Malware

malware

The Malware object describes the classification of known malicious software, which is intentionally designed to cause damage to a computer, server, client, or computer network.

Attributes

Caption	Name	Type	Description
Classification IDs	`classification_ids`	Integer[]	The list of normalized identifiers of the malware classifications. `1`: Adware (`ADWARE`) `2`: Backdoor (`BACKDOOR`) `3`: Bot (`BOT`) `4`: Bootkit (`BOOTKIT`) `5`: DDOS (`DDOS`) `6`: Downloader (`DOWNLOADER`) `7`: Dropper (`DROPPER`) `8`: Exploit-Kit (`EXPLOIT_KIT`) `9`: Keylogger (`KEYLOGGER`) `10`: Ransomware (`RANSOMWARE`) `11`: Remote-Access-Trojan (`REMOTE_ACCESS_TROJAN`) `13`: Resource-Exploitation (`RESOURCE_EXPLOITATION`) `14`: Rogue-Security-Software (`ROGUE_SECURITY_SOFTWARE`) `15`: Rootkit (`ROOTKIT`) `16`: Screen-Capture (`SCREEN_CAPTURE`) `17`: Spyware (`SPYWARE`) `18`: Trojan (`TROJAN`) `19`: Virus (`VIRUS`) `20`: Webshell (`WEBSHELL`) `21`: Wiper (`WIPER`) `22`: Worm (`WORM`) `0`: Unknown (`UNKNOWN`) `99`: Other (`OTHER`)
Classifications	`classifications`	String[]	The list of malware classifications, normalized to the captions of the classification_ids values. In the case of 'Other', they are defined by the event source.
CVE List	`cves`	CVE[]	The list of Common Vulnerabilities and Exposures (CVE) identifiers associated with the malware. Reference: CVE
Files	`files`	File[]	Entity:`FILE` The list of file objects representing files that were identified as infected by the malware.
Name	`name`	String	The malware name, as reported by the detection engine.
Number of Infected Entities	`num_infected`	Integer	The number of files that were identified to be infected by the malware.
Path	`path`	File Path	Entity:`FILE_PATH` The filesystem path of the malware that was observed. 🚧 WARNING: DEPRECATED Path has been deprecated since 1.5.0. Use file.path attribute available via files.
Provider	`provider`	String	The name or identifier of the security solution or service that provided the malware detection information.
Raw Data	`raw_data`	JSON	Group:`context` The event data as received from the event source.
Record ID	`record_id`	String	Group:`primary` Unique identifier for the object
Severity	`severity`	String	The severity of the malware, normalized to the captions of the severity_id values. In the case of 'Other', they are defined by the event source.
Severity ID	`severity_id`	Integer	The normalized identifier of the malware severity. `0`: Unknown (`UNKNOWN`) `1`: Informational (`INFORMATIONAL`) `2`: Low (`LOW`) `3`: Medium (`MEDIUM`) `4`: High (`HIGH`) `5`: Critical (`CRITICAL`) `6`: Fatal (`FATAL`) `99`: Other (`OTHER`)
Unique ID	`uid`	String	A unique identifier for the specific malware instance, as assigned by the detection engine (e.g., virus signature ID or IPS rule ID).
Unmapped	`unmapped`	Unmapped[]	Data from the source that was not mapped into the schema.

Relationships

Inbound Relationships

These objects and events reference Malware in their attributes:

Outbound Relationships

Malware references the following objects and events in its attributes:

This page describes qdm-1.5.1+ocsf-1.6.0