle_Reference + maec-package-2.tmp#AnalysisType_Tools + maec-package-2.tmp#AnalysisType_Dynamic_Analysis_Metadata + maec-package-2.tmp#AnalysisType_Analysis_Environment + maec-package-2.tmp#AnalysisType_Report
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    complete_datetimexs:dateTimeoptional +
    + + + + + 
    The complete_datetime field specifies the date/time the analysis was completed.
    +
    +
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for this Analysis.
    +
    +
    lastupdate_datetimexs:dateTimeoptional +
    + + + + + 
    The lastupdate_datetime field specifies the date/time the analysis was last updated.
    +
    +
    methodmaecPackage:AnalysisMethodEnumoptional +
    + + + + + 
    The method field specifies the analysis method used in the analysis.
    +
    +
    ordinal_positionxs:positiveIntegeroptional +
    + + + + + 
    The ordinal_position field specifies the ordering of the analysis with respect to the other analyses performed on the Malware Subject.
    +
    +
    start_datetimexs:dateTimeoptional +
    + + + + + 
    The start_datetime field specifies the date/time the analysis was started.
    +
    +
    typemaecPackage:AnalysisTypeEnumoptional +
    + + + + + 
    The type field specifies the type of malware analysis being performed.
    +
    +
    +
    +
    +
    Complex Type maecPackage:SourceType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The SourceType provides a way of characterizing the external source of a relevant MAEC entity, such as an Analysis.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#SourceType_Name + maec-package-2.tmp#SourceType_Method + maec-package-2.tmp#SourceType_Reference + maec-package-2.tmp#SourceType_Organization + maec-package-2.tmp#SourceType_URL
    +
    +
    Complex Type maecPackage:CommentListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CommentListType provides a simple way of capturing any comments relating to MAEC entities, such as Analyses.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#CommentListType_Comment
    +
    +
    Complex Type maecPackage:CommentType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CommentType captures a comment relating to some MAEC field.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CommentType_author + NO_NAMESPACE.tmp#CommentType_timestamp + NO_NAMESPACE.tmp#CommentType_observation_name
    +
    Typeextension of cyboxCommon:StructuredTextType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    authorxs:stringoptional +
    + + + + + 
    The author field specifies the name of the author that added the comment.
    +
    +
    observation_namexs:stringoptional +
    + + + + + 
    The observation_name field captures the name, type, or identifier of an observation, for comments that refer to the observation of particular entities. For example, a comment that refers to a command and control (C2) encryption key could have an observation_name of "C2 Encryption Key".
    +
    +
    structuring_formatxs:stringoptional +
    + + + + + 
    Used to indicate a particular structuring format (e.g., HTML5) used within an instance of StructuredTextType. Note that if the markup tags used by this format would be interpreted as XML information (such as the bracket-based tags of HTML) the text area should be enclosed in a CDATA section to prevent the markup from interfering with XML validation of the CybOX document. If this attribute is absent, the implication is that no markup is being used.
    +
    +
    timestampxs:dateTimeoptional +
    + + + + + 
    The timestamp field specifies the date/time that the comment was added.
    +
    +
    +
    +
    +
    Complex Type maecPackage:ToolListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ToolsType characterizes one or more tools, such as those used in the analysis of a Malware Subject.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#ToolListType_Tool
    +
    +
    Complex Type maecPackage:DynamicAnalysisMetadataType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The DynamicAnalysisMetadataType captures any metadata specific to the dynamic analysis of a malware instance.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#DynamicAnalysisMetadataType_Command_Line + maec-package-2.tmp#DynamicAnalysisMetadataType_Analysis_Duration + maec-package-2.tmp#DynamicAnalysisMetadataType_Exit_Code + maec-package-2.tmp#DynamicAnalysisMetadataType_Raised_Exception
    +
    +
    Complex Type maecPackage:MalwareExceptionType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareExceptionType captures details of exceptions that may be raised as a result of a malware instance executing on a system.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#MalwareExceptionType_is_fatal + maec-package-2.tmp#MalwareExceptionType_Exception_Code + maec-package-2.tmp#MalwareExceptionType_Faulting_Address + maec-package-2.tmp#MalwareExceptionType_Description
    +
    Typeextension of cyboxCommon:ErrorType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    is_fatalxs:booleanoptional +
    + + + + + 
    The is_fatal field specifies whether the exception is fatal; that is, whether it caused the malware instance to terminate.
    +
    +
    +
    +
    +
    Complex Type maecPackage:AnalysisEnvironmentType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AnalysisEnvironmentType provides mechanisms for characterizing the particular hardware/software environment used in the analysis of a Malware Subject.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#AnalysisEnvironmentType_Hypervisor_Host_System + maec-package-2.tmp#AnalysisEnvironmentType_Analysis_Systems + maec-package-2.tmp#AnalysisEnvironmentType_Network_Infrastructure
    +
    +
    Complex Type maecPackage:HypervisorHostSystemType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The HypervisorHostSystemType characterizes the VM Hypervisor host system used in the malware analysis environment.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#HypervisorHostSystemType_VM_Hypervisor
    +
    Typeextension of SystemObj:SystemObjectType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    object_referencexs:QNameoptional +
    + + + + + 
    The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
    +
    +
    +
    +
    +
    Complex Type maecPackage:AnalysisSystemListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AnalysisSystemListType captures a list of the systems, physical or virtual, used in the analysis of a Malware Subject.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#AnalysisSystemListType_Analysis_System
    +
    +
    Complex Type maecPackage:AnalysisSystemType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AnalysisSystemType is intended to characterize any systems on which malware analysis is performed. It imports and extends version 2.0.1 of the CybOX System Object.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#AnalysisSystemType_Installed_Programs
    +
    Typeextension of SystemObj:SystemObjectType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    object_referencexs:QNameoptional +
    + + + + + 
    The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.
    +
    +
    +
    +
    +
    Complex Type maecPackage:InstalledProgramsType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The InstalledProgramsType captures the programs installed on a particular operating system image.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#InstalledProgramsType_Program
    +
    +
    Complex Type maecPackage:NetworkInfrastructureType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The NetworkInfrastructureType captures specific details about the network infrastructure used in the malware analysis environment.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#NetworkInfrastructureType_Captured_Protocols
    +
    +
    Complex Type maecPackage:CapturedProtocolListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CapturedProtocolListType specifies a list of network protocols that a malware analysis environment may capture or interact with.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#CapturedProtocolListType_Protocol
    +
    +
    Complex Type maecPackage:CapturedProtocolType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The CapturedProtocolType specifies the details of a network protocol that may be captured or otherwise manipulated in the malware analysis environment.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#CapturedProtocolType_layer7_protocol + NO_NAMESPACE.tmp#CapturedProtocolType_layer4_protocol + NO_NAMESPACE.tmp#CapturedProtocolType_port_number + NO_NAMESPACE.tmp#CapturedProtocolType_interaction_level
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    interaction_levelmaecPackage:InteractionLevelEnumoptional +
    + + + + + 
    The interaction_level field specifies the relative level of interaction that the analysis environment has with the specified network protocol.
    +
    +
    layer4_protocolmaecPackage:Layer4ProtocolEnumoptional +
    + + + + + 
    The layer4_protocol field specifies the name of the Layer 4 network protocol (OSI model) captured or manipulated by the analysis environment.
    +
    +
    layer7_protocolmaecPackage:Layer7ProtocolEnumoptional +
    + + + + + 
    The layer7_protocol field specifies the name of the Layer 7 network protocol (OSI model) captured or manipulated by the analysis environment.
    +
    +
    port_numberxs:positiveIntegeroptional +
    + + + + + 
    The port_number field specifies the port number for this network protocol that is captured or manipulated by the analysis environment.
    +
    +
    +
    +
    +
    Simple Type maecPackage:Layer7ProtocolEnum
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Layer7ProtocolEnum is a non-exhaustive enumeration of Layer 7 (OSI model) network protocols.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationhttp +
    + + + + + 
    The http value specifies the Hypertext Transfer Protocol (HTTP).
    +
    +
    enumerationhttps +
    + + + + + 
    The https value specifies the Hypertext Transfer Protocol Secure (HTTPS).
    +
    +
    enumerationftp +
    + + + + + 
    The ftp value specifies the File Transfer Protocol (FTP).
    +
    +
    enumerationftps +
    + + + + + 
    The ftps value specifies the File Transfer Protocol Secure (FTPS).
    +
    +
    enumerationsmtp +
    + + + + + 
    The smtp value specifies the Simple Mail Transfer Protocol (SMTP).
    +
    +
    enumerationsmtps +
    + + + + + 
    The smtps value specifies the Simple Mail Transfer Protocol Secure (SMTPS).
    +
    +
    enumerationpop3 +
    + + + + + 
    The pop3 value specifies the Post Office Protocol version 3 (POP3).
    +
    +
    enumerationpop3s +
    + + + + + 
    The pop3s value specifies the Post Office Protocol version 3 Secure (POP3S).
    +
    +
    enumerationirc +
    + + + + + 
    The irc value specifies the Internet Relay Chat (IRC) protocol.
    +
    +
    enumerationdns +
    + + + + + 
    The dns value specifies the Domain Name System (DNS) protocol.
    +
    +
    enumerationrdp +
    + + + + + 
    The rdp value specifies the Remote Desktop Protocol (RDP).
    +
    +
    enumerationrpc +
    + + + + + 
    The rpc value specifies some Remote Procedure Call (RPC) protocol, such as MSRPC.
    +
    +
    enumerationssh +
    + + + + + 
    The ssh value specifies the Secure Shell (SSH) protocol.
    +
    +
    enumerationtelnet +
    + + + + + 
    The telnet value specifies the Telnet protocol.
    +
    +
    +
    +
    +
    Simple Type maecPackage:Layer4ProtocolEnum
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The Layer4ProtocolEnum is a non-exhaustive enumeration of Layer 4 (OSI model) network protocols.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + +
    enumerationtcp +
    + + + + + 
    The tcp value specifies the Transport Control Protocol (TCP).
    +
    +
    enumerationudp +
    + + + + + 
    The udp value specifies the User Datagram Protocol (UDP).
    +
    +
    +
    +
    +
    Simple Type maecPackage:InteractionLevelEnum
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The InteractionLevelEnum is a non-exhaustive enumeration of interaction levels for network protocols in a malware analysis environment.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + + + + + + +
    enumerationhigh +
    + + + + + 
    The high value specifies that, for the specified protocol, the analysis environment will establish the connection and attempt to decode/identify any common protocols used by the malware. The level of decode/protocol support can be subjective and dependent on the particular environment.
    +
    +
    enumerationlow +
    + + + + + 
    The low value specifies that, for the specified protocol, the analysis environment will accept the packets and will identify the initial connection request. No further interaction is performed.
    +
    +
    enumerationhoneytrap +
    + + + + + 
    The honeytrap value specifies that, for the specified protocol, the analysis environment will establish the connection and attempt to interact with outgoing requests. The level of interaction can be subjective and dependent on the particular environment.
    +
    +
    enumerationlive +
    + + + + + 
    The live value specifies that, for the specified protocol, the analysis environment allows the malware to connect out to the real (unemulated) IP.
    +
    +
    enumerationnone +
    + + + + + 
    The none value specifies that, for the specified protocol, the analysis environment does not support or perform any level of interaction.
    +
    +
    +
    +
    +
    Simple Type maecPackage:AnalysisTypeEnum
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AnalysisTypeEnum is an enumeration of types of malware analyses.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + +
    enumerationtriage +
    + + + + + 
    The Triage value specifies an cursory, or triage type of malware analysis, commonly automated in conjunction with one or more tools.
    +
    +
    enumerationin-depth +
    + + + + + 
    The in-depth value specifies a detailed type of malware analysis that is typically performed by a human analyst.
    +
    +
    +
    +
    +
    Simple Type maecPackage:AnalysisMethodEnum
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The AnalysisMethodEnum is an enumeration of malware analysis methods.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram
    +
    Typerestriction of xs:string
    +
    Facets
    +
    +     		+
    + + + + + + + + + + + + + + + + +
    enumerationstatic +
    + + + + + 
    The static value specifies a static malware analysis method, which is achieved by inspecting but not executing the malware instance.
    +
    +
    enumerationdynamic +
    + + + + + 
    The dynamic value specifies a dynamic malware analysis method, which is achieved by executing but not inspecting the malware instance.
    +
    +
    enumerationcombination +
    + + + + + 
    The combination value specifies a combination of dynamic and static malware analysis, achieved by both inspecting and executing the malware instance.
    +
    +
    +
    +
    +
    Complex Type maecPackage:FindingsBundleListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The FindingsBundleListType captures a list of Bundles or external references to Bundles, along with any related meta-analysis entities.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#FindingsBundleListType_Meta_Analysis + maec-package-2.tmp#FindingsBundleListType_Bundle + maec-package-2.tmp#FindingsBundleListType_Bundle_External_Reference
    +
    +
    Complex Type maecPackage:MetaAnalysisType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MetaAnalysisType captures meta-analysis entities associated with the Bundles that were captured for a Malware Subject, such as Action Equivalencies.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#MetaAnalysisType_Action_Equivalences + maec-package-2.tmp#MetaAnalysisType_Object_Equivalences
    +
    +
    Complex Type maecPackage:ActionEquivalenceListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ActionEquivalenceListType captures a list of Action Equivalences.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#ActionEquivalenceListType_Action_Equivalence
    +
    +
    Complex Type maecPackage:ActionEquivalenceType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ActionEquivalenceType relates any Actions that are equivalent to each other, e.g., those that were found for the same Malware Subject when using different analysis tools. It can be used as a way of referencing equivalent actions as a single unit, such as for specifying the Action composition of a Behavior.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ActionEquivalenceType_id + maec-package-2.tmp#ActionEquivalenceType_Action_Reference
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for the Action Equivalence.
    +
    +
    +
    +
    +
    Complex Type maecPackage:ObjectEquivalenceListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ObjectEquivalenceListType captures a list of Object Equivalences.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#ObjectEquivalenceListType_Object_Equivalence
    +
    +
    Complex Type maecPackage:ObjectEquivalenceType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ObjectEquivalenceType relates the Objects that are equivalent to each other, e.g., those that were found for the same Malware Subject when using different analysis tools.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ObjectEquivalenceType_id
    +
    Typeextension of maecBundle:ObjectReferenceListType
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    idxs:QNamerequired +
    + + + + + 
    The required id field specifies a unique ID for the Object Equivalence.
    +
    +
    +
    +
    +
    Complex Type maecPackage:MalwareSubjectRelationshipListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareSubjectRelationshipListType captures a list of relationships between a Malware Subject and other Malware Subjects.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#MalwareSubjectRelationshipListType_Relationship
    +
    +
    Complex Type maecPackage:MalwareSubjectRelationshipType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareSubjectRelationshipType provides a mechanism for capturing the relationships between a Malware Subject and one or more other Malware Subjects.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#MalwareSubjectRelationshipType_Type + maec-package-2.tmp#MalwareSubjectRelationshipType_Malware_Subject_Reference
    +
    +
    Complex Type maecPackage:MalwareSubjectReferenceType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The MalwareSubjectReferenceType provides a mechanism for specifying a reference to a Malware Subject contained in the Package.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#MalwareSubjectReferenceType_malware_subject_idref
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    malware_subject_idrefxs:QNamerequired +
    + + + + + 
    The malware_subject_idref field provides a reference to a Malware Subject contained in the Package, via its ID.
    +
    +
    +
    +
    +
    Complex Type maecPackage:GroupingRelationshipListType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The GroupingRelationshipListType captures a list of grouping relationships relating the Malware Subjects in a Package.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#GroupingRelationshipListType_Grouping_Relationship
    +
    +
    Complex Type maecPackage:GroupingRelationshipType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The GroupingRelationshipType provides a mechanism for specifying the relationship that groups together the Malware Subjects in a Package.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#GroupingRelationshipType_Type + maec-package-2.tmp#GroupingRelationshipType_Malware_Family_Name + maec-package-2.tmp#GroupingRelationshipType_Malware_Toolkit_Name + maec-package-2.tmp#GroupingRelationshipType_Clustering_Metadata
    +
    +
    Complex Type maecPackage:ClusteringMetadataType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ClusteringMetadataType specifies any metadata regarding the algorithm and/or methods used for clustering the Malware Subjects in this Package, for use in the ‘clustered together’ relationship type.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#ClusteringMetadataType_Algorithm_Name + maec-package-2.tmp#ClusteringMetadataType_Algorithm_Version + maec-package-2.tmp#ClusteringMetadataType_Algorithm_Parameters + maec-package-2.tmp#ClusteringMetadataType_Cluster_Size + maec-package-2.tmp#ClusteringMetadataType_Cluster_Description + maec-package-2.tmp#ClusteringMetadataType_Cluster_Composition
    +
    +
    Complex Type maecPackage:ClusteringAlgorithmParametersType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ClusteringAlgorithmParametersType captures any parameters that may have been used in a malware clustering algorithm.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + maec-package-2.tmp#ClusteringAlgorithmParametersType_Distance_Threshold + maec-package-2.tmp#ClusteringAlgorithmParametersType_Number_of_Iterations
    +
    +
    Complex Type maecPackage:ClusterCompositionType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ClusterCompositionType captures the composition of a malware cluster via its edges and their respective connected nodes, as in an undirected graph.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ClusterCompositionType_score_type + maec-package-2.tmp#ClusterCompositionType_Edge_Node_Pair
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    score_typexs:stringoptional +
    + + + + + 
    For clustering algorithms that may capture different types of scores, the score_type attribute specifies the type of score used to define the composition of this malware cluster.
    +
    +
    +
    +
    +
    Complex Type maecPackage:ClusterEdgeNodePairType
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + +
    Namespacehttp://maec.mitre.org/XMLSchema/maec-package-2
    +
    Annotations
    +
    +     		+
    +
    + + + + + 
    The ClusterEdgeNodePairType captures a single edge-node pair in a malware cluster, which is composed of the two Malware Subjects that correspond to the nodes connected to the edge (via references), and represents the similarity index between the two Malware Subjects.
    +
    +
    +
    +
    Diagram
    +
    +     		+
    Diagram + NO_NAMESPACE.tmp#ClusterEdgeNodePairType_similarity_index + NO_NAMESPACE.tmp#ClusterEdgeNodePairType_similarity_distance + maec-package-2.tmp#ClusterEdgeNodePairType_Malware_Subject_Node_A + maec-package-2.tmp#ClusterEdgeNodePairType_Malware_Subject_Node_B
    +
    +
    Attributes
    +
    +     		+
    + + + + + + + + + + + + + + + + + + + + + +
    QNameTypeUseAnnotation
    similarity_distancexs:decimaloptional +
    + + + + + 
    The similarity_index field specifies the similarity distance between the two Malware Subjects being referenced (indicating how dissimilar they are), as a decimal value. This value should be equivalent to 1 minus the similarity index value (if included).
    +
    +
    similarity_indexxs:decimaloptional +
    + + + + + 
    The similarity_index field specifies the similarity index  between the two Malware Subjects being referenced (indicating how similar they are), as a decimal value. This value should be equivalent to 1 minus the similarity distance value (if included).
    +
    +
    +
    +
    +
    +
    +
    +
    XML Schema documentation generated by ® XML Editor. +
    +
    + \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/maec_bundle_schema.html b/documentation/maec4.1-xsddocs/maec_bundle_schema.html new file mode 100644 index 00000000..047a9078 --- /dev/null +++ b/documentation/maec4.1-xsddocs/maec_bundle_schema.html @@ -0,0 +1,4 @@ + + +Schema documentation for namespace http://maec.mitre.org/XMLSchema/maec-bundle-4 \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/maec_bundle_schema.indexList.html b/documentation/maec4.1-xsddocs/maec_bundle_schema.indexList.html new file mode 100644 index 00000000..3f1efe9e --- /dev/null +++ b/documentation/maec4.1-xsddocs/maec_bundle_schema.indexList.html @@ -0,0 +1,655 @@ + + + + + Schema documentation for namespace + + +

    Table of Contents

    +
    +
    +
    Group by:
    +
    +
    +
    +
    +

    maec_bundle_schema.xsd

    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Elements
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Complex Types
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Simple Types
    +
    + +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Attributes
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    XML Schema documentation generated by ® XML Editor. +
    +
    + \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/maec_bundle_schema.indexListcomp.html b/documentation/maec4.1-xsddocs/maec_bundle_schema.indexListcomp.html new file mode 100644 index 00000000..2d55b8e7 --- /dev/null +++ b/documentation/maec4.1-xsddocs/maec_bundle_schema.indexListcomp.html @@ -0,0 +1,622 @@ + + + + + Schema documentation for + + +

    Table of Contents

    +
    +
    +
    Group by:
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Elements
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Complex Types
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Simple Types
    +
    + +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Attributes
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    XML Schema documentation generated by ® XML Editor. +
    +
    + + \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/maec_bundle_schema.indexListns.html b/documentation/maec4.1-xsddocs/maec_bundle_schema.indexListns.html new file mode 100644 index 00000000..21c57050 --- /dev/null +++ b/documentation/maec4.1-xsddocs/maec_bundle_schema.indexListns.html @@ -0,0 +1,633 @@ + + + + + Schema documentation for + + +

    Table of Contents

    +
    +
    +
    Group by:
    +
    +
    +
    +
    +

    http://maec.mitre.org/XMLSchema/maec-bundle-4

    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Elements
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Complex Types
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Simple Types
    +
    + +
    +
    +
    +
    +
    +
    +
    +

    No namespace

    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Attributes
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    XML Schema documentation generated by ® XML Editor. +
    +
    + + \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/maec_container_schema.html b/documentation/maec4.1-xsddocs/maec_container_schema.html new file mode 100644 index 00000000..3e7b7fb7 --- /dev/null +++ b/documentation/maec4.1-xsddocs/maec_container_schema.html @@ -0,0 +1,4 @@ + + +Schema documentation for namespace http://maec.mitre.org/XMLSchema/maec-container-2 \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/maec_container_schema.indexList.html b/documentation/maec4.1-xsddocs/maec_container_schema.indexList.html new file mode 100644 index 00000000..2714c0dc --- /dev/null +++ b/documentation/maec4.1-xsddocs/maec_container_schema.indexList.html @@ -0,0 +1,424 @@ + + + + + Schema documentation for namespace + + +

    Table of Contents

    +
    +
    +
    Group by:
    +
    +
    +
    +
    +

    maec_container_schema.xsd

    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Elements
    +
    + +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Complex Types
    +
    + +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Attributes
    +
    + +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    XML Schema documentation generated by ® XML Editor. +
    +
    + \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/maec_container_schema.indexListcomp.html b/documentation/maec4.1-xsddocs/maec_container_schema.indexListcomp.html new file mode 100644 index 00000000..9aa39895 --- /dev/null +++ b/documentation/maec4.1-xsddocs/maec_container_schema.indexListcomp.html @@ -0,0 +1,391 @@ + + + + + Schema documentation for + + +

    Table of Contents

    +
    +
    +
    Group by:
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Elements
    +
    + +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Complex Types
    +
    + +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Attributes
    +
    + +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    XML Schema documentation generated by ® XML Editor. +
    +
    + + \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/maec_container_schema.indexListns.html b/documentation/maec4.1-xsddocs/maec_container_schema.indexListns.html new file mode 100644 index 00000000..c6a4649b --- /dev/null +++ b/documentation/maec4.1-xsddocs/maec_container_schema.indexListns.html @@ -0,0 +1,402 @@ + + + + + Schema documentation for + + +

    Table of Contents

    +
    +
    +
    Group by:
    +
    +
    +
    +
    +

    http://maec.mitre.org/XMLSchema/maec-container-2

    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Elements
    +
    + +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Complex Types
    +
    + +
    +
    +
    +
    +
    +
    +
    +

    No namespace

    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Attributes
    +
    + +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    XML Schema documentation generated by ® XML Editor. +
    +
    + + \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/maec_default_vocabularies.html b/documentation/maec4.1-xsddocs/maec_default_vocabularies.html new file mode 100644 index 00000000..fac47f7e --- /dev/null +++ b/documentation/maec4.1-xsddocs/maec_default_vocabularies.html @@ -0,0 +1,4 @@ + + +Schema documentation for namespace http://maec.mitre.org/default_vocabularies-1 \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/maec_default_vocabularies.indexList.html b/documentation/maec4.1-xsddocs/maec_default_vocabularies.indexList.html new file mode 100644 index 00000000..a1a6cbe1 --- /dev/null +++ b/documentation/maec4.1-xsddocs/maec_default_vocabularies.indexList.html @@ -0,0 +1,573 @@ + + + + + Schema documentation for namespace + + +

    Table of Contents

    +
    +
    +
    Group by:
    +
    +
    +
    +
    +

    maec_default_vocabularies.xsd

    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Complex Types
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Simple Types
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    XML Schema documentation generated by ® XML Editor. +
    +
    + \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/maec_default_vocabularies.indexListcomp.html b/documentation/maec4.1-xsddocs/maec_default_vocabularies.indexListcomp.html new file mode 100644 index 00000000..6346cb29 --- /dev/null +++ b/documentation/maec4.1-xsddocs/maec_default_vocabularies.indexListcomp.html @@ -0,0 +1,540 @@ + + + + + Schema documentation for + + +

    Table of Contents

    +
    +
    +
    Group by:
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Complex Types
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Simple Types
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    XML Schema documentation generated by ® XML Editor. +
    +
    + + \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/maec_default_vocabularies.indexListns.html b/documentation/maec4.1-xsddocs/maec_default_vocabularies.indexListns.html new file mode 100644 index 00000000..ad7d1334 --- /dev/null +++ b/documentation/maec4.1-xsddocs/maec_default_vocabularies.indexListns.html @@ -0,0 +1,545 @@ + + + + + Schema documentation for + + +

    Table of Contents

    +
    +
    +
    Group by:
    +
    +
    +
    +
    +

    http://maec.mitre.org/default_vocabularies-1

    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Complex Types
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Simple Types
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    XML Schema documentation generated by ® XML Editor. +
    +
    + + \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/maec_package_schema.html b/documentation/maec4.1-xsddocs/maec_package_schema.html new file mode 100644 index 00000000..1518ab7c --- /dev/null +++ b/documentation/maec4.1-xsddocs/maec_package_schema.html @@ -0,0 +1,4 @@ + + +Schema documentation for namespace http://maec.mitre.org/XMLSchema/maec-package-2 \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/maec_package_schema.indexList.html b/documentation/maec4.1-xsddocs/maec_package_schema.indexList.html new file mode 100644 index 00000000..36a29679 --- /dev/null +++ b/documentation/maec4.1-xsddocs/maec_package_schema.indexList.html @@ -0,0 +1,619 @@ + + + + + Schema documentation for namespace + + +

    Table of Contents

    +
    +
    +
    Group by:
    +
    +
    +
    +
    +

    maec_package_schema.xsd

    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Elements
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Complex Types
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Simple Types
    +
    + +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Attributes
    +
    + +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    XML Schema documentation generated by ® XML Editor. +
    +
    + \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/maec_package_schema.indexListcomp.html b/documentation/maec4.1-xsddocs/maec_package_schema.indexListcomp.html new file mode 100644 index 00000000..d90f0e58 --- /dev/null +++ b/documentation/maec4.1-xsddocs/maec_package_schema.indexListcomp.html @@ -0,0 +1,586 @@ + + + + + Schema documentation for + + +

    Table of Contents

    +
    +
    +
    Group by:
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Elements
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Complex Types
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Simple Types
    +
    + +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Attributes
    +
    + +
    +
    +
    +
    +
    +
    +
    +
    +
    +
    XML Schema documentation generated by ® XML Editor. +
    +
    + + \ No newline at end of file diff --git a/documentation/maec4.1-xsddocs/maec_package_schema.indexListns.html b/documentation/maec4.1-xsddocs/maec_package_schema.indexListns.html new file mode 100644 index 00000000..e2c688db --- /dev/null +++ b/documentation/maec4.1-xsddocs/maec_package_schema.indexListns.html @@ -0,0 +1,597 @@ + + + + + Schema documentation for + + +

    Table of Contents

    +
    +
    +
    Group by:
    +
    +
    +
    +
    +

    http://maec.mitre.org/XMLSchema/maec-package-2

    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Elements
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Complex Types
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + +
    +
    Simple Types
    +
    + +
    +
    +
    +
    +
    +
    +
    +

    No namespace

    + +
    +
    +
    +
    +
    +
    +
    XML Schema documentation generated by ® XML Editor. +
    +
    + + \ No newline at end of file diff --git a/documentation/maec5-docs/fonts/slate.eot b/documentation/maec5-docs/fonts/slate.eot new file mode 100644 index 00000000..13c4839a Binary files /dev/null and b/documentation/maec5-docs/fonts/slate.eot differ diff --git a/documentation/maec5-docs/fonts/slate.svg b/documentation/maec5-docs/fonts/slate.svg new file mode 100644 index 00000000..5f349823 --- /dev/null +++ b/documentation/maec5-docs/fonts/slate.svg @@ -0,0 +1,14 @@ + + + +Generated by IcoMoon + + + + + + + + + + diff --git a/documentation/maec5-docs/fonts/slate.ttf b/documentation/maec5-docs/fonts/slate.ttf new file mode 100644 index 00000000..ace9a46a Binary files /dev/null and b/documentation/maec5-docs/fonts/slate.ttf differ diff --git a/documentation/maec5-docs/fonts/slate.woff b/documentation/maec5-docs/fonts/slate.woff new file mode 100644 index 00000000..1e72e0ee Binary files /dev/null and b/documentation/maec5-docs/fonts/slate.woff differ diff --git a/documentation/maec5-docs/fonts/slate.woff2 b/documentation/maec5-docs/fonts/slate.woff2 new file mode 100644 index 00000000..7c585a72 Binary files /dev/null and b/documentation/maec5-docs/fonts/slate.woff2 differ diff --git a/documentation/maec5-docs/images/logo.png b/documentation/maec5-docs/images/logo.png new file mode 100644 index 00000000..d3a85813 Binary files /dev/null and b/documentation/maec5-docs/images/logo.png differ diff --git a/documentation/maec5-docs/images/navbar.png b/documentation/maec5-docs/images/navbar.png new file mode 100644 index 00000000..df38e90d Binary files /dev/null and b/documentation/maec5-docs/images/navbar.png differ diff --git a/documentation/maec5-docs/index.html b/documentation/maec5-docs/index.html new file mode 100644 index 00000000..5bd95b10 --- /dev/null +++ b/documentation/maec5-docs/index.html @@ -0,0 +1,6284 @@ + + + + + + + + MAEC 5 Specification Reference + + + + + + + + + + + NAV + Navbar + + +
    + +
    + json +
    +
    + +
    + + + +
    +
    +
    +
    +

    Introduction

    +
    +

    Sandbox analysis of a Malware Instance

    +
    +
    {
+  "type":"package",
+  "id":"package--773adac8-2316-42c6-6fbc-9cdef8876fc5",
+  "schema_version":"5.0",
+  "maec_objects": [
+     {
+        "type":"malware-instance",
+        "id":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
+        "instance_object_refs": ["0"],
+        "name": {
+           "value":"Zeus 1.3",
+           "confidence":"medium"
+        },
+        "capabilities": [{"name":"anti-detection"}],
+        "analysis_metadata": [
+           {
+              "analysis_type":"in-depth",
+              "description": "ran sample through sandbox"
+           }
+        ]
+     }
+  ],
+  "observable_objects": {
+     "0": {
+        "type":"file",
+        "hashes":{"MD5":"4472ea40dc71e5bb701574ea215a81a1"},
+        "size":25536,
+        "name":"foo.dll"
+     }
+  }
+}
+
    +

    Welcome to the Malware Attribute Enumeration and Characterization (MAEC™, pronounced “mike”) effort, a comprehensive language and data model for the exchange of malware data.

