# STIX 2.1 Object Reference

## Overview

STIX (Structured Threat Information Expression) 2.1 defines a set of domain objects (SDOs) and relationship objects (SROs) for representing threat intelligence. This reference covers the most commonly used objects in malware analysis reporting.

## Core Concepts

### Object Types
- **SDO (STIX Domain Object)**: Represents a concept (Malware, Indicator, Attack Pattern)
- **SRO (STIX Relationship Object)**: Links between SDOs (Relationship, Sighting)
- **SCO (STIX Cyber-observable Object)**: Technical observables (File, IPv4 Address, Domain Name)
- **Bundle**: Container for STIX objects

### Common Properties

All SDOs share these properties:

| Property | Type | Required | Description |
|----------|------|----------|-------------|
| type | string | Yes | Object type (e.g., "malware") |
| spec_version | string | Yes | Always "2.1" |
| id | identifier | Yes | Format: `type--UUID` |
| created | timestamp | Yes | ISO 8601 with Z suffix |
| modified | timestamp | Yes | ISO 8601 with Z suffix |
| created_by_ref | identifier | No | Reference to Identity |
| object_marking_refs | list | No | TLP and other markings |
| labels | list | No | Descriptive labels |
| external_references | list | No | External source references |

## STIX Domain Objects (SDOs)

### Malware

Represents a malware family or instance.

```json
{
    "type": "malware",
    "spec_version": "2.1",
    "id": "malware--1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d",
    "created": "2024-01-15T10:00:00.000Z",
    "modified": "2024-01-15T10:00:00.000Z",
    "name": "Emotet",
    "description": "Emotet is a modular banking trojan that primarily functions as a downloader or dropper of other banking trojans.",
    "malware_types": ["trojan", "downloader"],
    "is_family": true,
    "aliases": ["Heodo", "Geodo"],
    "first_seen": "2014-06-01T00:00:00Z",
    "capabilities": ["accesses-remote-machines", "exfiltrates-data"],
    "object_marking_refs": ["marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"]
}
```

**Key properties**:
- `malware_types`: adware, backdoor, bot, bootkit, ddos, downloader, dropper, exploit-kit, keylogger, ransomware, remote-access-trojan, rootkit, spyware, trojan, virus, wiper, worm
- `is_family`: true for a malware family, false for a specific instance
- `capabilities`: accesses-remote-machines, exfiltrates-data, communicates-with-c2, etc.

### Indicator

Represents a detection pattern.

```json
{
    "type": "indicator",
    "spec_version": "2.1",
    "id": "indicator--a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d",
    "created": "2024-01-15T10:00:00.000Z",
    "modified": "2024-01-15T10:00:00.000Z",
    "name": "Emotet SHA-256 Hash",
    "description": "SHA-256 hash of Emotet loader sample",
    "indicator_types": ["malicious-activity"],
    "pattern": "[file:hashes.'SHA-256' = 'aabbccdd11223344aabbccdd11223344aabbccdd11223344aabbccdd11223344']",
    "pattern_type": "stix",
    "valid_from": "2024-01-15T00:00:00Z",
    "valid_until": "2025-01-15T00:00:00Z",
    "kill_chain_phases": [
        {
            "kill_chain_name": "mitre-attack",
            "phase_name": "initial-access"
        }
    ]
}
```

**Pattern types**:
- `stix`: STIX Patterning Language (recommended)
- `pcre`: Perl Compatible Regular Expressions
- `sigma`: Sigma detection rules
- `snort`: Snort IDS rules
- `suricata`: Suricata IDS rules
- `yara`: YARA rules

### Attack Pattern

Represents a TTP, typically mapped to MITRE ATT&CK.

```json
{
    "type": "attack-pattern",
    "spec_version": "2.1",
    "id": "attack-pattern--a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d",
    "created": "2024-01-15T10:00:00.000Z",
    "modified": "2024-01-15T10:00:00.000Z",
    "name": "Process Injection",
    "description": "Adversaries may inject code into processes to evade process-based defenses and elevate privileges.",
    "external_references": [
        {
            "source_name": "mitre-attack",
            "external_id": "T1055",
            "url": "https://attack.mitre.org/techniques/T1055"
        }
    ],
    "kill_chain_phases": [
        {
            "kill_chain_name": "mitre-attack",
            "phase_name": "defense-evasion"
        },
        {
            "kill_chain_name": "mitre-attack",
            "phase_name": "privilege-escalation"
        }
    ]
}
```

