# STIX Patterning Language Reference ## Overview The STIX Patterning Language is used in Indicator objects to express detection conditions against STIX Cyber-observable Objects (SCOs). Patterns are enclosed in square brackets and use a path-based syntax to reference observable properties. ## Basic Syntax ### Observation Expression ``` [: ] ``` Example: ``` [file:hashes.'SHA-256' = 'aabbccdd11223344'] ``` ### Comparison Operators | Operator | Description | Example | |----------|-------------|---------| | `=` | Equal | `[file:name = 'malware.exe']` | | `!=` | Not equal | `[file:size != 0]` | | `>` | Greater than | `[file:size > 1024]` | | `<` | Less than | `[file:size < 1048576]` | | `>=` | Greater or equal | `[network-traffic:dst_port >= 1024]` | | `<=` | Less or equal | `[network-traffic:dst_port <= 65535]` | | `IN` | Value in set | `[file:name IN ('a.exe', 'b.exe')]` | | `LIKE` | SQL-like wildcard | `[file:name LIKE 'drop%']` | | `MATCHES` | Regex match | `[file:name MATCHES '^mal.*\\.exe$']` | | `ISSUBSET` | Subnet check | `[ipv4-addr:value ISSUBSET '10.0.0.0/8']` | | `ISSUPERSET` | Superset check | `[ipv4-addr:value ISSUPERSET '10.0.0.0/24']` | ## Compound Expressions ### AND (within one observation) Both conditions on the same observed data: ``` [file:name = 'malware.exe' AND file:size > 1024] ``` ### OR (within one observation) Either condition on the same observed data: ``` [file:hashes.'MD5' = 'abc123' OR file:hashes.'SHA-256' = 'def456'] ``` ### AND (across observations) Both patterns observed (possibly at different times): ``` [file:name = 'dropper.exe'] AND [network-traffic:dst_ref.value = 'evil.com'] ``` ### OR (across observations) Either pattern observed: ``` [file:name = 'variant_a.exe'] OR [file:name = 'variant_b.exe'] ``` ### NOT Negation: ``` [file:name = 'legit.exe' AND file:hashes.'MD5' != 'known_good_hash'] ``` ### FOLLOWEDBY Temporal ordering: ``` [file:name = 'dropper.exe'] FOLLOWEDBY [network-traffic:dst_ref.value = 'c2.evil.com'] ``` ## Observable Object Types and Properties ### File Observable ``` [file:name = 'sample.exe'] [file:hashes.'MD5' = 'd41d8cd98f00b204e9800998ecf8427e'] [file:hashes.'SHA-1' = 'da39a3ee5e6b4b0d3255bfef95601890afd80709'] [file:hashes.'SHA-256' = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'] [file:size > 0] [file:name LIKE '%.dll'] [file:parent_directory_ref.path = 'C:\\Windows\\Temp'] [file:content_ref.mime_type = 'application/x-dosexec'] [file:extensions.'windows-pebinary-ext'.pe_type = 'exe'] [file:extensions.'windows-pebinary-ext'.imphash = 'abc123'] ``` ### Network Traffic ``` [network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '10.0.0.1'] [network-traffic:dst_ref.type = 'domain-name' AND network-traffic:dst_ref.value = 'evil.com'] [network-traffic:dst_port = 443] [network-traffic:src_port > 1024] [network-traffic:protocols[*] = 'tcp'] [network-traffic:extensions.'http-request-ext'.request_header.'User-Agent' LIKE '%Mozilla%'] ``` ### Domain Name ``` [domain-name:value = 'malicious.example.com'] [domain-name:value MATCHES '^[a-z]{12}\\.com$'] [domain-name:resolves_to_refs[*].value = '10.0.0.1'] ``` ### IPv4 / IPv6 Address ``` [ipv4-addr:value = '198.51.100.1'] [ipv4-addr:value ISSUBSET '198.51.100.0/24'] [ipv6-addr:value = '2001:0db8::1'] ``` ### URL ``` [url:value = 'https://evil.com/payload.exe'] [url:value MATCHES 'https?://.