maec_vocab.txt

 

THE MITRE CORPORATION 

THE MAEC™ LANGUAGE 

VERSION 4.1 SPECIFICATION  

MAEC DEFAULT VOCABULARIES VERSION 1.1 

 

 
 
 
 
 
 
 

 

DESIREE BECK, IVAN KIRILLOV, PENNY CHASE, MITRE 

JUNE 12, 2014 

 
 
 
 
 
 
 
Malware  Attribute  Enumeration  and  Characterization  (MAEC™)  is  a  standardized 
language for sharing structured information about malware based upon attributes such 
as behaviors, artifacts, and attack patterns. 

inaccuracy  that  currently  exists 

By  eliminating  the  ambiguity  and 
in  malware 
descriptions and by reducing reliance on signatures, MAEC aims to improve human-to-
human, human-to-tool, tool-to-tool, and tool-to-human communication about malware; 
reduce  potential  duplication  of  malware  analysis  efforts  by  researchers;  and  allow  for 
the  faster  development  of  countermeasures  by  enabling  the  ability  to  leverage 
responses to previously observed malware instances. 

 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 

Acknowledgements 
The authors would like to thank the MAEC Community for its input and help in reviewing 
this document. 
 

Trademark Information 
MAEC, the MAEC logo, CybOX, STIX, and CVE are trademarks of The MITRE Corporation.  
All other trademarks are the property of their respective owners. 
 

Warnings 
MITRE PROVIDES MAEC "AS IS" AND MAKES NO WARRANTY, EXPRESS OR IMPLIED, AS 
TO THE ACCURACY, CAPABILITY, EFFICIENCY, MERCHANTABILITY, OR FUNCTIONING OF 
MAEC. IN NO EVENT WILL MITRE BE LIABLE FOR ANY GENERAL, CONSEQUENTIAL, 
INDIRECT, INCIDENTAL, EXEMPLARY, OR SPECIAL DAMAGES, RELATED TO MAEC OR ANY 
DERIVATIVE THEREOF, WHETHER SUCH CLAIM IS BASED ON WARRANTY, CONTRACT, OR 
TORT, EVEN IF MITRE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.1 
 
Feedback 
The MAEC development team welcomes any feedback regarding the MAEC Language 
Default Vocabularies Specification. Please send any comments, questions, or 
suggestions maec@mitre.org.2

                                                      
1 For detailed information see [TOU].  
2 For more information about the MAEC Language, please visit [MAEC].  

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

ii 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

Table of Contents 
1 

2.2.1 

Overview....................................................................................... 1 
1.1 
Additional Documents and Information .............................................................. 2 
1.2  Data Model Conventions ...................................................................................... 3 
Data Model Fields and Types ........................................................................ 3 
1.2.1 
1.2.2 
XML Attributes and Elements ....................................................................... 3 
1.2.3  Non-MAEC Data Models ............................................................................... 4 
1.2.4 
Primitive Data Types ..................................................................................... 4 
Controlled Vocabularies ....................................................................................... 4 
1.3 
ID Formats ............................................................................................................ 5 
1.4 
1.5 
XML Implementation............................................................................................ 7 
1.6  Document Conventions ........................................................................................ 7 
Key Words ..................................................................................................... 7 
1.6.1 
1.6.2 
Fonts .............................................................................................................. 7 
1.6.3  Namespaces .................................................................................................. 8 
1.6.4  UML Diagrams ............................................................................................... 8 
Property Table Notation ............................................................................... 8 
1.6.5 
MAEC Default Controlled Vocabularies ....................................... 12 
2.1  Using Default Vocabularies ................................................................................ 12 
Action-Related Default Vocabularies ................................................................. 13 
2.2 
ActionObjectAssociationTypeVocab-1.0..................................................... 13 
ActionObjectAssociationTypeEnum-1.0 .............................................. 14 
2.3  Default Vocabularies for Specific Action Names ................................................ 14 
DebuggingActionNameVocab-1.0 ............................................................... 14 
DebuggingActionNameEnum-1.0 ........................................................ 15 
DeviceDriverActionNameVocab-1.1 ........................................................... 15 
DeviceDriverActionNameEnum-1.1 ..................................................... 16 
DirectoryActionNameVocab-1.1 ................................................................. 16 
DirectoryActionNameEnum-1.1 .......................................................... 17 
DiskActionNameVocab-1.1 ......................................................................... 17 
DiskActionNameEnum-1.1 ................................................................... 18 
DNSActionNameVocab-1.0 ......................................................................... 18 
DNSActionNameEnum-1.0................................................................... 19 
FileActionNameVocab-1.1 .......................................................................... 19 
FileActionNameEnum-1.1 .................................................................... 20 
FTPActionNameVocab-1.0 .......................................................................... 21 
FTPActionNameEnum-1.0.................................................................... 21 
GUIActionNameVocab-1.0 .......................................................................... 21 
GUIActionNameEnum-1.0 ................................................................... 22 
HookingActionNameVocab-1.1................................................................... 22 
HookingActionNameEnum-1.1 ............................................................ 23 

2.2.1.1 

2.3.1.1 

2.3.2.1 

2.3.3.1 

2.3.4.1 

2.3.5.1 

2.3.1 

2.3.6 

2.3.6.1 

2.3.7 

2.3.7.1 

2.3.8 

2.3.8.1 

2.3.9 

2.3.9.1 

2.3.5 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

iii 

2 

2.3.2 

2.3.3 

2.3.4 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.3.17.1 

2.3.18.1 

2.3.11 

2.3.12 

2.3.12.1 

2.3.11.1 

2.3.13.1 

2.3.16.1 

2.3.10  HTTPActionNameVocab-1.0........................................................................ 23 
2.3.10.1  HTTPActionNameEnum-1.0 ................................................................. 24 
IPCActionNameVocab-1.0 ........................................................................... 24 
IPCActionNameEnum-1.0 .................................................................... 25 
IRCActionNameVocab-1.0 ........................................................................... 26 
IRCActionNameEnum-1.0 .................................................................... 26 
2.3.13  LibraryActionNameVocab-1.1 ..................................................................... 27 
LibraryActionNameEnum-1.1 .............................................................. 27 
2.3.14  NetworkActionNameVocab-1.1 .................................................................. 28 
2.3.14.1  NetworkActionNameEnum-1.1 ........................................................... 28 
2.3.15  NetworkShareActionNameVocab-1.0 ......................................................... 29 
2.3.15.1  NetworkShareActionNameEnum-1.0 .................................................. 29 
2.3.16  ProcessActionNameVocab-1.0 .................................................................... 30 
ProcessActionNameEnum-1.0 ............................................................. 30 
2.3.17  ProcessMemoryActionNameVocab-1.0 ...................................................... 31 
ProcessMemoryActionNameEnum-1.0 ............................................... 31 
2.3.18  ProcessThreadActionNameVocab-1.0 ........................................................ 32 
ProcessThreadActionNameEnum-1.0 .................................................. 33 
2.3.19  RegistryActionNameVocab-1.0 ................................................................... 33 
2.3.19.1  RegistryActionNameEnum-1.0 ............................................................ 34 
2.3.20  ServiceActionNameVocab-1.1 .................................................................... 34 
ServiceActionNameEnum-1.1 .............................................................. 35 
2.3.21  SocketActionNameVocab-1.0 ..................................................................... 36 
SocketActionNameEnum-1.0 ............................................................... 36 
2.3.22  SynchronizationActionNameVocab-1.0 ...................................................... 37 
SynchronizationActionNameEnum-1.0 ............................................... 37 
2.3.23  SystemActionNameVocab-1.0 .................................................................... 38 
SystemActionNameEnum-1.0 .............................................................. 39 
2.3.24  UserActionNameVocab-1.1 ........................................................................ 40 
2.3.24.1  UserActionNameEnum-1.1 .................................................................. 40 
Candidate-Indicator-Related Default Vocabularies ........................................... 41 
ImportanceTypeVocab-1.0 ......................................................................... 41 
ImportanceTypeEnum-1.0 ................................................................... 41 
2.4.2  MalwareEntityTypeVocab-1.0 .................................................................... 42 
2.4.2.1  MalwareEntityTypeEnum-1.0 .............................................................. 42 
Capability-Related Default Vocabularies ........................................................... 43 
CapabilityObjectiveRelationshipTypeVocab-1.0 ......................................... 43 
CapabilityObjectiveRelationshipTypeEnum-1.0 .................................. 43 
CommonCapabilityPropertiesVocab-1.0 .................................................... 44 
CommonCapabilityPropertiesEnum-1.0 .............................................. 44 
2.5.3  MalwareCapabilityVocab-1.0 ...................................................................... 45 
2.5.3.1  MalwareCapabilityEnum-1.0 ............................................................... 45 
2.5.4  MalwareLabelVocab-1.0 ............................................................................. 46 

2.4.1 

2.4.1.1 

2.5.1 

2.5.1.1 

2.5.2 

2.5.2.1 

2.3.20.1 

2.3.21.1 

2.3.22.1 

2.3.23.1 

2.4 

2.5 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

iv 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.6.7 

2.6.7.1 

2.6.8 

2.6.8.1 

2.6.9 

2.6.4 

2.6.9.1 

2.6.5 

2.6.5.1 

2.6.6 

2.6.6.1 

2.6.1 

2.6.1.1 

2.6.2 

2.6.2.1 

2.6.3 

2.6.4.1 

2.6.3.1 

2.5.4.1  MalwareLabelEnum-1.0....................................................................... 47 
2.6  Default Vocabularies for Specific Capabilities .................................................... 50 
AntiBehavioralAnalysisPropertiesVocab-1.0 .............................................. 50 
AntiBehavioralAnalysisPropertiesEnum-1.0 ........................................ 51 
AntiBehavioralAnalysisStrategicObjectivesVocab-1.0 ................................ 51 
AntiBehavioralAnalysisStrategicObjectivesEnum-1.0 ......................... 52 
AntiBehavioralAnalysisTacticalObjectivesVocab-1.0 .................................. 52 
AntiBehavioralAnalysisTacticalObjectivesEnum-1.0 ........................... 53 
AntiCodeAnalysisStrategicObjectiveVocab-1.0 .......................................... 53 
AntiCodeAnalysisStrategicObjectivesEnum-1.0 .................................. 54 
AntiCodeAnalysisTacticalObjectiveVocab-1.0 ............................................ 54 
AntiCodeAnalysisTacticalObjectivesEnum-1.0 .................................... 55 
AntiDetectionStrategicObjectivesVocab-1.0 .............................................. 55 
AntiDetectionStrategicObjectivesEnum-1.0 ........................................ 56 
AntiDetectionTacticalObjectivesVocab-1.0 ................................................ 56 
AntiDetectionTacticalObjectivesEnum-1.0 .......................................... 57 
AntiRemovalStrategicObjectivesVocab-1.0 ................................................ 58 
AntiRemovalStrategicObjectivesEnum-1.0 ......................................... 58 
AntiRemovalTacticalObjectivesVocab-1.0 .................................................. 59 
AntiRemovalTacticalObjectivesEnum-1.0 ........................................... 59 
2.6.10  AvailabilityViolationPropertiesVocab-1.0 ................................................... 60 
2.6.10.1  AvailabilityViolationPropertiesEnum-1.0 ............................................ 60 
2.6.11  AvailabilityViolationStrategicObjectivesVocab-1.0 .................................... 61 
2.6.11.1  AvailabilityViolationStrategicObjectivesEnum-1.0 .............................. 61 
2.6.12  AvailabilityViolationTacticalObjectivesVocab-1.0 ...................................... 62 
2.6.12.1  AvailabilityViolationTacticalObjectivesEnum-1.0 ................................ 62 
2.6.13  CommandandControlPropertiesVocab-1.0 ................................................ 63 
CommandandControlPropertiesEnum-1.0 .......................................... 63 
2.6.14  CommandandControlStrategicObjectivesVocab-1.0 .................................. 64 
CommandandControlStrategicObjectivesEnum-1.0 ........................... 64 
2.6.15  CommandandControlTacticalObjectivesVocab-1.0 .................................... 65 
CommandandControlTacticalObjectivesEnum-1.0 ............................. 65 
2.6.16  DataExfiltrationPropertiesVocab-1.0 .......................................................... 66 
2.6.16.1  DataExfiltrationPropertiesEnum-1.0 ................................................... 66 
2.6.17  DataExfiltrationStrategicObjectivesVocab-1.0 ........................................... 67 
2.6.17.1  DataExfiltrationStrategicObjectivesEnum-1.0 ..................................... 67 
2.6.18  DataExfiltrationTacticalObjectivesVocab-1.0 ............................................. 68 
2.6.18.1  DataExfiltrationTacticalObjectivesEnum-1.0 ....................................... 68 
2.6.19  DataTheftPropertiesVocab-1.0 ................................................................... 69 
2.6.19.1  DataTheftPropertiesEnum-1.0 ............................................................ 70 
2.6.20  DataTheftStrategicObjectivesVocab-1.0 ..................................................... 70 
2.6.20.1  DataTheftStrategicObjectivesEnum-1.0 .............................................. 70 
2.6.21  DataTheftTacticalObjectivesVocab-1.0 ....................................................... 71 

2.6.13.1 

2.6.14.1 

2.6.15.1 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

v 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.6.29 

2.6.30 

2.6.30.1 

2.6.31 

2.6.31.1 

2.6.26.1 

2.6.27 

2.6.27.1 

2.6.28 

2.6.29.1 

2.6.28.1 

2.6.25.1 

2.6.21.1  DataTheftTacticalObjectivesEnum-1.0 ................................................ 71 
2.6.22  DestructionPropertiesVocab-1.0 ................................................................ 72 
2.6.22.1  DestructionPropertiesEnum-1.0 .......................................................... 73 
2.6.23  DestructionStrategicObjectivesVocab-1.0 .................................................. 73 
2.6.23.1  DestructionStrategicObjectivesEnum-1.0 ........................................... 74 
2.6.24  DestructionTacticalObjectivesVocab-1.0 .................................................... 74 
2.6.24.1  DestructionTacticalObjectivesEnum-1.0 ............................................. 75 
2.6.25  FraudStrategicObjectivesVocab-1.0 ........................................................... 75 
FraudStrategicObjectivesEnum-1.0 ..................................................... 75 
2.6.26  FraudTacticalObjectivesVocab-1.0 ............................................................. 76 
FraudTacticalObjectivesEnum-1.0 ....................................................... 76 
InfectionPropagationPropertiesVocab-1.0 ................................................. 77 
InfectionPropagationPropertiesEnum-1.0 .......................................... 77 
InfectionPropagationStrategicObjectivesVocab-1.0 .................................. 78 
InfectionPropagationStrategicObjectivesEnum-1.0 ............................ 78 
InfectionPropagationTacticalObjectivesVocab-1.0 .................................... 79 
InfectionPropagationTacticalObjectivesEnum-1.0 .............................. 79 
IntegrityViolationStrategicObjectivesVocab-1.0 ........................................ 80 
IntegrityViolationStrategicObjectivesEnum-1.0 .................................. 81 
IntegrityViolationTacticalObjectivesVocab-1.0 .......................................... 81 
IntegrityViolationTacticalObjectivesEnum-1.0 .................................... 82 
2.6.32  MachineAccessControlPropertiesVocab-1.0 .............................................. 82 
2.6.32.1  MachineAccessControlPropertiesEnum-1.0 ........................................ 83 
2.6.33  MachineAccessControlStrategicObjectivesVocab-1.0 ................................ 83 
2.6.33.1  MachineAccessControlStrategicObjectivesEnum-1.0 ......................... 83 
2.6.34  MachineAccessControlTacticalObjectivesVocab-1.0 .................................. 84 
2.6.34.1  MachineAccessControlTacticalObjectivesEnum-1.0 ........................... 84 
2.6.35  PersistencePropertiesVocab-1.0 ................................................................. 85 
PersistencePropertiesEnum-1.0 .......................................................... 85 
2.6.36  PersistenceStrategicObjectivesVocab-1.0 .................................................. 86 
PersistenceStrategicObjectivesEnum-1.0 ............................................ 86 
2.6.37  PersistenceTacticalObjectivesVocab-1.0 .................................................... 87 
PersistenceTacticalObjectivesEnum-1.0 .............................................. 87 
2.6.38  PrivilegeEscalationPropertiesVocab-1.0 ..................................................... 88 
PrivilegeEscalationPropertiesEnum-1.0 .............................................. 88 
2.6.39  PrivilegeEscalationStrategicObjectivesVocab-1.0....................................... 89 
PrivilegeEscalationStrategicObjectivesEnum-1.0 ................................ 89 
2.6.40  PrivilegeEscalationTacticalObjectivesVocab-1.0 ........................................ 90 
PrivilegeEscalationTacticalObjectivesEnum-1.0 .................................. 90 
2.6.41  ProbingStrategicObjectivesVocab-1.0 ........................................................ 90 
ProbingStrategicObjectivesEnum-1.0 .................................................. 91 
2.6.42  ProbingTacticalObjectivesVocab-1.0 .......................................................... 91 
ProbingTacticalObjectivesEnum-1.0 .................................................... 92 

2.6.35.1 

2.6.41.1 

2.6.42.1 

2.6.39.1 

2.6.36.1 

2.6.37.1 

2.6.38.1 

2.6.40.1 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

vi 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.6.49.1 

2.6.47.1 

2.6.48.1 

2.6.46.1 

2.6.45.1 

2.6.43  RemoteMachineManipulationStrategicObjectivesVocab-1.0 .................... 92 
2.6.43.1  RemoteMachineManipulationStrategicObjectivesEnum-1.0 ............. 93 
2.6.44  RemoteMachineManipulationTacticalObjectivesVocab-1.0 ...................... 93 
2.6.44.1  RemoteMachineManipulationTacticalObjectivesEnum-1.0 ............... 94 
2.6.45  SecondaryOperationPropertiesVocab-1.0 .................................................. 94 
SecondaryOperationPropertiesEnum-1.0 ........................................... 95 
2.6.46  SecondaryOperationStrategicObjectivesVocab-1.0 ................................... 95 
SecondaryOperationStrategicObjectivesEnum-1.0 ............................. 96 
2.6.47  SecondaryOperationTacticalObjectivesVocab-1.0 ..................................... 96 
SecondaryOperationTacticalObjectivesEnum-1.0 ............................... 97 
2.6.48  SecurityDegradationPropertiesVocab-1.0 .................................................. 97 
SecurityDegradationPropertiesEnum-1.0 ........................................... 98 
2.6.49  SecurityDegradationStrategicObjectivesVocab-1.0 .................................... 98 
SecurityDegradationStrategicObjectivesEnum-1.0 ............................. 98 
2.6.50  SecurityDegradationTacticalObjectivesVocab-1.0 ...................................... 99 
SecurityDegradationTacticalObjectivesEnum-1.0 ............................. 100 
2.6.51  SpyingStrategicObjectivesVocab-1.0 ........................................................ 101 
SpyingStrategicObjectivesEnum-1.0 .................................................. 101 
2.6.52  SpyingTacticalObjectivesVocab-1.0 .......................................................... 102 
SpyingTacticalObjectivesEnum-1.0 .................................................... 102 
2.7  Malware Subject-Related Default Vocabularies .............................................. 103 
2.7.1  MalwareConfigurationParameterVocab-1.0 ............................................ 103 
2.7.1.1  MalwareConfigurationParameterEnum-1.0 ...................................... 104 
2.7.2  MalwareDevelopmentToolVocab-1.0 ....................................................... 104 
2.7.2.1  MalwareDevelopmentToolEnum-1.0 ................................................ 105 
2.7.3  MalwareSubjectRelationshipTypeVocab-1.1 ............................................ 105 
2.7.3.1  MalwareSubjectRelationshipTypeEnum-1.1 ..................................... 106 
Package-Related Default Vocabularies ............................................................ 107 
GroupingRelationshipTypeVocab-1.0 ....................................................... 107 
GroupingRelationshipTypeEnum-1.0 ................................................ 108 
Appendix – References.......................................................................... 109 
A.1  MAEC Documents ............................................................................................. 109 
A.2  MAEC Web Pages ............................................................................................. 109 
A.3  MAEC Schema .................................................................................................. 110 
A.4  MAEC Development ......................................................................................... 110 
A.5  Other References ............................................................................................. 111 

2.8.1 

2.8.1.1 

2.6.50.1 

2.6.51.1 

2.6.52.1 

2.8 

 
 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

vii 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

1  Overview 
The Malware Attribute Enumeration and Characterization (MAEC) Language is defined by 
three data models and a set of default controlled vocabularies3. As illustrated in Figure 1-1, 
“MAEC Bundle” is the (lowest) Tier 1 data model; “MAEC Package” is the (middle) Tier 2 
data model; and “MAEC Container” is the (highest) Tier 3 data model.  All three data 
models offer a stand-alone output format, so a lower level model can be used without the 
higher tier data model (although each model level encompasses and makes use of all lower 
tiers).   

