Skip to content

Malware

The Malware object describes the classification of known malicious software, which is intentionally designed to cause damage to a computer, server, client, or computer network.

  • Extends: _entity

Attributes

Section titled “Attributes”

classification_ids

  • Type: integer_t
  • Requirement: required
  • Values:
    • 0 - Unknown: The classification is unknown.
    • 1 - Adware
    • 2 - Backdoor
    • 3 - Bot
    • 4 - Bootkit
    • 5 - DDOS
    • 6 - Downloader
    • 7 - Dropper
    • 8 - Exploit-Kit
    • 9 - Keylogger
    • 10 - Ransomware
    • 11 - Remote-Access-Trojan
    • 13 - Resource-Exploitation
    • 14 - Rogue-Security-Software
    • 15 - Rootkit
    • 16 - Screen-Capture
    • 17 - Spyware
    • 18 - Trojan
    • 19 - Virus
    • 20 - Webshell
    • 21 - Wiper
    • 22 - Worm
    • 99 - Other: The classification is not mapped. See the classifications attribute, which contains a data source specific value.

The list of normalized identifiers of the malware classifications.

name

  • Type: string_t
  • Requirement: recommended

The malware name, as reported by the detection engine.

path

  • Type: file_path_t
  • Requirement: recommended

The filesystem path of the malware that was observed.

provider

  • Type: string_t
  • Requirement: recommended

The name or identifier of the security solution or service that provided the malware detection information.

severity_id

  • Type: integer_t
  • Requirement: recommended
  • Values:
    • 0 - Unknown: The event/finding severity is unknown.
    • 1 - Informational: Informational message. No action required.
    • 2 - Low: The user decides if action is needed.
    • 3 - Medium: Action is required but the situation is not serious at this time.
    • 4 - High: Action is required immediately.
    • 5 - Critical: Action is required immediately and the scope is broad.
    • 6 - Fatal: An error occurred but it is too late to take remedial action.
    • 99 - Other: The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.

The normalized identifier of the malware severity.

uid

  • Type: string_t
  • Requirement: recommended

A unique identifier for the specific malware instance, as assigned by the detection engine (e.g., virus signature ID or IPS rule ID).

classifications

  • Type: string_t
  • Requirement: optional

The list of malware classifications, normalized to the captions of the classification_ids values. In the case of ‘Other’, they are defined by the event source.

cves

  • Type: cve
  • Requirement: optional

The list of Common Vulnerabilities and Exposures (CVE) identifiers associated with the malware. Reference: CVE

files

  • Type: file
  • Requirement: optional

The list of file objects representing files that were identified as infected by the malware.

num_infected

  • Type: integer_t
  • Requirement: optional

The number of files that were identified to be infected by the malware.

severity

  • Type: string_t
  • Requirement: optional

The severity of the malware, normalized to the captions of the severity_id values. In the case of ‘Other’, they are defined by the event source.

Constraints

Section titled “Constraints”

At least one of: name, uid

Used By

Section titled “Used By”