    + +

    This page provides a basic outline of the MAEC 5.0 data model. For an introduction and conceptual overview of MAEC, please see the Core Concepts and Vocabularies specification documents. There's also a documentation website containing examples and further information.

    + +

    This documentation is divided into seven sections:

    + +
      +

    • Top-level Objects - MAEC top-level objects (TLOs) are the entities captured at the top level of a Package. Examples include the Malware Instance and the Behavior Objects.

      • +

    • MAEC Types - These MAEC 5.0 types are used by MAEC’s TLOs.

      • +

    • Relationships - Relationships are defined between pairs of MAEC TLOs.

      • +

    • Package - The Package is MAEC's standard output format.

      • +

    • Common Data Types - These common data types are used by MAEC TLOs and data types.

      • +

    • Cyber Observable Object Extensions - MAEC-specific extensions are defined for STIX Cyber Observable Objects used in the context of MAEC.

      • +

    • Vocabularies - Many of MAEC's TLOs and data types contain properties that may be defined by MAEC open vocabularies. Each open vocabulary provides a list of common and industry-accepted terms. The use of MAEC's vocabularies is recommended to increase compatibility, but custom values may also be used.

      • +
    +

    Top-level Objects

    Behavior

    +
    +

    Persistence Behavior comprising several Malware Actions:

    +
    +
    {
+  "type":"package",
+  "id":"package--2d42dac8-c416-42c6-bc5c-7b6dcf576fc5",
+  "schema_version":"5.0",
+  "maec_objects":[
+    {
+      "type":"behavior",
+      "id":"behavior--2099d4c1-0e8a-49d2-8d32-f0427e1ff817",
+      "name":"persist-after-system-reboot",
+      "action_refs":[
+        "malware-action--c095f1ab-0847-4d89-92ef-010e6ed39c20",
+        "malware-action--80f3f63a-d5c9-4599-b9e4-2a2bd7210736"
+      ],
+      "attributes":{
+        "persistence-scope" : "system wide"
+      },
+      "technique_refs":[
+        {
+          "source_name":"att&ck",
+          "description":"registry run keys/start folder",
+          "external_id":"t1060"
+        }
+      ]
+    },
+    {
+      "type":"malware-action",
+      "id":"malware-action--c095f1ab-0847-4d89-92ef-010e6ed39c20",
+      "name":"create file",
+      "output_object_refs":[
+        "0"
+      ]
+    },
+    {
+      "type":"malware-action",
+      "id":"malware-action--80f3f63a-d5c9-4599-b9e4-2a2bd7210736",
+      "name":"create registry key value",
+      "output_object_refs":[
+        "1"
+      ]
+    }
+  ],
+  "observable_objects":{
+    "0":{
+      "type":"file",
+      "hashes":{
+        "MD5":"4472ea40dc71e5bb701574ea215a81a1"
+      },
+      "size":25536,
+      "name":"foo.dll",
+      "parent_directory_ref":"2"
+    },
+    "1":{
+      "type":"windows-registry-key",
+      "key":"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
+      "values":[
+        {
+          "name":"Foo",
+          "value":"C:\\Windows\\System32\foo.dll"
+        }
+      ]
+    },
+    "2":{
+      "type":"directory",
+      "path":"C:\\Windows\\System32"
+    }
+  }
+}
+
    +

    Type Name: behavior

    + +

    A Behavior corresponds to the specific purpose behind a particular snippet of code, as executed by a malware instance. Examples include keylogging, detecting a virtual machine, and installing a backdoor. Behaviors may be composed of one or more Malware Actions, thereby providing context to these Actions.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    id (required)identifierSpecifies a unique ID for the Behavior.
    type (required)stringThe value of property field MUST be behavior.
    name (required)open-vocabCaptures the name of the Behavior. The values for this property SHOULD come from the behavior-ov open vocabulary.
    description (optional)stringSpecifies a textual description of the Behavior.
    timestamp (optional)timestampCaptures the local or relative time at which the Behavior occurred or was observed.
    action_refs (optional)list of type identifierCaptures Actions that serve as an implementation of the Behavior. Each list item specifies the unique ID of the Action being referenced. Each Action MUST be present in the current Package. The ordering of the references in the list denotes the sequential ordering of the Actions with respect to the Behavior; that is, Actions at the beginning of the list MUST have occurred before those later in the list.
    technique_refs (optional)list of type external-referenceReferences any techniques used to implement the Behavior; for example, DLL Search Order Hijacking. Each reference SHOULD point to a valid ATT&CK Technique or related entity.
    +

    Relationships

    Embedded Relationships

    + + + + + + + + + + +
    NameValid Target(s)
    action_refsmalware-action
    +

    Common Relationships

    +

    related-to

    +

    Top-level Relationships

    + + + + + + + + + + + + + + + + + + + + +
    SourceNameTargetDescription
    behaviordependent-onbehaviorSpecifies that the behavior is dependent on the successful execution of another.
    behaviordiscovered-bysoftwareSpecifies that the behavior was discovered by a particular tool, as a represented by a STIX Cyber Observable Software Object.
    +

    Collection

    +
    +

    Basic Collection of Malware Instances observed together:

    +
    +
    {
+  "type":"package",
+  "id":"package--12fbdac8-c416-42c6-cc5c-7b84cf576fc5",
+  "schema_version":"5.0",
+  "maec_objects": [
+     {
+        "type":"collection",
+        "id":"collection--739df9c1-93ab-49d2-73f0-f0427e1ff817",
+        "association_type":"observed together",
+        "entity_refs": [
+           "malware-instance--4c46cb42-8e83-4bbb-acf8-e09c1311093b",
+           "malware-instance--f19859bf-26e4-415e-a1be-41c0486d406d",
+           "malware-instance--4a58d70a-9d25-4c80-a114-28036705d026"
+        ]
+     }
+  ]
+}
+
    +

    Type Name: collection

    + +

    A Collection captures a set of MAEC entities (e.g., Malware Instances, Behaviors, etc.) or STIX Cyber Observables that are related or associated in some way.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    type (required)stringThe value of this property MUST be collection.
    id (required)identifierSpecifies a unique ID for the Collection.
    description (optional)stringSpecifies a textual description of the Collection.
    association_type (optional)open-vocabSpecifies how the contents of the Collection are associated. The values for this property SHOULD come from the entity-association-ov vocabulary.
    entity_refs (optional)list of type identifierSpecifies a set of one or more MAEC entities that are contained in the Collection. Each item specifies the unique ID of the entity being referenced. All entities MUST be present in the current Package. This property is mutually exclusive with regard to the observable_refs property and both properties MUST NOT be present in the same Collection.
    observable_refs (optional)list of type object-refSpecifies a set of one or more STIX Cyber Observable Objects that are contained in the Collection. All Cyber Observable Objects MUST be present in the current Package. This property is mutually exclusive with regard to the entity_refs property and both properties MUST NOT be present in the same Collection.
    +

    Requirements

    +

    One of entity_refs or observable_refs MUST be included when using this object.

    +

    Relationships

    Embedded Relationships

    + + + + + + + + + + + + + + +
    NameValid Target(s)
    entity_refsbehavior, collection, malware-action, malware-family, malware-instance, relationship
    observable_refsartifact, autonomous-system, directory, domain-name, email-addr, email-message, file, ipv4-addr, ipv6-addr, mac-addr, mutex, network-traffic, process, software, url, user-account, windows-registry-key, x509-certificate
    +

    Common Relationships

    +

    related-to

    +

    Malware Action

    +
    +

    Basic "Create File" Action

    +
    +
    {
+  "type":"package",
+  "id":"package--7892dac8-c416-35c6-bc5c-7b6dcf576f91",
+  "schema_version":"5.0",
+  "maec_objects": [
+     {
+        "type":"malware-action",
+        "id":"malware-action--c095f1ab-0847-4d89-92ef-010e6ed39c20",
+        "name":"create file",
+        "is_successful":true,
+        "output_object_refs": ["4"],
+        "timestamp": "2016-01-20T12:31:12.12345Z"
+     }
+  ],
+  "observable_objects": {
+    "4": {
+       "type":"file",
+       "hashes":{"MD5":"4472ea40dc71e5bb701574ea215a81a1"},
+       "size":25536,
+       "name":"foo.dll"
+    }
+  }
+}
+
    +
    +

    Read Registry Key Value Action with Implementation

    +
    +
    {
+  "type":"package",
+  "id":"package--0072dac8-c416-35c6-bc5c-7b6dcf576def",
+  "schema_version":"5.0",
+  "maec_objects": [
+     {
+        "type":"malware-action",
+        "id":"malware-action--e754b078-4185-4eba-a06c-7b2b6c6bd0a5",
+        "name":"read registry key value",
+        "input_object_refs": ["3"],
+        "implementation": {"api_function_name" : "RegQueryValueEx"},
+        "timestamp": "2016-01-20T12:31:12.12345Z"
+     }
+  ],
+  "observable_objects": {
+     "3": {
+        "type":"windows-registry-key",
+        "key":"hkey_local_machine\\system\\bar\\foo",
+        "values": [
+           {
+              "name":"Foo",
+              "data":"qwerty",
+              "data_type":"REG_SZ"
+           }
+        ]
+     }
+  }
+}
+
    +

    Type Name: malware-action

    + +

    A Malware Action represents an abstraction on a system-level API call (or similar entity) called by the malware instance during its execution, and thereby corresponds to the lowest-level dynamic operation of the malware instance. Actions do not contain any associated context as to why they were performed, as this level of detail and abstraction is documented by Behaviors. Examples of Actions include the creation of a particular file on disk and the opening of a port. Actions are commonly captured and reported by dynamic malware analysis tools (i.e., sandboxes).

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    type (required)stringThe value of this property MUST be malware-action.
    id (required)identifierSpecifies a unique ID for the Malware Action.
    name (required)open-vocabCaptures the name of the Malware Action. The values for this property SHOULD come from the malware-action-ov vocabulary.
    description (optional)stringCaptures a basic textual description of the Malware Action.
    is_successful (optional)booleanSpecifies whether the Malware Action was successful in its execution.
    timestamp (optional)timestampCaptures the local or relative time(s) at which the Malware Action occurred or was observed.
    input_object_refs (optional)list of type object-refReferences STIX Observable Objects used as input(s) to the Malware Action. The Object(s) referenced MUST be specified in the observable_objects property of the Package.
    output_object_refs (optional)list of type object-refReferences STIX Observable Objects resulting as output(s) from the Malware Action. The Object(s) referenced MUST be specified in the observable_objects property of the Package.
    api_call (optional)api-callCaptures attributes of the specific API call that was used to implement the Malware Action.
    +

    Relationships

    Embedded Relationships

    + + + + + + + + + + + + + + +
    NameValid Target(s)
    input_object_refsartifact, autonomous-system, directory, domain-name, email-addr, email-message, file, ipv4-addr, ipv6-addr, mac-addr, mutex, network-traffic, process, software, url, user-account, windows-registry-key, x509-certificate
    output_object_refsartifact, autonomous-system, directory, domain-name, email-addr, email-message, file, ipv4-addr, ipv6-addr, mac-addr, mutex, network-traffic, process, software, url, user-account, windows-registry-key, x509-certificate
    +

    Common Relationships

    +

    related-to

    +

    Top-level Relationships

    + + + + + + + + + + + + + + + + + + + + +
    SourceNameTargetDescription
    malware-actiondependent-onmalware-actionSpecifies that the action is dependent on the successful execution of another.
    malware-actiondiscovered-bysoftwareSpecifies that the action was discovered by a particular tool, as a represented by a STIX Cyber Observable Software Object.
    +

    Malware Family

    +
    +

    Basic Malware Family:

    +
    +
    {
+  "type":"package",
+  "id":"package--f53adac8-c416-42c6-6fbc-7b6ef8876fc5",
+  "schema_version":"5.0",
+  "maec_objects": [
+     {
+        "type":"malware-family",
+        "id":"malware-family--df91014d-0c2e-4e01-b8a5-d8c32bb038e6",
+        "name": {
+           "value":"Zeus",
+           "confidence":90
+        }
+     }
+  ]
+}
+
    +
    +

    Expanded Malware Family:

    +
    +
    {
+  "type":"package",
+  "id":"package--b73adac8-3416-66c6-6fbc-096ef8876fc5",
+  "schema_version":"5.0",
+  "maec_objects": [
+     {
+        "type":"malware-family",
+        "id":"malware-family--df91014d-0c2e-4e01-b8a5-d8c32bb038e6",
+        "name": {
+           "value":"Zeus",
+           "confidence":90
+        },
+        "aliases": [
+           {
+              "value":"ZBot",
+              "source":"McAfee",
+              "confidence":80
+           }
+        ],
+        "labels": ["bot", "downloader", "trojan"],
+        "common_capabilities": [
+           {
+              "name":"persistence",
+              "refined_capabilities":[{"name":"continuous execution"}]
+           }
+        ],
+        "common_behavior_refs": ["behavior--ac15b814-868b-43fd-a89b-91e463293f2b"]
+     },
+     {
+        "type":"malware-instance",
+        "id":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
+        "instance_object_refs": ["0"],
+        "name": {
+           "value":"Zeus 1.3",
+           "confidence":80
+        }
+     },
+     {
+        "type":"behavior",
+        "id":"behavior--ac15b814-868b-43fd-a89b-91e463293f2b",
+        "name":"persist after system reboot"
+     }
+  ],
+  "observable_objects": {
+     "0": {
+        "type":"file",
+        "hashes": {"MD5":"4472ea40dc71e5bb701574ea215a81a1"},
+        "size":25536,
+        "name":"foo.dll"
+     }
+  },
+  "relationships": [
+     {
+        "type":"relationship",
+        "id":"relationship--74ae7da8-784d-4a00-aad1-e40c65c78b98",
+        "source_ref":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
+        "target_ref":"malware-family--df91014d-0c2e-4e01-b8a5-d8c32bb038e6",
+        "relationship_type":"variant-of"
+     }
+  ]
+}
+
    +

    Type Name: malware-family

    + +

    A Malware Family is a set of malware instances that are related by common authorship and/or lineage. Malware Families are often named and may have components such as strings that are common across all members of the family.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    type (required)stringThe value of this property MUST be malware-family.
    id (required)identifierSpecifies a unique ID for the Malware Family.
    name (required)nameCaptures the name of the Malware Family, as specified by the producer of the MAEC Package.
    aliases (optional)list of type nameCaptures aliases for the Malware Family. For cases where the alias comes from an external source, the name of the source SHOULD be provided.
    labels (optional)list of type open-vocabSpecifies one or more commonly accepted labels to describe the members of the Malware Family, e.g. “worm.” The values for this property SHOULD come from the malware-label-ov vocabulary.
    description (optional)stringCaptures a basic, textual description of the Malware Family.
    field_data (required)field-dataSpecifies field data about the Malware Family, such as first seen and last seen dates, as well as delivery vectors.
    common_strings (optional)list of type stringSpecifies any strings common to all members of the Malware Family.
    common_capabilities (optional)list of type object-refSpecifies any Capabilities common to all members of the Malware Family.
    common_code_refs (optional)list of type capabilityReferences code snippets that are shared between all of the members of the Malware Family. The Object(s) referenced MUST be of STIX Cyber Observable type artifact and MUST be specified in the observable_objects property of the Package.
    common_behavior_refs (optional)list of type identifierSpecifies a set of one or more Behaviors that are common to all of the members of the Malware Family. Each item specifies the unique ID of the Behavior being referenced; accordingly, each referenced item MUST be of type behavior.
    references (optional)list of type external-referenceCaptures external references to the Malware Family.
    +

    Relationships

    Embedded Relationships

    + + + + + + + + + + + + + + +
    NameValid Target(s)
    common_code_refsartifact
    common_behavior_refsbehavior
    +

    Common Relationships

    +

    related-to

    +

    Top-level Relationships

    + + + + + + + + + + + + + + + + + + + + +
    SourceNameTargetDescription
    malware-familydropped-bymalware-familyIndicates that the source malware family is dropped by the target malware family.
    malware-familyderived-frommalware-familyIndicates that the code base of the source malware family is a derived from the code base of the target malware family.
    +

    Malware Instance

    +
    +

    Basic Malware Instance

    +
    +
    {
+  "type":"package",
+  "id":"package--773adac8-2316-42c6-6fbc-9cdef8876fc5",
+  "schema_version":"5.0",
+  "maec_objects": [
+     {
+        "type":"malware-instance",
+        "id":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
+        "instance_object_refs": ["0"],
+        "name": {
+           "value":"Zeus 1.3",
+           "confidence":50
+        },
+        "capabilities": [{"name":"anti-detection"}],
+        "analysis_metadata": [
+           {
+              "analysis_type":"in-depth",
+              "description": "ran sample through sandbox"
+           }
+        ]
+     }
+  ],
+  "observable_objects": {
+     "0": {
+        "type":"file",
+        "hashes":{"MD5":"4472ea40dc71e5bb701574ea215a81a1"},
+        "size":25536,
+        "name":"foo.dll"
+     }
+  }
+}
+
    +
    +

    Malware Instance with Malware Actions

    +
    +
    {
+    "id": "package--3a7b331e-906f-42c0-bfd5-c2cd04076834",
+    "type": "package",
+    "schema_version": "5.0",
+    "maec_objects": [
+        {
+            "type": "malware-instance",
+            "id": "malware-instance--1d43c77c-21a0-4a10-9a9a-8c0fdfd280b8",
+            "instance_object_refs": ["0"],
+            "dynamic_features": {
+                "action_refs": [
+                    "malware-action--935a718f-863e-49fb-89b8-d65dc0e70e53",
+                    "malware-action--75514819-ea94-4684-8107-68ee63315fc4"
+                ]
+            }
+        },
+        {
+            "type": "malware-action",
+            "id": "malware-action--935a718f-863e-49fb-89b8-d65dc0e70e53",
+            "name": "create-file",
+            "is_successful": true,
+            "output_object_refs": ["0"]
+        },
+        {
+            "type": "malware-action",
+            "id": "malware-action--75514819-ea94-4684-8107-68ee63315fc4",
+            "name": "write-to-process-memory",
+            "is_successful": true,
+            "input_object_refs": ["0"],
+            "output_object_refs": ["1"]
+        }
+    ],
+    "observable_objects": {
+        "0": {
+            "type": "file",
+            "size": 196608,
+            "hashes": {
+                "MD5": "4EC0027BEF4D7E1786A04D021FA8A67F"
+            },
+            "parent_directory_ref": "2"
+        },
+        "1": {
+            "type": "file",
+            "name": "msvcr.dll",
+            "parent_directory_ref": "parent_directory_ref1"
+        },
+        "2": {
+            "type": "directory",
+            "path": "C:\\Documents and Settings\\user\\Local Settings\\Application\\Data"
+        },
+        "3": {
+            "type": "process",
+            "name": "explorer.exe",
+            "cwd": "C:\\Windows\\"
+        }
+    }
+}
+
    +

    Type Name: malware-instance

    + +

    A Malware Instance can be thought of as a single member of a Malware Family that is typically packaged as a binary. This type allows for the characterization of the binaries associated with a Malware Instance along with any corresponding analyses, associated Capabilities, Behaviors, and Actions, and relationships to other Malware Instances.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    type (required)stringThe value of this property MUST be malware-instance.
    id (required)identifierSpecifies a unique ID for the Malware Instance.
    instance_object_refs (required)list of type object-refReferences the Cyber Observable Objects that characterize the packaged code (typically a binary) associated with the Malware Instance Object. For most use cases, the object referenced SHOULD be of STIX Cyber Observable type file. Objects referenced MUST be specified in the observable_objects property of the Package. For cases where multiple STIX Observable File Objects are referenced by this property, each Object MUST have the same hash value (via the hashes property) but MAY have different file names (via the name property).
    name (optional)nameCaptures the name of the Malware Instance, as specified by the producer of the MAEC Package.
    aliases (optional)list of type nameCaptures any aliases for the name of the Malware Instance, as reported by sources other than the producer of the MAEC document (e.g., AV vendors).
    labels (optional)list of type open-vocabSpecifies one or more commonly accepted labels to describe the Malware Instance, e.g. “trojan.” The values for this property SHOULD come from the malware-label-ov vocabulary.
    description (optional)stringCaptures a basic, textual description of the Malware Instance.
    field_data (optional)field-dataSpecifies field data about the Malware Instance, such as first seen and last seen dates, as well as delivery vectors.
    os_execution_envs (optional)list of type open-vocabSpecifies the operating systems that the Malware Instance executes on. The values for this property SHOULD come from the operating-system-ov vocabulary.
    architecture_execution_envs (optional)list of type open-vocabSpecifies the processor architectures that the Malware Instance executes on. The values for this property SHOULD come from the processor-architecture-ov vocabulary.
    capabilities (optional)list of type capabilitySpecifies a set of one or more Capabilities possessed by the Malware Instance.
    os_features (optional)list of type open-vocabSpecifies any operating system-specific features used by the Malware Instance. Each item in the list specifies a single feature. The values for this property SHOULD come from the os-features-ov vocabulary.
    dynamic_features (optional)dynamic-featuresCaptures features associated with the semantics of the code executed by the Malware Instance, such as Malware Actions and Behaviors.
    static_features (optional)static-featuresCaptures features associated with the binary that aren’t related to the semantics of the executed code, such as strings and packer information.
    analysis_metadata (optional)list of type analysis-metadataCaptures metadata associated with the analyses performed on the Malware Instance, such as the tools that were used.
    triggered_signatures (optional)list of type signature-metadataCaptures metadata associated with any signatures or rules (e.g., YARA) that were triggered during the analysis of the malware instance.
    +

    Relationships

    Embedded Relationships

    + + + + + + + + + + +
    NameValid Target(s)
    instance_object_refsfile
    +

    Common Relationships

    +

    related-to

    +

    Top-level Relationships

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    SourceNameTargetDescription
    malware-instanceancestor-ofmalware-instanceIndicates that the source malware instance is an ancestor of the target malware instance.
    malware-instancedownloaded-bymalware-family, malware-instanceIndicates that the source malware instance is downloaded by the target malware instance or family.
    malware-instancedropped-bymalware-family, malware-instanceIndicates that the source malware instance is dropped by the target malware instance or family.
    malware-instancederived-frommalware-family, malware-instanceIndicates that the code base of the source malware instance is a derived from the code base of the target malware instance or family.
    malware-instanceextracted-frommalware-instanceIndicates that the source malware instance is extracted from the target malware instance.
    malware-instancehas-distancemalware-instanceIndicates that the source malware instance has some distance (with respect to similarity) to the target malware instance.
    malware-instancehas-distancemalware-family, malware-instanceIndicates that the source malware instance is installed by the target malware instance or family.
    malware-instancevariant-ofmalware-family, malware-instanceIndicates that the source malware instance is a variant of the target malware instance or family.
    +

    MAEC Types

    API Call

    +
    +

    Malware Action with parameter constants

    +
    +
    {
+ "type":"package",
+ "id":"package--7892dac8-c416-35c6-bc5c-7b6dcf576f91",
+ "schema_version":"5.0",
+ "maec_objects": [
+    {
+       "type":"malware-action",
+       "id":"malware-action--c095f1ab-0847-4d89-92ef-010e6ed39c20",
+       "name":"delete file",
+       "output_object_refs": ["3"],
+       "api_call": {
+          "address":"040089aa",
+          "return_value":"0400f258",
+          "parameters": {
+             "lpFileName":"C:\\Temp\\badfile.pptx",
+             "dwDesiredAccess":"GENERIC_WRITE",
+             "dwShareMode":"FILE_SHARE_READ",
+             "lpSecurityAttributes":"NULL",
+             "dwCreationDisposition":"CREATE_NEW",
+             "dwFlagsAndAttributes":"FILE_ATTRIBUTE_NORMAL",
+             "hTemplateFile":"00000000"
+          },
+          "function_name":"CreateFileEx"
+       }
+    }
+ ]
+}
+
    +
    +

    Malware Action with parameter literals

    +
    +
    {
+ "type":"package",
+ "id":"package--6e8a76ff-9ffa-419e-8ad4-8a165e86f171",
+ "schema_version":"5.0",
+ "maec_objects": [
+    {
+       "type":"malware-action",
+       "id":"malware-action--2dc56470-bef0-4a32-910f-760a5d62be2b",
+       "name":"delete file",
+       "input_object_refs": ["1"],
+       "api_call": {
+          "address":"040089aa",
+          "return_value":"1",
+          "parameters": {
+             "lpFileName":"C:\\Temp\\badfile.pptx",
+             "dwDesiredAccess":"40000000",
+             "dwShareMode":"0x00000001",
+             "lpSecurityAttributes":"0",
+             "dwCreationDisposition":"1",
+             "dwFlagsAndAttributes":"128",
+             "hTemplateFile":"00000000"
+          },
+          "function_name":"DeleteFile"
+       }
+    }
+ ]
+}
+
+
    +

    Type Name: api-call

    + +

    The api-call type serves as a method for characterizing API Calls, as implementations of Malware Actions.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    address (optional)hexCaptures the hexadecimal address of the API call in the binary.
    return_value (optional)stringCaptures the return value of the API call.
    parameters (optional)dictionaryCaptures a list of function parameters. Each key in the dictionary MUST be a string that captures the exact name of the parameter, and each corresponding key value MUST be a string that captures the corresponding parameter value. For parameter values that can be represented by a constant, e.g., GENERIC_WRITE, the constant rather than the literal SHOULD be used. For cases where the parameter cannot be represented by a constant, the literal (as reported by the tool producing the data) MUST be used.
    function_name (required)stringCaptures the full name of the API function called, e.g., CreateFileEx.
    +

    Analysis Metadata

    +
    +

    Analysis Metadata

    +
    +
    {
+ "type":"package",
+ "id":"package--7892dac8-c416-35c6-bc5c-7b6dcf576f91",
+ "schema_version":"5.0",
+ "maec_objects":[
+   {
+     "type":"malware-instance",
+     "id":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
+     "instance_object_refs":[
+       "0"
+     ],
+     "name":{
+       "value":"MalwareB.1.1",
+       "confidence":80
+     },
+     "analysis_metadata":[
+       {
+         "is_automated":false,
+         "start_time":"2017-02-05T12:15:00Z",
+         "end_time":"2017-02-05T12:20:00Z",
+         "last_update_time":"2017-02-05T12:20:00Z",
+         "confidence":75,
+         "analysts":[
+           "John Doe",
+           "Jane Doe"
+         ],
+         "analysis_type":"dynamic",
+         "analysis_environment":{
+           "operating-system":"2",
+           "host-vm":"3",
+           "installed-software":[
+             "4",
+             "5"
+           ]
+         },
+         "comments":[
+           "The decryption key is: Infected---key+-34512",
+           "Analysis required increase of default timeout value"
+         ],
+         "tool_refs":[
+           "1"
+         ],
+         "description":"Basic automated sandbox analysis.",
+         "conclusion":"malicious"
+       }
+     ]
+   }
+ ],
+ "observable_objects":{
+   "0":{
+     "type":"file",
+     "hashes":{
+       "MD5":"4472ea40dc71e5bb701574ea215a81a1"
+     },
+     "size":25536
+   },
+   "1":{
+     "type":"software",
+     "name":"Cuckoo Sandbox",
+     "version":"2.0"
+   },
+   "2":{
+     "type":"software",
+     "name":"Windows 7",
+     "vendor":"Microsoft"
+   },
+   "3":{
+     "type":"software",
+     "name":"Virtualbox",
+     "version":"5.0.40",
+     "vendor":"Oracle"
+   },
+   "4":{
+     "type":"software",
+     "name":"Office 2010",
+     "vendor":"Microsoft",
+     "version":"14.0.4"
+   },
+   "5":{
+     "type":"software",
+     "name":"Java",
+     "vendor":"Oracle",
+     "version":"1.8.0_40"
+   }
+ }
+}
+
    +