 

Figure 1-1. MAEC data models 

 
A complete discussion of the structure of the MAEC language can be found in the MAEC 
Overview [MAECO].  In brief: 
 

  MAEC Bundle – provides the ability to capture and share data obtained from the 

analysis of a single malware instance.  Its underlying structure is formed by Actions, 
Behaviors, and Capabilities. 

  MAEC Package – enables a user to capture and share MAEC characterized data for 

one or more Malware Subjects; in most such cases, the Malware Subjects are 
related. A Malware Subject is MAEC’s representation of a malware instance and all 
of the known data associated with it, including data derived from analysis and 
metadata.  

  MAEC Container – enables a user to share any collection of MAEC characterized 

data, including one or more Packages. 

 

                                                      
3 Each data model and the default vocabularies are implemented by an XML schema.  Other output formats, 
such as JSON, are being considered for future implementations. 
 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

1 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

This document serves as the specification for the MAEC default controlled vocabularies. 
Before we present the vocabularies in Section 2, we provide relevant background 
information in Subsections 1.1 through 1.6.  

1.1  Additional Documents and Information 
Numerous overview, specification, and supporting documents are available for the MAEC 
Language.  All documents are shown in Figure 1-2.  Icons are used to indicate whether the 
material is contained in an actual document (      ) or captured on a Web page (      ).  This 
document is highlighted in yellow.  
 

 

Figure 1-2.  MAEC Language v4.1 documents 

All documents can be found on the MAEC Website [MAEC], and a summary and link to 
each is provided below: 
 

  Overview: Introduces and motivates MAEC, provides an overview of the MAEC 

language, and presents a collection of high level use cases [MAECO]. 

  Detailed Use Cases: Provides explicit examples to illustrate how MAEC can be used 
to capture malware information stemming from various forms of malware analysis 
[EXAMD].  

  Characterizing Malware with MAEC and STIX: Describes the use of MAEC and STIX in 
the context of malware characterization and malware metadata exchange [MAECS]. 

  Container Specification: Specification for the MAEC Container data model [SPECC]. 

  Package Specification: Specification for the MAEC Package data model [SPECP]. 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

2 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

  Bundle Specification: Specification for the MAEC Bundle data model [MAECB].  (This 

document.) 

  Default Vocabulary Specification: Specification for the MAEC Default Vocabularies 

[SPECV]. 

  Ties to Existing Standards: Provides an overview of how MAEC is related to MMDEF, 

CybOX, CPE, CVE, and STIX [TIES]. 

  Terminology:  Contains terms associated with malware and malware analysis, as 

well as terminology that is specific to MAEC [TERM]. 

  FAQs: Frequently asked questions about MAEC including questions about the 
language, use, relationships to other efforts, and the MAEC community [FAQ]. 

  Versioning Policy: Details the current methodology for determining whether a 

revision will require a major version change, a minor version change, or an update 
version change. Note that the MAEC schemas and default vocabularies are 
versioned independently of the MAEC Language, and their version numbers may or 
may not coincide with each other or with that of the MAEC Language [VER]. 

  Requirements and Recommendations for MAEC Compatibility: Specifies 

requirements for MAEC-compatible tools, services, and repositories [REQ]. 

1.2  Data Model Conventions 
The following information and conventions are used to define the MAEC data models, and 
may or may not apply to the particular MAEC data model or vocabularies documented in 
Section 2. 

1.2.1  Data Model Fields and Types 
In Section 2, we define the types associated with the MAEC default controlled vocabulary 
fields.  It is important to understand that “fields” correspond to the malware-related 
properties captured in a MAEC document and “types” are used to define and express the 
underlying data model used in the fields.   

1.2.2  XML Attributes and Elements 
Our methodology for representing a field as either an attribute or an element in the XML 
implementation4 is based primarily on the determination of the complexity of the field.  
Generally, simple fields such as identifiers, data types, and timestamps are represented as 
attributes.  Complex fields, for example, those that have multiplicity greater than one (such 
as lists), are represented as elements. However, in this specification we have attempted, as 
much as possible, to abstract away these XML-specific implementation details to provide a 
more general view of the MAEC controlled vocabularies. 
                                                      
4 Each data model and the default vocabularies are implemented in MAEC v4.1 via an XML schema. 
 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

3 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

1.2.3  Non-MAEC Data Models 
MAEC draws several components from the CybOX Language (see [MAECO]); consequently, 
the reader is referred to [CYBOX] for the definitions of these entities.  In this specification, 
we do not define any types that are part of a non-MAEC data model.  Instead we make 
note of the referenced data model’s specification and explicitly define only the extensions 
(i.e., new fields and types) that have been made as an extension of the base type.  

1.2.4  Primitive Data Types 
The following primitive datatypes are used in the MAEC Language.  
 

  binary – Data of this type conforms to the World Wide Web Consortium (W3C) 

Recommendation for hex-encoded binary data [W3C1].  

  boolean – Data of this type conforms to the W3C Recommendation for boolean 

data [W3C2].  

  double – Data of this type conforms to the W3C Recommendation for double data 

 

 

[W3C3].  
float – Data of this type conforms to the W3C Recommendation for float data 
[W3C4].  
int – Data of this type conforms to the W3C Recommendation for integer data 
[W3C5].  

  QName – Data of this type conforms to the W3C Recommendation for an XML 

namespace-qualified name [W3C6]. 

  string – Data of this type conforms to the W3C Recommendation for string data 

[W3C7].  

  unsigned int – Data of this type conforms to the W3C Recommendation for 

unsigned int data [W3C8].  

  URI – Data of this type conforms to the W3C Recommendation for anyURI data 

[W3C9].  

  dateTime – Data of this type represents a time value that conforms to the yyyy-

mm-ddThh:mm:ss format.  

1.3  Controlled Vocabularies 
Some of the fields defined in the MAEC schemas are of type cyboxCommon: 
ControlledVocabularyStringType.  A field of this type is implemented through 
the xsi:type XML abstract type extension mechanism. The default vocabulary 
applicable to the particular type will be provided in the “Description” column of the 
property table.  Default vocabularies are defined in the maec_default_vocabularies.xsd file 
available at [RELD].  Please see Section 2 for more information. 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

4 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

ID Formats 

1.4 
In MAEC v4.1, all MAEC IDs are captured and formatted as XML QNames5.  Each such ID 
includes both a namespace portion (optional) and an ID portion (required), separated by a 
colon (“:”).  The recommended approach to creating a MAEC ID is to define a producer 
namespace and namespace prefix and then use the form: 
 
[ns prefix]:[construct type]-[GUID] 
 
The “ns prefix” SHOULD be a namespace prefix bound to a namespace owned/controlled 
by the producer of the content.  For consistency across MAEC documents, the “construct 
type” SHOULD correspond to the labels provided in Table 1-1 below (datatypes are defined 
in MAEC v4.1 unless otherwise indicated).  Finally, the “GUID” SHOULD correspond to a 
globally unique ID. For example, a MAEC Bundle could have the following ID: 
 
somecompany:bundle-2f44522e-8164-4050-8e13-e01f9a 
 
In order to use this approach, the namespace and prefix MUST be defined in the head of 
the XML document, e.g., 
xmlns:somecompany=“http://company.example.com”. 
 
This format provides high assurance that IDs will be both meaningful and unique.  Meaning 
comes from the producer namespace, which denotes who is producing it, as well as the 
construct type, which denotes to what the ID pertains.  Uniqueness is achieved when the 
meaningful portion is combined with a globally unique ID. 

                                                      
5 In MAEC v4.1, restrictions on ID syntax have been lifted in all IDs used in MAEC types so that all MAEC IDs 
are now compatible with the implementations used in CybOX and STIX. Consequently, the additional 
schematron and XSL files used in earlier MAEC versions primarily for ID syntax validation have been 
deprecated.  
 
 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

5 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

Table 1-1. Recommended construct type labels 

Construct Name 
BUNDLE IDs and IDREFs 
action_collection 
action_implementation 

action_equivalence_reference 

Datatype (defining ID) 
 
ActionCollectionType 

ActionImplementationType 

BehavioralAction 
EquivalenceReferenceType 

Construct Type (in ID) 
 
action_collection 
action_implementation 

action_equivalence 

BehaviorCollectionType 

BundleType 
CandidateIndicatorCollectionType  candidate_indicator_collection 
CandidateIndicatorType 

BehaviorType 

CapabilityType 

cybox:ActionType 

action 
behavior 
behavior_collection 
maec_bundle 
candidate_indicator_collection 
candidate_indicator 
capability 
malware_instance_object_attributes  cybox:ObjectType 
strategic_objective 
tactical_objective 
object_collection 
process_tree_node 
object 
PACKAGE IDs and IDREFs 
action_equivalence 
analysis 
malware_subject 
object_equivalence 
maec_package 
malware_instance_object_attributes  cybox:ObjectType 
CONTAINER IDs 
maec_container 
 

cybox:ObjectType 

ContainerType 

 

 

PackageType 

ActionEquivalenceType 

AnalysisType 

MalwareSubjectType 

ObjectEquivalenceType 

CapabilityObjectiveType 

CapabilityObjectiveType 

ObjectCollectionType 

ProcessTreeNodeType 

action 
behavior 
behavior_collection 
bundle 

candidate_indicator 
capability 
object 
objective 
objective 
object_collection 
process_tree 
object 
 
action_equivalence 
analysis 
malware_subject 
object_equivalence 
package 
object 
 
container 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

6 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

1.5  XML Implementation 
The XML implementation of the MAEC Language data model is documented in a series of 
XML Schemas.6  These schemas describe how the information presented in this 
Specification is formatted and represented as XML. Please refer to the appropriate Schema 
for more information about a specific XML implementation. 
 
MAEC Container Model 
https://maec.mitre.org/language/version4.1/maec-container-schema.xsd 
 
MAEC Package Model 
https://maec.mitre.org/language/version4.1/maec-package-schema.xsd 
 
MAEC Bundle Model 
https://maec.mitre.org/language/version4.1/maec-bundle-schema.xsd 
 
MAEC Default Vocabularies 
https://maec.mitre.org/language/version4.1/maec-default-vocabularies.xsd 
 
The complete listing of XML representation resources can be found on the MAEC website 
[REL4].  

1.6  Document Conventions 
The following conventions are used in this document. 

1.6.1  Key Words 
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", 
"SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be 
interpreted as described in RFC 2119 [RFC2119]. 

1.6.2  Fonts 
The following font and font style conventions are used in the document:  

  Capitalization is used for MAEC high level concepts, which are defined as basic 

components in the MAEC Overview document [MAECO] (see Section 2 in [MAECO]). 
 
Examples: Bundle, Strategic Objective, Malware Subject 
 

                                                      
6 XML Schema Part 0: Primer Second Edition http://www.w3.org/TR/xmlschema-0  
 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

7 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

  The Courier New font is used for writing constructs in the MAEC Language 

Data Model (and related data models).  

 

 

 

Examples: CandidateIndicatorType, Malware_Subject  
 
Note that all high level concepts have a corresponding data model construct (e.g., 
Malware Subject  Malware_Subject).  

  The ‘italic, with single quotes’ font is used for noting values for MAEC Language 

properties.  

 

Examples: ‘2.1’, ‘MAEC Default Device Driver Action Names’ 

1.6.3  Namespaces  
The Bundle, Package, and Container specifications use the concept of namespaces7
logically group MAEC constructs throughout the Data Model sections of the documents, as 
well as other parts of the specifications. The format of these namespaces is 
prefix:namespace, where the prefix is the namespace component, and the 
namespace is the actual namespace URI.  Table 1-2 on page 10 provides a listing of the 
default namespaces used in MAEC to help provide context as to the particular source data 
model or vocabulary used in a field.  Table 1-2 also lists the relevant version of each of the 
data models.  These namespaces are compatible with XML Namespaces [W3C0], though 
the MAEC language is not restricted to XML serialization.  

 to 

1.6.4  UML Diagrams 
The Data Model makes use of Unified Modeling Language (UML) diagrams where 
appropriate, to visually depict relationships for the MAEC Language constructs. Diagrams 
are included for any construct that inherits from other constructs or has a compositional 
relationship.  

1.6.5  Property Table Notation 
Throughout the data model, tables are used to describe each data type and its properties. 
Each property table will consist of a column of field names to identify the property, a type 
column to reflect the datatype of the property, a multiplicity column to reflect the allowed 
number of occurrences of the property, and a description column that will describe the 
property.  In addition: 
 

  Fields that are part of a “choice” relationship (e.g., Field1 OR Field2 is used but not 
both) will be denoted by a unique letter subscript (e.g., API_CallA, CodeB) and single 
logic expression in the Multiplicity column.  For example, if there is a choice of field 

                                                      
7 Namespaces (computer science): http://en.wikipedia.org/wiki/Namespace_(computer_science) 
 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

8 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

API_CallA and CodeB, the expression “A(1)|B(0..1)” will indicate that the 
API_Call field can be chosen with multiplicity 1 or the Code property can be 
chosen with multiplicity 0..1.   

Values in the type column are either primitive datatypes or other types defined in this 
document. These values will be cross referenced to the base definition of their types. 
 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

9 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

Namespace 
Prefix 

maecBundle 

maecPackage 

maecContainer 

maecVocabs 

metadata 

cybox 

cyboxCommon 

cyboxVocabs 

CodeObj 

SystemObj 

Data Model / 
Vocab 
MAEC Bundle 
v4.1 
MAEC Package 
v2.1 
MAEC Container 
v2.1 
MAEC Default 
Vocabularies 
v1.1 
Malware 
Metadata 
Exchange Format 
(MMDEF) v1.2 
CybOX Core 
v2.1 

CybOX Common 
v2.1 

CybOX Default 
Vocabularies 
v2.1 

Code Object 
v2.1 

System Object 
v2.1 

 

Table 1-2.  Namespace prefixes used by MAEC 

Description 

Example 

The MAEC Bundle data model captures 
the constructs used in a MAEC Bundle. 
The MAEC Package data model captures 
the constructs used in a MAEC Package. 
The MAEC Container data model 
captures all MAEC characterized data. 
The MAEC default vocabularies define 
types for default controlled 
vocabularies used within MAEC. 

The MMDEF data model captures some 
constructs used in exchanging malware 
sample data. 

The CybOX core data model captures all 
the core constructs used in CybOX. 
The CybOX common data model 
captures common constructs used 
across CybOX objects and other types. 
The CybOX default vocabularies define 
types for default controlled 
vocabularies used within CybOX. 
The CybOX Code Object data model is 
intended to characterize a body of 
computer code. 
The CybOX System Object data model is 
intended to characterize computer 

maecBundle:ActionType 

maecPackage:MalwareSubjectType 

maecContainer:PackageListType 

maecVocabs:FileActionNameVocab 

metadata:fieldDataEntry 

cybox:ObjectType 

cyboxCommon:MeasureSourceType 

cyboxVocabs:HashNameVocab 

CodeObj:CodeObjectType 

SystemObj:SystemObjectType 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

10 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

Process Object 
v2.1 

ProcessObj 

systems (as a combination of both 
software and hardware). 
The CybOX Process Object data model 
is intended to characterize system 
processes. 

ProcessObj:ProcessObjectType 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

11 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2  MAEC Default Controlled Vocabularies 
The MAEC Vocabularies represent a set of default controlled vocabularies for use in MAEC content and were created to take 
advantage of the extension mechanisms provided by the CybOX v2.x controlled vocabulary implementation.  These vocabularies are 
broken out from the MAEC Bundle, Package, and Container schemas to support customized extension and replacement.  However, it 
is expected that most MAEC authors will use the provided default vocabularies, and thus most tools that parse MAEC data SHOULD 
support those vocabularies where appropriate.  Details on using default vocabularies are givein in Section 2.1. 
 
The remaining subsections provide a listing of version 1.1 of the Default Vocabularies and the corresponding enumerations for use 
within MAEC v4.1.  The lists have been grouped according to the higher level MAEC entity associated with the vocabularies:  Actions 
(Section 2.2), Candidate Indicators (Section 2.4), Capabilities (Section 2.5), Malware Subjects (Section 2.7), and Packages (Section 
2.8).  Because the list of default vocabularies associated with Action Name fields is considerably lengthy, it has been captured 
separately in Section 2.3.  Similarly, the list of default vocabularies associated with malware Capability Property fields and 
Strategic and Tactical Objective Name fields is captured separately in Section 2.6.  
 
Note that if an enumeration has been updated, the previous version is also included in the Default Vocabularies for backward 
compatibility.  However, only the latest vocabulary version is provided in this document. 

