STIX Idioms

An idiom is an example of using STIX for a typical use case, and includes sample Python code and XML.

Idiom None Use Cases Command and Control Malware Packaging Victim Targeting STIX Types Campaign Course of Action Exploit Target Incident Indicator Observable TTP Threat Actor	Use Cases	STIX Types	Description
Incident Essentials - Who, What, When
Indicator for Malicious URL
Threat Actor Leveraging Attack Patterns and Malware	Malware
Victim Targeting by Sector	Victim Targeting
Yara Test Mechanism
Malware Indicator for File Hash	Malware
Incident with Related Observables
File Hash Reputation	Reputation
Identifying a Threat Actor Profile
CVE in an Exploit Target
Linking an Indicator to Kill Chain Phase
Plain Wrapper Around Multiple Reports	Packaging
Snort Test Mechanism
Course of Action to Block Network Traffic
Kill Chains in STIX
Malware Used During an Incident	Malware
OpenIOC Test Mechanism
Victim Targeting for a Campaign	Victim Targeting
Indicator for C2 IP Address	Command and Control
Command and Control IP List	Command and Control
Defining Campaigns vs Threat Actors
Assets Affected in an Incident
Indicator to Campaign Relationship	Deprecation
Malware Characterization using MAEC	Malware
Incident vs. Indicator	Watchlist Mapping
Malicious E-mail Indicator With Attachment
Working with Identity	Identity