behavior.json

{
    "$schema": "http://json-schema.org/draft-04/schema#",
    "definitions": {
        "behavior": {
            "title": "Behavior",
	        "type": "object",
            "description": "A Behavior corresponds to the specific purpose behind a particular snippet of code, as executed by a malware instance. Examples include keylogging, detecting a virtual machine, and installing a backdoor. Behaviors may be composed of one or more Malware Actions, thereby providing context to these Actions.",
            "properties": {
                "type": {
                    "type": "string",
                    "enum": ["behavior"]
                },
                "id": {
                    "type": "string",
                    "description": "Specifies a unique ID for this Behavior."
                },
                "name": {
                    "type": "string",
                    "description": "Captures the name of the Behavior. The values for this property SHOULD come from the behavior-ov open vocabulary."
                },
                "description": {
                    "type": "string",
                    "description": "Specifies a textual description of the Behavior."
                },
                "timestamp": {
                    "type": "string",
                    "format": "date-time",
                    "description": "Captures the local or relative time at which the Behavior occured or was observed."
                },
                "attributes": {
                    "type": "object",
                    "description": "Captures attributes of the Behavior as name/value pairs. Dictionary keys used in this property SHOULD come from the common-attribute-ov vocabulary. The corresponding values for the keys SHOULD come from the platform-ov and encryption-algorithm-ov vocabularies."
                },
                "action_refs": {
                    "type": "array",
                    "items": {"type": "string"},
                    "description": "Captures Actions that serve as an implementation of the Behavior. Each list item specifies the unique ID of the Action being referenced. The Action MUST be present in the current Package. The ordering of the references in the list denotes the sequential ordering of the Actions with respect to the Behavior; that is, Actions at the beginning of the list MUST have occurred before those later in the list."
                },
                "technique_refs": {
                    "type": "array",
                    "items": {"$ref": "external-reference.json#/definitions/external-reference"},
                    "description": "References any techniques, such as DLL Search Order Hijacking, used to implement the Behavior. Each reference SHOULD point to a valid ATT&CK Technique or related entity."
                }
            },
            "required": [
                "id",
                "type",
                "name"
            ]
        }
    }
}