2.1  Using Default Vocabularies 
MAEC default vocabularies are referenced from MAEC elements by using the xsi:type extension mechanism to indicate the 
default vocabulary that is used in a particular element.  For example, to specify the ‘download file’ Action name, one would use the 
‘NetworkActionVocab’ default vocabulary, which includes this value in its enumeration:  
 
<maecBundle:Action id="maec-example-act-1"> 
   <cybox:Name xsi:type="maecVocabs:NetworkActionNameVocab-1.0">download file</cybox:Name> 
</maecBundle:Action> 
 
To use a non-default vocabulary, one may similarly use the xsi:type extension mechanism to indicate the custom vocabulary that 
is used in a particular element. For example, to use a custom ‘foo’ vocabulary in the Action name example above, one would simply 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

12 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

add the appropriate namespace (xmlns:fooVocabs=“http://foo/fooVocabulary-1” for the sake of this example) and schemalocation 
declarations to their MAEC document, and then reference and use the namespace like any default vocabulary: 
 
<maecBundle:Action id="maec-example-act-2"> 
   <cybox:Name xsi:type="fooVocabs:fooVocabulary">some custom action</cybox:Name> 
</maecBundle:Action> 
 
Accordingly, any elements that use the controlled vocabulary implementation can also accept arbitrary values without the 
specification of any vocabulary, which may be useful in certain instances. This is achieved simply by not specifying the xsi:type 
extension mechanism on the element. To continue with the above examples, we could also specify a custom Action name that is not 
part of a vocabulary: 
 
<maecBundle:Action id="maec-example-act-3"> 
   <cybox:Name>another custom action</cybox:Name> 
</maecBundle:Action> 
 
An individual vocabulary may be revised at any time. Revisions to vocabularies will result in the creation of new types with the new 
version number embedded in the name of those types (e.g., FileActionNameVocab-1.0 might be updated to 
FileActionNameVocab-1.1 or FileActionNameVocab-2.0). 

2.2  Action-Related Default Vocabularies 
The default vocabularies in this section are related to Actions in a MAEC Bundle. 

2.2.1  ActionObjectAssociationTypeVocab-1.0 
The ActionObjectAssociationTypeVocab is the default MAEC vocabulary for Action-Object association types in a MAEC 
Bundle, which are captured in MAEC Actions via the Association_Type field of type AssociatedObjectType defined in 
the CybOX Core schema.  Thus, the MAEC ActionObjectAssociationTypeVocab-1.0 SHOULD be used in place of the 
CybOX ActionObjectAssociationVocab-1.0.   
 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

13 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

The MAEC ActionObjectAssociationTypeVocab-1.0 extends the ControlledVocabularyStringType defined in 
the CybOX Common schema.  Thus, Association_Type fields that make use of this vocabulary are restricted to the enumerated 
entries contained in maecVocabs:ActionObjectAssociationTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is MAEC 
‘Default Action-Object Association Names’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#ActionObjectAssociationTypeVocab-1.0.’ 

2.2.1.1 ActionObjectAssociationTypeEnum-1.0 
The ActionObjectAssociationTypeEnum is a non-exhaustive enumeration of types of Action-Object associations. 
 

Enumeration Value 

Description 

input 

output 

side-effect 

Specifies that the Associated_Object field serves as an input to the Action. This includes 
cases where an Object is used by the Action or an existing Object is modified by the Action. 
Specifies that the Associated_Object field serves as an output to the Action. This includes 
cases where the Object is created anew by the Action or otherwise returned by the Action. 
Specifies that the Associated_Object field serves as a side-effect resulting from the Action. 
This includes cases where the Object is modified indirectly by the Action. 

2.3  Default Vocabularies for Specific Action Names 
The default vocabularies in this section are related to MAEC Action names. 

2.3.1  DebuggingActionNameVocab-1.0 
The DebuggingActionNameVocab is the default MAEC vocabulary for Action names associated with debugging, which are 
captured in MAEC Actions via the Name element of the ActionType that is defined in CybOX Core and extended by MAEC’s 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

14 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

MalwareActionType in the MAEC Bundle.  Thus, for debugging Action names, the MAEC DebuggingActionNameVocab-
1.0 SHOULD be used in place of the CybOX ActionNameVocab default vocabulary.   
 
The MAEC DebuggingActionNameVocab-1.0 type extends the ControlledVocabularyStringType defined in CybOX 
Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in 
maecVocabs:DebuggingActionNameEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC Default 
Debugging Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabularies.xsd#D
ebuggingActionNameVocab-1.0.’ 

2.3.1.1 DebuggingActionNameEnum-1.0 
The DebuggingActionNameEnum is a non-exhaustive enumeration of the different Action names associated with debugging. 
 

Enumeration Value 

check for remote debugger 
check for kernel debugger 

Specifies the defined Action of checking for the presence of a remote debugger. 
Specifies the defined Action of checking for the presence of a kernel debugger. 

Description 

2.3.2  DeviceDriverActionNameVocab-1.1 
The DeviceDriverActionNameVocab is the default MAEC vocabulary for Action names associated with device drivers, which 
are captured in MAEC Actions via the Name element of the ActionType that is defined in CybOX Core, and extended by MAEC’s 
MalwareActionType in the MAEC Bundle.  Thus, for device driver Action names, the MAEC 
DeviceDriverActionNameVocab-1.1 type SHOULD be used in place of the CybOX ActionNameVocab default vocabulary.   
 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

15 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

The MAEC DeviceDriverActionNameVocab-1.1 extends the ControlledVocabularyStringType defined in CybOX 
Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in 
maecVocabs:DeviceDriverActionNameEnum-1.1; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Device Driver Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#DeviceDriverActionNameVocab-1.1.’ 

2.3.2.1 DeviceDriverActionNameEnum-1.1 
The DeviceDriverActionNameEnum is a non-exhaustive enumeration of the different Action names associated with device 
drivers. 
 

Enumeration Value 

Description 

load and call driver 
load driver 
unload driver 
emulate driver 

Specifies the defined Action of loading a driver into a system and then calling the loaded driver. 
Specifies the defined Action of loading a driver into a system. 
Specifies the defined Action of unloading a driver from a system. 
Specifies the defined Action of emulating an existing driver on a system. 

2.3.3  DirectoryActionNameVocab-1.1 
The DirectoryActionNameVocab is the default MAEC vocabulary for Action names associated with file directories, which are 
captured in MAEC Actions via the Name element of ActionType that is defined in CybOX Core, and extended by MAEC’s 
MalwareActionType in the MAEC Bundle.  Thus, for directory Action names, the MAEC DirectoryActionNameVocab-
1.1 SHOULD be used in place of the CybOX ActionNameVocab default vocabulary.   
 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

16 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

The MAEC DirectoryActionNameVocab-1.1 extends the ControlledVocabularyStringType defined in CybOX 
Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:DirectoryActionNameEnum-1.1; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Directory Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#DirectoryActionNameVocab-1.1.’ 

2.3.3.1 DirectoryActionNameEnum-1.1 
The DirectoryActionNameEnum is a non-exhaustive enumeration of the different Action names associated with directories. 
 

Enumeration Value 

Description 

create directory 
delete directory 
monitor directory 
hide directory 

Specifies the defined Action of creating a new directory on the filesystem. 
Specifies the defined Action of deleting an existing directory on the filesystem. 
Specifies the defined Action of monitoring an existing directory on the filesystem for changes. 
Specifies the defined Action of hiding an existing directory. 

2.3.4  DiskActionNameVocab-1.1 
The DiskActionNameVocab is the default MAEC vocabulary for Action names associated with disks, which are captured in MAEC 
Actions via the Name element of the ActionType that is defined in CybOX Core, and extended by MAEC’s 
MalwareActionType in the MAEC Bundle.  Thus, for disk Action names, the MAEC DiskActionNameVocab-1.1 SHOULD be 
used in place of the CybOX ActionNameVocab default vocabulary.   
 
The MAEC DiskActionNameVocab-1.1 type extends the ControlledVocabularyStringType defined in CybOX 
Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:DiskActionNameEnum-1.1; extended fields are shown below. 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

17 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Disk Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#DiskActionNameVocab-1.1.’ 

2.3.4.1 DiskActionNameEnum-1.1 
The DiskActionNameEnum is a non-exhaustive enumeration of the different Action names associated with hard disks. 
 

Enumeration Value 

Description 

get disk type 
get disk attributes 
mount disk 
unmount disk 
emulate disk 
list disks 
monitor disks 

Specifies the defined Action of getting the disk type. 
Specifies the defined Action of querying the attributes of a disk, such as the amount of available free space. 
Specifies the defined Action of mounting an existing file system to a mounting point. 
Specifies the defined Action of unmounting an existing file system from a mounting point. 
Specifies the defined Action of emulating an existing disk. 
Specifies the defined Action of listing all disks available on a system. 
Specifies the defined Action of monitoring an existing disk for changes. 

2.3.5  DNSActionNameVocab-1.0 
The DNSActionNameVocab is the default MAEC vocabulary for Action names associated with the Domain Name System (DNS), 
which are captured in MAEC Actions via the Name element of the ActionType that is defined in CybOX Core, and extended by 
MAEC’s MalwareActionType in the MAEC Bundle.  Thus, for DNS Action names, the MAEC DNSActionNameVocab-1.0 
SHOULD be used in place of the CybOX ActionNameVocab default vocabulary.   
 
The MAEC DNSActionNameVocab-1.0 extends the ControlledVocabularyStringType defined in CybOX Common.  
Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:DNSActionNameEnum-1.0; extended fields are shown below. 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

18 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default DNS Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#DNSActionNameVocab-1.0.’ 

2.3.5.1 DNSActionNameEnum-1.0 
The DNSActionNameEnum is a non-exhaustive enumeration of the different Action names associated with DNS. 
 

Enumeration Value 

send dns query 
send reverse dns lookup 

Specifies the defined Action of sending a DNS query 
Specifies the defined Action of sending a reverse DNS lookup 

Description 

2.3.6  FileActionNameVocab-1.1 
The FileActionNameVocab is the default MAEC vocabulary for Action names associated with files, which are captured in MAEC 
Actions via the Name element of the ActionType that is defined in CybOX Core, and extended by MAEC’s 
MalwareActionType in the MAEC Bundle.  Thus, for file Action names, the MAEC FileActionNameVocab-1.1 SHOULD be 
used in place of the CybOX ActionNameVocab default vocabulary.   
 
The MAEC FileActionNameVocab-1.1 extends the ControlledVocabularyStringType defined in CybOX Common.  
Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:FileActionNameEnum-1.1; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

vocab_reference 

string 

anyURI 

 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default File Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

19 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#FileActionNameVocab-1.1.’ 

2.3.6.1 FileActionNameEnum-1.1 
The FileActionNameEnum is a non-exhaustive enumeration of the different Action names associated with files. 
 

Enumeration Value 

create file 
delete file 
copy file 
create file symbolic link 
find file 
get file attributes 
set file attributes 
lock file 
unlock file 
modify file 
move file 
open file 
read from file 
write to file 
rename file 
create file alternate data stream 
send control code to file 
create file mapping 
open file mapping 
execute file 
hide file 
close file 

 

Description 

Specifies the defined Action of creating a new file. 
Specifies the defined Action of deleting an existing file. 
Specifies the defined Action of copying an existing file from one location to another. 
Specifies the defined Action of creating a symbolic link to an existing file. 
Specifies the defined Action of searching for an existing file. 
Specifies the defined Action of getting the attributes of an existing file. 
Specifies the defined Action of setting the file attributes for an existing file. 
Specifies the defined Action of locking an existing file. 
Specifies the defined Action of unlocking an existing file. 
Specifies the defined Action of modifying an existing file in some manner. 
Specifies the defined Action of moving an existing file from one location to another. 
Specifies the defined Action of opening an existing file for reading or writing. 
Specifies the defined Action of reading from an existing file. 
Specifies the defined Action of writing to an existing file. 
Specifies the defined Action of renaming an existing file. 
Specifies the defined Action of creating an alternate data stream in an existing file. 
Specifies the defined Action of sending a control code to a file. 
Specifies the defined Action of creating a new file mapping object. 
Specifies the defined Action of opening an existing file mapping object. 
Specifies the defined Action of executing an existing file. 
Specifies the defined Action of hiding an existing file. 
Specifies the defined Action of closing an existing file that previously opened for reading or writing. 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

20 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.3.7  FTPActionNameVocab-1.0 
The FTPActionNameVocab is the default MAEC vocabulary for Action names associated with the File Transfer Protocol (FTP), 
which are captured in MAEC Actions via the Name element of the ActionType that is defined in CybOX Core, and extended by 
MAEC’s MalwareActionType in the MAEC Bundle.  Thus, for FTP Action names, the MAEC FTPActionNameVocab-1.0 
SHOULD be used in place of the CybOX ActionNameVocab default vocabulary.   
 
The MAEC FTPActionNameVocab-1.0 extends the ControlledVocabularyStringType defined in CybOX Common.  
Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:FTPActionNameEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default FTP Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#FTPActionNameVocab-1.0.’ 

2.3.7.1 FTPActionNameEnum-1.0 
The FTPActionNameEnum is a non-exhaustive enumeration of the different Action names associated with FTP. 
 

Enumeration Value 

connect to ftp server 
disconnect from ftp server 
send ftp command 

Specifies the defined Action of connecting to an existing FTP server. 
Specifies the defined Action of disconnecting from an existing FTP server. 
Specifies the defined Action of sending a command on an FTP server connection. 

Description 

2.3.8  GUIActionNameVocab-1.0 
The GUIActionNameVocab is the default MAEC vocabulary for Action names associated with Graphical User Interfaces (GUIs), 
which are captured in MAEC Actions via the Name element of the ActionType that is defined in CybOX Core, and extended by 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

21 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

MAEC’s MalwareActionType in the MAEC Bundle.  Thus, for GUI Action names, the MAEC GUIActionNameVocab-1.0 
SHOULD be used in place of the CybOX ActionNameVocab default vocabulary.   
 
The MAEC GUIActionNameVocab-1.0 extends the ControlledVocabularyStringType defined in CybOX Common.  
Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:GUIActionNameEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default GUI Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#GUIActionNameVocab-1.0.’ 

2.3.8.1 GUIActionNameEnum-1.0 
The GUIActionNameEnum is a non-exhaustiveenumeration of the different Action names associated with GUIs. 
 

Enumeration Value 

create window 
kill window 
create dialog box 
enumerate windows 
find window 
hide window 
show window 

Description 
Specifies the defined Action of creating a new window. 
Specifies the defined Action of killing an existing window. 
Specifies the defined Action of creating a new dialog box. 
Specifies the defined Action of enumerating all open windows 
Specifies the defined Action of search for a particular window. 
Specifies the defined Action of hiding an existing window. 
Specifies the defined Action of showing an existing window 

 

2.3.9  HookingActionNameVocab-1.1 
The HookingActionNameVocab is the default MAEC vocabulary for Action names associated with hooking, which are captured 
in MAEC Actions via the Name element of the ActionType that is defined in CybOX Core, and extended by MAEC’s 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

22 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

MalwareActionType in the MAEC Bundle.  Thus, for hooking Action names, the MAEC HookingActionNameVocab-1.1 
SHOULD be used in place of the CybOX ActionNameVocab default vocabulary.   
 
The MAEC HookingActionNameVocab-1.1 extends the ControlledVocabularyStringType defined in CybOX 
Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:HookingActionNameEnum-1.1; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Hooking Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#HookingActionNameVocab-1.1.’ 

2.3.9.1 HookingActionNameEnum-1.1 
The HookingActionNameEnum is a non-exhaustive enumeration of the different Action names associated with hooking. 
 

Enumeration Value 

add system call hook 
add windows hook 
hide hook 

Specifies the defined Action of adding a new system call hook. 
Specifies the defined Action of adding a new Windows application-defined hook procedure. 
Specifies the defined action of hiding an existing hook. 

Description 

2.3.10 HTTPActionNameVocab-1.0 
The HTTPActionNameVocab is the default MAEC vocabulary for Action names associated with the Hypertext Transfer Protocol 
(HTTP), which are captured in MAEC Actions via the Name element of the ActionType that is defined in CybOX Core, and 
extended by MAEC’s MalwareActionType in the MAEC Bundle.  Thus, for HTTP Action names, the MAEC 
HTTPActionNameVocab-1.0 SHOULD be used in place of the CybOX ActionNameVocab default vocabulary.   
 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

23 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

The MAEC HTTPActionNameVocab-1.0 extends the ControlledVocabularyStringType defined in CybOX Common.  
Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:HTTPActionNameEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default HTTP Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#HTTPActionNameVocab-1.0.’ 

2.3.10.1  HTTPActionNameEnum-1.0 
The HTTPActionNameEnum is a non-exhaustive enumeration of the different Action names associated with HTTP. 
 

Enumeration Value 

Description 

send http get request 
send http head request 
send http post request 
send http put request 
send http delete request 
send http trace request 
send http options request 
send http connect request 
send http patch request 
receive http response 

Specifies the defined Action of sending an HTTP GET client request to an existing server. 
Specifies the defined Action of sending an HTTP HEAD client request to an existing server. 
Specifies the defined Action of sending an HTTP HEAD client request to an existing server. 
Specifies the defined Action of sending an HTTP PUT client request to an existing server. 
Specifies the defined Action of sending an HTTP DELETE client request to an existing server. 
Specifies the defined Action of sending an HTTP TRACE client request to an existing server. 
Specifies the defined Action of sending an HTTP OPTIONS client request to an existing server. 
Specifies the defined Action of sending an HTTP CONNECT client request to an existing server. 
Specifies the defined Action of sending an HTTP PATCH client request to an existing server. 
Specifies the defined Action of receiving an HTTP server response for a prior HTTP request. 

2.3.11 IPCActionNameVocab-1.0 
The IPCActionNameVocab is the default MAEC vocabulary for Action names associated with Inter-process communication (IPC), 
which are captured in MAEC Actions via the Name element of the ActionType that is defined in CybOX Core, and extended by 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

24 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

MAEC’s MalwareActionType in the MAEC Bundle.  Thus, for IPC Action names, the MAEC IPCActionNameVocab-1.0 
SHOULD be used in place of the CybOX ActionNameVocab default vocabulary.   
 
The MAEC IPCActionNameVocab-1.0 extends the ControlledVocabularyStringType defined in CybOX Common.  
Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:IPCActionNameEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default IPC Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#IPCActionNameVocab-1.0.’ 

IPCActionNameEnum-1.0 

2.3.11.1 
The IPCActionNameEnum is a non-exhaustive enumeration of the different Action names associated with entities related to IPC. 
 

Enumeration Value 

create named pipe 
delete named pipe 
connect to named pipe 
disconnect from named pipe 
read from named pipe 
write to named pipe 
create mailslot 
read from mailslot 
write to mailslot 

Description 

Specifies the defined Action of creating a new named pipe. 
Specifies the defined Action of deleting an existing named pipe. 
Specifies the defined Action of connecting to an existing named pipe. 
Specifies the defined Action of disconnecting from an existing named pipe. 
Specifies the defined Action of reading some data from an existing named pipe. 
Specifies the defined Action of writing some data to an existing named pipe. 
Specifies the defined Action of creating a new named mailslot. 
Specifies the defined Action of reading some data from an existing named mailslot. 
Specifies the defined Action of writing some data to an existing named mailslot. 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

25 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.3.12 IRCActionNameVocab-1.0 
The IRCActionNameVocab is the default MAEC vocabulary for Action names associated with Internet Relay Chat (IRC), which are 
captured in MAEC Actions via the Name element of the ActionType that is defined in CybOX Core, and extended by MAEC’s 
MalwareActionType in the MAEC Bundle.  Thus, for IRC Action names, the MAEC IRCActionNameVocab-1.0 SHOULD be 
used in place of the CybOX ActionNameVocab default vocabulary.   
 
