Malware, Malicious Tools, and Tools

Option 1: Weapon + Tool TLO (“Weapon”) is defined to capture information about weaponized tools: malware, tools that are always/nearly always malicious, and tools used maliciously. Potentially, a flag indicates whether the item is malware. Or, maybe it doesn’t matter. TLO (“Tool”) is defined to capture information about non-malicious tools. This would be used to capture “target” information, ???

Option 2: Malware + (Tool + Relationship) TLO (“Malware”) is defined to capture information about malware (malicious software executed without the user’s intent) TLO (“Tool”) is defined to capture information about all other tools (software?). Relationships are used to indicate whether the tool is a target of an attack or is being used maliciously itself

Option 3: Malware + (Tool + Flag) TLO (“Malware”) is defined to capture information about malware (malicious software executed without the user’s intent) TLO (“Tool”) is defined to capture information about all other tools (software?). A boolean flag on tool indicates whether the TLO represents that tool being used maliciously or benignly (in addition to relationships, if any)

Scenario: Simple Indicator for Malware 1 2 3 Indicator Indicator Indicator indicates indicates indicates Weapon Title = CryptoWall [Malware = True] Malware Title = CryptoWall Malware Title = CryptoWall

Scenario: Simple Indicator for Tool 1 2 3 Indicator Indicator Indicator indicates indicates indicates Weapon Title = nmap [Malware = False] Tool Title = nmap Tool Title = nmap Used Maliciously = True uses Campaign, Actor, Attack Pattern, etc.

Scenario: Tool as Target 1 2 3 Campaign Campaign Campaign targets targets targets Tool Title = IE8 Tool Title = IE8 Tool Title = IE8 Used Maliciously = False

Option 1: Evaluation PRO CON Doesn’t require deciding whether something used maliciously is malware or a malicious tool There’s a single TLO specifically for malicious code, no interpretation required CON No TLO for “Malware”, so people* would have to understand that malware is represented as a malicious tool Flag approach is perhaps not as clean. Might be a cop out to just adding a different TLO. Fields to describe malware might be different from fields to describe malicious tools * People = developers and/or users, depending on how good tools are at abstracting away the decision

Option 2: Evaluation PRO CON Has a malware TLO, so is very easy for people to tackle that common use case Theoretically cleaner, absent of any boolean flags (which sometimes feel like an anti-pattern) CON People* need to understand (and correctly indicate) the distinction between malware and malicious tools Though, with the flag approach in option 1, they do as well. Requires using relationships to indicate whether something is malicious, which might be limiting depending on what people want to share and are able to represent Fields to describe malicious tools may be different from fields to describe normal tools * People = developers and/or users, depending on how good tools are at abstracting away the decision

Option 3: Evaluation PRO CON Has a malware TLO, so is very easy for people to understand how to tackle that common use case Still possible to indicate from just the TLO whether a tool is malicious, no relationships required CON People* need to understand (and correctly indicate) the distinction between malware and malicious tools Though, with the flag approach in option 1, they do as well. Flag approach is perhaps not as clean. Might be a cop out to just adding a different TLO. Fields to describe malicious tools may be different from fields to describe normal tools * People = developers and/or users, depending on how good tools are at abstracting away the decision

Other thoughts What are the use cases for representing non-malicious tool usage? Target seems like an obvious one: attacks often target particular software Do we fully understand this use case? How does it fit in with the Vulnerability object? Could it be more easily captured some other way to remove the need to capture benign tools? Are the fields to support this use case different than the fields to support malicious tools? Information source is another (User agent, essentially) Is this MVP? Could it just be a text string in some other object?

Other thoughts Implementations can hide things from the user I.e. if we have a “malicious-tool” TLO and they mostly do malware, they just call it malware and always set malware=true So our decisions should be based on enabling tools to make those types of decisions, and making sure busy developers can find things (not users) The difference between a boolean flag and a separate TLO is minor in some ways Separate TLO basically just allows us to have separate fields and relationships Boolean flag still requires you to make the decision just as much as a separate TLO does