@mitre-attack/attack-data-model/dist/chunk-YIPWHVL6.js

A TypeScript API for the MITRE ATT&CK data model

// src/schemas/common/open-vocabulary.ts
import { z } from "zod/v4";
var MalwareTypeOV = z.enum([
  "adware",
  "backdoor",
  "bot",
  "bootkit",
  "ddos",
  "downloader",
  "dropper",
  "exploit-kit",
  "keylogger",
  "ransomware",
  "remote-access-trojan",
  "resource-exploitation",
  "rogue-security-software",
  "rootkit",
  "screen-capture",
  "spyware",
  "trojan",
  "virus",
  "webshell",
  "wiper",
  "worm",
  "unknown"
]);
var ProcessorArchitectureOV = z.enum([
  "alpha",
  "arm",
  "ia-64",
  "mips",
  "powerpc",
  "sparc",
  "x86",
  "x86-64"
]);
var ImplementationLanguageOV = z.enum([
  "applescript",
  "bash",
  "c",
  "c++",
  "c#",
  "go",
  "java",
  "javascript",
  "lua",
  "objective-c",
  "perl",
  "php",
  "powershell",
  "python",
  "ruby",
  "scala",
  "swift",
  "typescript",
  "visual-basic",
  "x86-32",
  "x86-64"
]);
var MalwareCapabilityOV = z.enum([
  "accesses-remote-machines",
  "anti-debugging",
  "anti-disassembly",
  "anti-emulation",
  "anti-memory-forensics",
  "anti-sandbox",
  "anti-vm",
  "captures-input-peripherals",
  "captures-output-peripherals",
  "captures-system-state-data",
  "cleans-traces-of-infection",
  "commits-fraud",
  "communicates-with-c2",
  "compromises-data-integrity",
  "compromises-data-availability",
  "compromises-system-availability",
  "controls-local-machine",
  "degrades-security-software",
  "degrades-system-updates",
  "determines-c2-server",
  "emails-spam",
  "escalates-privileges",
  "evades-av",
  "exfiltrates-data",
  "fingerprints-host",
  "hides-artifacts",
  "hides-executing-code",
  "infects-files",
  "infects-remote-machines",
  "installs-other-components",
  "persists-after-system-reboot",
  "prevents-artifact-access",
  "prevents-artifact-deletion",
  "probes-network-environment",
  "self-modifies",
  "steals-authentication-credentials",
  "violates-system-operational-integrity"
]);
var ToolTypeOV = z.enum([
  "denial-of-service",
  "exploitation",
  "information-gathering",
  "network-capture",
  "credential-exploitation",
  "remote-access",
  "vulnerability-scanning",
  "unknown"
]);
var IdentityClassOV = z.enum([
  "individual",
  "group",
  "system",
  "organization",
  "class",
  "unspecified"
]);
var AttackMotivationOV = z.enum([
  "accidental",
  "coercion",
  "dominance",
  "ideology",
  "notoriety",
  "organizational-gain",
  "personal-gain",
  "personal-satisfaction",
  "revenge",
  "unpredictable"
]);
var AttackResourceLevelOV = z.enum([
  "individual",
  "club",
  "contest",
  "team",
  "organization",
  "government"
]);
var IndustrySectorOV = z.enum([
  "agriculture",
  "aerospace",
  "automotive",
  "chemical",
  "commercial",
  "communications",
  "construction",
  "defense",
  "education",
  "energy",
  "entertainment",
  "financial-services",
  "government",
  "government-emergency-services",
  "government-local",
  "government-national",
  "government-public-services",
  "government-regional",
  "healthcare",
  "hospitality-leisure",
  "infrastructure",
  "infrastructure-dams",
  "infrastructure-nuclear",
  "infrastructure-water",
  "insurance",
  "manufacturing",
  "mining",
  "non-profit",
  "pharmaceuticals",
  "retail",
  "technology",
  "telecommunications",
  "transportation",
  "utilities"
]);
var MitreCollectionLayerOV = z.enum([
  "Cloud Control Plane",
  "Host",
  "Report",
  "Container",
  "Device",
  "OSINT",
  "Network"
]);
var PatternTypeOV = z.enum(["spl", "stix", "pcre", "sigma", "snort", "suricata", "yara"]).meta({
  description: "This is a non-exhaustive, open vocabulary that covers common pattern languages and is intended to characterize the pattern language that the indicator pattern is expressed in."
});
var IndicatorTypeOV = z.enum([
  "anomalous-activity",
  "anonymization",
  "benign",
  "compromised",
  "malicious-activity",
  "attribution",
  "unknown"
]).meta({
  description: "Indicator type is an open vocabulary used to categorize Indicators. It is intended to be high-level to promote consistent practices. Indicator types should not be used to capture information that can be better captured via related Malware or Attack Pattern objects. It is better to link an Indicator to a Malware object describing Poison Ivy rather than simply providing a type or label of 'poison-ivy.'"
});

export {
  MalwareTypeOV,
  ProcessorArchitectureOV,
  ImplementationLanguageOV,
  MalwareCapabilityOV,
  ToolTypeOV,
  IdentityClassOV,
  AttackMotivationOV,
  AttackResourceLevelOV,
  IndustrySectorOV,
  MitreCollectionLayerOV,
  PatternTypeOV,
  IndicatorTypeOV
};