{
  "$id": "http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/schemas/sdos/malware.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "malware",
  "description": "Malware is a type of TTP that is also known as malicious code and malicious software, refers to a program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim's data, applications, or operating system (OS) or of otherwise annoying or disrupting the victim.",
  "type": "object",
  "allOf": [
    {
      "$ref": "../common/core.json"
    },
    {
      "properties": {
        "type": {
          "type": "string",
          "description": "The type of this object, which MUST be the literal `malware`.",
          "enum": [
            "malware"
          ]
        },
        "id": {
          "title": "id",
          "pattern": "^malware--"
        },
        "aliases" : {
          "type" : "array",
          "description": "Alternative names used to identify this Malware or Malware family.",
          "items" : {
            "type" : "string"
          },
          "minItems" : 1
        },
        "first_seen" : {
          "$ref": "../common/timestamp.json",
          "description": "The time that the malware instance or family was first seen."
        },
        "last_seen" : {
          "$ref": "../common/timestamp.json",
          "description": "The time that the malware family or malware instance was last seen."
        },
        "operating_system_refs" : {
          "type" : "array",
          "description": "The operating systems that the malware family or malware instance is executable on.",
          "items" : {
            "allOf": [
              {
                "$ref": "../common/identifier.json"
              },
              {
                "pattern": "^software--"
              }
            ]
          },
          "minItems" : 1
        },
        "architecture_execution_envs" : {
          "type" : "array",
          "description": "The processor architectures (e.g., x86, ARM, etc.) that the malware instance or family is executable on. Open Vocab - processor-architecture-os.",
          "items" : {
            "type" : "string"
          },
          "minItems" : 1
        },
        "implementation_languages" : {
          "type" : "array",
          "description": "The programming language(s) used to implement the malware instance or family. Open Vocab - implementation-language-ov.",
          "items" : {
            "type" : "string"
          },
          "minItems" : 1
        },
        "capabilities" : {
          "type" : "array",
          "description": "Specifies any capabilities identified for the malware instance or family. Open Vocab - malware-capabilities-ov.",
          "items" : {
            "type" : "string"
          },
          "minItems" : 1
        },
        "sample_refs" : {
          "type" : "array",
          "description": "The sample_refs property specifies a list of identifiers of the SCO file or artifact objects associated with this malware instance(s) or family.",
          "items" : {
            "type" : "string"
          },
          "minItems" : 1
        },
        "malware_types": {
          "type": "array",
          "description": "The type of malware being described. Open Vocab - malware-type-ov",
          "items": {
            "type": "string"
          },
          "minItems": 1
        },
        "name": {
          "type": "string",
          "description": "The name used to identify the Malware."
        },
        "description": {
          "type": "string",
          "description": "Provides more context and details about the Malware object."
        },
        "kill_chain_phases": {
          "type": "array",
          "description": "The list of kill chain phases for which this Malware instance can be used.",
          "items": {
            "$ref": "../common/kill-chain-phase.json"
          },
          "minItems": 1
        }
      }
    }
  ],
  "required": [
    "is_family"
  ],
  "oneOf": [
    {
      "properties": {
        "is_family" : {
          "type" : "boolean",
          "enum": [
            false
          ],
          "description" : "Whether the object represents a malware family (if true) or a malware instance (if false)."
        }
      }
    },
    {
      "properties": {
        "is_family" : {
          "type" : "boolean",
          "enum": [
            true
          ],
          "description" : "Whether the object represents a malware family (if true) or a malware instance (if false)."
        }
      },
      "required": [
        "name"
      ]
    }
  ],
  "definitions": {
    "malware-type-ov": {
      "type": "string",
      "enum": [
        "adware",
        "backdoor",
        "bot",
        "bootkit",
        "ddos",
        "downloader",
        "dropper",
        "exploit-kit",
        "keylogger",
        "ransomware",
        "remote-access-trojan",
        "resource-exploitation",
        "rogue-security-software",
        "rootkit",
        "screen-capture",
        "spyware",
        "trojan",
        "unknown",
        "virus",
        "webshell",
        "wiper",
        "worm"
      ]
    },
    "implementation-language-ov": {
      "type": "string",
      "enum": [
        "applescript",
        "bash",
        "c",
        "c++",
        "c#",
        "go",
        "java",
        "javascript",
        "lua",
        "objective-c",
        "perl",
        "php",
        "powershell",
        "python",
        "ruby",
        "scala",
        "swift",
        "typescript",
        "visual-basic",
        "x86-32",
        "x86-64"
      ]
    },
    "malware-capabilities-ov": {
      "type": "string",
      "enum": [
        "accesses-remote-machines",
        "anti-debugging",
        "anti-disassembly",
        "anti-emulation",
        "anti-memory-forensics",
        "anti-sandbox",
        "anti-vm",
        "captures-input-peripherals",
        "captures-output-peripherals",
        "captures-system-state-data",
        "cleans-traces-of-infection",
        "commits-fraud",
        "communicates-with-c2",
        "compromises-data-availability",
        "compromises-data-integrity",
        "compromises-system-availability",
        "controls-local-machine",
        "degrades-security-software",
        "degrades-system-updates",
        "determines-c2-server",
        "emails-spam",
        "escalates-privileges",
        "evades-av",
        "exfiltrates-data",
        "fingerprints-host",
        "hides-artifacts",
        "hides-executing-code",
        "infects-files",
        "infects-remote-machines",
        "installs-other-components",
        "persists-after-system-reboot",
        "prevents-artifact-access",
        "prevents-artifact-deletion",
        "probes-network-environment",
        "self-modifies",
        "steals-authentication-credentials",
        "violates-system-operational-integrity"
      ]
    },
    "processor-architecture-ov": {
      "type": "string",
      "enum": [
        "alpha",
        "arm",
        "ia-64",
        "mips",
        "powerpc",
        "sparc",
        "x86",
        "x86-64"
      ]
    }
  }
}