The MAEC IRCActionNameVocab-1.0 extends the ControlledVocabularyStringType defined in CybOX Common.  Thus, 
Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:IRCActionNameEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default IRC Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#IRCActionNameVocab-1.0.’ 

IRCActionNameEnum-1.0 

2.3.12.1 
The IRCActionNameEnum is a non-exhaustive enumeration of the different Action names associated with IRC. 
 

Enumeration Value 

connect to irc server 
disconnect from irc server 
set irc nickname 
join irc channel 
leave irc channel 
send irc private message 
receive irc private message 

Description 

Specifies the defined Action of connecting to an existing IRC server. 
Specifies the defined Action of disconnecting from an existing IRC server. 
Specifies the defined Action of setting an IRC nickname on an IRC server. 
Specifies the defined Action of joining a channel on an IRC server. 
Specifies the defined Action of leaving a channel on an IRC server. 
Specifies the defined Action of sending a private message to another user on an IRC server. 
Specifies the defined Action of receiving a private message from another user on an IRC server. 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

26 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.3.13 LibraryActionNameVocab-1.1 
The LibraryActionNameVocab is the default MAEC vocabulary for Action names associated with libraries, which are captured 
in MAEC Actions via the Name element of the ActionType that is defined in CybOX Core, and extended by MAEC’s 
MalwareActionType in the MAEC Bundle.  Thus, for library Action names, the MAEC LibraryActionNameVocab-1.1 
SHOULD be used in place of the CybOX ActionNameVocab default vocabulary.   
 
The MAEC LibraryActionNameVocab-1.1 extends the ControlledVocabularyStringType defined in CybOX 
Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:LibraryActionNameEnum-1.1; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Library Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#LibraryActionNameVocab-1.1.’ 

2.3.13.1  LibraryActionNameEnum-1.1 
The LibraryActionNameEnum is a non-exhaustive enumeration of the different Action names associated with libraries. 
 

Enumeration Value 

enumerate libraries 
free library 
load library 
get function address 
call library function 

Description 

Specifies the defined Action of enumerating the libraries used by a process. 
Specifies the defined Action of freeing a library previously loaded into the address space of the calling process. 
Specifies the defined Action of loading a library into the address space of the calling process. 
Specifies the defined Action of getting the address of an exported function or variable from a library. 
Specifies the defined action of calling a function exported by a library. 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

27 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.3.14 NetworkActionNameVocab-1.1 
The NetworkActionNameVocab is the default MAEC vocabulary for Action names associated with networking, which are 
captured in MAEC Actions via the Name element of the ActionType that is defined in CybOX Core, and extended by MAEC’s 
MalwareActionType in the MAEC Bundle.  Thus, for network Action names, the MAEC NetworkActionNameVocab-1.1 
SHOULD be used in place of the CybOX ActionNameVocab default vocabulary.   
 
The MAEC NetworkActionNameVocab-1.1 extends the ControlledVocabularyStringType defined in CybOX 
Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:NetworkActionNameEnum-1.1; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Network Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#NetworkActionNameVocab-1.1.’ 

2.3.14.1  NetworkActionNameEnum-1.1 
The NetworkActionNameEnum is a non-exhaustive enumeration of the different Action names associated with networking. 
 

Enumeration Value 

open port 
close port 
connect to ip 
disconnect from ip 
connect to url 
connect to socket address 
download file 
upload file 
listen on port 

 

Description 

Specifies the defined Action of opening a network port. 
Specifies the defined Action of closing a network port. 
Specifies the defined Action of connecting to an IP address. 
Specifies the defined Action of disconnecting from a previously established connection with an IP address. 
Specifies the defined Action of connecting to a URL. 
Specifies the defined Action of connecting to a socket address, consisting of an IP address and port number. 
Specifies the defined Action of downloading a file from a remote location. 
Specifies the defined Action of uploading a file to a remote location. 
Specifies the defined Action of listening on a specific port. 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

28 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

send email message 
send icmp request 
send network packet 
receive network packet 

Specifies the defined Action of sending an email message. 
Specifies the defined Action of sending an ICMP request. 
Specifies the defined action of sending a packet on a network. 
Specifies the defined action of receiving a packet on a network. 

2.3.15 NetworkShareActionNameVocab-1.0 
The NetworkShareActionNameVocab is the default MAEC vocabulary for Action names associated with Windows network 
shares, which are captured in MAEC Actions via the Name element of the ActionType that is defined in CybOX Core, and 
extended by MAEC’s MalwareActionType in the MAEC Bundle.  Thus, for Windows network share Action names, the MAEC 
NetworkShareActionNameVocab-1.0 SHOULD be used in place of the CybOX ActionNameVocab default vocabulary.   
 
The MAEC NetworkShareActionNameVocab-1.0 extends the ControlledVocabularyStringType defined in CybOX 
Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:NetworkShareActionNameEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Network Share Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#NetworkShareActionNameVocab-1.0.’ 

2.3.15.1  NetworkShareActionNameEnum-1.0 
The NetworkShareActionNameEnum is a non-exhaustive enumeration of the different Action names associated with Windows 
network shares. 
 

Enumeration Value 

Description 

add connection to network share  Specifies the defined Action of adding a connection to an existing network share. 
add network share 

Specifies the defined Action of adding a new network share on a server. 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

29 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

delete network share 
connect to network share 
disconnect from network share 
enumerate network shares 

Specifies the defined Action of deleting an existing network share on a server. 
Specifies the defined Action of connecting to an existing network share. 
Specifies the defined Action of disconnecting from an existing network share. 
Specifies the defined Action of enumerating the available shared resources on a server. 

2.3.16 ProcessActionNameVocab-1.0 
The ProcessActionNameVocab is the default MAEC vocabulary for Action names associated with processes, which are 
captured in MAEC Actions via the Name element of the ActionType that is defined in CybOX Core, and extended by MAEC’s 
MalwareActionType in the MAEC Bundle.  Thus, for process Action names, the MAEC ProcessActionNameVocab-1.0 
SHOULD be used in place of the CybOX ActionNameVocab default vocabulary.   
 
The MAEC ProcessActionNameVocab-1.0 extends the ControlledVocabularyStringType defined in CybOX 
Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:ProcessActionNameEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Process Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#ProcessActionNameVocab-1.0.’ 

2.3.16.1  ProcessActionNameEnum-1.0 
The ProcessActionNameEnum is a non-exhaustive enumeration of the different Action names associated with processes. 
 

Enumeration Value 

create process 
kill process 
create process as user 

 

Specifies the defined Action of creating a new process. 
Specifies the defined Action of killing an existing process. 
Specifies the defined Action of creating a new process in the security context of a specified user. 

Description 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

30 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

enumerate processes 
open process 
flush process instruction cache 
get process current directory 
set process current directory 
get process environment variable 
set process environment variable 
sleep process 
get process startupinfo 

Specifies the defined Action of enumerating all of the running processes on a system. 
Specifies the defined Action of opening an existing process. 
Specifies the defined Action of flushing the instruction cache of an existing process. 
Specifies the defined Action of getting the current directory of an existing process. 
Specifies the defined Action of setting the current directory of an existing process. 
Specifies the defined Action of getting an environment variable used by an existing process. 
Specifies the defined Action of setting an environment variable used by an existing process. 
Specifies the defined Action of sleeping an existing process for some period of time. 
Specifies the defined Action of getting the STARTUPINFO struct associated with an existing process. 

2.3.17 ProcessMemoryActionNameVocab-1.0 
The ProcessMemoryActionNameVocab is the default MAEC vocabulary for Action names associated with process memory, 
which are captured in MAEC Actions via the Name element of the ActionType that is defined in CybOX Core, and extended by 
MAEC’s MalwareActionType in the MAEC Bundle.  Thus, for process memory Action names, the MAEC 
ProcessMemoryActionNameVocab-1.0 SHOULD be used in place of the CybOX ActionNameVocab default vocabulary.   
 
The MAEC ProcessMemoryActionNameVocab-1.0 extends the ControlledVocabularyStringType defined in 
CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:ProcessMemoryActionNameEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Process Memory Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#ProcessMemoryActionNameVocab-1.0.’ 

2.3.17.1  ProcessMemoryActionNameEnum-1.0 
The ProcessMemoryActionNameEnum is a non-exhaustive enumeration of the different Action names associated with process 
memory. 
 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

31 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

 

Enumeration Value 

allocate process virtual memory 
free process virtual memory 
modify process virtual memory 
protection 
read from process memory 
write to process memory 
map file into process 
upmap file from process 
map library into process 

Description 

Specifies the defined Action of allocating some virtual memory region in an existing process. 
Specifies the defined Action of freeing some virtual memory region from an existing process. 
Specifies the defined Action of modifying the protection on a memory region in the virtual address space 
of an existing process. 
Specifies the defined Action of reading from a memory region of an existing process 
Specifies the defined Action of writing to a memory region of an existing process. 
Specifies the defined Action of mapping an existing file into the address space of the calling process. 
Specifies the defined Action of unmapping an existing file from the address space of the calling process. 
Specifies the defined Action of mapping a library into the address space of the calling process. 

2.3.18 ProcessThreadActionNameVocab-1.0 
The ProcessThreadActionNameVocab is the default MAEC vocabulary for Action names associated with process threads, 
which are captured in MAEC Actions via the Name element of the ActionType that is defined in CybOX Core, and extended by 
MAEC’s MalwareActionType in the MAEC Bundle.  Thus, for process thread Action names, the MAEC 
ProcessThreadActionNameVocab-1.0 SHOULD be used in place of the CybOX ActionNameVocab default vocabulary.   
 
The MAEC ProcessThreadActionNameVocab-1.0 extends the ControlledVocabularyStringType defined in 
CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:ProcessThreadActionNameEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Process Thread Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#ProcessThreadActionNameVocab-1.0.’ 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

32 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.3.18.1  ProcessThreadActionNameEnum-1.0 
The ProcessThreadActionNameEnum is a non-exhaustive enumeration of the different Action names associated with process 
threads. 
 

Enumeration Value 

create thread 
kill thread 

create remote thread in process 

enumerate threads 
get thread username 

impersonate process 

revert thread to self 

get thread context 

set thread context 

queue apc in thread 

Description 

Specifies the defined Action of creating a new thread in the virtual address space of the calling process. 
Specifies the defined Action of killing a thread existing in the virtual address space of the calling process. 
Specifies the defined Action of creating a thread that runs in the virtual address space of another existing 
process. 
Specifies the defined Action of enumerating all threads in the calling process. 
Specifies the defined Action of getting the name or ID of the user associated with an existing thread. 
Specifies the defined Action of a thread in the calling process impersonating the security context of another 
existing process. 
Specifies the defined Action of reverting an existing thread to its own security context. 
Specifies the defined Action of getting the context structure (containing processor-specific register data) of 
an existing thread. 
Specifies the defined Action of setting the context structure (containing processor-specific register data) for 
an existing thread. 
Specifies the defined Action of queuing a new Asynchronized Procedure Call (APC) in the context of an 
existing thread. 

2.3.19 RegistryActionNameVocab-1.0 
The RegistryActionNameVocab is the default MAEC vocabulary for Action names associated with the Windows registry, which 
are captured in MAEC Actions via the Name element of the ActionType that is defined in CybOX Core, and extended by MAEC’s 
MalwareActionType in the MAEC Bundle.  Thus, for Windows registry Action names, the MAEC 
RegistryActionNameVocab-1.0 SHOULD be used in place of the CybOX ActionNameVocab default vocabulary.   
 
The MAEC RegistryActionNameVocab-1.0 extends the ControlledVocabularyStringType defined in CybOX 
Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:RegistryActionNameEnum-1.0; extended fields are shown below. 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

33 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Registry Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#RegistryActionNameVocab-1.0.’ 

2.3.19.1  RegistryActionNameEnum-1.0 
The RegistryActionNameEnum is a non-exhaustive enumeration of the different Action names associated with the Windows 
registry. 
 

Enumeration Value 

create registry key 
delete registry key 
open registry key 
close registry key 
create registry key value 
delete registry key value 
enumerate registry key subkeys 
enumerate registry key values 
get registry key attributes 
read registry key value 
modify registry key value 
modify registry key 
monitor registry key 

Description 

Specifies the defined Action of creating a new registry key. 
Specifies the defined Action of deleting an existing registry key. 
Specifies the defined Action of opening an existing registry key. 
Specifies the defined Action of closing a handle to an existing registry key. 
Specifies the defined Action of creating a new named value under an existing registry key. 
Specifies the defined Action of deleting an existing named value under an existing registry key. 
Specifies the defined Action of enumerating the registry key subkeys under an existing registry key. 
Specifies the defined Action of enumerating the named values under an existing registry key. 
Specifies the defined Action of getting the attributes of an existing registry key. 
Specifies the defined Action of reading an existing named value of an existing registry key. 
Specifies the defined Action of modifying an existing named value of an existing registry key. 
Specifies the defined Action of modifying an existing registry key. 
Specifies the defined Action of monitoring an existing registry key for changes. 

2.3.20 ServiceActionNameVocab-1.1 
The ServiceActionNameVocab is the default MAEC vocabulary for Action names associated with services and daemons, which 
are captured in MAEC Actions via the Name element of the ActionType that is defined in CybOX Core, and extended by MAEC’s 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

34 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

MalwareActionType in the MAEC Bundle.  Thus, for service Action names, the MAEC ServiceActionNameVocab-1.1 
SHOULD be used in place of the CybOX ActionNameVocab default vocabulary.   
 
The MAEC ServiceActionNameVocab-1.1 extends the ControlledVocabularyStringType defined in CybOX 
Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:ServiceActionNameEnum-1.1; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Service Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#ServiceActionNameVocab-1.1.’ 

2.3.20.1  ServiceActionNameEnum-1.1 
The ServiceActionNameEnum is a non-exhaustive enumeration of the different Action names associated with services or 
daemons. 
 

Enumeration Value 

create service 
delete service 
start service 
stop service 
enumerate services 
modify service configuration 
open service 
send control code to service 

Description 

Specifies the defined Action of creating a new service. 
Specifies the defined Action of deleting an existing service. 
Specifies the defined Action of starting an existing service. 
Specifies the defined Action of stopping an existing service. 
Specifies the defined Action of enumerating a specific set of services on a system. 
Specifies the defined Action of modifying the configuration parameters of an existing service. 
Specifies the defined Action of opening an existing service. 
Specifies the defined Action of sending a control code to an existing service. 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

35 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.3.21 SocketActionNameVocab-1.0 
The SocketActionNameVocab is the default MAEC vocabulary for Action names associated with network sockets, which are 
captured in MAEC Actions via the Name element of the ActionType that is defined in CybOX Core, and extended by MAEC’s 
MalwareActionType in the MAEC Bundle.  Thus, for network socket Action names, the MAEC SocketActionNameVocab-
1.0 SHOULD be used in place of the CybOX ActionNameVocab default vocabulary.   
 
The MAEC SocketActionNameVocab-1.0 extends the ControlledVocabularyStringType defined in CybOX 
Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:SocketActionNameEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Socket Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#SocketActionNameVocab-1.0.’ 

2.3.21.1  SocketActionNameEnum-1.0 
The SocketActionNameEnum is a non-exhaustive enumeration of the different Action names associated with network sockets. 
 

Enumeration Value 

accept socket connection 
bind address to socket 
create socket 
close socket 
connect to socket 
disconnect from socket 
listen on socket 
send data on socket 
receive data on socket 

 

Description 

Specifies the defined Action of accepting a socket connection. 
Specifies the defined Action of binding a socket address to a socket. 
Specifies the defined Action of creating a new socket. 
Specifies the defined Action of closing an existing socket. 
Specifies the defined Action of connecting to an existing socket. 
Specifies the defined Action of disconnecting from an existing socket. 
Specifies the defined Action of listening on an existing socket. 
Specifies the defined Action of sending data on an existing, connected socket. 
Specifies the defined Action of receiving data on an existing socket. 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

36 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

send data to address on socket 

get host by address 

get host by name 

Specifies the defined Action of sending data to a specified IP address on an existing, unconnected socket. 
Specifies the defined Action of getting information on a host from a local or remote host database by its IP 
address. 
Specifies the defined Action of getting information on a host from a local or remote host database by its 
name. 

2.3.22 SynchronizationActionNameVocab-1.0 
The SynchronizationActionNameVocab is the default MAEC vocabulary for Action names associated with process and 
thread synchronization-related entities, which are captured in MAEC Actions via the Name element of the ActionType that is 
defined in CybOX Core, and extended by MAEC’s MalwareActionType in the MAEC Bundle.  Thus, for process and thread 
synchronization-related Action names, the MAEC SynchronizationActionNameVocab-1.0 SHOULD be used in place of the 
CybOX ActionNameVocab default vocabulary.   
 
The MAEC SynchronizationActionNameVocab-1.0 extends the ControlledVocabularyStringType defined in CybOX 
Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:SynchronizationActionNameEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Synchronization Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#SynchronizationActionNameVocab-1.0.’ 

2.3.22.1  SynchronizationActionNameEnum-1.0 
The SynchronizationActionNameEnum is a non-exhaustive enumeration of the different Action names associated with 
process and thread synchronization-related entities. 
 
 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

37 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

Enumeration Value 

Description 

create mutex 
delete mutex 
open mutex 
release mutex 
create semaphore 
delete semaphore 
open semaphore 
release semaphore 
create event 
delete event 
open event 
reset event 
create critical section 
delete critical section 
open critical section 
release critical section 

Specifies the defined Action of creating a new named mutex. 
Specifies the defined Action of deleting an existing named mutex. 
Specifies the defined Action of opening an existing named mutex. 
Specifies the defined Action of releasing ownership of an existing named mutex. 
Specifies the defined Action of creating a new named semaphore. 
Specifies the defined Action of deleting an existing named semaphore. 
Specifies the defined Action of opening an existing named semaphore. 
Specifies the defined Action of releasing ownership of an existing named semaphore. 
Specifies the defined Action of creating a new named event object. 
Specifies the defined Action of deleting an existing named event object. 
Specifies the defined Action of opening an existing named event object. 
Specifies the defined Action of resetting an existing named event object to the non-signaled state. 
Specifies the defined Action of creating a new critical section. 
Specifies the defined Action of deleting an existing critical section object. 
Specifies the defined Action of opening an existing critical section object. 
Specifies the defined Action of releasing an existing critical section object. 

2.3.23 SystemActionNameVocab-1.0 
The SystemActionNameVocab is the default MAEC vocabulary for Action names associated with system-related entities, which 
are captured in MAEC Actions via the Name element of the ActionType that is defined in CybOX Core, and extended by MAEC’s 
MalwareActionType in the MAEC Bundle.  Thus, for system-related field Action names, the MAEC 
SystemActionNameVocab-1.0 SHOULD be used in place of the CybOX ActionNameVocab default vocabulary.   
 
