Malware#

Tip

This entity is analogous to these STIX objects:

When exported as EclecticIQ JSON and ingested into EclecticIQ Intelligence Center 2.14, it is ingested as a TTP entity. See Compatibility with 2.14.

Create an Malware entity by selecting:

  • In the side navigation bar + Create > Malware.

Or:

  • (Requires EclecticIQ Labs: Intelligence creation on the graph)

    In the top navigation bar of a graph, select + and then select one of the following to create a draft entity:

    • Malware: Creates a Malware entity.

    • Malware family: Creates a Malware entity with the is family check box selected.

  • Double-click to open the newly created draft entity to edit it.

Then, Configure this entity.

Configure#

The following sections the fields and options available.

Note

Required fields are marked with an asterisk (*).

General#

Field

EIQ JSON field

Description

Title*

data.title

Compatible with STIX 2.1 export Compatible with STIX 1.2 export

Descriptive title for this entity. See Titles and aliases.

is family

data.is_family

Compatible with STIX 2.1 export

Select this if this Malware entity represents a malware family or not.

Analysis

data.description

Compatible with STIX 2.1 export Compatible with STIX 1.2 export

Long description.

Aliases

data.aliases[]

Compatible with STIX 2.1 export Compatible with STIX 1.2 export

One or more known names to identify this malware by.

When this entity is published, also creates one malware observable for each alias here.

Types

data.malware_types[]

Compatible with STIX 2.1 export Compatible with STIX 1.2 export

Based on STIX 2.1 §10.15 Malware Types Vocabulary.

Confidence

data.confidence

Compatible with STIX 2.1 export

See Confidence scale: High Medium low.

Execution environments#

Field

EIQ JSON field

Description

Environments

data.architecture_execution_environments[]

Compatible with STIX 2.1 export

Based on STIX 2.1 §10.20 Processor Architecture Vocabulary.

Implementation language#

Field

EIQ JSON field

Description

Languages

data.implementation_languages[]

Compatible with STIX 2.1 export

Based on STIX 2.1 §10.9 Implementation Language Vocabulary.

Capabilities#

Field

EIQ JSON field

Description

Capabilities

data.capabilities[]

Compatible with STIX 2.1 export

Based on STIX 2.1 §10.14 Malware Capabilities Vocabulary.

Observables#

You can create one or more new observables and link it to the currently open entity by selecting + Observable under the Observables section.

Note

If an observable you create here matches an observable rule with an ignore action, it does not appear when the you publish the entity.

In the Add observable view that appears, fill out these fields:

Field

EIQ JSON field

Description

Type*

extracts[].kind

See Observable types

Link name*

See Observable link types

See Observable link types

Values(s)*

extracts[].value

Enter one or more values. One observable is created per value.

Values must be comma-separated, or newline-separated, but not both.

Maliciousness*

See Observable maliciousness

See Observable maliciousness

Relationships#

Add relationships to this entity by selecting + Add relationship.

See Relationships.

Meta#

The Meta section contains configuration options that allow you to attach descriptive data to the entity.

Field

EIQ JSON field

Description

Estimated threat start time

meta.estimated_threat_start_time

Estimated start of threat. See Time values.

Estimated threat end time

meta.estimated_threat_end_time

Estimated end of threat. See Time values.

Estimated observed time

meta.estimated_observed_time

Estimated time threat was observed. See Time values.

Half-life

meta.half_life

See Half-life.

Select one of these options:

  • Use default value: When selected, half-life for this entity is set to 720 days.

  • Override value: Set a custom value for half-life, in number of days.

Tags

meta.tags[] and meta.taxonomy_paths[]

See tags and taxonomies.

Source*

sources[]

Select one source.

Source reliability

meta.source_reliability

See source reliability.

Options:

  • Inherit from source: This entity inherits source reliability from Source.

  • Custom override: Set a source reliability value for just this entity.

Information source#

Field

EIQ JSON field

Description

Description

data.information_source.description

Description of information source.

Identity

data.information_source.identity

Name of this information source

Roles

data.information_source.roles[]

One or more information source roles. Possible values:

  • Initial Author

  • Content Enhancer/Refiner

  • Aggregator

  • Transformer/Translator

References

data.information_source.references[]

One or more URLs.

Data marking#

Descriptive metadata for entity.

Field

EIQ JSON field

Description

TLP

meta.tlp_color

Set a TLP color for this entity.

Terms of use

data.handling[].marking_structures[]

Free text field allowing you to attach terms of use to an entity. Analogous to TermsOfUseMarkingStructureType.

Simple

data.handling[].marking_structures[]

Free text field for attaching any text to an entity. Analogous to SimpleMarkingStructureType.

Workflow#

Use options here to apply workflow options to this entity.

Field

Description

Add to dataset

Select this option to add this entity to one or more datasets on Publish.

Manually enrich

Run one or more enrichers on this entity on Publish.

Save and publish#

Tip

For more information, see Draft and published entities.

Select Publish to create this entity, and make it available under + Create > Production > Published.

For more publishing options, select More Drop-down menu arrow and then one of these options:

  • Publish and new: Publish this entity, and start creating a new entity.

  • Publish and duplicate: Publish this entity, and start creating a new entity using all the values set for this entity.

Select Save draft to save this entity as a draft, and make it available under + Create > Production > Drafts. You must publish an entity to use it elsewhere on EclecticIQ Intelligence Center.

For more options while saving as a draft, select More Drop-down menu arrow and then one of these options:

  • Publish and new: Save this entity as a draft, and start creating a new entity.

  • Publish and duplicate: Save this entity as a draft, and start creating a new entity using all the values set for this draft entity.

Compatibility with 2.14#

You can export this entity type as EclecticIQ JSON and import it into EclecticIQ Intelligence Center 2.14.

When imported into 2.14, it produces a TTP entity with the following transformations:

Malware field

Mapped to 2.14 TTP field

Description

data.title

data.title

data.title field prefixed with Malware:. E.g. A Malware entity with title “Anonymous trojan” is ingested in 2.14 as a TTP with title “Malware: Anonymous trojan”.

data.aliases[]

data.behavior.malware[].names[]

N/A

data.architecture_execution_envs[]

N/A

Not ingested

data.capabilities[]

N/A

Not ingested

data.implementation_languages[]

N/A

Not ingested

data.malware_types[]

data.behavior.malware[].types[]

N/A