1. Malware, Malicious Tools, and Tools

2. Option 1: Weapon + Tool
TLO (“Weapon”) is defined to capture information about weaponized tools: malware, tools that are always/nearly always malicious, and tools used maliciously. Potentially, a flag indicates whether the item is malware. Or, maybe it doesn’t matter.
TLO (“Tool”) is defined to capture information about non-malicious tools. This would be used to capture “target” information, ???

3. Option 2: Malware + (Tool + Relationship)
TLO (“Malware”) is defined to capture information about malware (malicious software executed without the user’s intent)
TLO (“Tool”) is defined to capture information about all other tools (software?). Relationships are used to indicate whether the tool is a target of an attack or is being used maliciously itself

4. Option 3: Malware + (Tool + Flag)
TLO (“Malware”) is defined to capture information about malware (malicious software executed without the user’s intent)
TLO (“Tool”) is defined to capture information about all other tools (software?). A boolean flag on tool indicates whether the TLO represents that tool being used maliciously or benignly (in addition to relationships, if any)

5. Scenario: Simple Indicator for Malware1 2 3
Indicator
Indicator
Indicator
indicates
indicates
indicates
Weapon
Title = CryptoWall
[Malware = True]
Malware
Title = CryptoWall
Malware
Title = CryptoWall

6. Scenario: Simple Indicator for Tool1 2 3
Indicator
Indicator
Indicator
indicates
indicates
indicates
Weapon
Title = nmap
[Malware = False]
Tool
Title = nmap
Tool
Title = nmap
Used Maliciously = True
uses
Campaign, Actor, Attack Pattern, etc.

7. Scenario: Tool as Target1 2 3
Campaign
Campaign
Campaign
targets
targets
targets
Tool
Title = IE8
Tool
Title = IE8
Tool
Title = IE8
Used Maliciously = False

8. Option 1: Evaluation PRO CON
Doesn’t require deciding whether something used maliciously is malware or a malicious tool
There’s a single TLO specifically for malicious code, no interpretation required
CON
No TLO for “Malware”, so people* would have to understand that malware is represented as a malicious tool
Flag approach is perhaps not as clean. Might be a cop out to just adding a different TLO.
Fields to describe malware might be different from fields to describe malicious tools
* People = developers and/or users, depending on how good tools are at abstracting away the decision

9. Option 2: Evaluation PRO CON
Has a malware TLO, so is very easy for people to tackle that common use case
Theoretically cleaner, absent of any boolean flags (which sometimes feel like an anti-pattern)
CON
People* need to understand (and correctly indicate) the distinction between malware and malicious tools
Though, with the flag approach in option 1, they do as well.
Requires using relationships to indicate whether something is malicious, which might be limiting depending on what people want to share and are able to represent
Fields to describe malicious tools may be different from fields to describe normal tools
* People = developers and/or users, depending on how good tools are at abstracting away the decision

10. Option 3: Evaluation PRO CON
Has a malware TLO, so is very easy for people to understand how to tackle that common use case
Still possible to indicate from just the TLO whether a tool is malicious, no relationships required
CON
People* need to understand (and correctly indicate) the distinction between malware and malicious tools
Though, with the flag approach in option 1, they do as well.
Flag approach is perhaps not as clean. Might be a cop out to just adding a different TLO.
Fields to describe malicious tools may be different from fields to describe normal tools
* People = developers and/or users, depending on how good tools are at abstracting away the decision

11. Other thoughts
What are the use cases for representing non-malicious tool usage?
Target seems like an obvious one: attacks often target particular software
Do we fully understand this use case? How does it fit in with the Vulnerability object?
Could it be more easily captured some other way to remove the need to capture benign tools? Are the fields to support this use case different than the fields to support malicious tools?
Information source is another (User agent, essentially)
Is this MVP? Could it just be a text string in some other object?

12. Other thoughts Implementations can hide things from the user
I.e. if we have a “malicious-tool” TLO and they mostly do malware, they just call it malware and always set malware=true
So our decisions should be based on enabling tools to make those types of decisions, and making sure busy developers can find things (not users)
The difference between a boolean flag and a separate TLO is minor in some ways
Separate TLO basically just allows us to have separate fields and relationships
Boolean flag still requires you to make the decision just as much as a separate TLO does