The MAEC SystemActionNameVocab-1.0 extends the ControlledVocabularyStringType defined in CybOX 
Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:SystemActionNameEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

38 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

vocab_reference 

anyURI 

0..1 

Default System Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#SystemActionNameVocab-1.0.’ 

2.3.23.1  SystemActionNameEnum-1.0 
The SystemActionNameEnum is a non-exhaustive enumeration of the different Action names associated with system-related 
entities. 
 

Enumeration Value 

Description 

add scheduled task 
shutdown system 
sleep system 
get elapsed system up time 
get netbios name 
set netbios name 
get system host name 
set system host name 

get system time 

set system time 

get system local time 
set system local time 
get username 
enumerate system handles 
get system global flags 
set system global flags 
get windows directory 
get windows system directory 
get windows temporary files directory 

 

Specifies the defined Action of adding a scheduled task to a system. 
Specifies the defined Action of shutting down a system. 
Specifies the defined Action of sleeping a system for some period of time. 
Specifies the defined Action of getting the elapsed up-time for a system. 
Specifies the defined Action of getting the NetBIOS name of a system. 
Specifies the defined Action of setting the NetBIOS name of a system. 
Specifies the defined Action of getting the host name of a system. 
Specifies the defined Action of setting the system host name of a system. 
Specifies the defined Action of getting the system time of a system, represented in Coordinated 
Universal Time (UTC). 
Specifies the defined Action of setting the system time for a system, represented in Coordinated 
Universal Time (UTC). 
Specifies the defined Action of getting the local time of a system. 
Specifies the defined Action of setting the local time of a system. 
Specifies the defined Action of getting the username of the currently logged in user of a system. 
Specifies the defined Action of enumerating all open handles on a system. 
Specifies the defined Action of getting the enabled global flags on a system. 
Specifies the defined Action of setting system global flags on a system. 
Specifies the defined Action of getting the path to the Windows installation directory on a system. 
Specifies the defined Action of getting the path to the Windows \System directory on a system. 
Specifies the defined Action of getting the path to the Windows Temporary Files Directory on a 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

39 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

System. 

2.3.24 UserActionNameVocab-1.1 
The UserActionNameVocab is the default MAEC vocabulary for Action names associated with users, which are captured in 
MAEC Actions via the Name element of the ActionType that is defined in CybOX Core, and extended by MAEC’s 
MalwareActionType in the MAEC Bundle.  Thus, for user Action names, the MAEC UserActionNameVocab-1.1 SHOULD 
be used in place of the CybOX ActionNameVocab default vocabulary.   
 
The MAEC UserActionNameVocab-1.1 extends the ControlledVocabularyStringType defined in CybOX Common.  
Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:UserActionNameEnum-1.1; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default User Action Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#UserActionNameVocab-1.1.’ 

2.3.24.1  UserActionNameEnum-1.1 
The UserActionNameEnum is a non-exhaustive enumeration of the different Action names associated with users. 
 

Enumeration Value 

Description 

add user 
delete user 
enumerate users 
get user attributes 
logon as user 
change password 

 

Specifies the defined Action of adding a new user. 
Specifies the defined Action of deleting an existing user. 
Specifies the defined Action of enumerating all users. 
Specifies the defined Action of getting the attributes of an existing user. 
Specifies the defined Action of logging on as a specific user. 
Specifies the defined Action of changing an existing user's password. 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

40 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

add user to group 
remove user from group 
invoke user privilege 

Specifies the defined Action of adding an existing user to an existing group. 
Specifies the defined Action of removing an existing user from existing group. 
Specifies the defined Action of invoking a privilege given to an existing user. 

2.4  Candidate-Indicator-Related Default Vocabularies 
The default vocabularies in this section are related to MAEC Candidate Indicators. 

2.4.1  ImportanceTypeVocab-1.0 
ImportanceTypeVocab is the default MAEC vocabulary for relative importance measures in a MAEC Bundle, which are captured 
via the Importance field in Candidate Indicators of type CandidateIndicatorType, defined in the MAEC Bundle schema.     
 
The MAEC ImportanceTypeVocab-1.0 type extends ControlledVocabularyStringType defined in CybOX Common.  
Thus, Importance fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:ImportanceTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Importance Types.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#ImportanceTypeVocab-1.0.’ 

2.4.1.1 ImportanceTypeEnum-1.0 
The ImportanceTypeEnum is a non-exhaustive enumeration of relative importance measures. 
 

Enumeration Value 

Description 

high 
medium 
low 

 

Specifies that the field is of relative high importance. 
Specifies that the field is of relative medium importance. 
Specifies that the field is of relative low importance. 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

41 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

informational 

numeric 

unknown 

Specifies that the field is only informational in its importance. 
Specifies that the field has a numeric importance value, which is defined in another attribute or 
element. 
Specifies that the relative importance for the field is unknown. 

2.4.2  MalwareEntityTypeVocab-1.0 
The MalwareEntityTypeVocab is the default MAEC vocabulary for malware entity types in a MAEC Bundle, which are captured 
in Candidate Indicators via the Type field, a child of the Malware_Entity field of the CandidateIndicatorType, defined 
in the MAEC_Bundle schema.     
 
The MAEC MalwareEntityTypeVocab-1.0 extends the ControlledVocabularyStringType defined in CybOX 
Common.  Thus, Type fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:MalwareEntityTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Malware Entity Types.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#MalwareEntityTypeVocab-1.0.’ 

2.4.2.1 MalwareEntityTypeEnum-1.0 
The MalwareEntityTypeEnum is a non-exhaustive enumeration of the different types of entities that a malware indicator or 
signature may be written against. 
 

Enumeration Value 

Description 

instance 
family 
class 

 

Specifies that the particular malware entity being referred to is a single malware instance. 
Specifies that the particular malware entity being referred to is a single malware family. 
Specifies that the particular malware entity being referred to is a single class of malware. 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

42 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

 

2.5  Capability-Related Default Vocabularies 
The default vocabularies in this section are related to malware Capabilities in a MAEC Bundle. 

2.5.1  CapabilityObjectiveRelationshipTypeVocab-1.0 
The CapabilityObjectiveRelationshipTypeVocab is the default MAEC vocabulary for relationships between Strategic 
and Tactical Objectives associated with a malware Capability, which are captured in Relationship fields via the child 
Relationship_Type field of type CapabilityObjectiveRelationshipType, defined in the MAEC Bundle schema.   
 
The MAEC CapabilityObjectiveRelationshipTypeVocab-1.0 type extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Relationship_Type fields that make use of this 
vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:CapabilityObjectiveRelationshipTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Malware Capability Objective Relationship Types.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#CapabilityObjectiveRelationshipTypeVocab-1.0.’ 

2.5.1.1 CapabilityObjectiveRelationshipTypeEnum-1.0 
The CapabilityObjectiveRelationshipEnum is a non-exhaustive enumeration of relationships between malware 
Capability Strategic and Tactical Objectives. 
 

Enumeration Value 

Description 

child of 
parent of 
 

Indicates that the Objective is a child of the Objective being referenced. 
Indicates that the Objective is a parent of the Objective being referenced. 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

43 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

incorporates 
incorporated by 

Indicates that the Objective incorporates the Objective being referenced in a supporting or enabling role. 
Indicates that the Objective is incorporated in a supporting or enabling role by the Objective being referenced. 

2.5.2  CommonCapabilityPropertiesVocab-1.0 
The CommonCapabilityPropertiesVocab is the default MAEC vocabulary for properties common to many Capabilities and 
their child Objectives. The names of these properties are captured in the Name field of the Property field that uses the 
CapabilityPropertyType as its base type.  The Property field is found on the CapabilityType (which is used to define 
a Capability) and on the CapabilityObjectiveType (which is used to define a Strategic Objective or a Tactical Objective).  All 
aforementioned types are defined in the MAEC Bundle schema. 
   
The MAEC CommonCapabilityPropertiesVocab-1.0 extends the ControlledVocabularyStringType defined in 
CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:CommonCapabilityPropertiesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Common Capability and Objective Properties.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#CommonCapabilityPropertiesVocab-1.0.’ 

2.5.2.1 CommonCapabilityPropertiesEnum-1.0 
The CommonCapabilityPropertiesEnum is a non-exhaustive enumeration of properties common to many Capability, 
Strategic Objective, and Tactical Objective properties. 
 

Enumeration Value 

encryption algorithm 

protocol used 

 

Refers to the name of the encryption algorithm used in the Capability or Objective. 
Refers to the name of the network protocol used in the Capability or Strategic or Tactical Objective.  It is 
recommended that protocols be specified by their acronym or abbreviated name, e.g. "IRC", "HTTP". 

Description 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

44 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

 

2.5.3  MalwareCapabilityVocab-1.0 
The MalwareCapabilityVocab is the default MAEC vocabulary for names of malware Capabilities, which are captured via the 
name field of the CapabilityType, defined in the MAEC Bundle schema. 
 
The MAEC MalwareCapabilityVocab-1.0 extends the ControlledVocabularyStringType defined in CybOX 
Common.  Thus, name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:MalwareCapabilityTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Malware Capabilities.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#MalwareCapabilityVocab-1.0.’  

2.5.3.1 MalwareCapabilityEnum-1.0 
The MalwareCapabilityEnum is a non-exhaustive enumeration of Capability names. 
 
Enumeration Value 
command and control 
remote machine 
manipulation 
privilege escalation 

Description 
Indicates that the malware instance is able to receive and execute remotely submitted commands. 

data theft 

spying 

 

Indicates that the malware instance is able to manipulate or access other remote machines. 

Indicates that the malware instance is able to elevate the privileges under which it executes. 
Indicates that the malware instance is able to steal data from the system on which it executes. This includes data 
stored in some form, e.g. in a file, as well as data that may be entered into some application such as a web-
browser. 
Indicates that the malware instance is able to capture information from a system related to user or system activity 
(e.g., from a system's peripheral devices). 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

45 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

secondary operation 

anti-detection 
anti-code analysis 

infection/propagation 

anti-behavioral analysis 
integrity violation 

data exfiltration 

probing 

anti-removal 

security degradation 

availability violation 

destruction 
fraud 
persistence 

machine access/control 

Indicates that the malware instance is able to achieve secondary objectives in conjunction with or after achieving 
its primary objectives. 
Indicates that the malware instance is able to prevent itself and its components from being detected on a system. 
Indicates that the malware instance is able to prevent code analysis or make it more difficult. 
Indicates that the malware instance is able to propagate through the infection of a machine or is able to infect a file 
after executing on a system.  The malware instance may infect actively (e.g., gain access to a machine directly) or 
passively (e.g., send malicious email).  This Capability does not encompass any aspects of the initial infection that is 
done independently of the malware instance itself. 
Indicates that the malware instance is able to prevent behavioral analysis or make it more difficult. 
Indicates that the malware instance is able to compromise the integrity of a system. 
Indicates that the malware instance is able to exfiltrate stolen data or perform tasks related to the exfiltration of 
stolen data. 
Indicates that the malware instance is able to probe its host system or network environment; most often this is 
done to support other Capabilities and their Objectives. 
Indicates that the malware instance is able to prevent itself and its components from being removed from a 
system. 
Indicates that the malware instance is able to bypass or disable security features and/or controls. 
Indicates that the malware instance is able to compromise the availability of a system or some aspect of the 
system. 
Indicates that the malware instance is able to destroy some aspect of a system. 
Indicates that the malware instance is able to defraud a user or a system. 
Indicates that the malware instance is able to persist and remain on a system regardless of system events. 
Indicates that the malware instance is able to provide the means to access or control the machine on which it is 
resident. 

2.5.4  MalwareLabelVocab-1.0 
The MalwareLabelVocab is the default MAEC vocabulary for common labels associated with Malware Subjects, which are 
captured in a Malware Subject via the Label field of the MalwareSubjectType, defined in the MAEC Package schema. 
 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

46 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

The MAEC MalwareLabelVocab-1.0 extends the ControlledVocabularyStringType defined in CybOX Common.  
Thus, Label fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:MalwareLabelEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Malware Labels.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#MalwareLabelsVocab-1.0.’ 

2.5.4.1 MalwareLabelEnum-1.0 
The MalwareLabelEnum is a non-exhaustive enumeration of common malware labels. 
 

Enumeration Value 

Description 

adware 

appender 

backdoor 

boot sector virus 

bot 

clicker 

companion virus 
cavity filler 

 

Specifies any software that is funded by advertising. Some adware may install itself in such a manner as to 
become difficult to remove, hiding components and disabling removal techniques. Adware may also gather 
sensitive user information from a system. 
Specifies a file-infecting virus that places its code at the end of the files it infects, adjusting the file's entry 
point to cause its code to be executed before that of the original file. 
Specifies a piece of software which, once running on a system, opens a communication vector to the outside 
so that the computer can be accessed remotely by an attacker. 
Specifies a virus that infects the master boot record of a storage device. 
Specifies a program which resides on an infected system, communicating with and forming part of a botnet. 
The bot may be implanted by a worm or trojan, which opens a backdoor. The bot then monitors the 
backdoor for further instructions. 
Specifies a trojan that makes a system visit a specific Web page, often very frequently and usually with the 
aim of increasing the traffic recorded by the site and thus increasing revenue from advertising. Clickers may 
also be used to carry out DDoS attacks. 
Specifies a virus that takes the place of a particular file on a system instead of injecting code into it. 
Specifies a type of file-infecting virus which seeks out unused space within the files it infects, inserting its 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

47 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

code into these gaps to avoid changing the size of the file and thus not alerting integrity-checking software 
to its presence. 
Specifies a type of malware that makes small, random changes to data, such as data in a spreadsheet, to 
render the data contained in a document inaccurate and in some cases worthless. 
Specifies a small trojan file programmed to download and execute other files, usually more complex 
malware. 
Specifies a type of Trojan that deposits an enclosed payload onto a destination host computer by loading 
itself into memory, extracting the malicious payload, and then writing it to the file system. 
Specifies a virus that infects a system by inserting itself somewhere in existing files; this is the "classic" form 
of virus. 
Specifies a very simple form of malware, a type of rabbit which simply launches more copies of itself. Once a 
fork bomb is executed, it will attempt to run several identical processes, which will do the same, the number 
growing exponentially until the system resources are overwhelmed by the number of identical processes 
running, which may in some cases bring the system down and cause a denial of service. 
Specifies software that, while not definitely malicious, has a suspicious or potentially unwanted aspect. 
Specifies code inserted into an existing program using a code patcher or other tool. 
Specifies a function of malware that alters target files for the purpose of persisting and hiding the injected 
malware. 
Specifies a type of program implanted on a system to monitor the keys pressed and thus record any 
sensitive data, such as passwords, entered by the user. 
Specifies a worm that encrypts information assets on compromised systems so they can only be decrypted 
by the worm's author, also known as information-stealing worm. 
Specifies a virus that uses a macro language, for example in Microsoft Office documents. 
Short for malicious code, also known as malware. 
Specifies fies a worm that uses email to propagate across the internet. 
Specifies a virus that changes its own code with each infection. 
Specifies a type of file-infecting virus which places its code in the middle of files it infects. It may move a 
section of the original code to the end of the file, or simply push the code aside to make space for its own 
code. 
Specifies (1) Code received from remote, possibly untrusted systems, but executed on a local system. (2) 
Software transferred between systems (e.g across a network) and executed on a local system without 
explicit installation or execution by the recipient. 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

48 

data diddler 

downloader 

dropper file 

file infector virus 

fork bomb 

greyware 
implant 

infector 

keylogger 

kleptographic worm 

macro virus 
malcode 
mass-mailer 
metamorphic virus 

mid-infector 

mobile code 

 

multipartite virus 

password stealer 

polymorphic virus 
premium dialer/smser 
prepender 

ransomware 

rat 

rogue anti-malware 

rootkit 

shellcode 

spaghetti packer 

spyware 

trojan horse 
variant 

 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

Specifies malware that infects boot records, boot sectors, and files. 
Specifies a type of trojan designed to steal passwords, personal data and details, or other sensitive 
information from the infected system. 
Specifies a type of virus that encrypts its code differently with each infection, or generation of infections. 
Specifies a piece of malware whose primary aim is to dial or send SMS messages to premium rate numbers. 
Specifies a file-infecting virus which inserts code at the beginning of the files it infects. 
Specifies a type of malware that encrypts files on a victim's system, demanding payment of ransom in return 
for the access codes required to unlock files. 
Specifies a remote access trojan or RAT, which is a trojan horse capable of controlling a machine through 
commands issue by a remote attacker. 
Specifies a fake security product that demands money to clean phony infections. 
Generally refers to a method of hiding files or processes from normal methods of monitoring, and is often 
used by malware to conceal its presence and activities. Originally, the term applied to UNIX-based operating 
systems - a root kit was a collection of tools to enable a user to obtain root (administrator-level) access to a 
system and conceal any changes they might make. Such tools often included trojanized versions of standard 
monitoring software which would hide the root kit operators' activities. More recently the term has 
generally been applied to malware using stealth techniques. Rootkits can operate at a number of levels, 
from the application level - simply replacing or adjusting the settings of system software to prevent the 
display of certain information - through hooking certain functions or inserting modules or drivers into the 
operating system kernel, to the deeper level of firmware or virtualization rook kits, which are activated 
before the operating system and thus even harder to detect while the system is running. 
Specifies (1) A small piece of code that activates a command-line interface to a system that can be used to 
disable security measures, open a backdoor, or download further malicious code. (2) A small piece of code 
that opens a system up for exploitation, sometimes by not necessarily involving a command-line shell. 
A packer that obfuscates programs by emitting "spaghetti" code with a complex and tangled control 
structure. 
Specifies software that gathers information and passes it to a third-party without adequate permission from 
the owner of the data. It may also be used in a wider sense, to include software that makes changes to a 
system or any of its component software, or which makes use of system resources without the full 
understanding and consent of the system owner. 
Specifies a piece of malicious code disguised as something inert or benign. 
Refers to the fact that types of malware can be subdivided into a number of families, or groups sharing 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

49 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

many similarities, generally based on the same blocks of code and sharing similar behaviours. Within a 
family, a variant signifies a single individual item that is uniquely different from other members of the same 
family. 
Specifies (1) A self-replicating malicious program that requires human interaction to replicate. (2) A self-
replicating program that runs and spreads by modifying other programs or files. 
Specifies a form of self-replicating malware that makes copies of itself on the local system. Unlike worms, 
wabbits do not attempt to spread across networks. 
Specifies a piece of code, generally a small file such as a tiny, transparent GIF image, which is used to track 
data on those viewing the page or mail in which it is hidden. 
Specifies a piece of malware whose primary aim is to delete files or entire disks on a machine. 
Specifies (1) A self-replicating malicious program that replicates using a network and does not require 
human interaction. (2) A self-replicating, self-propagating, self-contained program that uses networking 
mechanisms to spread itself. 
Specifies a file compressed into some archive format and that expands to an enormous size when 
uncompressed, often by looping over the extraction code until the system's resources are exhausted. 

virus 

wabbit 

web bug 

wiper 

worm 

zip bomb 

2.6  Default Vocabularies for Specific Capabilities 
The default vocabularies in this section are related to the properties, Strategic Objectives, and Tactical Objectives associated with 
specific MAEC Capabilities. 