    Type Name: analysis-metadata

    + +

    The analysis-metadata type captures metadata associated with the analyses performed on a malware instance, such as the tools used and the analysts who performed the analysis.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    is_automated (required)booleanCaptures whether the analysis was fully automated (i.e., no human analyst in the loop). If this property is set to true, the analysts property MUST NOT be included.
    start_time (optional)timestampCaptures the date/time that the analysis was started.
    end_time (optional)timestampCaptures the date/time that the analysis was completed.
    last_update_time (optional)timestampCaptures the date/time that the analysis was last updated.
    confidence (optional)integerCaptures the relative measure of confidence in the accuracy of the analysis results.  The confidence value MUST be a number in the range of 0-100.
    analysts (optional)list of type stringCaptures the names of analysts who performed the analysis.
    analysis_type (required)open-vocabCaptures the type of analysis performed. The value for this property SHOULD come from the analysis-type-ov vocabulary.
    comments (optional)list of type stringCaptures comments regarding the analysis that was performed. A comment SHOULD be attributable to a specific analyst and SHOULD reflect particular insights of the author that are significant from an analysis standpoint.
    tool_refs (optional)list of type object-refReferences the tools used in the analysis of the Malware Instance. The objects referenced MUST be of STIX Cyber Observable type software and MUST be specified in the observable_objects property of the Package.
    analysis_environment (optional)dictionaryCaptures any metadata, such as the host virtual machine, associated with the analysis environment used to perform the dynamic analysis of the Malware Instance. Each key in the dictionary SHOULD come from the analysis-environment-ov, and each corresponding key value SHOULD be a valid object-ref or list of object-ref. This property MUST NOT be included if analysis_type is set to a value of static.
    description (optional)stringCaptures a textual description of the analysis performed.
    conclusion (optional)open-vocabCaptures the conclusion of the analysis, such as whether the binary was found to be malicious. The value for this property SHOULD come from the analysis-conclusion-ov vocabulary.
    references (optional)list of type external-referenceCaptures any references to reports or other data sources pertaining to the analysis.
    +

    Binary Obfuscation

    +
    +

    Binary Obfuscation

    +
    +
    {
+  "type":"package",
+  "id":"package--2d42dac8-c416-42c6-bc5c-7b6dcf576fc5",
+  "schema_version":"5.0",
+  "maec_objects": [
+     {
+        "type":"malware-instance",
+        "id":"malware-instance--19863c16-503e-493f-8841-16c68e39c26e",
+        "instance_object_refs": ["0"],
+        "static_features": {
+           "obfuscation_methods": [
+              {
+                 "method":"packing",
+                 "layer_order":1,
+                 "packer_name":"UPX"
+              },
+              {
+                 "method":"encryption",
+                 "layer_order":2,
+                 "encryption_algorithm":"XOR"
+              }
+           ]
+        }
+     }
+  ]
+}
+
    +

    Type Name: binary-obfuscation

    + +

    The binary-obfuscation type captures metadata on the methods that a binary may be obfuscated with, such as executable packers or XOR encryption. This includes obfuscation of the entire binary as well as its constituent pieces, such as strings.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    method (required)open-vocabCaptures the method used to obfuscate the binary. The value for this property SHOULD come from the obfuscation-method-ov vocabulary.
    layer_order (optional)integerCaptures the ordering of the obfuscation method with respect to other obfuscation methods (if known), as a positive integer. For example, if a binary was packed and then XOR encrypted, the layer_order property of the packing layer would equal 1 and the layer_order property of the XOR encryption layer would equal 2.
    encryption_algorithm (optional)open-vocabCaptures the name of the encryption algorithm used by the obfuscation method (if applicable). The values for this property SHOULD come from the STIX encryption-algo-ov vocabulary.
    packer_name (optional)stringSpecifies the name of the packer (if applicable).
    packer_version (optional)stringSpecifies the version of the packer (if applicable).
    packer_entry_point (optional)hexSpecifies the entry point address of the packer (if applicable).
    packer_signature (optional)stringSpecifies the matching signature detected for the packer (if applicable).
    +

    Capability

    +
    +

    Capability

    +
    +
    {
+  "type":"package",
+  "id":"package--2d42dac8-c416-42c6-bc5c-7b6dcf576fc5",
+  "schema_version":"5.0",
+  "maec_objects":[
+    {
+      "type":"malware-instance",
+      "id":"malware-instance--19863c16-503e-493f-8841-16c68e39c26e",
+      "instance_object_refs":[
+        "0"
+      ],
+      "labels":[
+        "mass-mailer",
+        "worm"
+      ],
+      "capabilities":[
+        {
+          "name":"persistence",
+          "refined_capabilities":[
+            {
+              "name":"continuous-execution"
+            },
+            {
+              "name":"system-re-infection"
+            }
+          ],
+          "description":"The instance persists after a system reboot.",
+          "attributes":{
+            "persistence-scope":[
+              "self",
+              "other malware/components"
+            ],
+            "technique":"creates registry key"
+          },
+          "behavior_refs":[
+           "behavior--1",
+            "behavior--2"
+          ],
+          "references":[
+            {
+              "source_name":"ATT&CK",
+              "description":"Persistence",
+              "url":"https://attack.mitre.org/wiki/Persistence"
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}
+
    +

    Type Name: capability

    + +

    The capability type captures details of a Capability implemented by a malware instance. A Capability corresponds to a high-level ability that a malware instance possesses, such as persistence or anti-behavioral analysis. Malware Instances and Families may share Capabilities; however, the associated Behaviors implementing the Capabilities will often differ. Therefore, Capabilities are defined inline to Malware Instances and Malware Families rather than as top level objects that are subsequently referenced.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    name (required)open-vocabCaptures the name of the Capability. The values for this property SHOULD come from the capability-ov vocabulary. When used as part of a refined Capability, the values for this property SHOULD come from the refined-capability-ov vocabulary.
    refined_capabilities (optional)list of type capabilityCaptures a refinement of the Capability, recursively using capability type.
    description (optional)stringCaptures a textual description of the Capability.
    attributes (optional)dictionaryCaptures attributes of the Capability as key/value pairs. Each key in the dictionary MUST be a string that captures the name of the attribute and SHOULD come from the common-attribute-ov vocabulary. Each corresponding key value MUST be a string or list of strings that captures the corresponding attribute values.
    behavior_refs (optional)list of type identifierCaptures the IDs of Behaviors that implement the Capability. Each referenced entity MUST be of type behavior and each Behavior MUST be present in the current Package.
    references (optional)list of type external-referenceCaptures external references to ATT&CK Tactics and other entities that may be associated with the Capability.
    +

    Dynamic Features

    +
    +

    Dynamic Features

    +
    +
    {
+  "type":"package",
+  "id": "package--2d42dac8-c416-42c6-bc5c-7b6dcf576fc5",
+  "schema_version":"5.0",
+  "maec_objects": [
+     {
+        "type":"malware-instance",
+        "id":"malware-instance--19863c16-503e-493f-8841-16c68e39c26e",
+        "instance_object_refs": ["0"],
+        "dynamic_features": {
+           "behavior_refs": ["behavior--1", "behavior--2"],
+           "action_refs": ["malware-action--1", "malware-action--2"],
+           "network_traffic_refs": ["4"],
+           "process_tree": [
+             {          
+                 "process_ref":"1",
+                 "ordinal_position":0
+              }
+           ]
+        }
+     },
+     {
+        "type":"behavior",
+        "id":"behavior--1",
+        "name":"persist after system reboot",
+        "description":"System reboot persistence via registry startup",
+        "action_refs": ["malware-action--1"]
+     }
+  ],
+  "observable_objects": {
+     "0": {
+        "type": "file",
+        "hashes": {"MD5": "66e2ea40dc71d5ba701574ea215a81f1"}
+     },
+     "1": {
+        "type": "process",
+        "pid": "1234"
+     },
+     "2": {
+        "type": "process",
+        "pid": "2345"
+    },
+     "3": {
+        "type": "domain-name",
+        "value": "example.com"
+     },
+     "4": {
+        "type": "network-traffic",
+        "dst_ref": "0",
+        "protocols": [
+           "ipv4",
+           "tcp",
+           "http"
+        ]
+     }
+  }
+}
+
    +

    Type Name: dynamic-features

    + +

    The dynamic-features type captures the dynamic features (i.e., those associated with the semantics of the executed code, of a malware instance).

    + +

    Requirements:

    + +
      +
    • At least one of behavior_refs or action_refs or network_traffic_refs or process_tree MUST be included when using this type.
      • +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    behavior_refs (optional)list of type identifierCaptures the IDs of Behaviors exhibited by the Malware Instance. Each referenced entity MUST be of type behavior.
    action_refs (optional)list of type identifierCaptures the IDs of Actions discovered for the Malware Instance. Each referenced entity MUST be of type malware-action. This property is intended for capturing Actions that are discovered through static analysis, reverse engineering, or other methods and therefore MUST NOT be used to reference any of the Actions that are included in the process_tree property. As such, the Actions referenced by this property are mutually exclusive with respect to the Actions referenced by the process_tree property.
    network_traffic_refs (optional)list of type object-refCaptures any network traffic recorded for the Malware Instance. The Object(s) referenced MUST be of STIX Cyber Observable type network-traffic OR artifact (for including binaries of captured traffic such as PCAPs) and MUST be specified in the observable_objects property of the Package.
    process_tree (optional)list of type process-tree-nodeCaptures the Process Tree observed during the execution of the Malware Instance. This property may also capture Actions that are executed by a process and captured by dynamic analysis/sandboxing and therefore MUST NOT be used to reference any of the Actions that are included in the action_refs property. As such, the Actions referenced by this property are mutually exclusive with respect to the Actions referenced by the action_refs property.
    +

    Field Data

    +
    +

    Field Data

    +
    +
    {
+  "type":"package",
+  "id":"package--6864e55f-5f5f-451a-843e-8c66913ae116",
+  "schema_version":"5.0",
+  "maec_objects": [
+     {
+        "type":"malware-family",
+        "id":"malware-family--8ff5814d-0c2e-5601-b8a5-d0032bb03847",
+        "name": {
+           "value": "Cryptolocker",
+           "confidence": 85
+        },
+        "field_data": {
+           "delivery_vectors":["trojanized-link", "downloader"],
+           "first_seen":"2013-09-05T00:00:00Z",
+           "last_seen":"2017-01-05T00:00:00Z"
+        }
+     }
+  ]
+}
+
    +

    Type Name: field-data

    + +

    The field-data type captures field data, such as the time that the malware instance or family was first observed, associated with a malware instance or family.

    + +

    Requirements:

    + +
      +
    • At least one of delivery_vectors or first_seen or last_seen MUST be included when using this type.
      • +
    + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    delivery_vectors (optional)list of type open-vocabCaptures the vectors used to distribute/deploy the Malware Instance. The values for this property SHOULD come from the delivery-vector-ov vocabulary.
    first_seen (optional)timestampCaptures the date/time that the malware instance was first seen by the producer of the Malware Instance Object.
    last_seen (optional)timestampCaptures the date/time that the malware instance was last seen by producer of the Malware Instance Object.
    +

    Malware Development Environment

    +
    +

    Malware Development Environment

    +
    +
    {
+  "type":"package",
+  "id":"package--2f5d32d0-2f41-48a1-b272-fa5f0390dbd3",
+  "schema_version":"5.0",
+  "maec_objects": [
+     {
+        "type":"malware-instance",
+        "id":"malware-instance--90153d4d-092e-1601-b8a5-11312bb0388d",
+        "instance_object_refs":["0"],
+        "name": {
+           "value": "RansomW.cb",
+           "confidence": 20
+        },
+        "static_features": [
+           {
+              "development_environment": [
+                 {
+                    "tool_refs": ["4"]
+                 }
+              ]
+           }
+        ]
+     }
+  ],
+  "observable_objects": {
+     "0": {
+        "type": "file",
+        "hashes": {"MD5": "66e2ea40dc71d5ba701574ea215a81f1"}
+     },
+     "4": {
+        "type":"software",
+        "name":"gcc"
+     }
+  }
+}
+
    +

    Type Name: malware-development-environment

    + +

    The malware-development-environment captures details of the development environment used in developing the malware instance, such as information on any tools that were used.

    + +

    Requirements:

    + +
      +
    • At least one of tool_refs or debugging_file_refs MUST be included when using this type.
      • +
    + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    tool_refs (optional)list of type object-refReferences the tools used in the development of the malware instance. The Objects referenced MUST be of STIX Cyber Observable type software and MUST be specified in the observable_objects property of the Package.
    debugging_file_refs (optional)list of type object-refReferences debugging files associated with the malware instance, such as PDB files. The Objects referenced MUST be of STIX Cyber Observable type file and MUST be specified in the observable_objects property of the Package.
    +

    Name

    +
    +

    Name

    +
    +
    {
+  "type":"package",
+  "id":"package--d7b38d7d-f587-4556-a786-0cd2ee10bf5d",
+  "schema_version":"5.0",
+  "maec_objects": [
+     {
+        "type":"malware-instance",
+        "id":"malware-instance--90153d4d-092e-1601-b8a5-11312bb0388d",
+        "name": {
+           "value": "Conficker.A",
+           "source": {
+              "source_name": "Conficker Threat Intel",
+              "description": "Analysis details of Conficker by Amanda Analyst",
+              "url": "http://www.example.com/threat-report.pdf"
+           },
+           "confidence": 80
+        }
+     }
+  ]
+}
+
    +

    Type Name: name

    + +

    The name type captures the name of a Malware Instance, Malware Family, or alias, as well as the source and relative confidence in the name.

    + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    value (required)stringCaptures the name of the malware instance, family, or alias.
    source (optional)external-referenceCaptures the internal or external source of the value property (i.e., the name).
    confidence (optional)integerCaptures the relative confidence in the accuracy of the assigned name. The confidence value MUST be a number in the range of 0-100.
    +

    Process Tree Node

    +
    +

    Process Tree Node

    +
    +
    {
+  "type":"package",
+  "id": "package--2d42dac8-c416-42c6-bc5c-7b6dcf576fc5",
+  "schema_version":"5.0",
+  "maec_objects": [
+     {
+        "type":"malware-instance",
+        "id":"malware-instance--19863c16-503e-493f-8841-16c68e39c26e",
+        "instance_object_refs": ["0"],
+        "dynamic_features": {
+           "behavior_refs": ["behavior--1", "behavior--2"],
+           "process_tree": [
+              {
+                 "process_ref":"1",
+                 "ordinal_position":0
+               }
+           ]
+        }
+     }
+  ],
+  "observable_objects": {
+     "0": {
+        "type": "file",
+        "hashes": {"MD5": "66e2ea40dc71d5ba701574ea215a81f1"}
+     },
+     "1": {
+        "type": "process",
+        "pid": 1234
+     },
+     "2": {
+        "type": "process",
+        "pid": 2345
+     },
+     "3": {
+        "type": "process",
+        "pid": 5678
+     }
+  }
+}
+
    +

    Type Name: process-tree-node

    + +

    The process-tree-node type captures a single node in a process tree, as recorded for a Malware Instance.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    process_ref (required)object-refReferences the Process Object, contained in the Package, which represents the process and its relevant metadata. The Object referenced MUST be of STIX Cyber Observable type process and MUST be specified in the observable_objects property of the Package.
    parent_action_ref (optional)identifierCaptures the ID of the Action that created or injected the process. The referenced entity MUST be of type malware-action.
    ordinal_position (optional)integerCaptures the ordinal position of the process with respect to the other processes spawned or injected by the malware. This value MUST be a non-negative integer. For specifying the root process of the process tree, a value of 0 MUST be used.
    initiated_action_refs (optional)list of type identifierCaptures the IDs of the Actions initiated by the process. Each referenced entity MUST be of type malware-action.
    +

    Relationship Distance

    +
    +

    Relationship Distance

    +
    +
    {
+  "type":"package",
+  "id":"package--0987dac8-2316-52c6-6fbc-074ef8876fdd",
+  "schema_version":"5.0",
+  "maec_objects": [
+     {
+        "type":"malware-instance",
+        "id":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
+        "instance_object_refs": ["0"]
+     },
+     {
+        "type":"malware-instance",
+        "id":"malware-instance--bacd8340-83bd-94ad-0111-f029304ced90",
+        "instance_object_refs": ["1"]
+     }
+  ],
+  "observable_objects": {
+     "0": {
+        "type":"file",
+        "hashes": {"MD5":"4472ea40dc71e5bb701574ea215a81a1"}
+     },
+     "1": {
+        "type":"file",
+        "hashes": {"MD5":"39C8E9953FE8EA40FF1C59876E0E2F28"}
+     }
+  },
+  "relationships": [
+     {
+        "type":"relationship",
+        "id":"relationship--ffc99c9c-8765-4a36-b416-65dde178b008",
+        "source_ref":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
+        "target_ref":"malware-instance--bacd8340-83bd-94ad-0111-f029304ced90",
+        "relationship_type":"has-distance",
+        "metadata": {
+           "distance": {
+             "distance_score":0.92,
+             "algorithm_name":"clusterAlgorithm-abc",
+             "algorithm_version":"6.1",
+             "metadata":{"foo":"bar"}
+           }
+        }
+     }
+  ]
+}
+
    +

    Type Name: relationship-distance

    + +

    The relationship-distance type captures a distance score and associated metadata between the source and target in a MAEC relationship.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    distance_score (required)floatCaptures the distance score between the source and target in the relationship. This is most commonly represented as a floating point value between zero and one (with a higher value representing a greater distance).
    algorithm_name (optional)stringCaptures the name of the algorithm or tool used in calculating the distance score specified in the distance_score property.
    algorithm_version (optional)stringCaptures the version of the algorithm or tool used in calculating the distance score specified in the distance_score property.
    metadata (optional)dictionarySpecifies a dictionary of additional metadata around the distance score, as a set of key/value pairs. Dictionary keys and their corresponding values MUST be of type string.
    +

    Signature Metadata

    +
    +

    Signature Metadata

    +
    +
    {
+  "type":"package",
+  "id":"package--2d42dac8-c416-42c6-bc5c-7b6dcf576fc5",
+  "schema_version":"5.0",
+  "maec_objects": [
+     {
+        "type":"malware-instance",
+        "id":"malware-instance--19863c16-503e-493f-8841-16c68e39c26e",
+        "instance_object_refs": ["0"],
+        "triggered_signatures": [
+           {
+              "signature_type":"yara",
+              "description":"Ransomware",
+              "author":"John Doe",
+              "reference":{
+                 "url": "http://foo.bar"
+              },
+              "severity":"9.0"
+           },
+           {
+              "signature_type":"cuckoo",
+              "description":"Anti-sandbox sleep",
+              "author":"Jane Doe",
+              "reference":{
+                 "url":"http://bar.foo"
+              },
+              "severity":"5.0"
+           }
+        ]
+     }
+  ]
+}
+
    +

    Type Name: signature-metadata

    + +

    The signature-metadata type captures metadata associated with a signature (for example, a YARA rule) that may have been triggered during the analysis of a malware instance.

    + +

    Requirements:

    + +
      +
    • In addition to signature_type, at least one of the name or description properties MUST be included when using this type.
      • +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    signature_type (optional)stringCaptures the type of the signature, i.e., the language or platform it is written for. For example, “snort”, for the Snort network intrusion detection system (NIDS). The name of the language or platform SHOULD be in lowercase, with any whitespace replaced with dashes (i.e., “-”).
    name (optional)stringCaptures the name provided for the signature (if applicable).
    description (optional)stringCaptures a textual description of the signature.
    author (optional)stringCaptures the name of the author of the signature.
    reference (optional)external-referenceCaptures an external reference associated with the signature.
    severity (optional)stringCaptures a measure of severity associated with the detection of the signature.
    external_id (optional)stringCaptures an external identifier associated with the signature.
    +

    Static Features

    +
    +

    Static Features

    +
    +
    {
+  "type":"package",
+  "id":"package--b7be50bd-6348-4226-bef9-4c3510f698f7",
+  "schema_version":"5.0",
+  "maec_objects": [
+     {
+        "type":"malware-instance",
+        "id":"malware-instance--90153d4d-092e-1601-b8a5-11312bb0388d",
+        "name": {
+           "value": "Malcode.13",
+           "confidence": 50
+        },
+        "static_features": {
+           "strings": ["This string is key.", "This is another string in the instance"],
+           "obfuscation_methods": [
+              {
+                 "method":"packing",
+                 "ordering":1,
+                 "packer_name":"UPX"     
+              },
+              {
+                 "method":"encryption",
+                 "ordering":1,
+                 "encryption_algorithm":"XOR"     
+              }
+           ],
+           "configuration_parameters": [
+              {
+                 "name":"magic-number",
+                 "value":"0x674dfe60abee3234"
+              },
+              {
+                 "name":"directory",
+                 "value":"C:\\Users\\<username>\\Desktop"
+              }
+           ],
+           "development_environment": {
+              "tool_refs": ["4"],
+              "debugging_file_refs": ["6"]
+           }
+        }
+     }
+  ]
+}
+
    +

    Type Name: static-features

    + +

    The static-features type captures features associated with a malware instance (a binary file) not related to the semantics of the code.

    + +

    Requirements:

    + +
      +
    • At least one of strings or obfuscation_methods or certificates or file_headers or configuration_parameters or development_environment properties MUST be included when using this type.
      • +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    strings (optional)list of type stringCaptures any strings that were extracted from the malware instance.
    obfuscation_methods (optional)list of type binary-obfuscationCaptures metadata associated with methods used to obfuscate the malware instance (e.g., packers, encryptors).
    certificates (optional)list of type object-refReferences any software certificates used to sign the malware instance. The Objects referenced MUST be of STIX Cyber Observable type x509-certificate and MUST be specified in the observable_objects property of the Package.
    file_headers (optional)list of type object-refReferences any file headers (e.g., PE file headers) extracted from the malware instance. The Objects referenced MUST be of STIX Cyber Observable type file and MUST be specified in the observable_objects property of the Package.
    configuration_parameters (optional)dictionaryCaptures any configuration parameters specified for the malware instance. Each key in the dictionary MUST be of type string and SHOULD come from the malware-configuration-parameter-ov vocabulary, which is based on the data reported by the Malware Configuration Parser (MWCP) tool developed by the Department of Defense Cyber Crime Center (DC3). Each corresponding key value MUST also be of type string, and should capture the actual value of the configuration parameter.
    development_environment (optional)malware-development-environmentCaptures details of the development environment used to create the malware instance.
    +

    Relationships

    +
    +

    Relationship between Malware Instances ("downloaded-by")

    +
    +
    {
+  "type":"package",
+  "id":"package--0987dac8-2316-52c6-6fbc-074ef8876fdd",
+  "schema_version":"5.0",
+  "maec_objects": [
+     {
+        "type":"malware-instance",
+        "id":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
+        "instance_object_refs": ["0"]
+     },
+     {
+        "type":"malware-instance",
+        "id":"malware-instance--bacd8340-83bd-94ad-0111-f029304ced90",
+        "instance_object_refs": ["1"]
+     }
+  ],
+  "observable_objects": {
+     "0": {
+        "type":"file",
+        "hashes": {"MD5":"4472ea40dc71e5bb701574ea215a81a1"}
+     },
+     "1": {
+        "type":"file",
+        "hashes": {"MD5":"39C8E9953FE8EA40FF1C59876E0E2F28"}
+     }
+  },
+  "relationships": [
+     {
+        "type":"relationship",
+        "id":"relationship--dcc7d8d4-91c0-412a-8d09-a030ab19e0f1",
+        "source_ref":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
+        "target_ref":"malware-instance--bacd8340-83bd-94ad-0111-f029304ced90",
+        "relationship_type":"downloaded-by"
+     }
+  ]
+}
+
    +
    +

    Relationship between Malware Instances ("has-distance")

    +
    +
    {
+  "type":"package",
+  "id":"package--dbd7a6ae-9dfc-48a2-9e6e-bf85f0c8613b",
+  "schema_version":"5.0",
+  "maec_objects": [
+     {
+        "type":"malware-instance",
+        "id":"malware-instance--c90945ec-ea66-4c61-9bd4-72e66aeb464e",
+        "instance_object_refs": ["0"]
+     },
+     {
+        "type":"malware-instance",
+        "id":"malware-instance--ce40a5c7-f3af-4b64-90e2-2884194192ab",
+        "instance_object_refs": ["1"]
+     }
+  ],
+  "observable_objects": {
+     "0": {
+        "type":"file",
+        "hashes": {"MD5":"aafdea40dc71e5bb701574ea215a81a1"}
+     },
+     "1": {
+        "type":"file",
+        "hashes": {"MD5":"3ABCE9953FE8EA40FF1C59876E0E2F28"}
+     }
+  },
+  "relationships": [
+     {
+        "type":"relationship",
+        "id":"relationship--0bc99c9c-8765-4a36-b416-bbdde178b5a4",
+        "source_ref":"malware-instance--c90945ec-ea66-4c61-9bd4-72e66aeb464e",
+        "target_ref":"malware-instance--ce40a5c7-f3af-4b64-90e2-2884194192ab",
+        "relationship_type":"has-distance",
+        "metadata":{"distance":{"distance_score":"0.35",
+                                "algorithm_name":"FooDist"}}
+     }
+  ]
+}
+
    +

    Type Name: relationship

    + +

    The Relationship Object captures relationships between two entities in a MAEC Package. If MAEC TLOs are considered "nodes" or "vertices" in the graph, the Relationship Object represent "edges". Explicit relationships between MAEC Top Level Objects are provided above in the MAEC specification. Note that MAEC relationships cannot be the source or target of another relationship.

    + +

    MAEC defines many relationship types to link together some TLOs. These relationships are contained in the "Relationships" table under each TLO definition. Relationship types defined in the specification SHOULD be used to ensure consistency. An example of a specification-defined relationship is that a malware-instance is downloaded-by a malware-instance. That relationship type is listed in the Relationships section of the Malware Instance TLO definition.

    + +

    MAEC also allows relationships from any TLO to any TLO that have not been defined in the specification. These relationships MAY use the generic related-to relationship type or MAY use a custom relationship type. As an example, a user might want to link malware-instance directly to a collection. They can do so using related-to to say that the Malware is related to the Collection but not describe how, or they could use has-common-artifacts (a custom name they determined) to indicate more detail.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    type (required)stringThe value of this property MUST be relationship.
    id (required)identifierSpecifies a unique ID for the Relationship.
    source_ref (required)identifierSpecifies a reference to the ID of the entity in the MAEC document that corresponds to the source in the source-target relationship. The referenced entity MUST be present in the current Package.
    target_ref (required)identifierSpecifies a reference to the ID of the entity in the MAEC document that corresponds to the target in the source-target relationship. The referenced entity MUST be present in the current Package.
    timestamp (optional)timestampSpecifies a timestamp that states when the relationship was created.
    relationship_type (required)stringSpecifies the type of relationship being expressed. This value SHOULD be an exact value listed in the relationships for the source and target top-level object, but MAY be any string. The value of this field MUST be in ASCII and is limited to characters a–z (lowercase ASCII), 0–9, and dash (-).
    metadata (optional)dictionarySpecifies a dictionary of additional metadata around the relationship. Standard dictionary keys include distance, which is used for capturing any distance-related metadata. The corresponding value for this key MUST be an object of type relationship-distance. Custom entries in the dictionary MAY also be included. Each custom entry MUST have a key of type string and the key MUST be in ASCII and is limited to characters a–z (lowercase ASCII), 0–9, and dash (-). Each custom entry MUST have a key value that is a valid common datatype.
    +

    Common Relationships

    +

    Each MAEC top-level object has its own set of relationship types that are specified in the definition of that TLO. The following common relationship types are defined for all TLOs.

