MAEC 5.0 Strawman - Flattened Capabilities/Structural Features

example.json

{
   "id":"package--2d42dac8-c416-42c6-bc5c-7b6dcf576fc5",
   "schema_version":"5.0",
   "malware_instances":[
      {
         "id":"malware_instance--19863c16-503e-493f-8841-16c68e39c26e",
         "instance_object_refs":[
            "object--1"
         ],
         "metadata":{
            "labels":[
               "dropper",
               "worm"
            ],
            "first_seen":"2016-01-20T12:31:12.12345Z",
            "delivery_vectors":[
               "email attachment",
               "phishing"
            ]
         },
         "capabilities":[
            {
               "name":"persistence",
               "refined_capabilities":[
                  "continuous execution"
               ],
               "behavior_refs":[
                  "behavior--2099d4c1-0e8a-49d2-8d32-f0427e1ff817"
               ]
            },
            {
               "name":"anti-behavioral analysis",
               "refined_capabilities":[
                  "anti-vm"
               ]
            }
         ],
         "os_features":[
            "named pipes",
            "windows registry keys"
         ],
         "structural_features":[
            {
               "name":"entrypoint obfuscation"
            },
            {
               "name":"symbolic obfuscation"
            }
         ],
         "behavioral_features":{
            "behavior_refs":[
               "behavior--2099d4c1-0e8a-49d2-8d32-f0427e1ff817"
            ],
            "action_refs":[
               "action--2aa73fd6-f440-4219-8d32-6929c47f0745"
            ],
            "process_tree_refs":[
               "pt--1"
            ]
         },
         "static_features":{
            "strings":[
               "foo",
               "bar",
               "test"
            ],
            "packers":[
               {
                  "name":"UPX",
                  "version":"3.0.2"
               }
            ],
            "file_headers_ref":"object--4"
         },
         "process_trees":[
            {
               "ordinal_position":0,
               "process_ref":"object--3",
               "spawned_processes":[{"ordinal_position":1}]
            }
         ]
      }
   ],
   "behaviors":[
      {
         "id":"behavior--2099d4c1-0e8a-49d2-8d32-f0427e1ff817",
         "name":"persist after system reboot",
         "description":"System reboot persistence via registry startup",
         "technique":"windows registry manipulation",
         "action_refs":[
            "action--2aa73fd6-f440-4219-8d32-6929c47f0745"
         ]
      }
   ],
   "actions":[
      {
         "id":"action--2aa73fd6-f440-4219-8d32-6929c47f0745",
         "name":"create registry key value",
         "output_object_refs":[
            "object--2"
         ]
      }
   ],
   "objects":{
      "object--1":{
         "type":"file",
         "hashes":{
            "MD5":"9d7006e30fdf15e9c8e03e62534b3a3e"
         }
      },
      "object--2":{
         "type":"windows-registry-key",
         "key":"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
         "values":[
            {
               "name":"MSInfo",
               "data":"%Windir%\\AVBgle.exe"
            }
         ]
      },
      "object--3":{
         "type":"process",
         "pid":"1234"
      },
      "object--4":{
         "type":"file",
         "hashes":{
            "MD5":"9d7006e30fdf15e9c8e03e62534b3a3e"
         },
         "extensions":{
            "windows-pebinary-ext":{
               "pe_type":"exe",
               "file_header":{
                  "machine_hex":"014c",
                  "number_of_sections":4,
                  "time_date_stamp":"2016-01-22T12:31:12",
                  "pointer_to_symbol_table_hex":"74726144",
                  "number_of_symbols":4542568,
                  "size_of_optional_header":224,
                  "characteristics_hex":"818f"
               }
            }
         }
      }
   }
}