2.6.1  AntiBehavioralAnalysisPropertiesVocab-1.0 
The AntiBehavioralAnalysisPropertiesVocab is the default MAEC vocabulary for properties of the anti-behavioral 
analysis Capability and its child Objectives. The names of these properties are captured in the Name field, a child of the Property 
field of type CapabilityPropertyType.  The Property field is found on the CapabilityType (which is used to define a 
Capability) and on the CapabilityObjectiveType (which is used to define a Strategic Objective or a Tactical Objective).  All 
aforementioned types are defined in the MAEC Bundle schema. 
   
The MAEC AntiBehavioralAnalysisPropertiesVocab-1.0 type extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

50 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

restricted to the enumerated entries contained in the maecVocabs:AntiBehavioralAnalysisPropertiesTypeEnum-
1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Anti-Behavioral Analysis Capability and Objective Properties.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#AntiBehavioralAnalysisPropertiesVocab-1.0.’ 

2.6.1.1 AntiBehavioralAnalysisPropertiesEnum-1.0 
The AntiBehavioralAnalysisPropertiesEnum is a non-exhaustive enumeration of anti-behavioral analysis Capability, 
Strategic Objective, and Tactical Objective properties. 
 

Enumeration Value 

Description 

targeted vm 

targeted sandbox 

Refers to the name of a virtual machine (VM) targeted by the anti-behavioral analysis Capability or one 
of its child Strategic or Tactical Objectives. 
Refers to the name of a sandbox targeted by the anti-behavioral analysis Capability or one of its child 
Strategic or Tactical Objectives. 

2.6.2  AntiBehavioralAnalysisStrategicObjectivesVocab-1.0 
The AntiBehavioralAnalysisStrategicObjectivesVocab is the default MAEC vocabulary for Strategic Objectives of 
the anti-behavioral analysis Capability. The names of these Strategic Objectives are captured in the Name field, a child of the 
Strategic_Objective field  of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC AntiBehavioralAnalysisStrategicObjectivesVocab-1.0 type extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the 
maecVocabs:AntiBehavioralAnalysisStrategicObjectivesTypeEnum-1.0; extended fields are shown below. 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

51 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Anti-Behavioral Analysis Capability Strategic Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#AntiBehavioralAnalysisStrategicObjectivesVocab-1.0.’ 

2.6.2.1 AntiBehavioralAnalysisStrategicObjectivesEnum-1.0 
The AntiBehavioralAnalysisStrategicObjectivesEnum is a non-exhaustive enumeration of Strategic Objectives of 
the anti-behavioral analysis Capability. 
 

Enumeration Value 

Description 

anti-vm 

anti-sandbox 

Indicates that the malware instance is able to prevent virtual machine (VM) based behavioral analysis or 
make it more difficult. 
Indicates that the malware instance is able to prevent sandbox-based behavioral analysis or make it 
more difficult. 

2.6.3  AntiBehavioralAnalysisTacticalObjectivesVocab-1.0 
The AntiBehavioralAnalysisTacticalObjectivesVocab is the default MAEC vocabulary for Tactical Objectives of the 
anti-behavioral analysis Capability. The names of these Tactical Objectives are captured in the Name field, a child of the 
Tactical_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC AntiBehavioralAnalysisTacticalObjectivesVocab-1.0 type extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the 
maecVocabs:AntiBehavioralAnalysisTacticalObjectivesTypeEnum-1.0; extended fields are shown below. 
 
 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

52 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Anti-Behavioral Analysis Capability Tactical Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#AntiBehavioralAnalysisTacticalObjectivesVocab-1.0.’ 

2.6.3.1 AntiBehavioralAnalysisTacticalObjectivesEnum-1.0 
The AntiBehavioralAnalysisTacticalObjectivesEnum is a non-exhaustive enumeration of Tactical Objectives of the 
anti-behavioral analysis Capability. 
 

Enumeration Value 

detect vm environment 

overload sandbox 

prevent execution in sandbox 
detect sandbox environment 
prevent execution in vm 

Description 

Indicates that the malware instance is able to detect whether it is being executed in a virtual machine (VM). 
Indicates that the malware instance is able to overload a sandbox (e.g., by generating a flood of meaningless 
behavioral data). 
Indicates that the malware instance is able to prevent its execution in a sandbox. 
Indicates that the malware instance is able to detect whether it is being executed in a sandbox environment. 
Indicates that the malware instance is able to prevent its execution in a virtual machine (VM). 

2.6.4  AntiCodeAnalysisStrategicObjectiveVocab-1.0 
The AntiCodeAnalysisStrategicObjectivesVocab is the default MAEC vocabulary for Strategic Objectives of the anti-
code analysis Capability.  The names of these Strategic Objectives are captured in the Name field, a child of the 
Strategic_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC AntiCodeAnalysisStrategicObjectivesVocab-1.0 extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the 
maecVocabs:AntiCodeAnalysisStrategicObjectivesTypeEnum-1.0; extended fields are shown below. 
 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

53 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Anti-Code Analysis Capability Strategic Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#AntiCodeAnalysisStrategicObjectivesVocab-1.0.’ 

2.6.4.1 AntiCodeAnalysisStrategicObjectivesEnum-1.0 
The AntiCodeAnalysisStrategicObjectivesEnum is a non-exhaustive enumeration of Strategic Objectives of the anti-
code analysis Capability. 
 

Enumeration Value 

Description 

anti-debugging 

code obfuscation 

anti-disassembly 

Indicates that the malware instance is able to prevent itself from being debugged and/or from being run 
in a debugger or is able to make debugging more difficult. 
Indicates that the malware instance is able to obfuscate its code. 
Indicates that the malware instance is able to prevent itself from being disassembled or make 
disassembly more difficult. 

2.6.5  AntiCodeAnalysisTacticalObjectiveVocab-1.0 
The AntiCodeAnalysisTacticalObjectivesVocab is the default MAEC vocabulary for Tactical Objectives of the anti-code 
analysis Capability. The names of these Tactical Objectives are captured in the Name field, a child of the Tactical_Objective 
field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC AntiCodeAnalysisTacticalObjectivesVocab-1.0 extends the ControlledVocabularyStringType 
defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained 
in the maecVocabs:AntiCodeAnalysisTacticalObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

54 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

vocab_reference 

anyURI 

0..1 

Default Anti-Code Analysis Capability Tactical Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#AntiCodeAnalysisTacticalObjectivesVocab-1.0.’ 

2.6.5.1 AntiCodeAnalysisTacticalObjectivesEnum-1.0 
The AntiCodeAnalysisTacticalObjectivesEnum is a non-exhaustive enumeration of Tactical Objectives of the anti-code 
analysis Capability. 
 

Enumeration Value 

transform control flow 
restructure arrays 
detect debugging 
prevent debugging 
defeat flow-oriented (recursive 
traversal) disassemblers 
defeat linear disassemblers 
obfuscate instructions 
obfuscate imports 
defeat call graph generation 
obfuscate runtime code 

Description 

Indicates that the malware instance is able to transform its control flow. 
Indicates that the malware instance is able to restructure its arrays, making disassembly more difficult. 
Indicates that the malware instance is able to detect its execution in a debugger. 
Indicates that the malware instance is able to prevent its execution in a debugger. 
Indicates that the malware instance is able to defeat its disassembly in a flow-oriented (recursive traversal) 
disassembler. 
Indicates that the malware instance is able to prevent its disassembly in a linear disassembler. 
Indicates that the malware instance obfuscates its instructions. 
Indicates that the malware instance is able to obfuscate its import table, making disassembly more difficult. 
Indicates that the malware instance is able to defeat accurate call graph generation during disassembly. 
Indicates that the malware instance is able to obfuscate its runtime code. 

2.6.6  AntiDetectionStrategicObjectivesVocab-1.0 
The AntiDetectionStrategicObjectivesVocab is the default MAEC vocabulary for Strategic Objectives of the anti-
detection Capability. The names of these Strategic Objectives are captured in the Name field, a child of the 
Strategic_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC AntiDetectionStrategicObjectivesVocab-1.0 extends ControlledVocabularyStringType 
defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained 
in the maecVocabs:AntiDetectionStrategicObjectivesTypeEnum-1.0; extended fields are shown below. 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

55 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Anti-Detection Capability Strategic Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#AntiDetectionStrategicObjectivesVocab-1.0.’ 

2.6.6.1 AntiDetectionStrategicObjectivesEnum-1.0 
The AntiDetectionStrategicObjectivesEnum is a non-exhaustive enumeration of Strategic Objectives of the anti-
detection Capability. 
 

Enumeration Value 

security software evasion 
hide executing code 
self-modification 
anti-memory forensics 
hide non-executing code 
hide malware artifacts 

Description 

Indicates that the malware instance is able to evade security software (e.g., anti-virus tools). 
Indicates that the malware instance is able to hide its executing code. 
Indicates that the malware instance is able to modify itself. 
Indicates that the malware instance is able to prevent or make memory forensics more difficult 
Indicates that the malware instance is able to hide its non-executing code. 
Indicates that the malware instance is able to hide its artifacts. 

2.6.7  AntiDetectionTacticalObjectivesVocab-1.0 
The AntiDetectionTacticalObjectivesVocab is the default MAEC vocabulary for Tactical Objectives of the anti-
detection analysis Capability. The names of these Tactical Objectives are captured in the Name field, a child of the 
Tactical_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC AntiDetectionTacticalObjectivesVocab-1.0 extends the ControlledVocabularyStringType 
defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained 
in the maecVocabs:AntiDetectionTacticalObjectivesTypeEnum-1.0; extended fields are shown below. 
 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

56 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Anti-Detection Capability Tactical Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#AntiDetectionTacticalObjectivesVocab-1.0.’ 

2.6.7.1 AntiDetectionTacticalObjectivesEnum-1.0 
The AntiDetectionTacticalObjectivesEnum is a non-exhaustive enumeration of Tactical Objectives of the anti-detection 
Capability. 
 

Enumeration Value 

hide open network ports 
execute before/external to 
kernel/hypervisor 
encrypt self 
hide processes 
hide network traffic 
change/add content 

execute stealthy code 

hide registry artifacts 
hide userspace libraries 
hide arbitrary virtual memory 

execute non-main cpu code 

feed misinformation during physical 
memory acquisition 

prevent physical memory acquisition 

prevent native api hooking 

 

Description 

Indicates that the malware instance is able to hide its open network ports. 
Indicates that the malware instance is able to execute some or all of its code before or external to the 
system's kernel or hypervisor (e.g., through the BIOS). 
Indicates that the malware is able to encrypt itself. 
Indicates that the malware instance is able to hide its processes. 
Indicates that the malware instance is able to hide its network traffic. 
Indicates that the malware instance is able to change or add to its content. 
Indicates that the malware instance is able to execute some or all of its code in a hidden manner (e.g., 
by injecting it into a benign process). 
Indicates that the malware instance is able to hide its Windows registry artifacts. 
Indicates that the malware instance is able to hide its usage of userspace libraries. 
Indicates that the malware instance is able to hide arbitrary virtual memory to prevent retrieval. 
Indicates that the malware instance is able to execute some or all of its code on a secondary, non CPU 
processor (e.g., a GPU). 
Indicates that the malware instance is able to report inaccurate data when the content of physical 
memory is retrieved. 
Indicates that the malware instance is able to prevent the contents of a system's physical memory from 
being retrieved. 
Indicates that the malware instance is able to prevent other software from hooking native APIs. 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

57 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

obfuscate artifact properties 

hide kernel modules 
hide code in file 
hide services 
hide file system artifacts 
hide threads 

Indicates that the malware instance is able to hide the properties of its artifacts (e.g., by altering 
timestamps). 
Indicates that the malware instance is able to hide its usage of kernel modules. 
Indicates that the malware instance is able to hide its code in a file. 
Indicates that the malware instance is able to hide any system services it creates or injects itself into. 
Indicates that the malware instance is able to hide its file system artifacts. 
Indicates that the malware instance is able to hide its threads. 

2.6.8  AntiRemovalStrategicObjectivesVocab-1.0 
The AntiRemovalStrategicObjectivesVocab is the default MAEC vocabulary for Strategic Objectives of the anti-removal 
Capability. The names of these Strategic Objectives are captured in the Name field, a child of the Strategic_Objective field of 
type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC AntiRemovalStrategicObjectivesVocab-1.0 extends the ControlledVocabularyStringType 
defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained 
in the maecVocabs:AntiRemovalStrategicObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Anti-Removal Capability Strategic Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#AntiRemovalStrategicObjectivesVocab-1.0.’ 

2.6.8.1 AntiRemovalStrategicObjectivesEnum-1.0 
The AntiRemovalStrategicObjectivesEnum is a non-exhaustive enumeration of Strategic Objectives of the anti-removal 
Capability. 
 

Enumeration Value 

prevent malware artifact access 
 

Indicates that the malware instance is able to prevent its artifacts from being accessed. 

Description 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

58 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

prevent malware artifact deletion 

Indicates that the malware instance is able to prevent its artifacts from being deleted from a system. 

2.6.9  AntiRemovalTacticalObjectivesVocab-1.0 
The AntiRemovalTacticalObjectivesVocab is the default MAEC vocabulary for Tactical Objectives of the anti-removal 
Capability. The names of these Tactical Objectives are captured in the Name field, a child of the Tactical_Objective field of 
type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC AntiRemovalTacticalObjectivesVocab-1.0 extends the ControlledVocabularyStringType defined 
in CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:AntiRemovalTacticalObjectivesTypeEnum-1.0; extended fields are shown below. 
 

 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Anti-Removal Capability Tactical Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#AntiRemovalTacticalObjectivesVocab-1.0.’ 

2.6.9.1 AntiRemovalTacticalObjectivesEnum-1.0 
The AntiRemovalTacticalObjectivesEnum is a non-exhaustive enumeration of Tactical Objectives of the anti-removal 
Capability. 
 

Enumeration Value 

prevent registry deletion 

prevent api unhooking 
prevent file access 

prevent memory access 

prevent registry access 
 

Description 

Indicates that the malware instance is able to prevent its Windows registry entries from being deleted from a 
system. 
Indicates that the malware instance is able to prevent its API hooks from being removed. 
Indicates that the malware instance is able to prevent access to the file system. 
Indicates that the malware instance is able to prevent access to system memory where it may be storing 
code or data. 
Indicates that the malware instance is able to prevent access to the Windows registry. 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

59 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

prevent file deletion 

Indicates that the malware instance is able to prevent its files from being deleted from a system. 

2.6.10 AvailabilityViolationPropertiesVocab-1.0 
The AvailabilityViolationPropertiesVocab is the default MAEC vocabulary for properties of the availability violation 
Capability and its child Objectives. The names of these properties are captured in the Name field, a child of the Property field of 
type CapabilityPropertyType.  The Property field is found on the CapabilityType (which is used to define a 
Capability) and on the CapabilityObjectiveType (which is used to define a Strategic Objective or a Tactical Objective).  All 
aforementioned types are defined in the MAEC Bundle schema. 
   
The MAEC AvailabilityViolationPropertiesVocab-1.0 extends the ControlledVocabularyStringType 
defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained 
in the maecVocabs:AvailabilityViolationPropertiesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Availability Violation Capability and Objective Properties.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#AvailabilityViolationPropertiesVocab-1.0.’ 

2.6.10.1  AvailabilityViolationPropertiesEnum-1.0 
The AvailabilityViolationPropertiesEnum is a non-exhaustive enumeration of availability violation Capability, Strategic 
Objective, and Tactical Objective properties. 
 

Enumeration Value 

Description 

cryptocurrency type 

Refers to the type of cryptocurrency targeted by the ‘mine for cryptocurrency’ Tactical Objective. 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

60 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.6.11 AvailabilityViolationStrategicObjectivesVocab-1.0 
The AvailabilityViolationStrategicObjectivesVocab is the default MAEC vocabulary for Strategic Objectives of the 
availability violation Capability. The names of these Strategic Objectives are captured in the Name field, a child of the 
Strategic_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC AvailabilityViolationStrategicObjectivesVocab-1.0 extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the maecVocabs: 
AvailabilityViolationStrategicObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Availability Violation Capability Strategic Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#AvailabilityViolationStrategicObjectivesVocab-1.0.’ 

2.6.11.1  AvailabilityViolationStrategicObjectivesEnum-1.0 
The AvailabilityViolationStrategicObjectivesEnum is a non-exhaustive enumeration of Strategic Objectives of the 
availability violation Capability. 
 

Enumeration Value 
compromise data availability 
compromise system availability 
cosume system resources 

Indicates that the malware instance is able to compromise the availability of data on a system. 
Indicates that the malware instance compromises the availability of the system. 
Indicates that the malware instance is able to consume system resources for its own purposes. 

Description 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

61 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.6.12 AvailabilityViolationTacticalObjectivesVocab-1.0 
AvailabilityViolationTacticalObjectivesVocab is the default MAEC vocabulary for Tactical Objectives of the 
availability violation Capability. The names of these Tactical Objectives are captured in the Name field, a child of the 
Tactical_Objective of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC AvailabilityViolationTacticalObjectivesVocab-1.0 type extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the maecVocabs: 
AvailabilityViolationTacticalObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Availability Violation Capability Tactical Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#AvailabilityViolationTacticalObjectivesVocab-1.0.’ 

2.6.12.1  AvailabilityViolationTacticalObjectivesEnum-1.0 
The AvailabilityViolationTacticalObjectivesEnum is a non-exhaustive enumeration of Tactical Objectives of the 
availability violation Capability. 
 

Enumeration Value 

denial of service 

compromise local system availability 
crack passwords 
mine for cryptocurrency 
compromise access to information 
assets 

 

Description 

Indicates that the malware instance is able to cause a server to be unavailable, otherwise known as a 
denial of service (DOS). 
Indicates that the malware instance is able to cause the local system to be unavailable. 
Indicates that the malware instance is able to consume system resources for password cracking. 
Indicates that the malware instance is able to consume system resources for cryptocurrency mining. 
Indicates that the malware instance is able to prevent data from being accessed (e.g., by encrypting user 
data on a compromised system). 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

62 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.6.13 CommandandControlPropertiesVocab-1.0 
CommandandControlPropertiesVocab is the default MAEC vocabulary for properties of the command and control 
Capability and its child Objectives. The names of these properties are captured in the Name field, a child of the Property field of 
type CapabilityPropertyType.  The Property field is found on the CapabilityType (which is used to define a 
Capability) and on the CapabilityObjectiveType (which is used to define a Strategic Objective or a Tactical Objective).  All 
aforementioned types are defined in the MAEC Bundle schema. 
   