    + + + + + + + + + + + + + + + +
    Relationship TypeSourceTargetDescription
    related-to<MAEC Object><MAEC Object>Asserts a non-specific relationship between two TLOs. This relationship can be used when none of the other predefined relationships are appropriate.
    +

    Relationship Summary

    +

    This relationship summary is provided as a convenience. If there is a discrepancy between this table and the relationships defined with each of the TLOs, then the relationships defined with the TLOs MUST be viewed as authoritative.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    SourceRelationship TypeTarget
    behaviordependent-onbehavior
    behaviordiscovered-bysoftware
    malware-actiondependent-onmalware-action
    malware-actiondiscovered-bysoftware
    malware-familydropped-bymalware-family
    malware-familyderived-frommalware-family
    malware-instanceancestor-ofmalware-instance
    malware-instancehas-distancemalware-instance
    malware-instanceinstalled-bymalware-family
    malware-instanceinstalled-bymalware-instance
    malware-instancederived-frommalware-family
    malware-instancederived-frommalware-instance
    malware-instancevariant-ofmalware-family
    malware-instancevariant-ofmalware-instance
    malware-instancedownloaded-bymalware-family
    malware-instancedownloaded-bymalware-instance
    malware-instancedropped-bymalware-family
    malware-instancedropped-bymalware-instance
    malware-instanceextracted-frommalware-instance
    +

    Package

    +
    +

    Package

    +
    +
    {
+  "type":"package",
+  "id":"package--0987dac8-2316-52c6-6fbc-074ef8876fdd",
+  "schema_version":"5.0",
+  "maec_objects": [
+     {
+        "type":"malware-instance",
+        "id":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
+        "instance_object_refs": ["0"]
+     },
+     {
+        "type":"malware-instance",
+        "id":"malware-instance--bacd8340-83bd-94ad-0111-f029304ced90",
+        "instance_object_refs": ["1"]
+     }
+  ],
+  "observable_objects": {
+     "0": {
+        "type":"file",
+        "hashes": {"MD5":"4472ea40dc71e5bb701574ea215a81a1"}
+     },
+     "1": {
+        "type":"file",
+        "hashes": {"MD5":"39C8E9953FE8EA40FF1C59876E0E2F28"}
+     }
+  },
+  "relationships": [
+     {
+        "type":"relationship",
+        "source_ref":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
+        "target_ref":"malware-instance--bacd8340-83bd-94ad-0111-f029304ced90",
+        "relationship_type":"downloaded-by"
+     }
+  ]
+}
+
    +

    Type Name: package

    + +

    The package is the standard output format that can be used to capture one or more Malware Instances or Malware Families and the entities associated with them: Capabilities, Behaviors, Actions, Cyber Observable Objects, and Collections and Relationships.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    type (required)stringThe value of this property MUST be package.
    id (required)identifierSpecifies the ID for the Package.
    schema_version (required)stringSpecifies the version of the MAEC specification used to represent the content in this Package. The value of this property MUST be 5.0.
    maec_objects (required)list of type <MAEC Object>Specifies MAEC Objects. Objects in this list MUST be valid MAEC Top-level Objects.
    observable_objects (optional)stix-observable-objectsSpecifies a dictionary of STIX Cyber Observable Objects relevant to the MAEC Package. This dictionary MUST contain all Cyber Observable Objects associated with the MAEC Package, including those that are referenced by other Cyber Observable Objects.
    relationships (optional)list of type relationshipSpecifies a set of one or more MAEC Relationships. Each entry in this list MUST be of type relationship.
    +

    STIX Cyber Observable Object Extensions

    AV Classification

    +

    The following are MAEC-specific extensions defined for STIX Cyber Observable Objects used in the context of MAEC.

    + +
    +

    AV Classification

    +
    +
    {
+  "type":"package",
+  "id":"package--e2ea70f1-02af-4560-8712-34e1d138393e",
+  "schema_version":"5.0",
+  "observable_objects": {
+     "0": {
+        "type":"file",
+        "name":"a92e5b2bae.exe",
+        "hashes": {"MD5":"a92e5b2bae0b4b3a3d81c85610b95cd4"},
+        "extensions": {
+           "x-maec-avclass": [
+              {
+                 "scan_date":"2010-05-15T03:38:44Z",
+                 "is_detected":false,
+                 "av_name":"Security Essentials",
+                 "av_vendor":"Microsoft",
+                 "av_engine_version":"4.2.3",
+                 "av_definition_version":"032415-0011"
+              },
+              {
+                 "scan_date":"2010-05-18T12:43:12Z",
+                "is_detected":true,
+                 "classification_name":"Trojan.Zeus",
+                 "av_vendor":"McAfee"
+              }
+           ]
+        }
+     }
+  }
+}
+
    +

    Type Name: x-maec-avclass

    + +

    The x-maec-avclass extension captures information on anti-virus (AV) tool classifications for a particular file. Note that unlike other extensions, the base type of this extension is list, with each entry in the list (of type dictionary) representing a single AV classification. This custom extension MUST only be used in conjunction with the STIX Cyber Observable File Object.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    scan_date (required)timestampCaptures the date and time of the scan. This property can be used to track how scans change over time.
    submission_date (optional)timestampCaptures the date and time that the binary was submitted for scanning.
    is_detected (optional)booleanCaptures whether the AV tool specified in the x-maec-avclass extension has detected the malware instance.
    classification_name (optional)stringCaptures the classification assigned to the malware instance by the AV tool.
    av_name (optional)stringCaptures the name of the AV tool that generated the classification.
    av_vendor (optional)stringCaptures the name of the vendor of the AV tool that generated the classification.
    av_version (optional)stringCaptures the version of the AV tool that generated the classification.
    av_engine_version (optional)stringCaptures the version of the AV engine used by the AV tool that generated the classification.
    av_definition_version (optional)stringCaptures the version of the AV definitions used by the AV tool that generated the classification.
    +

    Common Data Types

    Boolean

    +
    +

    Boolean

    +
    +
    {
+  ...
+  "is_encoded": true,
+  ...
+}
+
    +

    Type Name: boolean

    + +

    A boolean data type has two possible values: true or false.

    + +

    The JSON MTI serialization uses the JSON boolean type, which is a literal (unquoted) true or false.

    +

    Dictionary

    +
    +

    Dictionary

    +
    +
    {
+  ...
+  "attributes": {
+     "file type":"pdf",
+     "encryption algorithm":"rc4"
+  }
+  ...
+}
+
    +

    Type Name: dictionary

    + +

    The dictionary data type captures an arbitrary set of key/value pairs.

    + +

    Requirements:

    + +

    Dictionary keys:

    + +
      +
    • MUST be unique in each dictionary.
      • +
    • MUST be in ASCII.
      • +
    • MUST be limited to the characters a-z (lowercase ASCII), A-Z (uppercase ASCII), numerals 0-9, hyphen (-), and underscore (_).
      • +
    • SHOULD be no longer than 30 ASCII characters in length.
      • +
    • MUST have a minimum length of 3 ASCII characters.
      • +
    • MUST be no longer than 256 ASCII characters in length.
      • +
    • SHOULD be lowercase.
      • +
    + +

    Dictionary values:

    + +
      +
    • MUST be valid common data types.
      • +
    +

    External Reference

    +
    +

    External-reference #1

    +
    +
    {
+  ...
+  "references": [
+     {
+        "source_name": "ACME Threat Intel",
+        "description": "Threat report",
+        "url": "http://www.example.com/threat-report.pdf"
+     }
+  ]
+  ...
+}
+
    +
    +

    External-reference #2

    +
    +
    {
+  ...
+  "references": [
+     {"url":"https://collaborate.mitre.org/maec/index.php/Behavior:45"},
+     {"url":"https://collaborate.mitre.org/maec/index.php/Behavior:45/13"}
+  ]
+  ...
+}
+
    +

    Type Name: external-reference

    + +

    The external-reference data type describes pointers to information represented outside of MAEC. For example, a Malware Instance object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.

    + +

    The JSON MTI serialization uses the JSON object type when representing external-reference.

    + +

    Requirements: In addition to the source_name property, at least one of the description, url, or external_id properties MUST be present.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescription
    source_name (required)stringThe source within which the external-reference is defined (system, registry, organization, etc.).
    description (optional)stringA human readable description.
    url (optional)stringA URL reference to an external resource.
    external_id (optional)stringAn identifier for the external reference content.
    +

    Float

    +
    +

    Float

    +
    +
    {
+  ...
+  "distance": 8.321,
+  ...
+}
+
    +

    Type Name: float

    + +

    The float data type represents an IEEE 754 double-precision number (e.g., a number with a fractional part). However, because the values ±Infinity and NaN are not representable in JSON, they are not valid values in MAEC.

    + +

    In the JSON MTI serialization, floating point values are represented by the JSON number type.

    +

    Hexadecimal

    +
    +

    Hexadecimal

    +
    +
    {
+  ...
+  "file_offset":"0400af88"
+  ...
+}
+
    +

    Type Name: hex

    + +

    The hex data type encodes an array of octets (8-bit bytes) as hexadecimal. The string MUST consist of an even number of hexadecimal characters, which are the digits '0' through '9' and the letters 'a' through 'f'.

    +

    Identifier

    +
    +

    Identifier

    +
    +
    {
+  ...
+  "behaviors": [
+     {
+        "type": "behavior",
+        "id": "behavior--c2f01ec8-42ff-403e-9e76-b4e8a1ffe1b8",
+        "name": "persist after system reboot"
+     }
+  ]
+  ...
+}
+
    +

    Type Name: identifier

    + +

    The identifier data type universally and uniquely identifies a MAEC Top Level Object, Relationship Object, or Package. Identifiers (IDs) MUST follow the form object-type--UUIDv4, where object-type is the exact value (all type names are lowercase strings, by definition) from the type property of the object being identified or referenced and where the UUIDv4 is an RFC 4122-compliant Version 4 UUID. The UUID MUST be generated according to the algorithm(s) defined in RFC 4122, Section 4.4 (Version 4 UUID).

    + +

    The JSON MTI serialization uses the JSON string type when representing identifier.

    +

    Integer

    +
    +

    Integer

    +
    +
    {
+  ...
+  "count": 8,
+  ...
+}
+
    +

    Type Name: integer

    + +

    The integer data type represents a number without any fractional or decimal part. Unless otherwise specified, all integers MUST be capable of being represented as a signed 64-bit value ([-(2**63)+1, (2**63)-1]). Additional restrictions MAY be placed on the type as described where it is used.

    + +

    In the JSON MTI serialization, integers are represented by the JSON number type.

    +

    List

    +
    +

    List

    +
    +
    {
+  ...
+  "action_refs": [
+     "malware-action--c095f1ab-0847-4d89-92ef-010e6ed39c20",
+     "malware-action--80f3f63a-d5c9-4599-b9e4-2a2bd7210736",
+     "malware-action--5643f634-fff9-4b39-34a4-76fed73d0dd6"
+  ],
+  ...
+}
+
    +

    Type Name: list

    + +

    The list data type defines an ordered sequence of values. The phrasing “list of type <type>” is used to indicate that all values within the list MUST conform to the specific type. For instance, list of type integer means that all values of the list must be of the integer type. This specification does not specify the maximum number of allowed values in a list, however every instance of a list MUST have at least one value. Specific MAEC object properties may define more restrictive upper and/or lower bounds for the length of the list.

    + +

    Empty lists are prohibited in MAEC and MUST NOT be used as a substitute for omitting the property if it is optional. If the property is required, the list MUST be present and MUST have at least one value.

    + +

    The JSON MTI serialization uses the JSON array type, which is an ordered list of zero or more values.

    +

    Object Reference

    +
    +

    Object Reference - illustrates the referencing of a malware binary (represented as a STIX Cyber Observable File Object) by a Malware Instance.

    +
    +
    {
+  "type":"package",
+  "id":"package--7892dac8-c416-35c6-bc5c-7b6dcf576f91",
+  "schema_version":"5.0",
+  "maec_objects": [
+     {
+        "type":"malware-instance",
+        "id":"malware-instance--b965814d-0c2e-4e01-b8a5-d8c32bb038e6",
+        "instance_object_refs": ["0"]
+     }
+  ],
+  "observable_objects": {
+     "0": {
+        "type":"file",
+        "hashes":{"MD5":"4472ea40dc71e5bb701574ea215a81a1"},
+        "size":25536
+     }
+  }
+}
+
    +

    Type Name: object-ref

    + +

    The object-ref data type specifies a reference to a STIX Observable Object captured in the MAEC Package observable_objects property (stix-observable-objects). The reference MUST be valid within the scope of the local Package and MUST reference a STIX Cyber Observable of one of the following types:

    + +
      +
    • artifact
      • +
    • autonomous-system
      • +
    • directory
      • +
    • domain-name
      • +
    • email-addr
      • +
    • email-message
      • +
    • file
      • +
    • ipv4-addr
      • +
    • ipv6-addr
      • +
    • mac-addr
      • +
    • network-traffic
      • +
    • process
      • +
    • software
      • +
    • url
      • +
    • user-account
      • +
    • windows-registry-key
      • +
    • x509-certificate
      • +
    +

    Observable Objects

    +
    +

    Observable Object - illustrates the capture of a STIX Network Traffic Object and an associated IPv4 Address Object.

    +
    +
    {
+ "0": {
+   "type": "ipv4-addr",
+   "value": "198.51.100.2"
+ },
+ "1": {
+   "type": "network-traffic",
+   "dst_ref": "0"
+ }
+}
+
    +

    Type Name: stix-observable-objects

    + +

    The stix-observable-objects data type is a dictionary (see the dictionary data type) where the keys are used as references to the values, which are STIX Observable Objects. Each key in the dictionary SHOULD be a non-negative monotonically increasing integer, starting at the value 0 and incrementing by 1, and represented as a string within the JSON MTI serialization. However, implementers MAY elect to use an alternate key format.

    +

    Open Vocabulary

    +
    +

    Example using a value from an open vocabulary +json +{ + ... + "structural_features": { + "name":"code-compression", + ... + } + ... +} +

    + +

    Example using a custom value +json +{ + ... + "structural_features": { + "name":"some-odd-code-obfuscation", + ... + } + ... +} +

    +
    + +

    Type Name: open-vocab

    + +

    The open-vocab data type is represented as a string. For properties that use this type, there will be a list of suggested values to define the property (see Vocabularies). The value of the property SHOULD be chosen from the open vocabulary but MAY be any other string value. Values that are not from the open vocabulary SHOULD be all lowercase (where lowercase is defined by the locality conventions) and SHOULD use hyphens instead of spaces or underscores as word separators.

    + +

    A consumer that receives MAEC content with one or more open-vocab terms not defined in the open vocabulary MAY ignore those values.

    + +

    The JSON MTI serialization uses the JSON string type when representing open-vocab.

    +

    String

    +
    +

    String

    +
    +
    {
+  ...
+  "name":"add-windows-hook",
+  ...
+}
+
    +

    Type Name: string

    + +

    The string data type represents a finite-length string of valid characters from the Unicode coded character set. Unicode incorporates ASCII and the characters of many other international character sets.

    + +

    The JSON MTI serialization uses the JSON string type, which mandates the UTF-8 encoding for supporting Unicode.

    +

    Timestamp

    +
    +

    Timestamp

    +
    +
    {
+  ...
+  "submission_date": "2016-01-20T12:31:12.12345Z",
+  ...
+}
+
    +

    Type Name: timestamp

    + +

    The timestamp data type defines how timestamps are represented in MAEC.

    + +

    The JSON MTI serialization uses the JSON string type when representing timestamp.

    + +

    Requirements:

    + +
      +
    • A timestamp property MUST be a valid RFC 3339-formatted timestamp using the format YYYY-MM-DDTHH:mm:ss[.s+]Z where the “s+” represents 1 or more sub-second values. The brackets denote that subsecond precision is optional, and that if no digits are provided, the decimal place MUST NOT be present.
      • +
    • A timestamp MUST be represented in the UTC timezone and MUST use the “Z” designation to indicate this.
      • +
    +

    Vocabularies

    Analysis Conclusions

    +

    Vocabulary Name: analysis-conclusion-ov

    + +

    The Analysis Conclusion vocabulary is used by the following object/property:

    + +
      +
    • Malware Instance --> analysis_metadata --> conclusion
      • +
    + +

    This vocabulary is an enumeration of conclusions resulting from the analysis of a malware instance.

    + + + + + + + + + + + + + + + + + + + + + + + +
    ValueDescription
    benignAs a conclusion of the analysis, the malware instance was determined to be benign.
    maliciousAs a conclusion of the analysis, the malware instance was determined to be malicious.
    suspiciousAs a conclusion of the analysis, the malware instance was determined to be suspicious.
    indeterminateThe conclusion of the analysis was indeterminate.
    +

    Analysis Environment

    +

    Vocabulary Name: analysis-environment-ov

    + +

    The Analysis Environment vocabulary is currently used by the following object/property:

    + +
      +
    • Malware Instance --> analysis_metadata --> analysis_environment
      • +
    + +

    This vocabulary is an enumeration of properties associated with the environment used in malware analysis.

    + + + + + + + + + + + + + + + + + + + +
    ValueDescription
    operating-systemThe operating system used for the dynamic analysis of the malware instance. This applies to virtualized operating systems as well as those running on bare metal. The corresponding value for this entry MUST be of type object-ref and the referenced STIX Cyber Observable Object MUST be of type software.
    host-vmThe virtual machine used to host the guest operating system (if applicable) used for the the dynamic analysis of the malware instance. If this value is not included in conjunction with operating-system, this means that the dynamic analysis was performed on bare metal (i.e., without virtualization). The corresponding value for this entry MUST be of type object-ref and the referenced STIX Cyber Observable Object MUST be of type software.
    installed-softwareAny non-standard software installed on the operating system (specified through the operating-system value) used for the dynamic analysis of the malware instance. The corresponding value for this entry MUST be of type list and each STIX Cyber Observable Object(s) referenced in the list MUST be of type software.
    +

    Analysis Types

    +

    Vocabulary Name: analysis-type-ov

    + +

    The Analysis Type open vocabulary is used by the following object/property:

    + +
      +
    • Malware Instance --> analysis_metadata --> analysis_type
      • +
    + +

    This vocabulary is an enumeration of malware analysis types.

    + + + + + + + + + + + + + + + + + + + +
    ValueDescription
    staticStatic malware analysis, achieved by inspecting but not executing the malware instance. For example, inspection can be done by studying memory dumps captured after the instance is run.
    dynamicDynamic malware analysis, achieved by executing the malware instance (e.g., in a sandbox) and recording its behavior.
    combinationA combination of dynamic and static malware analysis, achieved by both inspecting and executing the malware instance.
    +

    Behaviors

    +

    Vocabulary Name: behavior-ov

    + +

    The Behavior open vocabulary is used in the following object/property:

    + +
      +
    • Behavior --> name
      • +
    + +

    This vocabulary is a non-exhaustive enumeration of malware behaviors.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ValueDescription
    access-premium-serviceAccesses a premium service, such as a premium SMS service.
    autonomous-remote-infectionInfects a remote machine autonomously, without the involvement of any end user (e.g., through the exploitation of a remote procedure call vulnerability).
    block-security-websitesPrevents access from the system on which the malware instance is executing to one or more security vendor or security-related websites.
    capture-camera-inputCaptures data from a system's camera, including from embedded cameras (i.e. on mobile devices) and/or attached webcams.
    capture-file-system-dataCaptures data from a file system.
    capture-gps-dataCaptures GPS data from the system on which the malware instance is executing.
    capture-keyboard-inputCaptures data from the keyboard attached to the system on which the malware instance is running.
    capture-microphone-inputCapture data from a system's microphone, including from embedded microphones (i.e. on mobile devices) and those that may be attached externally.
    capture-mouse-inputCaptures data from a system's mouse.
    capture-printer-outputCaptures data sent to a system's printer, either locally or remotely.
    capture-system-memoryCaptures data from a system's RAM.
    capture-system-network-trafficCaptures network traffic from the system on which the malware instance is executing.
    capture-system-screenshotCaptures images of what is currently being displayed on a system's screen, either locally (i.e. on a display) or remotely via a remote desktop protocol.
    capture-touchscreen-inputCaptures data from a system's touchscreen.
    check-for-payloadQueries a command and control server to check whether a new payload is available for download.
    check-languageChecks the language of the host system on which it executes.
    click-fraudSimulates legitimate user clicks on website advertisements for the purpose of revenue generation.
    compare-host-fingerprintsCompares a previously computed host fingerprint to one computed for the current system on which the malware instance is executing, to determine if the malware instance is still executing on the same system.
    compromise-remote-machineGains control of a remote machine through compromise, e.g., by exploiting a particular vulnerability.
    control-local-machine-via-remote-commandControls the machine on which the malware instance is executing, through one or more remotely sent commands.
    control-malware-via-remote-commandExecutes commands issued to the malware instance from a remote source such as a command and control server, for the purpose of controlling its behavior.
    crack-passwordsConsumes system resources for the purpose of password cracking.
    defeat-call-graph-generationDefeats accurate call graph generation during disassembly of the malware instance.
    defeat-emulatorDefeats or prevents the execution of the malware instance in an emulator.
    defeat-flow-oriented-disassemblerDefeats disassembly of the malware instance in a flow-oriented (recursive traversal) disassembler.
    defeat-linear-disassemblerPrevents the disassembly of the malware instance in a linear disassembler.
    degrade-security-programDegrades one or more security programs running on a system, either by stopping them from executing or by making changes to their code or configuration parameters.
    denial-of-serviceCauses the local machine on which the malware instance is executing and/or a remote network resource to be unavailable.
    destroy-hardwarePhysically destroys a piece of hardware, e.g., by causing it to overheat.
    detect-debuggingDetects whether the malware instance is being executed inside of a debugger.
    detect-emulatorDetects whether the malware instance is being executed inside of an emulator.
    detect-installed-analysis-toolsIndicates that the malware instance attempts to detect whether certain analysis tools are present on the system on which it is executing.
    detect-installed-av-toolsIndicates that the malware instance attempts to detect whether certain anti-virus tools are present on the system on which it is executing.
    detect-sandbox-environmentDetects whether the malware instance is being executed in a sandbox environment.
    detect-vm-environmentDetects whether the malware instance is being executed in a virtual machine (VM).
    determine-host-ip-addressDetermines the IP address of the host system on which the malware instance is executing.
    disable-access-rights-checkingBypasses, disables, or modifies access tokens or access control lists, thereby enabling the malware instance to read, write, or execute a file with one or more of these controls set.
    disable-firewallEvades or disables the host-based firewall running on the system on which the malware instance is executing.
    disable-kernel-patch-protectionBypasses or disables kernel patch protection mechanisms such as Windows' PatchGuard, enabling the malware instance to operate at the same level as the operating system kernel and kernel mode drivers (KMD).
    disable-os-security-alertsDisables operating system (OS) security alert messages that could lead to identification and/or notification of the presence of the malware instance.
    disable-privilege-limitingBypasses or disables mechanisms that limit the privileges that can be granted to a user or entity.
    disable-service-pack-patch-installationDisables the system's ability to install service packs and/or patches.
    disable-system-file-overwrite-protectionDisables system file overwrite protection mechanisms such as Windows file protection, thereby enabling system files to be modified or replaced.
    disable-update-services-daemonsDisables system update services or daemons that may be already be running on the system on which the malware instance is executing.
    disable-user-account-controlBypasses or disables Windows' user account control (UAC), enabling the malware instance and/or its component to execute with elevated privileges.
    drop-retrieve-debug-log-fileGenerates and retrieves a log file of errors relating to the execution of the malware instance.
    elevate-privilegeElevates the privilege level under which the malware instance is executing.
    encrypt-dataEncrypts data that will be exfiltrated.
    encrypt-filesEncrypts one or more files on the system on which the malware instance is executing, to make them unavailable for use by the users of the system.
    encrypt-selfEncrypts the executing code (in memory) that belongs to the malware instance.
    erase-dataDestroys data stored on a disk or in memory by erasure.
    evade-static-heuristicEvades a static anti-virus heuristic. For example, an heuristic engine can try to figure out if a file are using a dual extension (e.g: invoice.doc.exe) and determine the file as being malicious.
    execute-before-external-to-kernel-hypervisorExecutes some or all of the malware instance's code before or external to the system's kernel or hypervisor (e.g., through the BIOS).
    execute-non-main-cpu-codeExecutes some or all of the code of the malware instance on a secondary, non-CPU processor (e.g., a GPU).
    execute-stealthy-codeExecutes code in a hidden manner (e.g., by injecting it into a benign process).
    exfiltrate-data-via-covert channelExfiltrates data using a covert channel, such as a DNS tunnel or NTP.
    exfiltrate-data-via- -dumpster-diveExfiltrates data via dumpster dive - i.e, encoded data printed by malware is viewed as garbage and thrown away to then be physically picked up.
    exfiltrate-data-via-faxExfiltrates data using a fax system.
    exfiltrate-data-via-networkExfiltrates data through the computer network connected to the system on which the malware instance is executing.
    exfiltrate-data-via-physical-mediaExfiltrates data by writing it to physical media (e.g., to a USB flash drive).
    exfiltrate-data-via-voip-phoneExfiltrates data (encoded as audio) using a phone system, such as through voice over IP (VoIP).
    feed-misinformation-during-physical-memory-acquisitionReports inaccurate data when the contents of the physical memory of the system on which the malware instance is executing is retrieved.
    file-system-instantiationIndicates that the malware instance instantiates itself on the file system of the machine that it is infecting, in one or more locations.
    fingerprint-hostCreates a unique fingerprint for the system on which the malware instance is executing, e.g., based on the applications that are installed on the system.
    generate-c2-domain-namesGenerates the domain name of the command and control server to which the malware connects to.
    hide-arbitrary-virtual-memoryHides arbitrary segments of virtual memory belonging to the malware instance in order to prevent their retrieval.
    hide-data-in-other-formatsHides data that will be exfiltrated in other formats (e.g., image files).
    hide-file-system-artifactsHides one or more file system artifacts (e.g., files and/or directories) associated with the malware instance.
    hide-kernel-modulesHides the usage of any kernel modules by the malware instance.
    hide-network-trafficHides network traffic associated with the malware instance.
    hide-open-network-portsHides one or more open network ports associated with the malware instance.
    hide-processesHides one or more of the processes in which the malware instance is executing.
    hide-registry-artifactsHides one or more Windows registry artifacts (e.g., keys and/or values) associated with the malware instance.
    hide-servicesHides any system services that the malware instance creates or injects itself into.
    hide-threadsHides one or more threads that belong to the malware instance.
    hide-userspace-librariesHides the usage of userspace libraries by the malware instance.
    identify-fileIdentifies one or more files on a local, removable, and/or network drive for infection.
    identify-osIdentifies the operating system under which the malware instance is executing.
    identify-target-machinesIdentifies one or more machines to be targeted for infection via some remote means (e.g., via email or the network).
    impersonate-userImpersonates another user in order to operate within a different security context.
    install-backdoorInstalls a backdoor on the system on which the malware instance is executing, capable of providing covert remote access to the system.
    install-legitimate-softwareInstalls legitimate (i.e. non-malware) software on the same system on which the malware instance is executing.
    install-secondary-malwareInstalls another, different malware instance on the system on which the malware instance is executing.
    install-secondary-moduleInstalls a secondary module (typically related to the malware instance itself) on the same system on which the malware instance is executing.
    intercept-manipulate-network-trafficIntercepts and/or manipulates network traffic going to or originating from the system on which the malware instance is executing.
    inventory-security-productsCreates an inventory of the security products installed or running on a system.
    inventory-system-applicationsInventories the applications installed on the system on which the malware instance is executing.
    inventory-victimsKeeps an inventory of the victims that are remotely infected by the malware instance.
    limit-application-type-versionLimits the type or version of an application that runs on a system in order to ensure that the malware instance is able to continue executing.
    log-activityLogs the activity of the malware instance.
    manipulate-file-system-dataManipulates data stored on the file system of the system on which the malware instance is executing in order to compromise its integrity.
    map-local-networkMaps the layout of the local network environment in which the malware instance is executing.
    mine-for-cryptocurrencyConsumes system resources for cryptocurrency (e.g., Bitcoin, Litecoin, etc.) mining.
    modify-fileModifies a file in some other manner than writing code to it, such as packing it (in terms of binary executable packing).
    modify-security-software-configurationModifies the configuration of one or more instances of security software (e.g., anti-virus) running on a system in order to negatively impact their usefulness and ability to detect the malware instance.
    move-data-to-staging-serverMoves data to be exfiltrated to a particular server, to prepare it for exfiltration.
    obfuscate-artifact-propertiesHides the properties of one or more artifacts associated with the malware instance (e.g., by altering file system timestamps).
    overload-sandboxOverloads a sandbox (e.g., by generating a flood of meaningless behavioral data).
    package-dataPackages data for exfiltration, e.g., by adding it to an archive file.
    persist-after-hardware-changesContinues the execution of the malware instance after hardware changes to the system on which it is executing have been made, such as replacement of the hard drive on which the operating system was residing.
    persist-after-os-changesContinues the execution of the malware instance after the operating system under which it is executing is modified, such as being installed or reinstalled.
    persist-after-system-rebootContinues the execution of the malware instance after a system reboot.
    prevent-api-unhookingPrevents the API hooks installed by the malware instance from being removed.
    prevent-concurrent-executionChecks to see if it is already running on a system, in order to prevent multiple instances of the malware running concurrently.
    prevent-debuggingPrevents the execution of the malware instance in a debugger.
    prevent-file-accessPrevents access to the file system, including to specific files and/or directories associated with the malware instance.
    prevent-file-deletionPrevents files and/or directories associated with the malware instance from being deleted from a system.
    prevent-memory-accessPrevents access to system memory where the malware instance may be storing code or data.
    prevent-native-api-hookingPrevents other software from hooking native system APIs.
    prevent-physical-memory-acquisitionPrevents the contents of the physical memory of the system on which the malware instance is executing from being retrieved.
    prevent-registry-accessPrevents access to the Windows registry, including to the entire registry and/or to particular registry keys/values.
    prevent-registry-deletionPrevent Windows registry keys and/or values associated with the malware instance from being deleted from a system.
    prevent-security-software- -from-executingPrevents one or more instances of security software from executing on a system.
    re-instantiate-selfRe-establishes the malware instance on the system after it is initially detected and partially removed.
    remove-selfRemoves the malware instance from the system on which it is executing.
    remove-sms-warning-messagesCaptures the message body of incoming SMS messages and aborts displaying messages that meets a certain criteria.
    remove-system-artifactsRemoves artifacts associated with the malware instance (e.g., files, directories, Windows registry keys, etc.) from the system on which it is executing.
    request-email-address-listRequests the current list of email addresses, for sending email spam messages to, from the command and control server.
    request-email-templateRequests the current template, for use in generating email spam messages, from the command and control server.
    search-for-remote-machinesSearches for one or more remote machines to target.
    send-beaconSends 'beacon' data to a command and control server, indicating that the malware instance is still active on the host system and able to communicate.
    send-email-messageSends an email message from the system on which the malware instance is executing to one or more recipients, most commonly for the purpose of spamming.
    send-system-informationSends data regarding the system on which it is executing to a command and control server.
    social-engineering-based-remote-infectionInfects remote machines via some method that involves social engineering (e.g., sending an email with a malicious attachment).
    steal-browser-cacheSteals a user's browser cache.
    steal-browser-cookiesSteals one or more browser cookies stored on the system on which the malware instance is executing.
    steal-browser-historySteals a user's browser history.
    steal-contact-list-dataSteals a user's contact list.
    steal-cryptocurrency-dataSteals cryptocurrency data that may be stored on a system (e.g., Bitcoin wallets).
    steal-database-contentSteals content from a database that the malware instance may be able to access.
    steal-dialed-phone-numbersSteals the list of phone numbers that a user has dialed (i.e. on a mobile device).
    steal-digital-certificatesSteals one or more digital private keys that may be present on the system on which the malware instance is executing, to then use to hijack the corresponding digital certificates, e.g., those used in public-key infrastructure (PKI).
    steal-documentsSteals document files (e.g., PDF) stored on a system.
    steal-email-dataSteals a user's email data.
    steal-imagesSeals image files that may be stored on a system.
    steal-password-hashesSteals password hashes.
    steal-pki-keySteals one or more public key infrastructure (PKI) keys.
    steal-referrer-urlsSteals HTTP referrer information (URL of the webpage that linked to the resource being requested).
    steal-serial-numbersSteals serial numbers stored on a system.
    steal-sms-databaseSteals a user's short message service (SMS) (text messaging) database (i.e. on a mobile device).
    steal-web-network-credentialSteals usernames, passwords, or other forms of web (e.g., for logging into a website) and/or network credentials.
    stop-execution-of-security-softwareStops the execution of one or more instances of security software that may already be executing on a system.
    suicide-exitTerminates the execution of the malware instance based on some trigger condition or value.
    test-for-firewallTests whether the network environment in which the malware instance is executing contains a hardware or software firewall.
    test-for-internet-connectivityTests whether the network environment in which the malware instance is executing is connected to the internet.
    test-for-network-drivesTests for network drives that may be present in the network environment in which the malware instance is executing.
    test-for-proxyTests whether the network environment in which the malware instance is executing contains a hardware or software proxy.
    test-smtp-connectionTests whether an outgoing SMTP connection can be made from the system on which the malware instance is executing to some SMTP server, by sending a test SMTP transaction.
    update-configurationUpdates the configuration of the malware instance using data received from a command and control server.
    validate-dataValidates the integrity of data received from a command and control server.
    write-code-into-fileWrites code into one or more files.
    +

