Malware Behavior Catalog v2.x Expressed in STIX 2.1

The Malware Behavior Catalog v2.3 has been expressed in STIX 2.1 JSON using the STIX 2.1 Committee Specification 03 (CS03).

MBC v3.0 has been expressed in STIX 2.1 JSON using a new malware behavior extension.

Malware Behavior Catalog

The Malware Behavior Catalog (MBC) is a catalog of malware objectives and behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the FAQ page for answers to common questions.

STIX

Structured Threat Information Expression (STIX) is a language and serialization format used to exchange cyber threat intelligence (CTI). STIX enables organizations to share CTI with one another, including malware analysis information, in a consistent and machine-readable manner.

MBC and STIX

Details on how MBC data maps to STIX 2.1, as well as information on how to query and manipulate MBC data and how to use the MBC Content in the ATT&CK® Navigator, is given in USAGE.md.