The MAEC CommandandControlPropertiesVocab-1.0 type extends the ControlledVocabularyStringType 
defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained 
in the maecVocabs:CommandandControlPropertiesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Command and Control Capability and Objective Properties.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#CommandandControlPropertiesVocab-1.0.’ 

2.6.13.1  CommandandControlPropertiesEnum-1.0 
The CommandandControlPropertiesEnum is a non-exhaustive enumeration of command and control Capability, Strategic 
Objective, and Tactical Objective properties. 
 

Enumeration Value 

Description 

frequency 

 

Refers to a description of the frequency that the ‘receive data from c2 server’ and ‘send data to c2 
server’ Strategic Objectives, as well as their child Tactical Objectives, are employed.  It is recommended 
that the description follow the format of "every x [units]", e.g., "every 5 minutes". 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

63 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.6.14 CommandandControlStrategicObjectivesVocab-1.0 
The CommandandControlStrategicObjectivesVocab is the default MAEC vocabulary for Strategic Objectives of the 
command and control Capability. The names of these Strategic Objectives are captured in the Name field, a child of the 
Strategic_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC CommandandControlStrategicObjectivesVocab-1.0 extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the 
maecVocabs:CommandandControlStrategicObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Command and Control Capability Strategic Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#CommandandControlStrategicObjectivesVocab-1.0.’ 

2.6.14.1  CommandandControlStrategicObjectivesEnum-1.0 
The CommandandControlStrategicObjectivesEnum is a non-exhaustive enumeration of Strategic Objectives of the 
command and control Capability. 
 

Enumeration Value 

determine c2 server 

receive data from c2 server 

send data to c2 server 

Description 

Indicates that the malware instance is able to identify one or more command and control (C2) servers 
with which to communicate. 
Indicates that the malware instance is able to control its behavior through some external stimulus (e.g., 
a remotely submitted command). 
Indicates that the malware instance is able to send some data to a command and control server. 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

64 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.6.15 CommandandControlTacticalObjectivesVocab-1.0 
The CommandandControlTacticalObjectivesVocab is the default MAEC vocabulary for Tactical Objectives of the 
command and control Capability. The names of these Tactical Objectives are captured in the Name field, a child of the 
Tactical_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC CommandandControlTacticalObjectivesVocab-1.0 extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the maecVocabs: 
CommandandControlTacticalObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Command and Control Capability Tactical Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#CommandandControlTacticalObjectivesVocab-1.0.’ 

2.6.15.1  CommandandControlTacticalObjectivesEnum-1.0 
The CommandandControlTacticalObjectivesEnum is a non-exhaustive enumeration of Tactical Objectives of the 
command and control Capability. 
 

Enumeration Value 

Description 

check for payload 

validate data 

control malware via remote 
command 

send system information 

 

Indicates that the malware instance is able to query a command and control server to check whether a new 
malicious payload is available for download 
Indicates that the malware instance is able to validate the integrity of the data it receives from a command 
and control server. 
Indicates that the malware instance is able to execute commands issued to it from a remote source such as a 
command and control server for the purpose of controlling its behavior. 
Indicates that the malware instance is able to send data regarding the system on which it is executing to a 
command and control server. 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

65 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

send heartbeat data 

generate c2 domain name(s) 

update configuration 

Indicates that the malware instance is able to send heartbeat data to a command and control server, 
indicating that it is still active on the host system and able to communicate. 
Indicates that the malware instance is able to generate the domain name of the command and control server 
to which it connects. 
Indicates that the malware instance is able to update its configuration using data received from a command 
and control server. 

2.6.16 DataExfiltrationPropertiesVocab-1.0 
The DataExfiltrationPropertiesVocab is the default MAEC vocabulary for properties of the data exfiltration Capability 
and its child Objectives. The names of these properties are captured in the Name field, a child of the Property field of type 
CapabilityPropertyType.  The Property field is found on the CapabilityType (which is used to define a Capability) 
and on the CapabilityObjectiveType (which is used to define a Strategic Objective or a Tactical Objective).  All 
aforementioned types are defined in the MAEC Bundle schema. 
   
The MAEC DataExfiltrationPropertiesVocab-1.0 extends the ControlledVocabularyStringType defined 
in CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:DataExfiltrationPropertiesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Data Exfiltration Capability and Objective Properties.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#DataExfiltrationPropertiesVocab-1.0.’ 

2.6.16.1  DataExfiltrationPropertiesEnum-1.0 
The DataExfiltrationPropertiesEnum is a non-exhaustive enumeration of data exfiltration Capability, Strategic Objective, 
and Tactical Objective properties. 
 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

66 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

Enumeration Value 

Description 

archive type 

file type 

Refers to the name of the file archive format used in the ‘stage data for exfiltration’ Strategic Objective 
and/or its ‘package data’ Tactical Objective. 
Refers to the name of the file format used for storing data to be exfiltrated as part of the data 
exfiltration Capability or its child Objectives. 

2.6.17 DataExfiltrationStrategicObjectivesVocab-1.0 
The DataExfiltrationStrategicObjectivesVocab is the default MAEC vocabulary for Strategic Objectives of the data 
exfiltration Capability. The names of these Strategic Objectives are captured in the Name field, a child of the 
Strategic_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC DataExfiltrationStrategicObjectivesVocab-1.0 extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the 
maecVocabs:DataExfiltrationStrategicObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Data Exfiltration Capability Strategic Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#DataExfiltrationStrategicObjectivesVocab-1.0.’ 

2.6.17.1  DataExfiltrationStrategicObjectivesEnum-1.0 
The DataExfiltrationStrategicObjectivesEnum is a non-exhaustive enumeration of Strategic Objectives of the data 
exfiltration Capability. 
 

Enumeration Value 

Description 

perform data exfiltration 

Indicates that the malware instance is able to perform data exfiltration via some physical or virtual 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

67 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

obfuscate data for exfiltration 
stage data for exfiltration 

means. 
Indicates that the malware is able to obfuscate data that will be exfiltrated. 
Indicates that the malware instance is able to gather and prepare data for exfiltration. 

2.6.18 DataExfiltrationTacticalObjectivesVocab-1.0 
The DataExfiltrationTacticalObjectivesVocab is the default MAEC vocabulary for Tactical Objectives of the data 
exfiltration Capability. The names of these Tactical Objectives are captured in the Name field, a child of the 
Tactical_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC DataExfiltrationTacticalObjectivesVocab-1.0 extends the ControlledVocabularyStringType 
defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained 
in the maecVocabs:DatExfiltrationTacticalObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Data Exfiltration Capability Tactical Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#DataExfiltrationTacticalObjectivesVocab-1.0.’ 

2.6.18.1  DataExfiltrationTacticalObjectivesEnum-1.0 
The DataExfiltrationTacticalObjectivesEnum is a non-exhaustive enumeration of Tactical Objectives of the data 
exfiltration Capability. 
 

Enumeration Value 

exfiltrate via covert channel 
exfiltrate via fax 
exfiltrate via physical media 
encrypt data 

 

Description 

Indicates that that the malware instance is able to exfiltrate data using a covert channel. 
Indicates that the malware instance is able to exfiltrate data using a fax system. 
Indicates that the malware instance is able to exfiltrate data using physical media (e.g., a USB drive). 
Indicates that the malware instance is able to encrypt data that will be exfiltrated. 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

68 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

exfiltrate via network 

hide data 

package data 

exfiltrate via dumpster dive 

move data to staging server 

exfiltrate via voip/phone 

Indicates that the malware instance is able to exfiltrate data across the network. 
Indicates that the malware instance is able to hide data that will be exfiltrated in other formats (also 
known as steganography). 
Indicates that the malware instance is able to package data for exfiltration. 
Indicates that the malware instance is able to exfiltrate data via dumpster dive (i.e., encoded data 
printed by malware is viewed as garbage and thrown away to then be physically picked up). 
Indicates that the malware instance is able to move data to be exfiltrated to a particular server to 
prepare for exfiltration. 
Indicates that the malware instance is able to exfiltrate data (encoded as audio) using a phone system. 

2.6.19 DataTheftPropertiesVocab-1.0 
The DataTheftPropertiesVocab is the default MAEC vocabulary for properties of the data theft Capability and its child 
Objectives. The names of these properties are captured in the Name field, a child of the Property field of type 
CapabilityPropertyType.  The Property field is found on the CapabilityType (which is used to define a Capability) 
and on the CapabilityObjectiveType (which is used to define a Strategic Objective or a Tactical Objective).  All 
aforementioned types are defined in the MAEC Bundle schema. 
   
The MAEC DataTheftPropertiesVocab-1.0 type extends ControlledVocabularyStringType defined in CybOX 
Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:DataTheftPropertiesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Data Theft Capability and Objective Properties.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#DataTheftPropertiesVocab-1.0.’ 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

69 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.6.19.1  DataTheftPropertiesEnum-1.0 
The DataTheftPropertiesEnum is a non-exhaustive enumeration of data theft Capability, Strategic Objective, and Tactical 
Objective properties. 
 

Enumeration Value 

targeted application 
targeted website 

Refers to the name of an application targeted by the ‘steal authentication credentials’ Strategic Objective. 
Refers to the domain name of a website targeted by the ‘steal web/network credential’ Tactical Objective. 

Description 

2.6.20 DataTheftStrategicObjectivesVocab-1.0 
The DataTheftStrategicObjectivesVocab is the default MAEC vocabulary for Strategic Objectives of the data theft 
Capability. The names of these Strategic Objectives are captured in the Name field, a child of the Strategic_Objective of type 
CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC DataTheftStrategicObjectivesVocab-1.0 extends the ControlledVocabularyStringType defined 
in CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:DataTheftStrategicObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Data Theft Capability Strategic Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#DataTheftStrategicObjectivesVocab-1.0.’ 

2.6.20.1  DataTheftStrategicObjectivesEnum-1.0 
The DataTheftStrategicObjectivesEnum is a non-exhaustive enumeration of Strategic Objectives of the data theft 
Capability. 
 
 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

70 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

Enumeration Value 

steal stored information 
steal user data 

steal system information 

steal authentication credentials 

Description 

Indicates that the malware instance is able to steal information stored on a system (e.g., files). 
Indicates that the malware instance is able to steal user data (e.g., email). 
Indicates that the malware instance is able to steal information about a system (e.g., network address 
data). 
Indicates that the malware instance is able to steal authentication credentials. 

2.6.21 DataTheftTacticalObjectivesVocab-1.0 
The DataTheftTacticalObjectivesVocab is the default MAEC vocabulary for Tactical Objectives of the data theft 
Capability. The names of these Tactical Objectives are captured in the Name field, a child of the Tactical_Objective field of 
type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC DataTheftTacticalObjectivesVocab-1.0 extends the ControlledVocabularyStringType defined in 
CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:DataTheftTacticalObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Data Theft Capability Tactical Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#DataTheftTacticalObjectivesVocab-1.0.’ 

2.6.21.1  DataTheftTacticalObjectivesEnum-1.0 
The DataTheftTacticalObjectivesEnum is a non-exhaustive enumeration of Tactical Objectives of the data theft 
Capability. 
 

Enumeration Value 

Description 

steal dialed phone numbers 

Indicates that the malware instance is able to steal the list of phone numbers that a user has dialed. 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

71 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

steal email data 

steal referrer urls 

steal cryptocurrency data 

steal pki software certificate 

steal browser cache 
steal serial numbers 

steal sms database 

steal cookie 
steal password hash 
steal make/model 
steal documents 

steal network address 

steal open port 
steal images 
steal browser history 

steal web/network credential 

steal pki key 
steal contact list data 
steal database content 

Indicates that the malware instance is able to steal a user's email data 
Indicates that the malware instance is able to steal HTTP referrer information (URL of the Web page that 
linked to the resource being requested). 
Indicates that the malware instance is able to steal cryptocurrency data (e.g., Bitcoin wallets). 
Indicates that the malware instance is able to steal one or more public key infrastructure (PKI) software 
certificates. 
Indicates that the malware instance is able to steal a user's browser cache 
Indicates that the malware instance is able to steal serial numbers stored on a system. 
Indicates that the malware instance is able to steal a user's short message service (SMS) (text messaging) 
database. 
Indicates that the malware instance is able to steal cookies. 
Indicates that the malware instance is able to steal password hashes. 
Indicates that the malware instance is able to steal the information on the make and/or model of a system. 
Indicates that the malware instance is able to steal document files stored on a system. 
Indicates that the malware instance is able to steal information about the network addresses used by a 
system. 
Indicates that the malware instance is able to steal information about the open ports on a system. 
Indicates that the malware instance is able to steal image files stored on a system. 
Indicates that the malware instance is able to steal a user's browser history. 
Indicates that the malware instance is able to steal usernames, passwords, or other forms of network 
credentials. 
Indicates icates that the malware instance is able to steal one or more public key infrastructure (PKI) keys. 
Indicates cates that the malware instance is able to steal a user's contact list. 
Indicates that the malware instance is able to steal database content. 

2.6.22 DestructionPropertiesVocab-1.0 
The DestructionPropertiesVocab is the default MAEC vocabulary for properties of the destruction Capability and its child 
Objectives. The names of these properties are captured in the Name field, a child of the Property field of type 
CapabilityPropertyType.  The Property field is found on the CapabilityType (which is used to define a Capability) 
and on the CapabilityObjectiveType (which is used to define a Strategic Objective or a Tactical Objective).  All 
aforementioned types are defined in the MAEC Bundle schema. 
 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

72 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

   
The MAEC DestructionPropertiesVocab-1.0 extends the ControlledVocabularyStringType defined in CybOX 
Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:DestructionPropertiesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Destruction Capability and Objective Properties.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#DestructionPropertiesVocab-1.0.’ 

2.6.22.1  DestructionPropertiesEnum-1.0 
The DestructionPropertiesEnum is a non-exhaustive enumeration of destruction Capability, Strategic Objective, and Tactical 
Objective properties. 
 

Enumeration Value 

erasure scope 

Refers to the scope of the erasure performed by the ‘erase data’ Tactical Objective.  Recommended 
values are: 'whole disk', or 'targeted files'. 

Description 

2.6.23 DestructionStrategicObjectivesVocab-1.0 
The DestructionStrategicObjectivesVocab is the default MAEC vocabulary for Strategic Objectives of the destruction 
Capability. The names of these Strategic Objectives are captured in the Name field, a child of the Strategic_Objective field of 
type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC DestructionStrategicObjectivesVocab-1.0 extends the ControlledVocabularyStringType 
defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained 
in the maecVocabs:DestructionStrategicObjectivesTypeEnum-1.0; extended fields are shown below. 
 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

73 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Destruction Capability Strategic Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#DestructionStrategicObjectivesVocab-1.0.’ 

2.6.23.1  DestructionStrategicObjectivesEnum-1.0 
The DestructionStrategicObjectivesEnum is a non-exhaustive enumeration of Strategic Objectives of the destruction 
Capability. 
 

Enumeration Value 

destroy physical entity 
destroy virtual entity 

Indicates that the malware instance is able to destroy a physical entity. 
Indicates that the malware instance is able to destroy a virtual entity. 

Description 

2.6.24 DestructionTacticalObjectivesVocab-1.0 
The DestructionTacticalObjectivesVocab is the default MAEC vocabulary for Tactical Objectives of the destruction 
Capability. The names of these Tactical Objectives are captured in the Name field, a child of the Tactical_Objective field of 
type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC DestructionTacticalObjectivesVocab-1.0 extends the ControlledVocabularyStringType 
defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained 
in the maecVocabs:DestructionTacticalObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Destruction Capability Tactical Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

74 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

ries.xsd#DestructionTacticalObjectivesVocab-1.0.’ 

2.6.24.1  DestructionTacticalObjectivesEnum-1.0 
The DestructionTacticalObjectivesEnum is a non-exhaustive enumeration of Tactical Objectives of the destruction 
Capability. 
 

Enumeration Value 

erase data 
destroy firmware 
destroy hardware 

Indicates that the malware instance is able to destroy data by erasure. 
Indicates that the malware instance is able to destroy a system's firmware. 
Indicates that the malware instance is able to destroy a system's hardware. 

Description 

2.6.25 FraudStrategicObjectivesVocab-1.0 
The FraudStrategicObjectivesVocab is the default MAEC vocabulary for Strategic Objectives of the fraud Capability. The 
names of these Strategic Objectives are captured in the Name field, a child of the Strategic_Objective field of type 
CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC FraudStrategicObjectivesVocab-1.0 extends the ControlledVocabularyStringType defined in 
CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:FraudStrategicObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Fraud Capability Strategic Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#FraudStrategicObjectivesVocab-1.0.’ 

2.6.25.1  FraudStrategicObjectivesEnum-1.0 
The FraudStrategicObjectivesEnum is a non-exhaustive enumeration of Strategic Objectives of the fraud Capability. 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

75 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

 

Enumeration Value 

perform premium rate fraud 

perform click fraud 

Description 

Indicates that the malware instance is able to send text messages or dial phone numbers that are 
charged at premium rates. 
Indicates that the malware instance is able to simulate clicks on website advertisements for the purpose 
of revenue generation. 

2.6.26 FraudTacticalObjectivesVocab-1.0 
The FraudTacticalObjectivesVocab is the default MAEC vocabulary for Tactical Objectives of the fraud Capability. The 
names of these Tactical Objectives are captured in the Name field, a child of the Tactical_Objective field of type 
CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC FraudTacticalObjectivesVocab-1.0 extends the ControlledVocabularyStringType defined in 
CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:FraudTacticalObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Fraud Capability Tactical Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#FraudTacticalObjectivesVocab-1.0.’ 

2.6.26.1  FraudTacticalObjectivesEnum-1.0 
The FraudTacticalObjectivesEnum is a non-exhaustive enumeration of Tactical Objectives of the fraud Capability. 
 

Enumeration Value 

Description 

access premium service 

Indicates that the malware instance is able to access a premium service. 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

76 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.6.27 InfectionPropagationPropertiesVocab-1.0 
The InfectionPropagationPropertiesVocab is the default MAEC vocabulary for properties of the infection propagation 
Capability and its child Objectives. The names of these properties are captured in the Name field, a child of the Property field of 
type CapabilityPropertyType.  The Property field is found on the CapabilityType (which is used to define a 
Capability) and on the CapabilityObjectiveType (which is used to define a Strategic Objective or a Tactical Objective).  All 
aforementioned types are defined in the MAEC Bundle schema. 
   
The MAEC InfectionPropagationPropertiesVocab-1.0 extends the ControlledVocabularyStringType 
defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained 
in the maecVocabs:InfectionPropagationPropertiesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default InfectionPropagation Capability and Objective Properties.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#InfectionPropagationPropertiesVocab-1.0.’ 

InfectionPropagationPropertiesEnum-1.0 

2.6.27.1 
The InfectionPropagationPropertiesEnum is a non-exhaustive enumeration of infection propagation Capability, 
Strategic Objective, and Tactical Objective properties. 
 