    Capabilities

    +

    Vocabulary Name: capability-ov

    + +

    The Malware Capability open vocabulary is used in the following object/property:

    + +
      +
    • Capability --> name
      • +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ValueDescription
    anti-behavioral-analysisIndicates that the malware instance or family is able to prevent behavioral analysis or make it more difficult.
    anti-code-analysisIndicates that the malware instance or family is able to prevent code analysis or make it more difficult.
    anti-detectionIndicates that the malware instance or family is able to prevent itself and its components from being detected on a system.
    anti-removalIndicates that the malware instance or family is able to prevent itself and its components from being removed from a system.
    availability-violationIndicates that the malware instance or family is able to compromise the availability of a system or some aspect of the system.
    collectionIndicates that the malware instance or family is able to capture information from a system related to user or system activity (e.g., from a system's peripheral devices).
    command-and-controlIndicates that the malware instance or family is able to receive and/or execute remotely submitted commands.
    data-theftIndicates that the malware instance or family is able to steal data from the system on which it executes. This includes data stored in some form, e.g. in a file, as well as data that may be entered into some application such as a web-browser.
    destructionIndicates that the malware instance or family is able to destroy some aspect of a system.
    discoveryIndicates that the malware instance or family is able to probe its host system or network environment; most often this is done to support other Capabilities and their Objectives.
    exfiltrationIndicates that the malware instance or family is able to exfiltrate stolen data or perform tasks related to the exfiltration of stolen data.
    fraudIndicates that the malware instance or family is able to defraud a user or a system.
    infection-propagationIndicates that the malware instance or family is able to propagate through the infection of a machine or is able to infect a file after executing on a system. The malware instance may infect actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email). This Capability does not encompass any aspects of the initial infection that is done independently of the malware instance itself.
    integrity-violationIndicates that the malware instance or family is able to compromise the integrity of a system.
    machine-access-controlIndicates that the malware instance or family is able to access or control one or more remote machines and/or the machine on which it is executing.
    persistenceIndicates that the malware instance or family is able to persist and remain on a system regardless of system events.
    privilege-escalationIndicates that the malware instance or family is able to elevate the privileges under which it executes.
    secondary-operationIndicates that the malware instance or family is able to achieve secondary objectives in conjunction with or after achieving its primary objectives.
    security-degradationIndicates that the malware instance or family is able to bypass or disable security features and/or controls.
    +

    Common Attributes

    +

    Vocabulary Name: common-attribute-ov

    + +

    The Common Attribute open vocabulary is used in the following objects/properties:

    + +
      +
    • Capability --> attributes
      • +
    • Behavior --> attributes
      • +
    + +

    This vocabulary is a non-exhaustive enumeration of common attributes associated with Capabilities or Behaviors of a Malware Instance or Malware Family.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ValueDescription
    applicable-platformCaptures the name of a targeted platform.
    archive-typeCaptures the name of a file archive format used.
    autonomyCaptures the level of autonomy used.
    backdoor-typeCaptures the type of backdoor used.
    cryptocurrency-typeCaptures a cryptocurrency targeted.
    encryption-algorithmCaptures the encryption algorithm used.
    erasure-scopeCaptures the scope of the erasure performed.
    file-infection-typeCaptures the method that an executable infector uses to infect a file.
    file-modification-typeCaptures how a malware file modifies itself to avoid detection.
    file-typeCaptures the type of file format used for storing data to be exfiltrated.
    frequency"Captures the frequency with which a C2 Server sends and receives data.
    infection-targeting"Captures the type of targeting employed, e.g., whether the targeted machines are randomly selected, or chosen from some particular set.
    network-protocol"Captures the name of the network protocol used in command and control communications.
    port-numberCaptures the port number used in command and control communications.
    persistence-scopeCaptures the scope of persistence employed.
    propagation-scope"Captures the scope of the infection or propagation performed, i.
    targeted-applicationCaptures the names of any targeted applications.
    targeted-file-architecture typeCaptures the types of file architectures targeted.
    targeted-file-typeCaptures the types of files targeted.
    targeted-programCaptures the names of any targeted programs.
    targeted-sandboxCaptures the names of any sandboxes targeted.
    targeted-vmCaptures the names of any virtual machines (VM) targeted.
    targeted-websiteCaptures the domain names of any targeted websites.
    techniqueCaptures the name of the technique used.
    trigger-typeCaptures the trigger used to wake or terminate the malware instance.
    user-privilege-escalation typeCaptures the type of user privilege escalation employed.
    vulnerability-id-cveCaptures the Common Vulnerabilities and Exposures (CVE) vulnerability identifier being referenced.
    vulnerability-id-osvdbCaptures the vulnerability identifier of the Open Source Vulnerability Database (OSVDB) entry being referenced.
    +

    Delivery Vectors

    +

    Vocabulary Name: delivery-vector-ov

    + +

    The Delivery Vector open vocabulary is used in the following objects/properties:

    + +
      +
    • Malware Instance --> field_data --> delivery_vectors
      • +
    • Malware Family --> field_data --> delivery_vectors
      • +
    + +

    This vocabulary is a non-exhaustive enumeration of vectors used to deliver malware.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ValueDescription
    active-attackerThe malware instance or family was delivered via an active attacker.
    auto-executing-mediaThe malware instance or family was delivered via media that automatically executes.
    downloaderThe malware instance or family was delivered via downloader.
    dropperThe malware instance or family was delivered via dropper.
    email-attachmentThe malware instance or family was delivered via email attachment.
    exploit-kit-landing-pageThe malware instance or family was delivered via an exploit kit landing page.
    fake-websiteThe malware instance or family was delivered via a fake website.
    janitor-attackThe malware instance or family was delivered via a janitor attack.
    malicious-iframesThe malware instance or family was delivered via malicious iframes.
    malvertisingThe malware instance or family was delivered via malvertising.
    media-baitingThe malware instance or family was delivered via media baiting.
    pharmingThe malware instance or family was delivered via pharming.
    phishingThe malware instance or family was delivered via phishing.
    trojanized-linkThe malware instance or family was delivered via a trojanized link.
    trojanized-softwareThe malware instance or family was delivered via trojanized software.
    usb-cable-syncingThe malware instance or family was delivered via usb cable syncing.
    watering-holeThe malware instance or family was delivered via a watering hole.
    +

    Entity Associations

    +

    Vocabulary Name: entity-association-ov

    + +

    The Entity Association open vocabulary is used in the following object/property:

    + +
      +
    • Collection --> association_type
      • +
    + +

    This vocabulary is an non-exhaustive enumeration of entity association types relevant to MAEC entities and STIX Cyber Observables.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ValueDescription
    file-system-entitiesThe collection contains Cyber Observable Objects that correspond to file system entities.
    network-entitiesThe collection contains Cyber Observable Objects that correspond to network entities.
    process-entitiesThe collection contains Cyber Observable Objects that correspond to process entities.
    memory-entitiesThe collection contains Cyber Observable Objects that correspond to memory entities.
    ipc-entitiesThe collection contains Cyber Observable Objects that correspond to inter-process communication (IPC) entities.
    device-entitiesThe collection contains Cyber Observable Objects that correspond to device entities.
    registry-entitiesThe collection contains Cyber Observable Objects that correspond to registry entities.
    service-entitiesThe collection contains Cyber Observable Objects that correspond to service entities.
    potential-indicatorsThe collection contains entities that serve as potential indicators.
    same-malware-familyThe collection contains that Malware Instances are from the same malware family.
    clustered-togetherThe collection contains Malware Instances that have been clustered together by some method such as a scoring algorithm.
    observed-togetherThe collection contains Malware Instances that have been observed together.
    same-malware-toolkitThe collection contains Malware Instances that are derived from the same malware toolkit.
    +

    Malware Actions

    +

    Vocabulary Name: malware-action-ov

    + +

    The Malware Action open vocabulary is used in the following object/property:

    + +
      +
    • Malware Action --> name
      • +
    + +

    This vocabulary is a non-exhaustive enumeration of Actions that may be performed by a Malware Instance.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ValueDescription
    accept-socket-connectionThe action of accepting a socket connection.
    add-connection-to-network-shareThe action of adding a connection to a network share.
    add-network-shareThe action of adding a new network share on a server.
    add-scheduled-taskThe action of adding a scheduled task to a system.
    add-system-call-hookThe action of adding a new system call hook.
    add-user-to-groupThe action of adding an existing user to a group.
    add-userThe action of adding a new user.
    add-windows-hookThe action of adding a new Windows application-defined hook procedure.
    allocate-process-virtual-memoryThe action of allocating a virtual memory region in an existing process.
    bind-address-to-socketThe action of binding a socket address to a socket.
    call-library-functionThe action of calling a function exported by a library.
    change-passwordThe action of changing a user’s password.
    check-for-kernel-debuggerThe action of checking for the presence of a kernel debugger.
    check-for-remote-debuggerThe action of checking for the presence of a remote debugger.
    close-fileThe action of closing an existing file previously opened for reading or writing.
    close-portThe action of closing a network port.
    close-registry-keyThe action of closing a handle to an existing registry key.
    close-socketThe action of closing a socket.
    connect-to-ftp-serverThe action of connecting to an ftp server.
    connect-to-ip-addressThe action of connecting to an IP address.
    connect-to-irc-serverThe action of connecting to an IRC server.
    connect-to-named-pipeThe action of connecting to a named pipe.
    connect-to-network-shareThe action of connecting to a network share.
    connect-to-socket-addressThe action of connecting to a socket address.
    connect-to-socket"The action of connecting to a socket, which consists of an IP address and port number.
    connect-to-urlThe action of connecting to a URL.
    copy-fileThe action of copying a file from one location to another.
    create-critical-sectionThe action of creating a new critical section.
    create-dialog-boxThe action of creating a new dialog box.
    create-directoryThe action of creating a new directory.
    create-eventThe action of creating a new event.
    create-file-alternate-data-streamThe action of creating a new file alternate data stream in a file.
    create-file-mappingThe action of creating a new file mapping object.
    create-file-symbolic-linkThe action of creating a new symbolic link to a file.
    create-fileThe action of creating a new file.
    create-mailslotThe action of creating a new mailslot.
    create-mutexThe action of creating a new mutex.
    create-named-pipeThe action of creating a new named pipe.
    create-process-as-userThe action of creating a new process as a particular user.
    create-processThe action of creating a new process.
    create-registry-key-valueThe action of creating a new registry key value.
    create-registry-keyThe action of creating a new registry key.
    create-remote-thread-in-processThe action of creating a new thread that runs in the virtual address space of another process.
    create-semaphoreThe action of creating a new named semaphore.
    create-serviceThe action of creating a new service.
    create-socketThe action of creating a new socket.
    create-threadThe action of creating a new thread.
    create-windowThe action of creating a new window.
    delete-critical-sectionThe action of deleting a critical section object.
    delete-directoryThe action of deleting a directory on a filesystem.
    delete-eventThe action of deleting a named event object.
    delete-fileThe action of deleting a file.
    delete-mutexThe action of deleting a named mutex.
    delete-named-pipeThe action of deleting a named pipe.
    delete-network-shareThe action of deleting a network share on a server.
    delete-registry-key-valueThe action of deleting a named value under an existing registry key.
    delete-registry-keyThe action of deleting a registry key.
    delete-semaphoreThe action of deleting a named semaphore.
    delete-serviceThe action of deleting a service.
    delete-userThe action of deleting a user.
    disconnect-from-ftp-serverThe action of disconnecting from a FTP server.
    disconnect-from-ipThe action of disconnecting from a previously established connection to an IP address.
    disconnect-from-irc-serverThe action of disconnecting from an IRC server.
    disconnect-from-named-pipeThe action of disconnecting from a named pipe.
    disconnect-from-network-shareThe action of disconnecting from a network share.
    disconnect-from-socketThe action of disconnecting from a socket.
    download-fileThe action of downloading a file from a remote location.
    enumerate-librariesThe action of enumerating the libraries used by a process.
    enumerate-network-sharesThe action of enumerating the available shared resources on a server.
    enumerate-processesThe action of enumerating all of the running processes on a system.
    enumerate-registry-key-subkeysThe action of enumerating the registry key subkeys under a registry key.
    enumerate-registry-key-valuesThe action of enumerating the named values under a registry key.
    enumerate-servicesThe action of enumerating a specific set of services on a system.
    enumerate-system-handlesThe action of enumerating all open handles on a system.
    enumerate-threadsThe action of enumerating all threads in the calling process.
    enumerate-usersThe action of enumerating all users.
    enumerate-windowsThe action of enumerating all open windows.
    execute-fileThe action of executing a file.
    find-fileThe action of searching for a file.
    find-windowThe action of searching for a window.
    flush-process-instruction-cacheThe action of flushing the instruction cache of a process.
    free-libraryThe action of freeing a library previously loaded into the address space of the calling process.
    free-process-virtual-memoryThe action of freeing virtual memory regions from a process.
    get-disk-attributes"The action of querying the attributes of a disk, such as the amount of available free space.
    get-disk-typeThe action of getting the disk type.
    get-elapsed-system-up-timeThe action of getting the elapsed up-time for a system.
    get-file-or-directory-attributesThe action of getting the attributes of a file or directory.
    get-function-addressThe action of getting the address of an exported function or variable from a library.
    get-host-by-addressThe action of getting information on a host from a local or remote host database by its IP address.
    get-host-by-nameThe action of getting information on a host from a local or remote host database by its name.
    get-netbios-nameThe action of getting the NetBIOS name of a system.
    get-process-current-directoryThe action of getting the current directory of a process.
    get-process-environment-variableThe action of setting an environment variable used by a process.
    get-process-startupinfoThe action of getting the STARTUPINFO struct associated with a process.
    get-registry-key-attributesThe action of getting the attributes of a registry key.
    get-system-global-flagsThe action of getting the enabled global flags on a system.
    get-system-host-nameThe action of getting the hostname of a system.
    get-system-local-timeThe action of getting the local time of a system.
    get-system-time"The action of getting the system time of a system, represented in Coordinated Universal Time (UTC).
    get-thread-contextThe action of getting the context structure (containing process-specific register data) of a thread.
    get-thread-usernameThe action of getting the name or ID of the user associated with a thread.
    get-user-attributesThe action of getting the attributes of a user.
    get-usernameThe action of getting the username of the currently logged in user of a system.
    get-windows-directoryThe action of getting the Windows installation directory on a system.
    get-windows-system-directoryThe action of getting the Windows \System or \System32 directory on a system.
    get-temporary-files-directoryThe action of getting the temporary file directory on a system.
    impersonate-processThe action of a thread in the calling process impersonating the security context of another process.
    invoke-user-privilegeThe action of invoking a privilege given to an existing user.
    join-irc-channelThe action of joining a channel on an IRC server.
    kill-processThe action of killing a process.
    kill-threadThe action of killing a thread in the virtual address space of the calling process.
    kill-windowThe action of killing a window.
    leave-irc-channelThe action of leaving a channel on an IRC server.
    enumerate-disksThe action of listing all disks available on a system.
    listen-on-portThe action of listening on a specific port.
    listen-on-socketThe action of listening on a socket.
    load-and-call-driverThe action of loading a driver into a system and then calling the loaded driver.
    load-driverThe action of loading a driver into a system.
    load-libraryThe action of loading a library into the address space of the calling process.
    lock-fileThe action of locking a file.
    logon-as-userThe action of logging on as a specific user.
    map-file-into-processThe action of mapping a file into the address space of the calling process.
    map-library-into-processThe action of mapping a library into the address space of the calling process.
    modify-process-virtual-memory-protectionThe action of modifying the protection on a memory region in the virtual address space of a process.
    modify-registry-key-valueThe action of modifying a named value of a registry key.
    modify-registry-keyThe action of modifying a registry key.
    modify-service-configurationThe action of modifying the configuration parameters of a service.
    monitor-directoryThe action of monitoring a directory on the filesystem for changes.
    monitor-diskThe action of monitoring a disk for changes.
    monitor-registry-keyThe action of monitoring a registry key for changes.
    mount-diskThe action of mounting a file system to a mounting point.
    move-fileThe action of moving a file from one location to another.
    open-critical-sectionThe action of opening a critical section object.
    open-eventThe action of opening a named event object.
    open-file-mappingThe action of opening a file mapping object.
    open-directoryThe action of opening a directory.
    open-fileThe action of opening a file for reading or writing.
    open-mutexThe action of opening a named mutex.
    open-portThe action of opening a network port.
    open-processThe action of opening a process.
    open-registry-keyThe action of opening a registry key.
    open-semaphoreThe action of opening a named semaphore.
    open-serviceThe action of opening a service.
    queue-apc-in-threadThe action of queuing a new Asynchronized Procedure Call (APC) in the context of a thread.
    read-from-fileThe action of reading from a file.
    read-from-mailslotThe action of reading some data from a named mailslot.
    read-from-named-pipeThe action of reading data from a named pipe.
    read-from-process-memoryThe action of reading from a memory region of a process.
    read-registry-key-valueThe action of reading a named value of a registry key.
    receive-data-on-socketThe action of receiving data on a socket.
    receive-http-responseThe action of receiving an HTTP server response for a prior HTTP request.
    receive-irc-private-messageThe action of receiving a private message from another user on an IRC server.
    receive-network-packetThe action of receiving a packet on a network.
    release-critical-sectionThe action of releasing a critical section object.
    release-mutexThe action of releasing ownership of a named mutex.
    release-semaphoreThe action of releasing ownership of a named semaphore.
    remove-user-from-groupThe action of removing a user from a group.
    rename-fileThe action of renaming a file on a file system.
    reset-eventThe action of resetting a named event object to the non-signaled state.
    revert-thread-to-selfThe action of reverting a thread to its own security context.
    send-control-code-to-fileThe action of sending a control code to a file.
    send-control-code-to-serviceThe action of sending a control code to a service.
    send-data-on-socketThe action of sending data on a connected socket.
    send-data-to-address-on-socketThe action of sending data to a specified IP address on an unconnected socket.
    send-dns-queryThe action of sending a DNS query.
    send-email-messageThe action of sending an email message.
    send-ftp-commandThe action of of sending a command on an FTP server connection.
    send-http-connect-requestThe action of sending an HTTP CONNECT client request to a server.
    send-http-delete-requestThe action of sending an HTTP DELETE client request.
    send-http-get-requestThe action of sending an HTTP GET client request.
    send-http-head-requestThe action of sending an HTTP HEAD client request.
    send-http-options-requestThe action of sending an HTTP OPTIONS client request.
    send-http-patch-requestThe action of sending an HTTP PATCH client request.
    send-http-post-requestThe action of sending an HTTP HEAD client request.
    send-http-put-requestThe action of sending an HTTP PUT client request.
    send-http-trace-requestThe action of sending an HTTP TRACE client request.
    send-icmp-requestThe action of sending an ICMP request.
    send-irc-private-messageThe action of sending a private message to another user on an IRC server.
    send-network-packetThe action of sending a packet on a network.
    send-reverse-dns-lookupThe action of sending a reverse DNS lookup.
    set-file-or-directory-attributesThe action of setting some attributes on a file or directory.
    set-irc-nicknameThe action of setting an IRC nickname on an IRC server.
    set-netbios-nameThe action of setting the NetBIOS name of a system.
    set-process-current-directoryThe action of setting the current directory of a process.
    set-process-environment-variableThe action of setting an environment variable used by a process.
    set-system-global-flagsThe action of setting a system’s global flags.
    set-system-host-nameThe action of setting a system’s hostname.
    set-system-local-timeThe action of setting a system’s local time.
    set-system-time"The action of setting a system’s time, represented in UTC.
    set-thread-contextThe action of setting the context structure (containing process-specific register data) for a thread.
    show-windowThe action of showing a window.
    shutdown-systemThe action of shutting down a system.
    sleep-processThe action of sleeping a process for some period of time.
    sleep-systemThe action of sleeping a system for some period of time.
    start-serviceThe action of starting a service.
    stop-serviceThe action of stopping a service.
    unload-driverThe action of unloading a driver from a system.
    unlock-fileThe action of unlocking a file.
    unmap-file-from-processThe action of unmapping a file from the address space of the calling process.
    unmount-diskThe action of unmounting a file system from a mounting point.
    upload-fileThe action of uploading a file to a remote location.
    write-to-fileThe action of writing data to a file.
    write-to-mailslotThe action of writing data to a named mailslot.
    write-to-named-pipeThe action of writing data to a named pipe.
    write-to-process-memoryThe action of writing to a memory region of an existing process.
    +

    Malware-Configuration-Parameters

    +

    Vocabulary Name: malware-configuration-parameter-ov

    + +

    The Malware Configuration Parameters open vocabulary is used in the following object/property:

    + +
      +
    • Malware Instance --> static_features --> configuration_parameters
      • +
    + +

    This vocabulary is a non-exhaustive enumeration of malware configuration parameter names.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ValueDescription
    filenameCaptures the name of a file (e.g., a binary downloaded, embedded binary).
    group-idCaptures an identifier of a collection of malware instances.
    idCaptures an identifier of a malware instance.
    installation-pathCaptures a location on disk where the malware instance is installed, copied, or moved.
    magic-numberCaptures a file signature used to identify or validate content of the malware instance.
    mutexCaptures a unique mutex value associated with the malware instance.
    c2-ip-addressCaptures an IP address used by the malware instance for command and control.
    c2-domainCaptures a domain name used by the malware instance for command and control.
    c2-urlCaptures a URL used by the malware instance for command and control.
    directoryCaptures the name of a directory used by the malware instance.
    filepathCaptures a file path (directory + file name) used by the malware instance.
    injection-processCaptures a process into which malware instance is injected. Usually this is a process name but it may take other forms such as a filename of the executable.
    intervalCaptures the time malware instance waits between beacons or other activity, in seconds.
    keyCaptures an encryption, encoding, or obfuscation key used by the malware instance. By convention, when these represent binary data, they should be bare hex encoded with no other markup. Base64 or similar custom dictionaries are stored as is.
    passwordCaptures a password used by the malware instance.
    useragentCaptures a software identifier used by the malware instance.
    versionCaptures the version of the malware instance. To the degree possible this should be based directly on artifacts from the malware.
    +

    Malware Labels

    +

    Vocabulary Name: malware-label-ov

    + +

    The malware label vocabulary is currently used in the following objects/properties:

    + +
      +
    • Malware Instance --> labels
      • +
    • Malware Family --> labels
      • +
    + +

    This vocabulary is a non-exhaustive enumeration of common malware labels.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ValueDescription
    adwareAny software that is funded by advertising. Adware may also gather sensitive user information from a system.
    appenderFile-infecting malware that places its code at the end of the files it infects, adjusting the file's entry point to cause its code to be executed before that in the original file.
    backdoorMalware which, once running on a system, opens a communication vector to the outside so the computer can be accessed remotely by an attacker.
    boot-sector-virusMalware that infects the master boot record of a storage device.
    botMalware that resides on an infected system, communicating with and forming part of a botnet. The bot may be implanted by a worm or trojan, which opens a backdoor. The bot then monitors the backdoor for further instructions.
    cavity-fillerA type of file-infecting virus that seeks unused space within the files it infects, inserting its code into these gaps to avoid changing the size of the file and thus not alerting integrity-checking software to its presence.
    clickerA trojan that makes a system visit a specific web page, often very frequently and usually with the aim of increasing the traffic recorded by the site and thus increasing revenue from advertising. Clickers may also be used to carry out DDoS attacks.
    companion-virusA virus that takes the place of a particular file on a system instead of injecting code into it.
    data-diddlerA type of malware that makes small, random changes to data, such as data in a spreadsheet, to render the data contained in a document inaccurate and in some cases worthless.
    ddosA tool used to perform a distributed denial of service attack.
    downloaderMalware programmed to download and execute other files, usually more complex malware.
    dropperA type of Trojan that deposits an enclosed payload onto a destination host computer by loading itself into memory, extracting the malicious payload, and then writing it to the file system.
    exploit-kitA software toolkit to target common vulnerabilities.
    file-infector-virusA virus that infects a system by inserting itself somewhere in existing files; this is the classic form of virus.
    file-lessMalware that is file-less, i.e., executes through some other mechanism such as Powershell.
    fork-bombA simple form of malware, a type of rabbit which launches more copies of itself. Once a fork bomb is executed, it will attempt to run several identical processes, which will do the same, the number growing exponentially until the system resources are overwhelmed by the number of identical processes running, which may in some cases bring the system down and cause a denial of service.
    greywareSoftware that, while not definitely malicious, has a suspicious or potentially unwanted aspect.
    implantCode inserted into an existing program using a code patcher or other tool.
    keyloggerA type of program implanted on a system to monitor the keys pressed and thus record any sensitive data, such as passwords, entered by the user.
    kleptographic-wormA worm that encrypts information assets on compromised systems so they can only be decrypted by the worm's author, also known as information-stealing worm.
    macro-virusA virus that uses a macro language, for example in Microsoft Office documents.
    malware-as-a-serviceMalware that is sold or produced as a service.
    mass-mailerA worm that uses email to propagate across the internet.
    metamorphic-virusA virus that changes its own code with each infection.
    mid-infectorA type of file-infecting virus which places its code in the middle of files it infects. It may move a section of the original code to the end of the file, or simply push the code aside to make space for its own code.
    mobile-codeEither code received from remote, possibly untrusted systems, but executed on a local system; or software transferred between systems (e.g across a network) and executed on a local system without explicit installation or execution by the recipient.
    multipartite-virusMalware that infects boot records, boot sectors, and files.
    parental-controlA program that monitors or limits machine usage. Such programs can run undetected and can transmit monitoring information to another machine.
    password-stealerA type of trojan designed to steal passwords, personal data and details, or other sensitive information from an infected system.
    polymorphic-virusA type of virus that encrypts its code differently with each infection (or with each generation of infections).
    premium-dialer-smserA type of malware whose primary aim is to dial (or send SMS messages to) premium rate numbers.
    prependerA file-infecting virus that inserts code at the beginning of the files it infects.
    ransomwareMalware that encrypts files on a victim's system, demanding payment of ransom in return for the access codes required to unlock files.
    remote-access-trojanA remote access trojan program (or RAT), is a trojan horse capable of controlling a machine through commands issued by a remote attacker.
    resource-exploiterA type of malware that steals a system's resources (e.g., CPU cycles), such as a bitcoin miner.
    rogue-security-softwareA fake security product that demands money to clean phony infections.
    rootkitA method of hiding files or processes from normal methods of monitoring; often used by malware to conceal its presence and activities.
    scarewareA program that reports false or significantly misleading information on the presence of security risks, threats, or system issues on the target computer.
    screen-captureA type of malware used to capture images from the target systems screen, used for exfiltration and command and control.
    security-assessment-toolA program that can be used to gather information for unauthorized access to computer systems.
    shellcodeEither a small piece of code that activates a command-line interface to a system that can be used to disable security measures, open a backdoor, or download further malicious code; or a small piece of code that opens a system up for exploitation, sometimes by not necessarily involving a command-line shell.
    spywareSoftware that gathers information and passes it to a third-party without adequate permission from the owner of the data. It may also refer to software that makes changes to a system or any of its component software, or which makes use of system resources without the full understanding and consent of the system owner.
    trackwareMalware that traces a user's path on the Internet and sends information to third parties. Compare to spyware, which monitors system activity to capture confidential information such as passwords.
    trojanMalware disguised as something inert or benign.
    virusSelf-replicating malware that requires human interaction to spread; also, self-replicating malware that runs and spreads by modifying and inserting itself into other programs or files.
    web-bugCode embedded in a web page or email that checks whether a user has accessed the content (e.g., a tiny, transparent GIF image).
    wormSelf-replicating malware that propagates across a network either with or without human interaction.
    +

