Malware

Anomali recommends to use the /api/v1/threat_model_search endpoint to retrieve a list of Malware entities. See Threat Model Search for details.

For example,

GET /api/v1/threat_model_search/?model_type=malware

GET /api/v1/malware/associated_with_intelligence/?value={value}

GET /api/v1/malware/associated_with_intelligence/?ids={comma_separated_id_list}

For example,

GET /api/v1/malware/associated_with_intelligence/?value=google.com returns all Malware associated with google.com.

GET /api/v1/malware/{id}/<entity_type>/

For example,

GET /api/v1/malware/234673/actor/ returns all actors associated with the specified Malware.

Actors associated with the Malware.

When creating Malware, specify the Actor ID. See Actors .

Attack patterns associated with the Malware.

When creating a Malware entity, specify the Attack Pattern ID.

Format used for the body text of the description: markdown or richtext

Default: markdown

Port utilized by associated command and control infrastructure.

Protocol utilized by associated command and control infrastructure.

Possible values include: custom, dns, dns_txt, http, https

Campaigns associated with the Malware.

When creating a Malware entity, specify the Campaign ID. See Campaigns.

Capabilities associated with the malware.

Possible values include: accesses-remote-machines, anti-debugging, anti-disassembly, anti-emulation, anti-memory-forensics, anti-sandbox, anti-vm, captures-input-peripherals, captures-output-peripherals, captures-system-state-data, cleans-traces-of-infection, commits-fraud, communicates-with-c2, compromises-data-availability, compromises-data-integrity, compromises-system-availability, controls-local-machine, degrades-security-software, degrades-system-updates, determines-c2-server, emails-spam, escalates-privileges, evades-av, exfiltrates-data, fingerprints-host, hides-artifacts, hides-executing-code, infects-files, infects-remote-machines, installs-other-components, persists-after-system-reboot, prevents-artifact-access, prevents-artifact-deletion, probes-network-environment, self-modifies, steals-authentication-credentials, violates-system-operational-integrity

Course of Action entities associated with the Malware.

When creating a Malware entity, specify the Course of Action ID.

datetime

Time stamp of when the Malware entity was created on ThreatStream, in UTC format.

Date is in this format: YYYYMMDDThhmmss

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

The free-form text associated with the Malware entity (as specified in the Description field in the UI).

Execution platforms associated with the Malware.

Possible values include: android, bios, bsd, ios, linux, macos, uefi, unknown, windows

Time stamp of when the malware was first observed, in UTC format.

Date is in this format: YYYYMMDDThhmmss

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

Identities associated with the Malware entity.

When creating a Malware entity, specify the Identity ID.

Implementation languages used by the Malware entity.

Possible values include: applescript, bash, c, c#, c++, go, java, javascript, lua

Incidents associated with the Malware entity.

When creating a Malware entity, specify the Incident ID.

Infrastructure entities associated with the Malware entity.

When creating a Malware entity, specify the Infrastructure ID.

Observables associated with the Malware entity on the ThreatStream platform.

When creating a Malware entit, specify the observable ID. See Intelligence.

Intrusion Sets associated with the Malware entity.

When creating a Malware entity, specify the Instrusion Set ID.

Whether the Threat Bulletin user and organization information is anonymized.

True—if information is anonymized

False—if information is not anonymized

Whether the entity is a Malware family or single malware instance.

True—if the entity is a Malware family

False—if the entitiy is a single Malware instance

Whether the Malware is public or private (including belonging to a trusted circle).

False—if the Malware is private or belongs to a Trusted Circle

True—if the Malware is public

Default: False

Time stamp of when the malware was last observed, in UTC format.

Date is in this format: YYYYMMDDThhmmss

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

Malware types associated with the Malware.

Possible values include: adware, backdoor, bootkit, bot, ddos, downloader, dropper, keylogger, exploit-kit, ransomware, remote-access-trojan, resource-exploitation, rogue-security-software, rootkit, screen-capture, spyware, trojan, unknown, virus, webshell, wiper, worm

Other Malware entities associated with the Malware entity.

When creating a Malware entity, specify the ID of Malware of interest.

Time stamp of when the Malware was last updated on ThreatStream, in UTC format.

Date is in this format: YYYYMMDDThhmmss

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

Name of the Malware entity.

Malware name is associated with your organization. Therefore, the name must be unique within your organization. However, two Malware entities with the same name can exist on ThreatStream as long as they belong to different organizations.

The name can contain up to 255 characters.

Malware entities can be in new, pending_review, review_requested, reviewed, or published statuses.

Whether the entity is remote (stored on Cloud).

Value returned for this attribute is true when the entity is remote.

Sandbox reports associated with the malware.

When creating a Malware entity, specify the Sandbox report ID. See Sandbox.

Signatures associated with the Malware entity.

When creating a Malware entity, specify the Signature ID. See Signatures.

skip_associations

(On ThreatStream OnPrem only)

By default, up to 1000 threat model and observable associations are returned with GET requests for details of a threat model entity on ThreatStream OnPrem. When a threat model entity has a large number of associations, association retrieval can take a long time and impact performance. Therefore, Anomali recommends setting the skip_associations parameter to true. This parameter is only applicable to ThreatStream OnPrem.

For example,

GET /api/v1/malware/{id}/?skip_associations=true

skip_intelligence

(On ThreatStream OnPrem only)

By default, up to 1000 Threat Model and observable associations are returned with GET requests for details of a threat model entity ThreatStream OnPrem. When a threat model entity has a large number of associations, association retrieval can take a long time and impact performance. Therefore, Anomali recommends setting the skip_intelligence parameter to true. This parameter is only applicable to ThreatStream OnPrem.

For example,

GET /api/v1/malware/{id}/?skip_intelligence=true

Time stamp of when the malware was originally created by the source, in UTC format.

Date is in this format: YYYYMMDDThhmmss

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

Time stamp of when the malware was last modified by the source, in UTC format.

Date is in this format: YYYYMMDDThhmmss

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

Tags assigned to the Malware entities.

A tag is a meaningful name or any other string value assigned to identify the information.

For example, spear phishing,exploitation.

Threat Bulletins associated with the Malware entity.

When creating a malware entity, specify the ID of the Threat Bulletin.

Traffic Light Protocol designation for the Malware entity—red, amber, amber+strict, green, clear.

Tools associated with the Malware entity.

When creating a malware entity, specify the ID of the Threat Bulletin.

TTP (Threat Bulletins) associated with the Malware entity.

When creating a Malware entity, specify the TTP ID. See TTPs (Tactics, Techniques, and Procedures).

Vulnerabilities associated with the Malware entity.

When creating a Malware entity, specify the ID of the vulnerability.