*\\.evil\\.com/.*'] ``` ### Email Message ``` [email-message:from_ref.value = 'phish@evil.com'] [email-message:subject LIKE '%Invoice%'] [email-message:body_multipart[*].content_type = 'application/vnd.ms-excel'] ``` ### Email Address ``` [email-addr:value = 'attacker@evil.com'] [email-addr:display_name LIKE '%CEO%'] ``` ### Process ``` [process:name = 'powershell.exe'] [process:command_line MATCHES '.*-enc.*'] [process:pid = 1234] [process:image_ref.name = 'cmd.exe'] [process:parent_ref.name = 'winword.exe'] ``` ### Windows Registry Key ``` [windows-registry-key:key = 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run'] [windows-registry-key:values[*].name = 'Malware'] [windows-registry-key:values[*].data LIKE '%evil.exe%'] ``` ### User Account ``` [user-account:user_id = 'admin'] [user-account:account_login = 'administrator'] ``` ### Software ``` [software:name = 'UPX'] [software:version MATCHES '^3\\.[0-9]+'] ``` ## Common Pattern Examples for Malware Analysis ### File Hash Indicators ``` # Single SHA-256 hash [file:hashes.'SHA-256' = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'] # Multiple hashes for same file (OR) [file:hashes.'SHA-256' = 'hash1' OR file:hashes.'MD5' = 'hash2'] # File with specific hash AND name [file:hashes.'SHA-256' = 'hash1' AND file:name = 'payload.dll'] ``` ### Network IOCs ``` # C2 domain [domain-name:value = 'c2.malware.example.com'] # C2 IP with port [network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '10.0.0.1' AND network-traffic:dst_port = 8443] # URL-based IOC [url:value = 'https://evil.com/gate.php'] # DNS query pattern (DGA detection) [domain-name:value MATCHES '^[a-z]{8,12}\\.xyz$'] ``` ### Process and Behavior Indicators ``` # Suspicious PowerShell [process:name = 'powershell.exe' AND process:command_line MATCHES '.*(-e|-enc|-encodedcommand).*'] # Macro spawning cmd [process:name = 'cmd.exe' AND process:parent_ref.name = 'winword.exe'] # Registry persistence [windows-registry-key:key = 'HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' AND windows-registry-key:values[*].data MATCHES '.*\\\\Temp\\\\.*'] ``` ### Combined Indicators ``` # File dropped + C2 communication [file:hashes.'SHA-256' = 'abc123'] AND [network-traffic:dst_ref.value = 'c2.evil.com'] # Email with malicious attachment [email-message:subject LIKE '%Invoice%' AND email-message:body_multipart[*].body_raw_ref.hashes.'SHA-256' = 'abc123'] ``` ## Temporal Qualifiers ### WITHIN Time window for compound observations: ``` [file:name = 'dropper.exe'] FOLLOWEDBY [network-traffic:dst_ref.value = 'c2.evil.com'] WITHIN 300 SECONDS ``` ### REPEATS Repeated observations: ``` [network-traffic:dst_ref.value = 'c2.evil.com'] REPEATS 5 TIMES WITHIN 600 SECONDS ``` ### START / STOP Time bounds: ``` [network-traffic:dst_ref.value = 'c2.evil.com'] START t'2024-01-01T00:00:00Z' STOP t'2024-12-31T23:59:59Z' ``` ## Validation Rules 1. Patterns must be enclosed in square brackets `[ ]` 2. Object type and property are separated by `:` 3. String values use single quotes `'value'` 4. Timestamps use `t'2024-01-01T00:00:00Z'` format 5. Hash type names with special characters must be quoted: `hashes.'SHA-256'` 6. List indexing uses `[*]` for any element or `[0]` for specific index 7. Reference traversal uses `.` notation: `dst_ref.value`