### Threat Actor

Represents an individual, group, or organization believed to be operating with malicious intent.

```json
{
    "type": "threat-actor",
    "spec_version": "2.1",
    "id": "threat-actor--a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d",
    "created": "2024-01-15T10:00:00.000Z",
    "modified": "2024-01-15T10:00:00.000Z",
    "name": "APT29",
    "description": "APT29 is a threat group attributed to Russia's SVR.",
    "threat_actor_types": ["nation-state"],
    "aliases": ["Cozy Bear", "The Dukes", "NOBELIUM"],
    "roles": ["agent", "director"],
    "sophistication": "expert",
    "resource_level": "government",
    "primary_motivation": "organizational-gain"
}
```

### Campaign

Represents a grouping of adversarial behaviors.

```json
{
    "type": "campaign",
    "spec_version": "2.1",
    "id": "campaign--a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d",
    "created": "2024-01-15T10:00:00.000Z",
    "modified": "2024-01-15T10:00:00.000Z",
    "name": "Operation SolarWinds",
    "description": "Supply chain attack targeting SolarWinds Orion platform.",
    "first_seen": "2020-03-01T00:00:00Z",
    "last_seen": "2021-01-15T00:00:00Z",
    "objective": "Gain persistent access to government and corporate networks"
}
```

### Report

Container that groups related STIX objects into a coherent narrative.

```json
{
    "type": "report",
    "spec_version": "2.1",
    "id": "report--a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d",
    "created": "2024-01-15T10:00:00.000Z",
    "modified": "2024-01-15T10:00:00.000Z",
    "name": "Emotet Resurgence Analysis",
    "description": "Analysis of Emotet malware samples observed in January 2024.",
    "report_types": ["malware"],
    "published": "2024-01-15T10:00:00.000Z",
    "object_refs": [
        "malware--...",
        "indicator--...",
        "attack-pattern--...",
        "relationship--..."
    ]
}
```

## STIX Relationship Objects (SROs)

### Relationship

Links two SDOs with a named relationship type.

```json
{
    "type": "relationship",
    "spec_version": "2.1",
    "id": "relationship--a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d",
    "created": "2024-01-15T10:00:00.000Z",
    "modified": "2024-01-15T10:00:00.000Z",
    "relationship_type": "indicates",
    "source_ref": "indicator--...",
    "target_ref": "malware--...",
    "description": "This indicator's pattern matches the Emotet loader."
}
```

### Common Relationship Types

| Source | Relationship | Target | Meaning |
|--------|-------------|--------|---------|
| indicator | indicates | malware | Indicator detects this malware |
| malware | uses | attack-pattern | Malware employs this technique |
| threat-actor | uses | malware | Actor uses this malware |
| threat-actor | attributed-to | identity | Actor attributed to organization |
| campaign | uses | malware | Campaign employs this malware |
| campaign | attributed-to | threat-actor | Campaign attributed to actor |
| malware | variant-of | malware | Malware is a variant |
| malware | targets | identity | Malware targets sector/org |
| indicator | based-on | observed-data | Indicator derived from observations |

## Marking Definitions (TLP)

```json
{
    "type": "marking-definition",
    "spec_version": "2.1",
    "id": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da",
    "created": "2017-01-20T00:00:00.000Z",
    "definition_type": "tlp",
    "name": "TLP:GREEN",
    "definition": {
        "tlp": "green"
    }
}
```

| TLP Level | Sharing | Use Case |
|-----------|---------|----------|
| TLP:CLEAR | Unlimited public sharing | Public reports, general IOCs |
| TLP:GREEN | Community sharing | Sector-wide sharing, ISACs |
| TLP:AMBER | Organization + clients | Internal reports, partner sharing |
| TLP:AMBER+STRICT | Organization only | Sensitive internal reports |
| TLP:RED | Named recipients only | Highly sensitive intelligence |

## Bundle

Top-level container for STIX objects.

```json
{
    "type": "bundle",
    "id": "bundle--a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d",
    "objects": [
        { "...marking-definition..." },
        { "...malware..." },
        { "...indicator..." },
        { "...relationship..." },
        { "...report..." }
    ]
}
```

Note: Bundles do not have `spec_version`, `created`, or `modified` properties. They only contain `type`, `id`, and `objects`.