    Operating System Features

    +

    Vocabulary Name: os-features-ov

    + +

    The Operating System Features open vocabulary is used by the following object/property:

    + +
      +
    • Malware Instance --> os_features
      • +
    + +

    This vocabulary is a non-exhaustive enumeration of operating system features that may be used by malware. Each feature is specific to a particular operating system, unless otherwise specified by “multi-OS” in its description, in which case it can apply to a range of operating systems.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ValueDescription
    login-itemsIndicates use of MacOS/OS X login items.
    plist-filesIndicates use of MacOS/OS X plist files.
    applescriptIndicates use of MacOS/OS X AppleScript.
    launch-agentIndicates use of a MacOS/OS X launch agent.
    launch-daemonsIndicates use of MacOS/OS X launch daemons.
    kextIndicates the use of MacOS/OS X kernel extensions (kexts).
    login-logout-hooksIndicates the use of MacOS/OS X login/logout hooks.
    named-pipesIndicates use of named pipes (multi-OS).
    berkeley-socketsIndicates use of Berkeley sockets (multi-OS).
    cronIndicates use of the Linux or MacOS/OS X cron jobs.
    mutexesIndicates use of mutual exclusion objects (mutexes) (multi-OS).
    registry-keysIndicates use of Windows registry keys.
    servicesIndicates use of Windows services.
    powershellIndicates use of Windows powershell.
    ntfs-extended-attributesIndicates use of Windows NTFS extended attributes.
    network-sharesIndicates use of Windows network shares.
    hooksIndicates use of Windows hooks.
    wmiIndicates use of Windows Management Instrumentation (WMI).
    task-schedulerIndicates use of Windows task scheduler (scheduled tasks).
    critical-sectionsIndicates of Windows critical sections.
    device-driversIndicates use of device drivers (multi-OS).
    admin-network-sharesIndicates use of Windows administrator (ADMIN$) network shares.
    +

    Operating Systems

    +

    Vocabulary Name: operating-system-ov

    + +

    The Operating System open vocabulary is used by the following objects/properties:

    + +
      +
    • Behavior --> attributes
      • +
    • Capability --> attributes
      • +
    + +

    This vocabulary is a non-exhaustive enumeration of operating systems.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ValueDescription
    android-1.0.xIndicates the Android 1.0.x operating system.
    android-1.1.xIndicates the Android 1.1.x operating system.
    android-1.5.xIndicates the Android 1.5.x operating system.
    android-1.6.xIndicates the Android 1.6.x operating system.
    android-2.0.xIndicates the Android 2.0.x operating system.
    android-2.1.xIndicates the Android 2.1.x operating system.
    android-2.2.xIndicates the Android 2.2.x operating system.
    android-2.3.xIndicates the Android 2.3.x operating system.
    android-3.0.xIndicates the Android 3.0.x operating system.
    android-3.1.xIndicates the Android 3.1.x operating system.
    android-3.2.xIndicates the Android 3.2.x operating system.
    android-4.0.xIndicates the Android 4.0.x operating system.
    android-4.1.xIndicates the Android 4.1.x operating system.
    android-4.2.xIndicates the Android 4.2.x operating system.
    android-4.3.xIndicates the Android 4.3.x operating system.
    android-4.4.xIndicates the Android 4.4.x operating system.
    android-5.0.xIndicates the Android 5.0.x operating system.
    android-5.1.xIndicates the Android 5.1.x operating system.
    android-unknown-versionIndicates an unknown version of the Android operating system.
    ios-1.0.xIndicates the iOS 1.0.x operating system.
    ios-1.1.xIndicates the iOS 1.1.x operating system.
    ios-2.0.xIndicates the iOS 2.0.x operating system.
    ios-2.1.xIndicates the iOS 2.1.x operating system.
    ios-2.2.xIndicates the iOS 2.2.x operating system.
    ios-3.0.xIndicates the iOS 3.0.x operating system.
    ios-3.1.xIndicates the iOS 3.1.x operating system.
    ios-3.2.xIndicates the iOS 3.2.x operating system.
    ios-4.0.xIndicates the iOS 4.0.x operating system.
    ios-4.1.xIndicates the iOS 4.1.x operating system.
    ios-4.2.xIndicates the iOS 4.2.x operating system.
    ios-4.3.xIndicates the iOS 4.3.x operating system.
    ios-5.0.xIndicates the iOS 5.0.x operating system.
    ios-5.1.xIndicates the iOS 5.1.x operating system.
    ios-6.0.xIndicates the iOS 6.0.x operating system.
    ios-6.1.xIndicates the iOS 6.1.x operating system.
    ios-7.0.xIndicates the iOS 7.0.x operating system.
    ios-7.1.xIndicates the iOS 7.1.x operating system.
    ios-8.0.xIndicates the iOS 8.0.x operating system.
    ios-8.1.xIndicates the iOS 8.1.x operating system.
    ios-8.2.xIndicates the iOS 8.2.x operating system.
    ios-8.3.xIndicates the iOS 8.3.x operating system.
    ios-8.4.xIndicates the iOS 8.4.x operating system.
    ios-9.0.xIndicates the iOS 9.0.x operating system.
    ios-9.1.xIndicates the iOS 9.1.x operating system.
    ios-9.2.xIndicates the iOS 9.2.x operating system.
    ios-9.3.xIndicates the iOS 9.3.x operating system.
    ios-10.0.xIndicates the iOS 10.0.x operating system.
    ios-10.1.xIndicates the iOS 10.1.x operating system.
    ios-unknown-versionIndicates an unknown version of the iOS operating system.
    linux-kernel-2.4.xIndicates version 2.4.x of the linux kernel.
    linux-kernel-2.6.xIndicates version 2.6.x of the linux kernel.
    linux-kernel-3.0.xIndicates version 3.0.x of the linux kernel.
    linux-kernel-3.1.xIndicates version 3.1.x of the linux kernel.
    linux-kernel-3.2.xIndicates version 3.2.x of the linux kernel.
    linux-kernel-3.3.xIndicates version 3.3.x of the linux kernel.
    linux-kernel-3.4.xIndicates version 3.4.x of the linux kernel.
    linux-kernel-3.5.xIndicates version 3.5.x of the linux kernel.
    linux-kernel-3.6.xIndicates version 3.6.x of the linux kernel.
    linux-kernel-3.7.xIndicates version 3.7.x of the linux kernel.
    linux-kernel-3.8.xIndicates version 3.8.x of the linux kernel.
    linux-kernel-3.9.xIndicates version 3.9.x of the linux kernel.
    linux-kernel-3.10.xIndicates version 3.10.x of the linux kernel.
    linux-kernel-3.11.xIndicates version 3.11.x of the linux kernel.
    linux-kernel-3.12.xIndicates version 3.12.x of the linux kernel.
    linux-kernel-3.13.xIndicates version 3.13.x of the linux kernel.
    linux-kernel-3.14.xIndicates version 3.14.x of the linux kernel.
    linux-kernel-3.15.xIndicates version 3.15.x of the linux kernel.
    linux-kernel-3.16.xIndicates version 3.16.x of the linux kernel.
    linux-kernel-3.17.xIndicates version 3.17.x of the linux kernel.
    linux-kernel-3.18.xIndicates version 3.18.x of the linux kernel.
    linux-kernel-3.19.xIndicates version 3.19.x of the linux kernel.
    linux-kernel-4.0.xIndicates version 4.0.x of the linux kernel.
    linux-kernel-4.1.xIndicates version 4.1.x of the linux kernel.
    linux-unknown-versionIndicates an unknown version of the linux kernel.
    mac-os-x-10.0.xIndicates the Mac OS X 10.0.x operating system.
    mac-os-x-10.1.xIndicates the Mac OS X 10.1.x operating system.
    mac-os-x-10.2.xIndicates the Mac OS X 10.2.x operating system.
    mac-os-x-10.3.xIndicates the Mac OS X 10.3.x operating system.
    mac-os-x-10.4.xIndicates the Mac OS X 10.4.x operating system.
    mac-os-x-10.5.xIndicates the Mac OS X 10.5.x operating system.
    mac-os-x-10.6.xIndicates the Mac OS X 10.6.x operating system.
    mac-os-x-10.7.xIndicates the Mac OS X 10.7.x operating system.
    mac-os-x-10.8.xIndicates the Mac OS X 10.8.x operating system.
    mac-os-x-10.9.xIndicates the Mac OS X 10.9.x operating system.
    mac-os-x-10.10.xIndicates the Mac OS X 10.10.x operating system.
    mac-os-x-10.11.xIndicates the Mac OS X 10.11.x operating system.
    mac-os-x-unknown-versionIndicates an unknown version of the Mac OS X operating system.
    windows-7Indicates the Windows 7 operating system.
    windows-7-sp1Indicates the Windows 7 SP1 operating system.
    windows-8Indicates the Windows 8 operating system.
    windows-8.1Indicates the Windows 8.1 operating system.
    windows-10Indicates the Windows 10 operating system.
    windows-server-2003Indicates the Windows Server 2003 operating system.
    windows-server-2003-sp1Indicates the Windows Server 2003 SP1 operating system.
    windows-server-2003-sp2Indicates the Windows Server 2003 SP2 operating system.
    windows-server-2008Indicates the Windows Server 2008 operating system.
    windows-server-2008-sp1Indicates the Windows Server 2008 SP1 operating system.
    windows-server-2008-sp2Indicates the Windows Server 2008 SP2 operating system.
    windows-server-2008-r2Indicates the Windows Server 2008 r2 operating system.
    windows-server-2008-r2-sp1Indicates the Windows Server 2008 R2 SP1 operating system.
    windows-server-2012Indicates the Windows Server 2012 operating system.
    windows-server-2012-r2Indicates the Windows Server 2012 r2 operating system.
    windows-vistaIndicates the Windows Vista operating system.
    windows-vista-sp1Indicates the Windows Vista SP1 operating system.
    windows-vista-sp2Indicates the Windows Vista SP2 operating system.
    windows-xpIndicates the Windows XP operating system.
    windows-xp-sp1Indicates the Windows XP SP1 operating system.
    windows-xp-sp2Indicates the Windows XP SP2 operating system.
    windows-xp-sp3Indicates the Windows XP SP3 operating system.
    windows-unknown-versionIndicates an unknown version of the Windows operating system.
    +

    Obfuscation Methods

    +

    Vocabulary Name: obfuscation-method-ov

    + +

    The Obfuscation Method open vocabulary is used in the following object/property:

    + +
      +
    • Malware Instance --> static_features --> obfuscation_methods --> method
      • +
    + +

    This vocabulary is a non-exhaustive enumeration of obfuscation methods used in obfuscating a binary associated with a Malware Instance.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ValueDescription
    packingPacking of the malware instance code, not including encryption (the code-encryption value defined below should be used for encrypted code).
    code-encryptionEncryption of the malware instance code.
    dead-code-insertionDead code inserted in the malware instance.
    entry-point-obfuscationObfuscation of the malware instance entry point.
    import-address-table-obfuscationObfuscation of the malware instance import address table.
    interleaving-codeCode interleaving in the malware instance (code is split into sections that are rearranged and connected by unconditional jumps).
    symbolic-obfuscationObfuscation of the malware instance symbols.
    string-obfuscationObfuscation of the malware instance strings.
    subroutine-reorderingReordering of subroutines in the malware instance.
    code-transpositionReordering of instructions in the malware instance.
    instruction-substitutionSubstitution of malware instance instructions with semantic equivalents.
    register-reassignmentReplacement of unused registers with those containing malicious code.
    +

    Processor Architectures

    +

    Vocabulary Name: processor-architecture-ov

    + +

    The Process Architecture open vocabulary is used in the following object/property:

    + +
      +
    • Malware Instance --> architecture_execution_envs
      • +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ValueDescription
    x86The 32-bit x86 architecture.
    x86-64The 64-bit x86 architecture.
    ia-64The 64-bit IA (Itanium) architecture.
    powerpcThe PowerPC architecture.
    armThe ARM architecture.
    alphaThe Alpha architecture.
    sparcThe SPARC architecture.
    mipsThe MIPS architecture.
    +

    Refined Capabilities

    +

    Vocabulary Name: refined-capability-ov

    + +

    The Refined Capability open vocabulary is used in the following object/property:

    + +
      +
    • Capability --> name
      • +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ValueDescription
    access-control-degradationIndicates that the malware instance or family is able to bypass or disable access control mechanisms designed to prevent unauthorized or unprivileged use or execution of applications or files.
    anti-debuggingIndicates that the malware instance or family is able to prevent itself from being debugged and/or from being run in a debugger or is able to make debugging more difficult.
    anti-disassemblyIndicates that the malware instance or family is able to prevent itself from being disassembled or make disassembly more difficult.
    anti-emulationIndicates that the malware instance or family is able to prevent its execution inside of an emulator or is able to make emulation more difficult.
    anti-memory-forensicsIndicates that the malware instance or family is able to prevent or make memory forensics more difficult.
    anti-sandboxIndicates that the malware instance or family is able to prevent sandbox-based behavioral analysis or make it more difficult.
    anti-virus-evasionIndicates that the malware instance or family is able to evade detection by anti-virus tools.
    anti-vmIndicates that the malware instance or family is able to prevent virtual machine (VM) based behavioral analysis or make it more difficult.
    authentication-credentials-theftIndicates that the malware instance is able to steal authentication credentials.
    clean-traces-of-infectionIndicates that the malware instance or family is able to clean traces of its infection (e.g., file system artifacts) from a system.
    communicate-with-c2-serverIndicates that the malware instance or family is able to communicate (i.e., send or receive data) with a command and control (C2) server.
    compromise-data-availabilityIndicates that the malware instance or family is able to compromise the availability of data on the local system on which it is executing and/or one or more remote systems.
    compromise-system-availabilityIndicates that the malware instance or family is able to compromise the availability of the local system on which it is executing and/or one or more remote systems.
    consume-system-resourcesIndicates that the malware instance or family is able to consume system resources for its own purposes, such as password cracking.
    continuous-executionIndicates that the malware instance or family is able to continue to execute on a system after significant system events, such as a system reboot.
    data-integrity-violationIndicates that the malware instance or family is able to compromise the integrity of some data that resides on (e.g., in the case of files) or is received/transmitted (e.g., in the case of network traffic) by the system on which it is executing.
    data-obfuscationIndicates that the malware instance or family is able to obfuscate data that will be exfiltrated.
    data-stagingIndicates that the malware instance or family is able to gather, prepare, and stage data for exfiltration.
    determine-c2-serverIndicates that the malware instance or family is able to identify one or more command and control (C2) servers with which to communicate.
    email-spamIndicates that the malware instance or family is able to send spam email messages.
    ensure-compatibilityIndicates that the malware instance or family is able to manipulate or modify the system on which it executes to ensure that it is able to continue executing.
    environment-awarenessIndicates that the malware instance or family can fingerprint or otherwise identify the environment in which it is executing, for the purpose of altering its behavior based on this environment.
    file-infectionIndicates that the malware instance or family is able to infect one or more files on the system on which it executes.
    hide-artifactsIndicates that the malware instance or family is able to hide its artifacts, such as files and open ports.
    hide-executing-codeIndicates that the malware instance or family is able to hide its executing code.
    hide-non-executing-codeIndicates that the malware instance or family is able to hide its non-executing code.
    host-configuration-probingIndicates that the malware instance or family is able to probe the configuration of the host system on which it executes.
    information-gathering-for-improvementIndicates that the malware instance or family is able to gather information from its environment to make itself less likely to be detected.
    input-peripheral-captureIndicates that the malware instance or family is able to capture data from a system's input peripheral devices, such as a keyboard or mouse.
    install-other-componentsIndicates that the malware instance or family is able to install additional components. This encompasses the dropping/downloading of other malicious components such as libraries, other malware, and tools.
    local-machine-controlIndicates that the malware instance or family is able to control the machine on which it is executing.
    network-environment-probingIndicates that the malware instance or family is able to probe the properties of its network environment, e.g. to determine whether it funnels traffic through a proxy.
    os-security-feature-degradationIndicates that the malware instance or family is able to bypass or disable operating system (OS) security mechanisms.
    output-peripheral-captureIndicates that the malware instance or family captures data sent to a system's output peripherals, such as a display.
    physical-entity-destructionIndicates that the malware instance or family is able to destroy physical entities.
    prevent-artifact-accessIndicates that the malware instance or family is able to prevent its artifacts (e.g., files, registry keys, etc.) from being accessed.
    prevent-artifact-deletionIndicates that the malware instance or family is able to prevent its artifacts (e.g., files, registry keys, etc.) from being deleted.
    remote-machine-accessIndicates that the malware instance or family is able to access one or more remote machines.
    remote-machine-infectionIndicates that the malware instance or family is able to self-propagate to a remote machine or infect a machine with malware that is different than itself.
    security-software-degradationIndicates that the malware instance or family is able to bypass or disable security programs running on a system, either by stopping them from executing or by making changes to their code or configuration parameters.
    security-software-evasionIndicates that the malware instance or family is able to evade security software (e.g., anti-virus tools).
    self-modificationIndicates that the malware instance or family is able to modify itself.
    service-provider-security-feature-degradationIndicates that the malware instance or family is able to bypass or disable mobile device service provider security features that would otherwise identify or notify users of its presence.
    stored-information-theftIndicates that the malware instance or family is able to steal information stored on a system (e.g., files).
    system-interface-data-captureIndicates that the malware instance or family is able to capture data from a system's logical or physical interfaces, such as from a network interface.
    system-operational-integrity-violationIndicates that the malware instance or family is able to compromise the operational integrity of the system on which it is executing and/or one or more remote systems, e.g., by causing them to operate beyond their set of specified operational parameters.
    system-re-infectionIndicates that the malware instance or family is able to re-infect a system after one or more of its components have been removed.
    system-state-data-captureIndicates that the malware instance or family is able to capture information about a system's state (e.g., data currently in its RAM).
    system-update-degradationIndicates that the malware instance or family is able to disable the downloading and installation of system updates and patches.
    user-data-theftIndicates that the malware instance or family is able to steal data associated with one or more users (e.g., browser history).
    virtual-entity-destructionIndicates that the malware instance or family is able to destroy a virtual entity.
    + +
    +
    +
    + json +
    +
    +
    + + diff --git a/documentation/maec5-docs/javascripts/all.js b/documentation/maec5-docs/javascripts/all.js new file mode 100644 index 00000000..2dc3705f --- /dev/null +++ b/documentation/maec5-docs/javascripts/all.js @@ -0,0 +1,131 @@ +!function(){if("ontouchstart"in window){var e,t,n,r,i,o,s={};e=function(e,t){return Math.abs(e[0]-t[0])>5||Math.abs(e[1]-t[1])>5},t=function(e){this.startXY=[e.touches[0].clientX,e.touches[0].clientY],this.threshold=!1},n=function(t){return!this.threshold&&void(this.threshold=e(this.startXY,[t.touches[0].clientX,t.touches[0].clientY]))},r=function(t){if(!this.threshold&&!e(this.startXY,[t.changedTouches[0].clientX,t.changedTouches[0].clientY])){var n=t.changedTouches[0],r=document.createEvent("MouseEvents");r.initMouseEvent("click",!0,!0,window,0,n.screenX,n.screenY,n.clientX,n.clientY,!1,!1,!1,!1,0,null),r.simulated=!0,t.target.dispatchEvent(r)}},i=function(e){var t=Date.now(),n=t-s.time,r=e.clientX,i=e.clientY,a=[Math.abs(s.x-r),Math.abs(s.y-i)],u=o(e.target,"A")||e.target,c=u.nodeName,l="A"===c,f=window.navigator.standalone&&l&&e.target.getAttribute("href");return s.time=t,s.x=r,s.y=i,!((!e.simulated&&(n<500||n<1500&&a[0]<50&&a[1]<50)||f)&&(e.preventDefault(),e.stopPropagation(),!f))&&(f&&(window.location=u.getAttribute("href")),void(u&&u.classList&&(u.classList.add("energize-focus"),window.setTimeout(function(){u.classList.remove("energize-focus")},150))))},o=function(e,t){for(var n=e;n!==document.body;){if(!n||n.nodeName===t)return n;n=n.parentNode}return null},document.addEventListener("touchstart",t,!1),document.addEventListener("touchmove",n,!1),document.addEventListener("touchend",r,!1),document.addEventListener("click",i,!0)}}(),/*! + * jQuery JavaScript Library v2.2.0 + * http://jquery.com/ + * + * Includes Sizzle.js + * http://sizzlejs.com/ + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license + * http://jquery.org/license + * + * Date: 2016-01-08T20:02Z + */ +function(e,t){"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(e,t){function n(e){var t=!!e&&"length"in e&&e.length,n=oe.type(e);return"function"!==n&&!oe.isWindow(e)&&("array"===n||0===t||"number"==typeof t&&t>0&&t-1 in e)}function r(e,t,n){if(oe.isFunction(t))return oe.grep(e,function(e,r){return!!t.call(e,r,e)!==n});if(t.nodeType)return oe.grep(e,function(e){return e===t!==n});if("string"==typeof t){if(ge.test(t))return oe.filter(t,e,n);t=oe.filter(t,e)}return oe.grep(e,function(e){return Z.call(t,e)>-1!==n})}function i(e,t){for(;(e=e[t])&&1!==e.nodeType;);return e}function o(e){var t={};return oe.each(e.match(we)||[],function(e,n){t[n]=!0}),t}function s(){Q.removeEventListener("DOMContentLoaded",s),e.removeEventListener("load",s),oe.ready()}function a(){this.expando=oe.expando+a.uid++}function u(e,t,n){var r;if(void 0===n&&1===e.nodeType)if(r="data-"+t.replace(je,"-$&").toLowerCase(),n=e.getAttribute(r),"string"==typeof n){try{n="true"===n||"false"!==n&&("null"===n?null:+n+""===n?+n:Ne.test(n)?oe.parseJSON(n):n)}catch(e){}ke.set(e,t,n)}else n=void 0;return n}function c(e,t,n,r){var i,o=1,s=20,a=r?function(){return r.cur()}:function(){return oe.css(e,t,"")},u=a(),c=n&&n[3]||(oe.cssNumber[t]?"":"px"),l=(oe.cssNumber[t]||"px"!==c&&+u)&&Ae.exec(oe.css(e,t));if(l&&l[3]!==c){c=c||l[3],n=n||[],l=+u||1;do o=o||".5",l/=o,oe.style(e,t,l+c);while(o!==(o=a()/u)&&1!==o&&--s)}return n&&(l=+l||+u||0,i=n[1]?l+(n[1]+1)*n[2]:+n[2],r&&(r.unit=c,r.start=l,r.end=i)),i}function l(e,t){var n="undefined"!=typeof e.getElementsByTagName?e.getElementsByTagName(t||"*"):"undefined"!=typeof e.querySelectorAll?e.querySelectorAll(t||"*"):[];return void 0===t||t&&oe.nodeName(e,t)?oe.merge([e],n):n}function f(e,t){for(var n=0,r=e.length;n-1)i&&i.push(o);else if(c=oe.contains(o.ownerDocument,o),s=l(d.appendChild(o),"script"),c&&f(s),n)for(p=0;o=s[p++];)Fe.test(o.type||"")&&n.push(o);return d}function d(){return!0}function h(){return!1}function g(){try{return Q.activeElement}catch(e){}}function v(e,t,n,r,i,o){var s,a;if("object"==typeof t){"string"!=typeof n&&(r=r||n,n=void 0);for(a in t)v(e,a,n,r,t[a],o);return e}if(null==r&&null==i?(i=n,r=n=void 0):null==i&&("string"==typeof n?(i=r,r=void 0):(i=r,r=n,n=void 0)),i===!1)i=h;else if(!i)return this;return 1===o&&(s=i,i=function(e){return oe().off(e),s.apply(this,arguments)},i.guid=s.guid||(s.guid=oe.guid++)),e.each(function(){oe.event.add(this,t,i,r,n)})}function m(e,t){return oe.nodeName(e,"table")&&oe.nodeName(11!==t.nodeType?t:t.firstChild,"tr")?e.getElementsByTagName("tbody")[0]||e:e}function y(e){return e.type=(null!==e.getAttribute("type"))+"/"+e.type,e}function x(e){var t=ze.exec(e.type);return t?e.type=t[1]:e.removeAttribute("type"),e}function b(e,t){var n,r,i,o,s,a,u,c;if(1===t.nodeType){if(Ee.hasData(e)&&(o=Ee.access(e),s=Ee.set(t,o),c=o.events)){delete s.handle,s.events={};for(i in c)for(n=0,r=c[i].length;n1&&"string"==typeof g&&!re.checkClone&&Be.test(g))return e.each(function(i){var o=e.eq(i);v&&(t[0]=g.call(this,i,o.html())),T(o,t,n,r)});if(d&&(i=p(t,e[0].ownerDocument,!1,e,r),o=i.firstChild,1===i.childNodes.length&&(i=o),o||r)){for(s=oe.map(l(i,"script"),y),a=s.length;f")).appendTo(t.documentElement),t=Ve[0].contentDocument,t.write(),t.close(),n=C(e,t),Ve.detach()),Ue[e]=n),n}function k(e,t,n){var r,i,o,s,a=e.style;return n=n||Je(e),n&&(s=n.getPropertyValue(t)||n[t],""!==s||oe.contains(e.ownerDocument,e)||(s=oe.style(e,t)),!re.pixelMarginRight()&&Qe.test(s)&&Ye.test(t)&&(r=a.width,i=a.minWidth,o=a.maxWidth,a.minWidth=a.maxWidth=a.width=s,s=n.width,a.width=r,a.minWidth=i,a.maxWidth=o)),void 0!==s?s+"":s}function N(e,t){return{get:function(){return e()?void delete this.get:(this.get=t).apply(this,arguments)}}}function j(e){if(e in rt)return e;for(var t=e[0].toUpperCase()+e.slice(1),n=nt.length;n--;)if(e=nt[n]+t,e in rt)return e}function L(e,t,n){var r=Ae.exec(t);return r?Math.max(0,r[2]-(n||0))+(r[3]||"px"):t}function A(e,t,n,r,i){for(var o=n===(r?"border":"content")?4:"width"===t?1:0,s=0;o<4;o+=2)"margin"===n&&(s+=oe.css(e,n+De[o],!0,i)),r?("content"===n&&(s-=oe.css(e,"padding"+De[o],!0,i)),"margin"!==n&&(s-=oe.css(e,"border"+De[o]+"Width",!0,i))):(s+=oe.css(e,"padding"+De[o],!0,i),"padding"!==n&&(s+=oe.css(e,"border"+De[o]+"Width",!0,i)));return s}function D(t,n,r){var i=!0,o="width"===n?t.offsetWidth:t.offsetHeight,s=Je(t),a="border-box"===oe.css(t,"boxSizing",!1,s);if(Q.msFullscreenElement&&e.top!==e&&t.getClientRects().length&&(o=Math.round(100*t.getBoundingClientRect()[n])),o<=0||null==o){if(o=k(t,n,s),(o<0||null==o)&&(o=t.style[n]),Qe.test(o))return o;i=a&&(re.boxSizingReliable()||o===t.style[n]),o=parseFloat(o)||0}return o+A(t,n,r||(a?"border":"content"),i,s)+"px"}function O(e,t){for(var n,r,i,o=[],s=0,a=e.length;s=0&&n=0},isPlainObject:function(e){return"object"===oe.type(e)&&!e.nodeType&&!oe.isWindow(e)&&!(e.constructor&&!ne.call(e.constructor.prototype,"isPrototypeOf"))},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},type:function(e){return null==e?e+"":"object"==typeof e||"function"==typeof e?ee[te.call(e)]||"object":typeof e},globalEval:function(e){var t,n=eval;e=oe.trim(e),e&&(1===e.indexOf("use strict")?(t=Q.createElement("script"),t.text=e,Q.head.appendChild(t).parentNode.removeChild(t)):n(e))},camelCase:function(e){return e.replace(ae,"ms-").replace(ue,ce)},nodeName:function(e,t){return e.nodeName&&e.nodeName.toLowerCase()===t.toLowerCase()},each:function(e,t){var r,i=0;if(n(e))for(r=e.length;iT.cacheLength&&delete e[t.shift()],e[n+" "]=r}var t=[];return e}function r(e){return e[I]=!0,e}function i(e){var t=O.createElement("div");try{return!!e(t)}catch(e){return!1}finally{t.parentNode&&t.parentNode.removeChild(t),t=null}}function o(e,t){for(var n=e.split("|"),r=n.length;r--;)T.attrHandle[n[r]]=t}function s(e,t){var n=t&&e,r=n&&1===e.nodeType&&1===t.nodeType&&(~t.sourceIndex||U)-(~e.sourceIndex||U);if(r)return r;if(n)for(;n=n.nextSibling;)if(n===t)return-1;return e?1:-1}function a(e){return function(t){var n=t.nodeName.toLowerCase();return"input"===n&&t.type===e}}function u(e){return function(t){var n=t.nodeName.toLowerCase();return("input"===n||"button"===n)&&t.type===e}}function c(e){return r(function(t){return t=+t,r(function(n,r){for(var i,o=e([],n.length,t),s=o.length;s--;)n[i=o[s]]&&(n[i]=!(r[i]=n[i]))})})}function l(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}function f(){}function p(e){for(var t=0,n=e.length,r="";t1?function(t,n,r){for(var i=e.length;i--;)if(!e[i](t,n,r))return!1;return!0}:e[0]}function g(e,n,r){for(var i=0,o=n.length;i-1&&(r[c]=!(s[c]=f))}}else x=v(x===s?x.splice(h,x.length):x),o?o(null,s,x,u):K.apply(s,x)})}function y(e){for(var t,n,r,i=e.length,o=T.relative[e[0].type],s=o||T.relative[" "],a=o?1:0,u=d(function(e){return e===t},s,!0),c=d(function(e){return ee(t,e)>-1},s,!0),l=[function(e,n,r){var i=!o&&(r||n!==j)||((t=n).nodeType?u(e,n,r):c(e,n,r));return t=null,i}];a1&&h(l),a>1&&p(e.slice(0,a-1).concat({value:" "===e[a-2].type?"*":""})).replace(ae,"$1"),n,a0,o=e.length>0,s=function(r,s,a,u,c){var l,f,p,d=0,h="0",g=r&&[],m=[],y=j,x=r||o&&T.find.TAG("*",c),b=_+=null==y?1:Math.random()||.1,w=x.length;for(c&&(j=s===O||s||c);h!==w&&null!=(l=x[h]);h++){if(o&&l){for(f=0,s||l.ownerDocument===O||(D(l),a=!$);p=e[f++];)if(p(l,s||O,a)){u.push(l);break}c&&(_=b)}i&&((l=!p&&l)&&d--,r&&g.push(l))}if(d+=h,i&&h!==d){for(f=0;p=n[f++];)p(g,m,s,a);if(r){if(d>0)for(;h--;)g[h]||m[h]||(m[h]=J.call(u));m=v(m)}K.apply(u,m),c&&!r&&m.length>0&&d+n.length>1&&t.uniqueSort(u)}return c&&(_=b,j=y),g};return i?r(s):s}var b,w,T,S,C,E,k,N,j,L,A,D,O,q,$,F,H,P,R,I="sizzle"+1*new Date,M=e.document,_=0,W=0,B=n(),z=n(),X=n(),V=function(e,t){return e===t&&(A=!0),0},U=1<<31,Y={}.hasOwnProperty,Q=[],J=Q.pop,G=Q.push,K=Q.push,Z=Q.slice,ee=function(e,t){for(var n=0,r=e.length;n+~]|"+ne+")"+ne+"*"),le=new RegExp("="+ne+"*([^\\]'\"]*?)"+ne+"*\\]","g"),fe=new RegExp(oe),pe=new RegExp("^"+re+"$"),de={ID:new RegExp("^#("+re+")"),CLASS:new RegExp("^\\.("+re+")"),TAG:new RegExp("^("+re+"|[*])"),ATTR:new RegExp("^"+ie),PSEUDO:new RegExp("^"+oe),CHILD:new RegExp("^:(only|first|last|nth|nth-last)-(child|of-type)(?:\\("+ne+"*(even|odd|(([+-]|)(\\d*)n|)"+ne+"*(?:([+-]|)"+ne+"*(\\d+)|))"+ne+"*\\)|)","i"),bool:new RegExp("^(?:"+te+")$","i"),needsContext:new RegExp("^"+ne+"*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\\("+ne+"*((?:-\\d)?\\d*)"+ne+"*\\)|)(?=[^-]|$)","i")},he=/^(?:input|select|textarea|button)$/i,ge=/^h\d$/i,ve=/^[^{]+\{\s*\[native \w/,me=/^(?:#([\w-]+)|(\w+)|\.([\w-]+))$/,ye=/[+~]/,xe=/'|\\/g,be=new RegExp("\\\\([\\da-f]{1,6}"+ne+"?|("+ne+")|.)","ig"),we=function(e,t,n){var r="0x"+t-65536;return r!==r||n?t:r<0?String.fromCharCode(r+65536):String.fromCharCode(r>>10|55296,1023&r|56320)},Te=function(){D()};try{K.apply(Q=Z.call(M.childNodes),M.childNodes),Q[M.childNodes.length].nodeType}catch(e){K={apply:Q.length?function(e,t){G.apply(e,Z.call(t))}:function(e,t){for(var n=e.length,r=0;e[n++]=t[r++];);e.length=n-1}}}w=t.support={},C=t.isXML=function(e){var t=e&&(e.ownerDocument||e).documentElement;return!!t&&"HTML"!==t.nodeName},D=t.setDocument=function(e){var t,n,r=e?e.ownerDocument||e:M;return r!==O&&9===r.nodeType&&r.documentElement?(O=r,q=O.documentElement,$=!C(O),(n=O.defaultView)&&n.top!==n&&(n.addEventListener?n.addEventListener("unload",Te,!1):n.attachEvent&&n.attachEvent("onunload",Te)),w.attributes=i(function(e){return e.className="i",!e.getAttribute("className")}),w.getElementsByTagName=i(function(e){return e.appendChild(O.createComment("")),!e.getElementsByTagName("*").length}),w.getElementsByClassName=ve.test(O.getElementsByClassName),w.getById=i(function(e){return q.appendChild(e).id=I,!O.getElementsByName||!O.getElementsByName(I).length}),w.getById?(T.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&$){var n=t.getElementById(e);return n?[n]:[]}},T.filter.ID=function(e){var t=e.replace(be,we);return function(e){return e.getAttribute("id")===t}}):(delete T.find.ID,T.filter.ID=function(e){var t=e.replace(be,we);return function(e){var n="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return n&&n.value===t}}),T.find.TAG=w.getElementsByTagName?function(e,t){return"undefined"!=typeof t.getElementsByTagName?t.getElementsByTagName(e):w.qsa?t.querySelectorAll(e):void 0}:function(e,t){var n,r=[],i=0,o=t.getElementsByTagName(e);if("*"===e){for(;n=o[i++];)1===n.nodeType&&r.push(n);return r}return o},T.find.CLASS=w.getElementsByClassName&&function(e,t){if("undefined"!=typeof t.getElementsByClassName&&$)return t.getElementsByClassName(e)},H=[],F=[],(w.qsa=ve.test(O.querySelectorAll))&&(i(function(e){q.appendChild(e).innerHTML="",e.querySelectorAll("[msallowcapture^='']").length&&F.push("[*^$]="+ne+"*(?:''|\"\")"),e.querySelectorAll("[selected]").length||F.push("\\["+ne+"*(?:value|"+te+")"),e.querySelectorAll("[id~="+I+"-]").length||F.push("~="),e.querySelectorAll(":checked").length||F.push(":checked"),e.querySelectorAll("a#"+I+"+*").length||F.push(".#.+[+~]")}),i(function(e){var t=O.createElement("input");t.setAttribute("type","hidden"),e.appendChild(t).setAttribute("name","D"),e.querySelectorAll("[name=d]").length&&F.push("name"+ne+"*[*^$|!~]?="),e.querySelectorAll(":enabled").length||F.push(":enabled",":disabled"),e.querySelectorAll("*,:x"),F.push(",.*:")})),(w.matchesSelector=ve.test(P=q.matches||q.webkitMatchesSelector||q.mozMatchesSelector||q.oMatchesSelector||q.msMatchesSelector))&&i(function(e){w.disconnectedMatch=P.call(e,"div"),P.call(e,"[s!='']:x"),H.push("!=",oe)}),F=F.length&&new RegExp(F.join("|")),H=H.length&&new RegExp(H.join("|")),t=ve.test(q.compareDocumentPosition),R=t||ve.test(q.contains)?function(e,t){var n=9===e.nodeType?e.documentElement:e,r=t&&t.parentNode;return e===r||!(!r||1!==r.nodeType||!(n.contains?n.contains(r):e.compareDocumentPosition&&16&e.compareDocumentPosition(r)))}:function(e,t){if(t)for(;t=t.parentNode;)if(t===e)return!0;return!1},V=t?function(e,t){if(e===t)return A=!0,0;var n=!e.compareDocumentPosition-!t.compareDocumentPosition;return n?n:(n=(e.ownerDocument||e)===(t.ownerDocument||t)?e.compareDocumentPosition(t):1,1&n||!w.sortDetached&&t.compareDocumentPosition(e)===n?e===O||e.ownerDocument===M&&R(M,e)?-1:t===O||t.ownerDocument===M&&R(M,t)?1:L?ee(L,e)-ee(L,t):0:4&n?-1:1)}:function(e,t){if(e===t)return A=!0,0;var n,r=0,i=e.parentNode,o=t.parentNode,a=[e],u=[t];if(!i||!o)return e===O?-1:t===O?1:i?-1:o?1:L?ee(L,e)-ee(L,t):0;if(i===o)return s(e,t);for(n=e;n=n.parentNode;)a.unshift(n);for(n=t;n=n.parentNode;)u.unshift(n);for(;a[r]===u[r];)r++;return r?s(a[r],u[r]):a[r]===M?-1:u[r]===M?1:0},O):O},t.matches=function(e,n){return t(e,null,null,n)},t.matchesSelector=function(e,n){if((e.ownerDocument||e)!==O&&D(e),n=n.replace(le,"='$1']"),w.matchesSelector&&$&&!X[n+" "]&&(!H||!H.test(n))&&(!F||!F.test(n)))try{var r=P.call(e,n);if(r||w.disconnectedMatch||e.document&&11!==e.document.nodeType)return r}catch(e){}return t(n,O,null,[e]).length>0},t.contains=function(e,t){return(e.ownerDocument||e)!==O&&D(e),R(e,t)},t.attr=function(e,t){(e.ownerDocument||e)!==O&&D(e);var n=T.attrHandle[t.toLowerCase()],r=n&&Y.call(T.attrHandle,t.toLowerCase())?n(e,t,!$):void 0;return void 0!==r?r:w.attributes||!$?e.getAttribute(t):(r=e.getAttributeNode(t))&&r.specified?r.value:null},t.error=function(e){throw new Error("Syntax error, unrecognized expression: "+e)},t.uniqueSort=function(e){var t,n=[],r=0,i=0;if(A=!w.detectDuplicates,L=!w.sortStable&&e.slice(0),e.sort(V),A){for(;t=e[i++];)t===e[i]&&(r=n.push(i));for(;r--;)e.splice(n[r],1)}return L=null,e},S=t.getText=function(e){var t,n="",r=0,i=e.nodeType;if(i){if(1===i||9===i||11===i){if("string"==typeof e.textContent)return e.textContent;for(e=e.firstChild;e;e=e.nextSibling)n+=S(e)}else if(3===i||4===i)return e.nodeValue}else for(;t=e[r++];)n+=S(t);return n},T=t.selectors={cacheLength:50,createPseudo:r,match:de,attrHandle:{},find:{},relative:{">":{dir:"parentNode",first:!0}," ":{dir:"parentNode"},"+":{dir:"previousSibling",first:!0},"~":{dir:"previousSibling"}},preFilter:{ATTR:function(e){return e[1]=e[1].replace(be,we),e[3]=(e[3]||e[4]||e[5]||"").replace(be,we),"~="===e[2]&&(e[3]=" "+e[3]+" "),e.slice(0,4)},CHILD:function(e){return e[1]=e[1].toLowerCase(),"nth"===e[1].slice(0,3)?(e[3]||t.error(e[0]),e[4]=+(e[4]?e[5]+(e[6]||1):2*("even"===e[3]||"odd"===e[3])),e[5]=+(e[7]+e[8]||"odd"===e[3])):e[3]&&t.error(e[0]),e},PSEUDO:function(e){var t,n=!e[6]&&e[2];return de.CHILD.test(e[0])?null:(e[3]?e[2]=e[4]||e[5]||"":n&&fe.test(n)&&(t=E(n,!0))&&(t=n.indexOf(")",n.length-t)-n.length)&&(e[0]=e[0].slice(0,t),e[2]=n.slice(0,t)),e.slice(0,3))}},filter:{TAG:function(e){var t=e.replace(be,we).toLowerCase();return"*"===e?function(){return!0}:function(e){return e.nodeName&&e.nodeName.toLowerCase()===t}},CLASS:function(e){var t=B[e+" "];return t||(t=new RegExp("(^|"+ne+")"+e+"("+ne+"|$)"))&&B(e,function(e){return t.test("string"==typeof e.className&&e.className||"undefined"!=typeof e.getAttribute&&e.getAttribute("class")||"")})},ATTR:function(e,n,r){return function(i){var o=t.attr(i,e);return null==o?"!="===n:!n||(o+="","="===n?o===r:"!="===n?o!==r:"^="===n?r&&0===o.indexOf(r):"*="===n?r&&o.indexOf(r)>-1:"$="===n?r&&o.slice(-r.length)===r:"~="===n?(" "+o.replace(se," ")+" ").indexOf(r)>-1:"|="===n&&(o===r||o.slice(0,r.length+1)===r+"-"))}},CHILD:function(e,t,n,r,i){var o="nth"!==e.slice(0,3),s="last"!==e.slice(-4),a="of-type"===t;return 1===r&&0===i?function(e){return!!e.parentNode}:function(t,n,u){var c,l,f,p,d,h,g=o!==s?"nextSibling":"previousSibling",v=t.parentNode,m=a&&t.nodeName.toLowerCase(),y=!u&&!a,x=!1;if(v){if(o){for(;g;){for(p=t;p=p[g];)if(a?p.nodeName.toLowerCase()===m:1===p.nodeType)return!1;h=g="only"===e&&!h&&"nextSibling"}return!0}if(h=[s?v.firstChild:v.lastChild],s&&y){for(p=v,f=p[I]||(p[I]={}),l=f[p.uniqueID]||(f[p.uniqueID]={}),c=l[e]||[],d=c[0]===_&&c[1],x=d&&c[2],p=d&&v.childNodes[d];p=++d&&p&&p[g]||(x=d=0)||h.pop();)if(1===p.nodeType&&++x&&p===t){l[e]=[_,d,x];break}}else if(y&&(p=t,f=p[I]||(p[I]={}),l=f[p.uniqueID]||(f[p.uniqueID]={}),c=l[e]||[],d=c[0]===_&&c[1],x=d),x===!1)for(;(p=++d&&p&&p[g]||(x=d=0)||h.pop())&&((a?p.nodeName.toLowerCase()!==m:1!==p.nodeType)||!++x||(y&&(f=p[I]||(p[I]={}),l=f[p.uniqueID]||(f[p.uniqueID]={}),l[e]=[_,x]),p!==t)););return x-=i,x===r||x%r===0&&x/r>=0}}},PSEUDO:function(e,n){var i,o=T.pseudos[e]||T.setFilters[e.toLowerCase()]||t.error("unsupported pseudo: "+e);return o[I]?o(n):o.length>1?(i=[e,e,"",n],T.setFilters.hasOwnProperty(e.toLowerCase())?r(function(e,t){for(var r,i=o(e,n),s=i.length;s--;)r=ee(e,i[s]),e[r]=!(t[r]=i[s])}):function(e){return o(e,0,i)}):o}},pseudos:{not:r(function(e){var t=[],n=[],i=k(e.replace(ae,"$1"));return i[I]?r(function(e,t,n,r){for(var o,s=i(e,null,r,[]),a=e.length;a--;)(o=s[a])&&(e[a]=!(t[a]=o))}):function(e,r,o){return t[0]=e,i(t,null,o,n),t[0]=null,!n.pop()}}),has:r(function(e){return function(n){return t(e,n).length>0}}),contains:r(function(e){return e=e.replace(be,we),function(t){return(t.textContent||t.innerText||S(t)).indexOf(e)>-1}}),lang:r(function(e){return pe.test(e||"")||t.error("unsupported lang: "+e),e=e.replace(be,we).toLowerCase(),function(t){var n;do if(n=$?t.lang:t.getAttribute("xml:lang")||t.getAttribute("lang"))return n=n.toLowerCase(),n===e||0===n.indexOf(e+"-");while((t=t.parentNode)&&1===t.nodeType);return!1}}),target:function(t){var n=e.location&&e.location.hash;return n&&n.slice(1)===t.id},root:function(e){return e===q},focus:function(e){return e===O.activeElement&&(!O.hasFocus||O.hasFocus())&&!!(e.type||e.href||~e.tabIndex)},enabled:function(e){return e.disabled===!1},disabled:function(e){return e.disabled===!0},checked:function(e){var t=e.nodeName.toLowerCase();return"input"===t&&!!e.checked||"option"===t&&!!e.selected},selected:function(e){return e.parentNode&&e.parentNode.selectedIndex,e.selected===!0},empty:function(e){for(e=e.firstChild;e;e=e.nextSibling)if(e.nodeType<6)return!1;return!0},parent:function(e){return!T.pseudos.empty(e)},header:function(e){return ge.test(e.nodeName)},input:function(e){return he.test(e.nodeName)},button:function(e){var t=e.nodeName.toLowerCase();return"input"===t&&"button"===e.type||"button"===t},text:function(e){var t;return"input"===e.nodeName.toLowerCase()&&"text"===e.type&&(null==(t=e.getAttribute("type"))||"text"===t.toLowerCase())},first:c(function(){return[0]}),last:c(function(e,t){return[t-1]}),eq:c(function(e,t,n){return[n<0?n+t:n]}),even:c(function(e,t){for(var n=0;n=0;)e.push(r);return e}),gt:c(function(e,t,n){for(var r=n<0?n+t:n;++r2&&"ID"===(s=o[0]).type&&w.getById&&9===t.nodeType&&$&&T.relative[o[1].type]){if(t=(T.find.ID(s.matches[0].replace(be,we),t)||[])[0],!t)return n;c&&(t=t.parentNode),e=e.slice(o.shift().value.length)}for(i=de.needsContext.test(e)?0:o.length;i--&&(s=o[i],!T.relative[a=s.type]);)if((u=T.find[a])&&(r=u(s.matches[0].replace(be,we),ye.test(o[0].type)&&l(t.parentNode)||t))){if(o.splice(i,1),e=r.length&&p(o),!e)return K.apply(n,r),n;break}}return(c||k(e,f))(r,t,!$,n,!t||ye.test(e)&&l(t.parentNode)||t),n},w.sortStable=I.split("").sort(V).join("")===I,w.detectDuplicates=!!A,D(),w.sortDetached=i(function(e){return 1&e.compareDocumentPosition(O.createElement("div"))}),i(function(e){return e.innerHTML="","#"===e.firstChild.getAttribute("href")})||o("type|href|height|width",function(e,t,n){if(!n)return e.getAttribute(t,"type"===t.toLowerCase()?1:2)}),w.attributes&&i(function(e){return e.innerHTML="",e.firstChild.setAttribute("value",""),""===e.firstChild.getAttribute("value")})||o("value",function(e,t,n){if(!n&&"input"===e.nodeName.toLowerCase())return e.defaultValue}),i(function(e){return null==e.getAttribute("disabled")})||o(te,function(e,t,n){var r;if(!n)return e[t]===!0?t.toLowerCase():(r=e.getAttributeNode(t))&&r.specified?r.value:null}),t}(e);oe.find=le,oe.expr=le.selectors,oe.expr[":"]=oe.expr.pseudos,oe.uniqueSort=oe.unique=le.uniqueSort,oe.text=le.getText,oe.isXMLDoc=le.isXML,oe.contains=le.contains;var fe=function(e,t,n){for(var r=[],i=void 0!