<commit_before>---
layout: idiom
title: Malware Characterization using MAEC
---

Analyzing malware behavior is an important part of any threat intelligence organization's job. Often, malware analysis tools will be able to output that information into a structured format called [MAEC](http://maec.mitre.org). MAEC (Malware Attribute Enumeration and Classification) is a language similar to STIX that is used to describe malware behavior at a very low level. When representing threat intelligence in STIX, it can often be useful to include a full representation of the malware behavior using MAEC in order to share it with other parties or relate its behavior to other pieces of intelligence in STIX.

## Scenario

In this scenario, the STIX describes a particular variant of Poison Ivy by giving it a name, a type, and a full characterization in MAEC.

## Data model

<img src="diagram.png" alt="Malware characterization in MAEC" class="aside-text"/>

The portion of the TTP data model that is used to represent malware is [MalwareInstanceType](/documentation/ttp/MalwareInstanceType), which is represented as a list of `Malware Instance` fields inside the TTP [BehaviorType](/documentation/ttp/BehaviorType) structure.

[MalwareInstanceType](/documentation/ttp/MalwareInstanceType) is a STIX extension point that can either be used as-is to represent basic information (name, type) about malware or can be extended to represent full malware expressions. The STIX default extension is the [MAEC4.1InstanceType](/documentation/stix-maec/MAEC4.1InstanceType) extension that uses MAEC to characterize the malware.

## XML

{% highlight xml linenos %}
<stix:TTP xsi:type="ttp:TTPType" id="example:ttp-7d9fe1f7-429d-077e-db51-92c70b8da45a">
    <ttp:Title>Poison Ivy Variant v4392-acc</ttp:Title>
    <ttp:Behavior>
        <ttp:Malware>
            <ttp:Malware_Instance xsi:type="stix-maec:MAEC4.1InstanceType">
                <ttp:Type xsi:type="stixVocabs:MalwareTypeVocab-1.0">Remote Access Trojan</ttp:Type>
                <ttp:Name>Poison Ivy Variant v4392-acc</ttp:Name>
                <stix-maec:MAEC>
                    <!-- MAEC Content Here --> 
                </stix-maec:MAEC>                        
            </ttp:Malware_Instance>
        </ttp:Malware><commit_msg>A few tweaks to the opening paragraph.<commit_after>---
layout: idiom
title: Malware Characterization using MAEC
---

Analyzing malware behavior is an important part of any threat intelligence organization's job. The results of this analysis whether from automated tools (static or dynamic) or from manual human analysis can be captured into a structured format called [MAEC](http://maec.mitre.org). MAEC (Malware Attribute Enumeration and Characterization) is a language similar to STIX that is used to describe malware behavior from the very low technical level up to the more abstract contextual levels of behaviors and capabilities. When representing threat intelligence in STIX, it can occasionally be useful to include a full representation of the malware behavior using MAEC in order to share it with other parties or relate its behavior to other pieces of intelligence in STIX.

## Scenario

In this scenario, the STIX describes a particular variant of Poison Ivy by giving it a name, a type, and a full characterization in MAEC.

## Data model

<img src="diagram.png" alt="Malware characterization in MAEC" class="aside-text"/>

The portion of the TTP data model that is used to represent malware is [MalwareInstanceType](/documentation/ttp/MalwareInstanceType), which is represented as a list of `Malware Instance` fields inside the TTP [BehaviorType](/documentation/ttp/BehaviorType) structure.

[MalwareInstanceType](/documentation/ttp/MalwareInstanceType) is a STIX extension point that can either be used as-is to represent basic information (name, type) about malware or can be extended to represent full malware expressions. The STIX default extension is the [MAEC4.1InstanceType](/documentation/stix-maec/MAEC4.1InstanceType) extension that uses MAEC to characterize the malware.

## XML

{% highlight xml linenos %}
<stix:TTP xsi:type="ttp:TTPType" id="example:ttp-7d9fe1f7-429d-077e-db51-92c70b8da45a">
    <ttp:Title>Poison Ivy Variant v4392-acc</ttp:Title>
    <ttp:Behavior>
        <ttp:Malware>
            <ttp:Malware_Instance xsi:type="stix-maec:MAEC4.1InstanceType">
                <ttp:Type xsi:type="stixVocabs:MalwareTypeVocab-1.0">Remote Access Trojan</ttp:Type>
                <ttp:Name>Poison Ivy Variant v4392-acc</ttp:Name>
                <stix-maec:MAEC>
                    <!-- MAEC Content Here --> 
                </stix-maec:MAEC>                        
            </ttp:Malware_Instance>
        </ttp:Malware>
{'fraction_non_alphanumeric': 0.07841483979763912, 'fraction_numerical': 0.01475548060708263, 'mean_word_length': 3.846782431052094, 'pattern_counts': {'":': 0, '<': 35, '<?xml version=': 0, '>': 35, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 2}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4870019', 'n_tokens_mistral': 1367, 'n_tokens_neox': 1265, 'n_words': 510}