==n;(e=e[t])&&9!==e.nodeType;)if(1===e.nodeType){if(i&&oe(e).is(n))break;r.push(e)}return r},pe=function(e,t){for(var n=[];e;e=e.nextSibling)1===e.nodeType&&e!==t&&n.push(e);return n},de=oe.expr.match.needsContext,he=/^<([\w-]+)\s*\/?>(?:<\/\1>|)$/,ge=/^.[^:#\[\.,]*$/;oe.filter=function(e,t,n){var r=t[0];return n&&(e=":not("+e+")"),1===t.length&&1===r.nodeType?oe.find.matchesSelector(r,e)?[r]:[]:oe.find.matches(e,oe.grep(t,function(e){return 1===e.nodeType}))},oe.fn.extend({find:function(e){var t,n=this.length,r=[],i=this;if("string"!=typeof e)return this.pushStack(oe(e).filter(function(){for(t=0;t1?oe.unique(r):r),r.selector=this.selector?this.selector+" "+e:e,r},filter:function(e){return this.pushStack(r(this,e||[],!1))},not:function(e){return this.pushStack(r(this,e||[],!0))},is:function(e){return!!r(this,"string"==typeof e&&de.test(e)?oe(e):e||[],!1).length}});var ve,me=/^(?:\s*(<[\w\W]+>)[^>]*|#([\w-]*))$/,ye=oe.fn.init=function(e,t,n){var r,i;if(!e)return this;if(n=n||ve,"string"==typeof e){if(r="<"===e[0]&&">"===e[e.length-1]&&e.length>=3?[null,e,null]:me.exec(e),!r||!r[1]&&t)return!t||t.jquery?(t||n).find(e):this.constructor(t).find(e);if(r[1]){if(t=t instanceof oe?t[0]:t,oe.merge(this,oe.parseHTML(r[1],t&&t.nodeType?t.ownerDocument||t:Q,!0)),he.test(r[1])&&oe.isPlainObject(t))for(r in t)oe.isFunction(this[r])?this[r](t[r]):this.attr(r,t[r]);return this}return i=Q.getElementById(r[2]),i&&i.parentNode&&(this.length=1,this[0]=i),this.context=Q,this.selector=e,this}return e.nodeType?(this.context=this[0]=e,this.length=1,this):oe.isFunction(e)?void 0!==n.ready?n.ready(e):e(oe):(void 0!==e.selector&&(this.selector=e.selector,this.context=e.context),oe.makeArray(e,this))};ye.prototype=oe.fn,ve=oe(Q);var xe=/^(?:parents|prev(?:Until|All))/,be={children:!0,contents:!0,next:!0,prev:!0};oe.fn.extend({has:function(e){var t=oe(e,this),n=t.length;return this.filter(function(){for(var e=0;e-1:1===n.nodeType&&oe.find.matchesSelector(n,e))){o.push(n);break}return this.pushStack(o.length>1?oe.uniqueSort(o):o)},index:function(e){return e?"string"==typeof e?Z.call(oe(e),this[0]):Z.call(this,e.jquery?e[0]:e):this[0]&&this[0].parentNode?this.first().prevAll().length:-1},add:function(e,t){return this.pushStack(oe.uniqueSort(oe.merge(this.get(),oe(e,t))))},addBack:function(e){return this.add(null==e?this.prevObject:this.prevObject.filter(e))}}),oe.each({parent:function(e){var t=e.parentNode;return t&&11!==t.nodeType?t:null},parents:function(e){return fe(e,"parentNode")},parentsUntil:function(e,t,n){return fe(e,"parentNode",n)},next:function(e){return i(e,"nextSibling")},prev:function(e){return i(e,"previousSibling")},nextAll:function(e){return fe(e,"nextSibling")},prevAll:function(e){return fe(e,"previousSibling")},nextUntil:function(e,t,n){return fe(e,"nextSibling",n)},prevUntil:function(e,t,n){return fe(e,"previousSibling",n)},siblings:function(e){return pe((e.parentNode||{}).firstChild,e)},children:function(e){return pe(e.firstChild)},contents:function(e){return e.contentDocument||oe.merge([],e.childNodes)}},function(e,t){oe.fn[e]=function(n,r){var i=oe.map(this,t,n);return"Until"!==e.slice(-5)&&(r=n),r&&"string"==typeof r&&(i=oe.filter(r,i)),this.length>1&&(be[e]||oe.uniqueSort(i),xe.test(e)&&i.reverse()),this.pushStack(i)}});var we=/\S+/g;oe.Callbacks=function(e){e="string"==typeof e?o(e):oe.extend({},e);var t,n,r,i,s=[],a=[],u=-1,c=function(){for(i=e.once,r=t=!0;a.length;u=-1)for(n=a.shift();++u-1;)s.splice(n,1),n<=u&&u--}),this},has:function(e){return e?oe.inArray(e,s)>-1:s.length>0},empty:function(){return s&&(s=[]),this},disable:function(){return i=a=[],s=n="",this},disabled:function(){return!s},lock:function(){return i=a=[],n||(s=n=""),this},locked:function(){return!!i},fireWith:function(e,n){return i||(n=n||[],n=[e,n.slice?n.slice():n],a.push(n),t||c()),this},fire:function(){return l.fireWith(this,arguments),this},fired:function(){return!!r}};return l},oe.extend({Deferred:function(e){var t=[["resolve","done",oe.Callbacks("once memory"),"resolved"],["reject","fail",oe.Callbacks("once memory"),"rejected"],["notify","progress",oe.Callbacks("memory")]],n="pending",r={state:function(){return n},always:function(){return i.done(arguments).fail(arguments),this},then:function(){var e=arguments;return oe.Deferred(function(n){oe.each(t,function(t,o){var s=oe.isFunction(e[t])&&e[t];i[o[1]](function(){var e=s&&s.apply(this,arguments);e&&oe.isFunction(e.promise)?e.promise().progress(n.notify).done(n.resolve).fail(n.reject):n[o[0]+"With"](this===r?n.promise():this,s?[e]:arguments)})}),e=null}).promise()},promise:function(e){return null!=e?oe.extend(e,r):r}},i={};return r.pipe=r.then,oe.each(t,function(e,o){var s=o[2],a=o[3];r[o[1]]=s.add,a&&s.add(function(){n=a},t[1^e][2].disable,t[2][2].lock),i[o[0]]=function(){return i[o[0]+"With"](this===i?r:this,arguments),this},i[o[0]+"With"]=s.fireWith}),r.promise(i),e&&e.call(i,i),i},when:function(e){var t,n,r,i=0,o=J.call(arguments),s=o.length,a=1!==s||e&&oe.isFunction(e.promise)?s:0,u=1===a?e:oe.Deferred(),c=function(e,n,r){return function(i){n[e]=this,r[e]=arguments.length>1?J.call(arguments):i,r===t?u.notifyWith(n,r):--a||u.resolveWith(n,r)}};if(s>1)for(t=new Array(s),n=new Array(s),r=new Array(s);i0||(Te.resolveWith(Q,[oe]),oe.fn.triggerHandler&&(oe(Q).triggerHandler("ready"),oe(Q).off("ready"))))}}),oe.ready.promise=function(t){return Te||(Te=oe.Deferred(),"complete"===Q.readyState||"loading"!==Q.readyState&&!Q.documentElement.doScroll?e.setTimeout(oe.ready):(Q.addEventListener("DOMContentLoaded",s),e.addEventListener("load",s))),Te.promise(t)},oe.ready.promise();var Se=function(e,t,n,r,i,o,s){var a=0,u=e.length,c=null==n;if("object"===oe.type(n)){i=!0;for(a in n)Se(e,t,a,n[a],!0,o,s)}else if(void 0!==r&&(i=!0,oe.isFunction(r)||(s=!0),c&&(s?(t.call(e,r),t=null):(c=t,t=function(e,t,n){return c.call(oe(e),n)})),t))for(;a-1&&void 0!==n&&ke.set(this,e,t)})},null,t,arguments.length>1,null,!0)},removeData:function(e){return this.each(function(){ke.remove(this,e)})}}),oe.extend({queue:function(e,t,n){var r;if(e)return t=(t||"fx")+"queue",r=Ee.get(e,t),n&&(!r||oe.isArray(n)?r=Ee.access(e,t,oe.makeArray(n)):r.push(n)),r||[]},dequeue:function(e,t){t=t||"fx";var n=oe.queue(e,t),r=n.length,i=n.shift(),o=oe._queueHooks(e,t),s=function(){oe.dequeue(e,t)};"inprogress"===i&&(i=n.shift(),r--),i&&("fx"===t&&n.unshift("inprogress"),delete o.stop,i.call(e,s,o)),!r&&o&&o.empty.fire()},_queueHooks:function(e,t){var n=t+"queueHooks";return Ee.get(e,n)||Ee.access(e,n,{empty:oe.Callbacks("once memory").add(function(){Ee.remove(e,[t+"queue",n])})})}}),oe.fn.extend({queue:function(e,t){var n=2;return"string"!=typeof e&&(t=e,e="fx",n--),arguments.length",""],thead:[1,"","
    "],col:[2,"","
    "],tr:[2,"","
    "],td:[3,"","
    "],_default:[0,"",""]};He.optgroup=He.option,He.tbody=He.tfoot=He.colgroup=He.caption=He.thead,He.th=He.td;var Pe=/<|&#?\w+;/;!function(){var e=Q.createDocumentFragment(),t=e.appendChild(Q.createElement("div")),n=Q.createElement("input");n.setAttribute("type","radio"),n.setAttribute("checked","checked"),n.setAttribute("name","t"),t.appendChild(n),re.checkClone=t.cloneNode(!0).cloneNode(!0).lastChild.checked,t.innerHTML="",re.noCloneChecked=!!t.cloneNode(!0).lastChild.defaultValue}();var Re=/^key/,Ie=/^(?:mouse|pointer|contextmenu|drag|drop)|click/,Me=/^([^.]*)(?:\.(.+)|)/;oe.event={global:{},add:function(e,t,n,r,i){var o,s,a,u,c,l,f,p,d,h,g,v=Ee.get(e);if(v)for(n.handler&&(o=n,n=o.handler,i=o.selector),n.guid||(n.guid=oe.guid++),(u=v.events)||(u=v.events={}),(s=v.handle)||(s=v.handle=function(t){return"undefined"!=typeof oe&&oe.event.triggered!==t.type?oe.event.dispatch.apply(e,arguments):void 0}),t=(t||"").match(we)||[""],c=t.length;c--;)a=Me.exec(t[c])||[],d=g=a[1],h=(a[2]||"").split(".").sort(),d&&(f=oe.event.special[d]||{},d=(i?f.delegateType:f.bindType)||d,f=oe.event.special[d]||{},l=oe.extend({type:d,origType:g,data:r,handler:n,guid:n.guid,selector:i,needsContext:i&&oe.expr.match.needsContext.test(i),namespace:h.join(".")},o),(p=u[d])||(p=u[d]=[],p.delegateCount=0,f.setup&&f.setup.call(e,r,h,s)!==!1||e.addEventListener&&e.addEventListener(d,s)),f.add&&(f.add.call(e,l),l.handler.guid||(l.handler.guid=n.guid)),i?p.splice(p.delegateCount++,0,l):p.push(l),oe.event.global[d]=!0)},remove:function(e,t,n,r,i){var o,s,a,u,c,l,f,p,d,h,g,v=Ee.hasData(e)&&Ee.get(e);if(v&&(u=v.events)){for(t=(t||"").match(we)||[""],c=t.length;c--;)if(a=Me.exec(t[c])||[],d=g=a[1],h=(a[2]||"").split(".").sort(),d){for(f=oe.event.special[d]||{},d=(r?f.delegateType:f.bindType)||d,p=u[d]||[],a=a[2]&&new RegExp("(^|\\.)"+h.join("\\.(?:.*\\.|)")+"(\\.|$)"),s=o=p.length;o--;)l=p[o],!i&&g!==l.origType||n&&n.guid!==l.guid||a&&!a.test(l.namespace)||r&&r!==l.selector&&("**"!==r||!l.selector)||(p.splice(o,1),l.selector&&p.delegateCount--,f.remove&&f.remove.call(e,l));s&&!p.length&&(f.teardown&&f.teardown.call(e,h,v.handle)!==!1||oe.removeEvent(e,d,v.handle),delete u[d])}else for(d in u)oe.event.remove(e,d+t[c],n,r,!0);oe.isEmptyObject(u)&&Ee.remove(e,"handle events")}},dispatch:function(e){e=oe.event.fix(e);var t,n,r,i,o,s=[],a=J.call(arguments),u=(Ee.get(this,"events")||{})[e.type]||[],c=oe.event.special[e.type]||{};if(a[0]=e,e.delegateTarget=this,!c.preDispatch||c.preDispatch.call(this,e)!==!1){for(s=oe.event.handlers.call(this,e,u),t=0;(i=s[t++])&&!e.isPropagationStopped();)for(e.currentTarget=i.elem,n=0;(o=i.handlers[n++])&&!e.isImmediatePropagationStopped();)e.rnamespace&&!e.rnamespace.test(o.namespace)||(e.handleObj=o,e.data=o.data,r=((oe.event.special[o.origType]||{}).handle||o.handler).apply(i.elem,a), +void 0!==r&&(e.result=r)===!1&&(e.preventDefault(),e.stopPropagation()));return c.postDispatch&&c.postDispatch.call(this,e),e.result}},handlers:function(e,t){var n,r,i,o,s=[],a=t.delegateCount,u=e.target;if(a&&u.nodeType&&("click"!==e.type||isNaN(e.button)||e.button<1))for(;u!==this;u=u.parentNode||this)if(1===u.nodeType&&(u.disabled!==!0||"click"!==e.type)){for(r=[],n=0;n-1:oe.find(i,this,null,[u]).length),r[i]&&r.push(o);r.length&&s.push({elem:u,handlers:r})}return a]*)\/>/gi,We=/\s*$/g;oe.extend({htmlPrefilter:function(e){return e.replace(_e,"<$1>")},clone:function(e,t,n){var r,i,o,s,a=e.cloneNode(!0),u=oe.contains(e.ownerDocument,e);if(!(re.noCloneChecked||1!==e.nodeType&&11!==e.nodeType||oe.isXMLDoc(e)))for(s=l(a),o=l(e),r=0,i=o.length;r0&&f(s,!u&&l(e,"script")),a},cleanData:function(e){for(var t,n,r,i=oe.event.special,o=0;void 0!==(n=e[o]);o++)if(Ce(n)){if(t=n[Ee.expando]){if(t.events)for(r in t.events)i[r]?oe.event.remove(n,r):oe.removeEvent(n,r,t.handle);n[Ee.expando]=void 0}n[ke.expando]&&(n[ke.expando]=void 0)}}}),oe.fn.extend({domManip:T,detach:function(e){return S(this,e,!0)},remove:function(e){return S(this,e)},text:function(e){return Se(this,function(e){return void 0===e?oe.text(this):this.empty().each(function(){1!==this.nodeType&&11!==this.nodeType&&9!==this.nodeType||(this.textContent=e)})},null,e,arguments.length)},append:function(){return T(this,arguments,function(e){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var t=m(this,e);t.appendChild(e)}})},prepend:function(){return T(this,arguments,function(e){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var t=m(this,e);t.insertBefore(e,t.firstChild)}})},before:function(){return T(this,arguments,function(e){this.parentNode&&this.parentNode.insertBefore(e,this)})},after:function(){return T(this,arguments,function(e){this.parentNode&&this.parentNode.insertBefore(e,this.nextSibling)})},empty:function(){for(var e,t=0;null!=(e=this[t]);t++)1===e.nodeType&&(oe.cleanData(l(e,!1)),e.textContent="");return this},clone:function(e,t){return e=null!=e&&e,t=null==t?e:t,this.map(function(){return oe.clone(this,e,t)})},html:function(e){return Se(this,function(e){var t=this[0]||{},n=0,r=this.length;if(void 0===e&&1===t.nodeType)return t.innerHTML;if("string"==typeof e&&!We.test(e)&&!He[($e.exec(e)||["",""])[1].toLowerCase()]){e=oe.htmlPrefilter(e);try{for(;n1)},show:function(){return O(this,!0)},hide:function(){return O(this)},toggle:function(e){return"boolean"==typeof e?e?this.show():this.hide():this.each(function(){Oe(this)?oe(this).show():oe(this).hide()})}}),oe.Tween=q,q.prototype={constructor:q,init:function(e,t,n,r,i,o){this.elem=e,this.prop=n,this.easing=i||oe.easing._default,this.options=t,this.start=this.now=this.cur(),this.end=r,this.unit=o||(oe.cssNumber[n]?"":"px")},cur:function(){var e=q.propHooks[this.prop];return e&&e.get?e.get(this):q.propHooks._default.get(this)},run:function(e){var t,n=q.propHooks[this.prop];return this.options.duration?this.pos=t=oe.easing[this.easing](e,this.options.duration*e,0,1,this.options.duration):this.pos=t=e,this.now=(this.end-this.start)*t+this.start,this.options.step&&this.options.step.call(this.elem,this.now,this),n&&n.set?n.set(this):q.propHooks._default.set(this),this}},q.prototype.init.prototype=q.prototype,q.propHooks={_default:{get:function(e){var t;return 1!==e.elem.nodeType||null!=e.elem[e.prop]&&null==e.elem.style[e.prop]?e.elem[e.prop]:(t=oe.css(e.elem,e.prop,""),t&&"auto"!==t?t:0)},set:function(e){oe.fx.step[e.prop]?oe.fx.step[e.prop](e):1!==e.elem.nodeType||null==e.elem.style[oe.cssProps[e.prop]]&&!oe.cssHooks[e.prop]?e.elem[e.prop]=e.now:oe.style(e.elem,e.prop,e.now+e.unit)}}},q.propHooks.scrollTop=q.propHooks.scrollLeft={set:function(e){e.elem.nodeType&&e.elem.parentNode&&(e.elem[e.prop]=e.now)}},oe.easing={linear:function(e){return e},swing:function(e){return.5-Math.cos(e*Math.PI)/2},_default:"swing"},oe.fx=q.prototype.init,oe.fx.step={};var it,ot,st=/^(?:toggle|show|hide)$/,at=/queueHooks$/;oe.Animation=oe.extend(I,{tweeners:{"*":[function(e,t){var n=this.createTween(e,t);return c(n.elem,e,Ae.exec(t),n),n}]},tweener:function(e,t){oe.isFunction(e)?(t=e,e=["*"]):e=e.match(we);for(var n,r=0,i=e.length;r1)},removeAttr:function(e){return this.each(function(){oe.removeAttr(this,e)})}}),oe.extend({attr:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return"undefined"==typeof e.getAttribute?oe.prop(e,t,n):(1===o&&oe.isXMLDoc(e)||(t=t.toLowerCase(),i=oe.attrHooks[t]||(oe.expr.match.bool.test(t)?ut:void 0)),void 0!==n?null===n?void oe.removeAttr(e,t):i&&"set"in i&&void 0!==(r=i.set(e,n,t))?r:(e.setAttribute(t,n+""),n):i&&"get"in i&&null!==(r=i.get(e,t))?r:(r=oe.find.attr(e,t),null==r?void 0:r))},attrHooks:{type:{set:function(e,t){if(!re.radioValue&&"radio"===t&&oe.nodeName(e,"input")){var n=e.value;return e.setAttribute("type",t),n&&(e.value=n),t}}}},removeAttr:function(e,t){var n,r,i=0,o=t&&t.match(we);if(o&&1===e.nodeType)for(;n=o[i++];)r=oe.propFix[n]||n,oe.expr.match.bool.test(n)&&(e[r]=!1),e.removeAttribute(n)}}),ut={set:function(e,t,n){return t===!1?oe.removeAttr(e,n):e.setAttribute(n,n),n}},oe.each(oe.expr.match.bool.source.match(/\w+/g),function(e,t){var n=ct[t]||oe.find.attr;ct[t]=function(e,t,r){var i,o;return r||(o=ct[t],ct[t]=i,i=null!=n(e,t,r)?t.toLowerCase():null,ct[t]=o),i}});var lt=/^(?:input|select|textarea|button)$/i,ft=/^(?:a|area)$/i;oe.fn.extend({prop:function(e,t){return Se(this,oe.prop,e,t,arguments.length>1)},removeProp:function(e){return this.each(function(){delete this[oe.propFix[e]||e]})}}),oe.extend({prop:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return 1===o&&oe.isXMLDoc(e)||(t=oe.propFix[t]||t,i=oe.propHooks[t]),void 0!==n?i&&"set"in i&&void 0!==(r=i.set(e,n,t))?r:e[t]=n:i&&"get"in i&&null!==(r=i.get(e,t))?r:e[t]},propHooks:{tabIndex:{get:function(e){var t=oe.find.attr(e,"tabindex");return t?parseInt(t,10):lt.test(e.nodeName)||ft.test(e.nodeName)&&e.href?0:-1}}},propFix:{"for":"htmlFor","class":"className"}}),re.optSelected||(oe.propHooks.selected={get:function(e){var t=e.parentNode;return t&&t.parentNode&&t.parentNode.selectedIndex,null}}),oe.each(["tabIndex","readOnly","maxLength","cellSpacing","cellPadding","rowSpan","colSpan","useMap","frameBorder","contentEditable"],function(){oe.propFix[this.toLowerCase()]=this});var pt=/[\t\r\n\f]/g;oe.fn.extend({addClass:function(e){var t,n,r,i,o,s,a,u=0;if(oe.isFunction(e))return this.each(function(t){oe(this).addClass(e.call(this,t,M(this)))});if("string"==typeof e&&e)for(t=e.match(we)||[];n=this[u++];)if(i=M(n),r=1===n.nodeType&&(" "+i+" ").replace(pt," ")){for(s=0;o=t[s++];)r.indexOf(" "+o+" ")<0&&(r+=o+" ");a=oe.trim(r),i!==a&&n.setAttribute("class",a)}return this},removeClass:function(e){var t,n,r,i,o,s,a,u=0;if(oe.isFunction(e))return this.each(function(t){oe(this).removeClass(e.call(this,t,M(this)))});if(!arguments.length)return this.attr("class","");if("string"==typeof e&&e)for(t=e.match(we)||[];n=this[u++];)if(i=M(n),r=1===n.nodeType&&(" "+i+" ").replace(pt," ")){for(s=0;o=t[s++];)for(;r.indexOf(" "+o+" ")>-1;)r=r.replace(" "+o+" "," ");a=oe.trim(r),i!==a&&n.setAttribute("class",a)}return this},toggleClass:function(e,t){var n=typeof e;return"boolean"==typeof t&&"string"===n?t?this.addClass(e):this.removeClass(e):oe.isFunction(e)?this.each(function(n){oe(this).toggleClass(e.call(this,n,M(this),t),t)}):this.each(function(){var t,r,i,o;if("string"===n)for(r=0,i=oe(this),o=e.match(we)||[];t=o[r++];)i.hasClass(t)?i.removeClass(t):i.addClass(t);else void 0!==e&&"boolean"!==n||(t=M(this),t&&Ee.set(this,"__className__",t),this.setAttribute&&this.setAttribute("class",t||e===!1?"":Ee.get(this,"__className__")||""))})},hasClass:function(e){var t,n,r=0;for(t=" "+e+" ";n=this[r++];)if(1===n.nodeType&&(" "+M(n)+" ").replace(pt," ").indexOf(t)>-1)return!0;return!1}});var dt=/\r/g;oe.fn.extend({val:function(e){var t,n,r,i=this[0];{if(arguments.length)return r=oe.isFunction(e),this.each(function(n){var i;1===this.nodeType&&(i=r?e.call(this,n,oe(this).val()):e,null==i?i="":"number"==typeof i?i+="":oe.isArray(i)&&(i=oe.map(i,function(e){return null==e?"":e+""})),t=oe.valHooks[this.type]||oe.valHooks[this.nodeName.toLowerCase()],t&&"set"in t&&void 0!==t.set(this,i,"value")||(this.value=i))});if(i)return t=oe.valHooks[i.type]||oe.valHooks[i.nodeName.toLowerCase()],t&&"get"in t&&void 0!==(n=t.get(i,"value"))?n:(n=i.value,"string"==typeof n?n.replace(dt,""):null==n?"":n)}}}),oe.extend({valHooks:{option:{get:function(e){return oe.trim(e.value)}},select:{get:function(e){for(var t,n,r=e.options,i=e.selectedIndex,o="select-one"===e.type||i<0,s=o?null:[],a=o?i+1:r.length,u=i<0?a:o?i:0;u-1)&&(n=!0);return n||(e.selectedIndex=-1),o}}}}),oe.each(["radio","checkbox"],function(){oe.valHooks[this]={set:function(e,t){if(oe.isArray(t))return e.checked=oe.inArray(oe(e).val(),t)>-1}},re.checkOn||(oe.valHooks[this].get=function(e){return null===e.getAttribute("value")?"on":e.value})});var ht=/^(?:focusinfocus|focusoutblur)$/;oe.extend(oe.event,{trigger:function(t,n,r,i){var o,s,a,u,c,l,f,p=[r||Q],d=ne.call(t,"type")?t.type:t,h=ne.call(t,"namespace")?t.namespace.split("."):[];if(s=a=r=r||Q,3!==r.nodeType&&8!==r.nodeType&&!ht.test(d+oe.event.triggered)&&(d.indexOf(".")>-1&&(h=d.split("."),d=h.shift(),h.sort()),c=d.indexOf(":")<0&&"on"+d,t=t[oe.expando]?t:new oe.Event(d,"object"==typeof t&&t),t.isTrigger=i?2:3,t.namespace=h.join("."),t.rnamespace=t.namespace?new RegExp("(^|\\.)"+h.join("\\.(?:.*\\.|)")+"(\\.|$)"):null,t.result=void 0,t.target||(t.target=r),n=null==n?[t]:oe.makeArray(n,[t]),f=oe.event.special[d]||{},i||!f.trigger||f.trigger.apply(r,n)!==!1)){if(!i&&!f.noBubble&&!oe.isWindow(r)){for(u=f.delegateType||d,ht.test(u+d)||(s=s.parentNode);s;s=s.parentNode)p.push(s),a=s;a===(r.ownerDocument||Q)&&p.push(a.defaultView||a.parentWindow||e)}for(o=0;(s=p[o++])&&!t.isPropagationStopped();)t.type=o>1?u:f.bindType||d,l=(Ee.get(s,"events")||{})[t.type]&&Ee.get(s,"handle"),l&&l.apply(s,n),l=c&&s[c],l&&l.apply&&Ce(s)&&(t.result=l.apply(s,n),t.result===!1&&t.preventDefault());return t.type=d,i||t.isDefaultPrevented()||f._default&&f._default.apply(p.pop(),n)!==!1||!Ce(r)||c&&oe.isFunction(r[d])&&!oe.isWindow(r)&&(a=r[c],a&&(r[c]=null),oe.event.triggered=d,r[d](),oe.event.triggered=void 0,a&&(r[c]=a)),t.result}},simulate:function(e,t,n){var r=oe.extend(new oe.Event,n,{type:e,isSimulated:!0});oe.event.trigger(r,null,t),r.isDefaultPrevented()&&n.preventDefault()}}),oe.fn.extend({trigger:function(e,t){return this.each(function(){oe.event.trigger(e,t,this)})},triggerHandler:function(e,t){var n=this[0];if(n)return oe.event.trigger(e,t,n,!0)}}),oe.each("blur focus focusin focusout load resize scroll unload click dblclick mousedown mouseup mousemove mouseover mouseout mouseenter mouseleave change select submit keydown keypress keyup error contextmenu".split(" "),function(e,t){oe.fn[t]=function(e,n){return arguments.length>0?this.on(t,null,e,n):this.trigger(t)}}),oe.fn.extend({hover:function(e,t){return this.mouseenter(e).mouseleave(t||e)}}),re.focusin="onfocusin"in e,re.focusin||oe.each({focus:"focusin",blur:"focusout"},function(e,t){var n=function(e){oe.event.simulate(t,e.target,oe.event.fix(e))};oe.event.special[t]={setup:function(){var r=this.ownerDocument||this,i=Ee.access(r,t);i||r.addEventListener(e,n,!0),Ee.access(r,t,(i||0)+1)},teardown:function(){var r=this.ownerDocument||this,i=Ee.access(r,t)-1;i?Ee.access(r,t,i):(r.removeEventListener(e,n,!0),Ee.remove(r,t))}}});var gt=e.location,vt=oe.now(),mt=/\?/;oe.parseJSON=function(e){return JSON.parse(e+"")},oe.parseXML=function(t){var n;if(!t||"string"!=typeof t)return null;try{n=(new e.DOMParser).parseFromString(t,"text/xml")}catch(e){n=void 0}return n&&!n.getElementsByTagName("parsererror").length||oe.error("Invalid XML: "+t),n};var yt=/#.*$/,xt=/([?&])_=[^&]*/,bt=/^(.*?):[ \t]*([^\r\n]*)$/gm,wt=/^(?:about|app|app-storage|.+-extension|file|res|widget):$/,Tt=/^(?:GET|HEAD)$/,St=/^\/\//,Ct={},Et={},kt="*/".concat("*"),Nt=Q.createElement("a");Nt.href=gt.href,oe.extend({active:0,lastModified:{},etag:{},ajaxSettings:{url:gt.href,type:"GET",isLocal:wt.test(gt.protocol),global:!0,processData:!0,async:!0,contentType:"application/x-www-form-urlencoded; charset=UTF-8",accepts:{"*":kt,text:"text/plain",html:"text/html",xml:"application/xml, text/xml",json:"application/json, text/javascript"},contents:{xml:/\bxml\b/,html:/\bhtml/,json:/\bjson\b/},responseFields:{xml:"responseXML",text:"responseText",json:"responseJSON"},converters:{"* text":String,"text html":!0,"text json":oe.parseJSON,"text xml":oe.parseXML},flatOptions:{url:!0,context:!0}},ajaxSetup:function(e,t){return t?B(B(e,oe.ajaxSettings),t):B(oe.ajaxSettings,e)},ajaxPrefilter:_(Ct),ajaxTransport:_(Et),ajax:function(t,n){function r(t,n,r,a){var c,f,y,x,w,S=n;2!==b&&(b=2,u&&e.clearTimeout(u),i=void 0,s=a||"",T.readyState=t>0?4:0,c=t>=200&&t<300||304===t,r&&(x=z(p,T,r)),x=X(p,x,T,c),c?(p.ifModified&&(w=T.getResponseHeader("Last-Modified"),w&&(oe.lastModified[o]=w),w=T.getResponseHeader("etag"),w&&(oe.etag[o]=w)),204===t||"HEAD"===p.type?S="nocontent":304===t?S="notmodified":(S=x.state,f=x.data,y=x.error,c=!y)):(y=S,!t&&S||(S="error",t<0&&(t=0))),T.status=t,T.statusText=(n||S)+"",c?g.resolveWith(d,[f,S,T]):g.rejectWith(d,[T,S,y]),T.statusCode(m),m=void 0,l&&h.trigger(c?"ajaxSuccess":"ajaxError",[T,p,c?f:y]),v.fireWith(d,[T,S]),l&&(h.trigger("ajaxComplete",[T,p]),--oe.active||oe.event.trigger("ajaxStop")))}"object"==typeof t&&(n=t,t=void 0),n=n||{};var i,o,s,a,u,c,l,f,p=oe.ajaxSetup({},n),d=p.context||p,h=p.context&&(d.nodeType||d.jquery)?oe(d):oe.event,g=oe.Deferred(),v=oe.Callbacks("once memory"),m=p.statusCode||{},y={},x={},b=0,w="canceled",T={readyState:0,getResponseHeader:function(e){var t;if(2===b){if(!a)for(a={};t=bt.exec(s);)a[t[1].toLowerCase()]=t[2];t=a[e.toLowerCase()]}return null==t?null:t},getAllResponseHeaders:function(){return 2===b?s:null},setRequestHeader:function(e,t){var n=e.toLowerCase();return b||(e=x[n]=x[n]||e,y[e]=t),this},overrideMimeType:function(e){return b||(p.mimeType=e),this},statusCode:function(e){var t;if(e)if(b<2)for(t in e)m[t]=[m[t],e[t]];else T.always(e[T.status]);return this},abort:function(e){var t=e||w;return i&&i.abort(t),r(0,t),this}};if(g.promise(T).complete=v.add,T.success=T.done,T.error=T.fail,p.url=((t||p.url||gt.href)+"").replace(yt,"").replace(St,gt.protocol+"//"),p.type=n.method||n.type||p.method||p.type,p.dataTypes=oe.trim(p.dataType||"*").toLowerCase().match(we)||[""],null==p.crossDomain){c=Q.createElement("a");try{c.href=p.url,c.href=c.href,p.crossDomain=Nt.protocol+"//"+Nt.host!=c.protocol+"//"+c.host}catch(e){p.crossDomain=!0}}if(p.data&&p.processData&&"string"!=typeof p.data&&(p.data=oe.param(p.data,p.traditional)),W(Ct,p,n,T),2===b)return T;l=oe.event&&p.global,l&&0===oe.active++&&oe.event.trigger("ajaxStart"),p.type=p.type.toUpperCase(),p.hasContent=!Tt.test(p.type),o=p.url,p.hasContent||(p.data&&(o=p.url+=(mt.test(o)?"&":"?")+p.data,delete p.data),p.cache===!1&&(p.url=xt.test(o)?o.replace(xt,"$1_="+vt++):o+(mt.test(o)?"&":"?")+"_="+vt++)),p.ifModified&&(oe.lastModified[o]&&T.setRequestHeader("If-Modified-Since",oe.lastModified[o]),oe.etag[o]&&T.setRequestHeader("If-None-Match",oe.etag[o])),(p.data&&p.hasContent&&p.contentType!==!1||n.contentType)&&T.setRequestHeader("Content-Type",p.contentType),T.setRequestHeader("Accept",p.dataTypes[0]&&p.accepts[p.dataTypes[0]]?p.accepts[p.dataTypes[0]]+("*"!==p.dataTypes[0]?", "+kt+"; q=0.01":""):p.accepts["*"]);for(f in p.headers)T.setRequestHeader(f,p.headers[f]);if(p.beforeSend&&(p.beforeSend.call(d,T,p)===!1||2===b))return T.abort();w="abort";for(f in{success:1,error:1,complete:1})T[f](p[f]);if(i=W(Et,p,n,T)){if(T.readyState=1,l&&h.trigger("ajaxSend",[T,p]),2===b)return T;p.async&&p.timeout>0&&(u=e.setTimeout(function(){T.abort("timeout")},p.timeout));try{b=1,i.send(y,r)}catch(e){if(!(b<2))throw e;r(-1,e)}}else r(-1,"No Transport");return T},getJSON:function(e,t,n){return oe.get(e,t,n,"json")},getScript:function(e,t){return oe.get(e,void 0,t,"script")}}),oe.each(["get","post"],function(e,t){oe[t]=function(e,n,r,i){return oe.isFunction(n)&&(i=i||r,r=n,n=void 0),oe.ajax(oe.extend({url:e,type:t,dataType:i,data:n,success:r},oe.isPlainObject(e)&&e))}}),oe._evalUrl=function(e){return oe.ajax({url:e,type:"GET",dataType:"script",async:!1,global:!1,"throws":!0})},oe.fn.extend({wrapAll:function(e){var t;return oe.isFunction(e)?this.each(function(t){oe(this).wrapAll(e.call(this,t))}):(this[0]&&(t=oe(e,this[0].ownerDocument).eq(0).clone(!0),this[0].parentNode&&t.insertBefore(this[0]),t.map(function(){for(var e=this;e.firstElementChild;)e=e.firstElementChild;return e}).append(this)),this)},wrapInner:function(e){return oe.isFunction(e)?this.each(function(t){oe(this).wrapInner(e.call(this,t))}):this.each(function(){var t=oe(this),n=t.contents();n.length?n.wrapAll(e):t.append(e)})},wrap:function(e){var t=oe.isFunction(e);return this.each(function(n){oe(this).wrapAll(t?e.call(this,n):e)})},unwrap:function(){return this.parent().each(function(){oe.nodeName(this,"body")||oe(this).replaceWith(this.childNodes)}).end()}}),oe.expr.filters.hidden=function(e){return!oe.expr.filters.visible(e)},oe.expr.filters.visible=function(e){return e.offsetWidth>0||e.offsetHeight>0||e.getClientRects().length>0};var jt=/%20/g,Lt=/\[\]$/,At=/\r?\n/g,Dt=/^(?:submit|button|image|reset|file)$/i,Ot=/^(?:input|select|textarea|keygen)/i;oe.param=function(e,t){var n,r=[],i=function(e,t){t=oe.isFunction(t)?t():null==t?"":t,r[r.length]=encodeURIComponent(e)+"="+encodeURIComponent(t)};if(void 0===t&&(t=oe.ajaxSettings&&oe.ajaxSettings.traditional),oe.isArray(e)||e.jquery&&!oe.isPlainObject(e))oe.each(e,function(){i(this.name,this.value)});else for(n in e)V(n,e[n],t,i);return r.join("&").replace(jt,"+")},oe.fn.extend({serialize:function(){return oe.param(this.serializeArray())},serializeArray:function(){return this.map(function(){var e=oe.prop(this,"elements");return e?oe.makeArray(e):this}).filter(function(){var e=this.type;return this.name&&!oe(this).is(":disabled")&&Ot.test(this.nodeName)&&!Dt.test(e)&&(this.checked||!qe.test(e))}).map(function(e,t){var n=oe(this).val();return null==n?null:oe.isArray(n)?oe.map(n,function(e){return{name:t.name,value:e.replace(At,"\r\n")}}):{name:t.name,value:n.replace(At,"\r\n")}}).get()}}),oe.ajaxSettings.xhr=function(){try{return new e.XMLHttpRequest}catch(e){}};var qt={0:200,1223:204},$t=oe.ajaxSettings.xhr();re.cors=!!$t&&"withCredentials"in $t,re.ajax=$t=!!$t,oe.ajaxTransport(function(t){var n,r;if(re.cors||$t&&!t.crossDomain)return{send:function(i,o){var s,a=t.xhr();if(a.open(t.type,t.url,t.async,t.username,t.password),t.xhrFields)for(s in t.xhrFields)a[s]=t.xhrFields[s];t.mimeType&&a.overrideMimeType&&a.overrideMimeType(t.mimeType),t.crossDomain||i["X-Requested-With"]||(i["X-Requested-With"]="XMLHttpRequest");for(s in i)a.setRequestHeader(s,i[s]);n=function(e){return function(){n&&(n=r=a.onload=a.onerror=a.onabort=a.onreadystatechange=null,"abort"===e?a.abort():"error"===e?"number"!=typeof a.status?o(0,"error"):o(a.status,a.statusText):o(qt[a.status]||a.status,a.statusText,"text"!==(a.responseType||"text")||"string"!=typeof a.responseText?{binary:a.response}:{text:a.responseText},a.getAllResponseHeaders()))}},a.onload=n(),r=a.onerror=n("error"),void 0!==a.onabort?a.onabort=r:a.onreadystatechange=function(){4===a.readyState&&e.setTimeout(function(){n&&r()})},n=n("abort");try{a.send(t.hasContent&&t.data||null)}catch(e){if(n)throw e}},abort:function(){n&&n()}}}),oe.ajaxSetup({accepts:{script:"text/javascript, application/javascript, application/ecmascript, application/x-ecmascript"},contents:{script:/\b(?:java|ecma)script\b/},converters:{"text script":function(e){return oe.globalEval(e),e}}}),oe.ajaxPrefilter("script",function(e){void 0===e.cache&&(e.cache=!1),e.crossDomain&&(e.type="GET")}),oe.ajaxTransport("script",function(e){if(e.crossDomain){var t,n;return{send:function(r,i){t=oe("