Enumeration Value 

Description 

scope 

infection targeting 

autonomy 

 

Refers to the scope of the infection or propagation performed by the malware instance via the 
Infection/Propagation Capability, i.e., whether it infects just the local machine or actively propagates to 
other machines as well. Recommended values are: 'local' or 'remote'. 
Refers to the type of targeting employed by the ‘infect remote machine’ Strategic Objective, i.e., 
whether the targeted machines are randomly selected, or chosen from some particular set.  
Recommended values are: 'targeted', 'semi-targeted', or 'untargeted'. 
Refers to the type of autonomy employed by the ‘infect remote machine’ Strategic Objective, i.e., 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

77 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

targeted file type 

targeted file architecture type 

file infection type 

whether the remote infection is performed autonomously.  Recommended values are: 'semi-
autonomous', 'autonomous'. 
Refers to the types of files targeted by the ‘infect file’ Strategic Objective. It is recommended that files 
be specified via their extension, e.g., "exe", "pdf", etc. 
Refers to type of file architecture targeted by the ‘infect file’ Strategic Objective. Recommended values 
are: '32 bit' or '64 bit'. 
Refers to the type of file infection employed by the ‘infect file’ Strategic Objective.  Recommended 
values are: 'appending', 'prepending', 'overwriting', 'companion', 'variable key', 'polymorphic', or 
'metamorphic'. 

2.6.28 InfectionPropagationStrategicObjectivesVocab-1.0 
The InfectionPropagationStrategicObjectivesVocab is the default MAEC vocabulary for Strategic Objectives of the 
infection/propagation Capability. The names of these Strategic Objectives are captured in the Name field, a child of the 
Strategic_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC InfectionPropagationStrategicObjectivesVocab-1.0 extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the 
maecVocabs:InfectionPropagationStrategicObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Infection/Propagation Capability Strategic Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#InfectionPropagationStrategicObjectivesVocab-1.0.’ 

InfectionPropagationStrategicObjectivesEnum-1.0 

2.6.28.1 
The InfectionPropagationStrategicObjectivesEnum is a non-exhaustive enumeration of Strategic Objectives of the 
infection/propagation Capability. 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

78 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

 

Enumeration Value 

prevent duplicate infection 
infect file 

infect remote machine 

Description 

Indicates that the malware instance is able to prevent itself from infecting a machine multiple times. 
Indicates that the malware instance is able to infect a file. 
Indicates that the malware instance is able to self-propagate or infect a machine with malware that is 
different than itself. 

2.6.29 InfectionPropagationTacticalObjectivesVocab-1.0 
The InfectionPropagationTacticalObjectivesVocab is the default MAEC vocabulary for Tactical Objectives of the 
infection/propagation Capability. The names of these Tactical Objectives are captured in the Name field, a child of the 
Tactical_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC InfectionPropagationTacticalObjectivesVocab-1.0 extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the 
maecVocabs:InfectionPropagationTacticalObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Infection/Propagation Capability Tactical Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#InfectionPropagationTacticalObjectivesVocab-1.0.’ 

InfectionPropagationTacticalObjectivesEnum-1.0 

2.6.29.1 
The InfectionPropagationTacticalObjectivesEnum is a non-exhaustive enumeration of Tactical Objectives of the 
infection/propagation Capability. 
 
 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

79 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

Enumeration Value 

identify file 

perform autonomous remote 
infection 

identify target machine(s) 

perform social-engineering 
based remote infection 
inventory victims 
write code into file 

modify file 

Description 

Indicates that the malware instance is able to identify a file or files on a local, removable, and/or network 
drive for infection. 
Indicates that the malware instance is able to infect a remote machine autonomously, without the 
involvement of any end user (e.g., through the exploitation of a remote procedure call vulnerability). 
Indicates that the malware instance is able to identify one or more machines to be targeted for infection via 
some remote means (e.g., via email or the network). 
Indicates that the malware instance is able to infect remote machines via some method that involves social 
engineering (e.g., sending an email with a malicious attachment). 
indicates that the malware instance is able to keep an inventory of the victims that it remotely infects. 
indicates that the malware instance is able to write code into a file. 
indicates that the malware instance is able to modify a file in some other manner than writing code to it, 
such as packing it (in terms of binary executable packing). 

2.6.30 IntegrityViolationStrategicObjectivesVocab-1.0 
The IntegrityViolationStrategicObjectivesVocab is the default MAEC vocabulary for Strategic Objectives of the 
integrity violation Capability. The names of these Strategic Objectives are captured in the Name field, a child of the 
Strategic_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC IntegrityViolationStrategicObjectivesVocab-1.0 extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the 
maecVocabs:IntegrityViolationStrategicObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Integrity Violation Capability Strategic Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#IntegrityViolationStrategicObjectivesVocab-1.0.’ 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

80 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

IntegrityViolationStrategicObjectivesEnum-1.0 

2.6.30.1 
The IntegrityViolationStrategicObjectivesEnum is a non-exhaustive enumeration of Strategic Objectives of the 
integrity violation Capability. 
 

Enumeration Value 

Description 

compromise system operational integrity 
compromise user data integrity 
annoy user 
compromise network operational integrity 
compromise system data integrity 

Indicates that the malware instance is able to compromise the operational integrity of a system. 
Indicates that the malware instance is able to compromise a system's user data. 
Indicates that the malware instance is able to annoy the users of a system. 
Indicate that the malware instance is able to compromise the operational integrity of a network. 
Indicates that the malware instance is able to compromise the integrity of a system's data. 

2.6.31 IntegrityViolationTacticalObjectivesVocab-1.0 
The IntegrityViolationTacticalObjectivesVocab is the default MAEC vocabulary for Tactical Objectives of the 
integrity violation Capability. The names of these Tactical Objectives are captured in the Name field, a child of the 
Tactical_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC IntegrityViolationTacticalObjectivesVocab-1.0 extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the 
maecVocabs:IntegrityViolationTacticalObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Integrity Violation Capability Tactical Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#IntegrityViolationTacticalObjectivesVocab-1.0.’ 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

81 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

IntegrityViolationTacticalObjectivesEnum-1.0 

2.6.31.1 
The IntegrityViolationTacticalObjectivesEnum is a non-exhaustive enumeration of Tactical Objectives of the 
integrity violation Capability. 
 

Enumeration Value 

subvert system 

corrupt system data 
annoy local system user 
intercept/manipulate network traffic 
annoy remote user 
corrupt user data 

Description 

Indicates that the malware instance is able to subvert a system to perform beyond its operational 
boundaries or to perform tasks for which it was not originally intended. 
Indicates that the malware instance is able to corrupt a system's data. 
Indicates that the malware instance is able to annoy local system users. 
Indicates that the malware is able to intercept and/or manipulate traffic on a network. 
Indicates that the malware instance is able to annoy a remote user. 
Indicates that the malware instance is able to corrupt a system's user data. 

2.6.32 MachineAccessControlPropertiesVocab-1.0 
The MachineAccessControlPropertiesVocab is the default MAEC vocabulary for properties of the machine access control 
Capability and its child Objectives. The names of these properties are captured in the Name field, a child of the Property field of 
type CapabilityPropertyType.  The Property field is found on the CapabilityType (which is used to define a 
Capability) and on the CapabilityObjectiveType (which is used to define a Strategic Objective or a Tactical Objective).  All 
aforementioned types are defined in the MAEC Bundle schema. 
   
The MAEC MachineAccessControlPropertiesVocab-1.0 extends the ControlledVocabularyStringType 
defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained 
in the maecVocabs:MachineAccessControlPropertiesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Machine Access Control Capability and Objective Properties.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#MachineAccessControlPropertiesVocab-1.0.’ 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

82 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.6.32.1  MachineAccessControlPropertiesEnum-1.0 
The MachineAccessControlPropertiesEnum is a non-exhaustive enumeration of machine access control Capability, 
Strategic Objective, and Tactical Objective properties. 
 

Enumeration Value 

Description 

backdoor type 

Refers to the type of backdoor, e.g., reverse shell, employed by the ‘install backdoor’ Strategic Objective. 

2.6.33 MachineAccessControlStrategicObjectivesVocab-1.0 
The MachineAccessControlStrategicObjectivesVocab is the default MAEC vocabulary for Strategic Objectives of the 
machine access control Capability. The names of these Strategic Objectives are captured in the Name field, a child of the 
Strategic_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC MachineAccessControlStrategicObjectivesVocab-1.0 extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the 
maecVocabs:MachineAccessControlStrategicObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Machine Access Control Capability Strategic Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#MachineAccessControlStrategicObjectivesVocab-1.0.’ 

2.6.33.1  MachineAccessControlStrategicObjectivesEnum-1.0 
The MachineAccessControlStrategicObjectivesEnum is a non-exhaustive enumeration of Strategic Objectives of the 
machine access control Capability. 
 
 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

83 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

Enumeration Value 

Description 

control local machine 

install backdoor 

Indicates that the malware instance is able to control the machine on which it is resident.  Examples of 
malware with this capability include bots, backdoors, and RATs. 
Indicates that the malware instance is able to install a backdoor, capable of providing covert remote 
access to the machine on which it is resident. 

2.6.34 MachineAccessControlTacticalObjectivesVocab-1.0 
The MachineAccessControlTacticalObjectivesVocab is the default MAEC vocabulary for Tactical Objectives of the 
machine access control Capability. The names of these Tactical Objectives are captured in the Name field, a child of the 
Tactical_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC MachineAccessControlTacticalObjectivesVocab-1.0 extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the maecVocabs: 
MachineAccessControlTacticalObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Machine Access Control Capability Tactical Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#MachineAccessControlTacticalObjectivesVocab-1.0.’ 

2.6.34.1  MachineAccessControlTacticalObjectivesEnum-1.0 
The MachineAccessControlTacticalObjectivesEnum is a non-exhaustive enumeration of Tactical Objectives of the 
machine access control Capability. 
 

Enumeration Value 

Description 

control machine via remote command 

Indicates that the malware instance is able to execute commands issued to it from a remote source, 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

84 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

for the purpose of controlling the machine on which it is resident. 

2.6.35 PersistencePropertiesVocab-1.0 
The PersistencePropertiesVocab is the default MAEC vocabulary for properties of the persistence Capability and its child 
Objectives. The names of these properties are captured in the Name field, a child of the Property field of type 
CapabilityPropertyType.  The Property field is found on the CapabilityType (which is used to define a Capability) 
and on the CapabilityObjectiveType (which is used to define a Strategic Objective or a Tactical Objective).  All 
aforementioned types are defined in the MAEC Bundle schema. 
   
The MAEC PersistencePropertiesVocab-1.0 extends the ControlledVocabularyStringType defined in 
CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:PersistencePropertiesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Persistence Capability and Objective Properties.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#PersistencePropertiesVocab-1.0.’ 

2.6.35.1  PersistencePropertiesEnum-1.0 
The PersistencePropertiesEnum is a non-exhaustive enumeration of persistence Capability, Strategic Objective, and Tactical 
Objective properties. 
 

Enumeration Value 

Description 

scope 

 

Refers to the scope of persistence employed by the persistence Capability, i.e., whether the malware 
instance make itself persist, or whether it makes other malware components persist.  Recommended 
values are: 'self', or 'other malware/components'. 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

85 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.6.36 PersistenceStrategicObjectivesVocab-1.0 
The PersistenceStrategicObjectivesVocab is the default MAEC vocabulary for Strategic Objectives of the persistence 
Capability. The names of these Strategic Objectives are captured in the Name field, a child of the Strategic_Objective of type 
CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC PersistenceStrategicObjectivesVocab-1.0 extends the ControlledVocabularyStringType 
defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained 
in the maecVocabs:PersistenceStrategicObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Persistence Capability Strategic Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#PersistenceStrategicObjectivesVocab-1.0.’ 

2.6.36.1  PersistenceStrategicObjectivesEnum-1.0 
The PersistenceStrategicObjectivesEnum is a non-exhaustive enumeration of Strategic Objectives of the persistence 
Capability. 
 

Enumeration Value 

persist to re-infect system 

gather information for improvement 

ensure compatibility 

persist to continuously execute on system 

Description 

Indicates that the malware instance is able to re-infect a system after some of its components have 
been removed. 
Indicates that the malware instance is able to gather information from its environment to make 
itself less likely to be detected. 
Indicates that the malware instance is able to manipulate or modify the system on which it 
executes to ensure that it is able to continue executing. 
Indicates that the malware instance is able to continue to execute on a system after significant 
system events (e.g., after a reboot). 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

86 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.6.37 PersistenceTacticalObjectivesVocab-1.0 
The PersistenceTacticalObjectivesVocab is the default MAEC vocabulary for Tactical Objectives of the persistence 
Capability. The names of these Tactical Objectives are captured in the Name field, a child of the Tactical_Objective field of 
type CapabilityObjectiveType (defined in the MAEC Bundle schema) as its base type.   
 
The MAEC PersistenceTacticalObjectivesVocab-1.0 extends the ControlledVocabularyStringType 
defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained 
in the maecVocabs:PersistenceTacticalObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Persistence Capability Tactical Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#PersistenceTacticalObjectivesVocab-1.0.’ 

2.6.37.1  PersistenceTacticalObjectivesEnum-1.0 
The PersistenceTacticalObjectivesEnum is a non-exhaustive enumeration of Tactical Objectives of the persistence 
Capability. 
 

Enumeration Value 

reinstantiate self after initial detection 

limit application type/version 

persist after os install/reinstall 

drop/retrieve debug log file 

persist independent of hard disk/os changes 

 

Description 

Indicates that the malware instance s able to re-establish itself on the system after it is initially 
detected. 
Indicates that the malware instance is able to limit the type or version of an application that 
runs on a system in order to ensure that it is able to continue executing. 
Indicates that the malware instance is able to continue to execute after the operating system is 
installed or reinstalled. 
Indicates that the malware instance is able to generate and retrieve a log file of errors 
associated with the malware. 
Indicates that the malware instance is able to continue to execute after changes to the hard disk 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

87 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

persist after system reboot 

or the operating system have been made. 
Indicates that the malware instance is able to continue to execute after a system reboot. 

2.6.38 PrivilegeEscalationPropertiesVocab-1.0 
The PrivilegeEscalationPropertiesVocab is the default MAEC vocabulary for properties of the privilege escalation 
Capability and its child Objectives. The names of these properties are captured in the Name field, a child of the Property field of 
type CapabilityPropertyType.  The Property field is found on the CapabilityType (which is used to define a 
Capability) and on the CapabilityObjectiveType (which is used to define a Strategic Objective or a Tactical Objective).  All 
aforementioned types are defined in the MAEC Bundle schema. 
   
The MAEC PrivilegeEscalationPropertiesVocab-1.0 extends the ControlledVocabularyStringType 
defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained 
in the maecVocabs:PrivilegeEscalationPropertiesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Privilege Escalation Capability and Objective Properties.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#PrivilegeEscalationPropertiesVocab-1.0.’ 

2.6.38.1  PrivilegeEscalationPropertiesEnum-1.0 
The PrivilegeEscalationPropertiesEnum is a non-exhaustive enumeration of privilege escalation Capability, Strategic 
Objective, and Tactical Objective properties. 
 

Enumeration Value 

user privilege escalation type 

Refers to the type of user privilege escalation employed by the ‘escalate user privilege’ Strategic 
Objective.  Recommended values are: 'horizontal', or 'vertical'. 

Description 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

88 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.6.39 PrivilegeEscalationStrategicObjectivesVocab-1.0 
The PrivilegeEscalationStrategicObjectivesVocab is the default MAEC vocabulary for Strategic Objectives of the 
privilege escalation Capability. The names of these Strategic Objectives are captured in the Name field, a child of the 
Strategic_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC PrivilegeEscalationStrategicObjectivesVocab-1.0 extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the 
maecVocabs:PrivilegeEscalationStrategicObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Privilege Escalation Capability Strategic Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#PrivilegeEscalationStrategicObjectivesVocab-1.0.’ 

2.6.39.1  PrivilegeEscalationStrategicObjectivesEnum-1.0 
The PrivilegeEscalationStrategicObjectivesEnum is a non-exhaustive enumeration of Strategic Objectives of the 
privilege escalation Capability. 
 

Enumeration Value 

impersonate user 

escalate user privilege 

Indicates that the malware instance is able to impersonate another user to operate within a different security 
context (also known as horizontal privilege escalation). 
Indicates that the malware instance is able to obtain a higher level of access than intended by the system (also 
known as vertical privilege escalation). 

Description 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

89 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.6.40 PrivilegeEscalationTacticalObjectivesVocab-1.0 
The PrivilegeEscalationTacticalObjectivesVocab is the default MAEC vocabulary for Tactical Objectives of the 
privilege escalation Capability. The names of these Tactical Objectives are captured in the Name field, a child of the 
Tactical_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC PrivilegeEscalationTacticalObjectivesVocab-1.0 extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the maecVocabs: 
PrivilegeEscalationTacticalObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Privilege Escalation Capability Tactical Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#PrivilegeEscalationTacticalObjectivesVocab-1.0.’ 

2.6.40.1  PrivilegeEscalationTacticalObjectivesEnum-1.0 
The PrivilegeEscalationTacticalObjectivesEnum is a non-exhaustive enumeration of Tactical Objectives of the 
privilege escalation Capability. 
 

Enumeration Value 

Description 

elevate cpu mode 

Indicates that the malware instance is able to elevate the CPU (processor) mode under which it executes. 

2.6.41 ProbingStrategicObjectivesVocab-1.0 
The ProbingStrategicObjectivesVocab is the default MAEC vocabulary for Strategic Objectives of the probing Capability. 
The names of these Strategic Objectives are captured in the Name field, a child of the Strategic_Objective field of type 
CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

90 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

The MAEC ProbingStrategicObjectivesVocab-1.0 extends the ControlledVocabularyStringType defined in 
CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:ProbingStrategicObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Probing Capability Strategic Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#ProbingStrategicObjectivesVocab-1.0.’ 

2.6.41.1  ProbingStrategicObjectivesEnum-1.0 
The ProbingStrategicObjectivesEnum is a non-exhaustive enumeration of Strategic Objectives of the probing Capability. 
 

Enumeration Value 

probe host configuration 

probe network configuration 

Indicates that the malware instance is able to probe the configuration of the host system on which it 
executes. 
Indicates that the malware instance is able to probe the properties of its network environment, e.g., to 
determine whether it funnels traffic through a proxy. 

Description 

2.6.42 ProbingTacticalObjectivesVocab-1.0 
The ProbingTacticalObjectivesVocab is the default MAEC vocabulary for Tactical Objectives of the probing Capability. 
The names of these Tactical Objectives are captured in the Name field, a child of the Tactical_Objective field of type 
CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC ProbingTacticalObjectivesVocab-1.0 extends the ControlledVocabularyStringType defined in 
CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:ProbingTacticalObjectivesTypeEnum-1.0; extended fields are shown below. 
 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

91 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Probing Capability Tactical Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#ProbingTacticalObjectivesVocab-1.0.’ 

2.6.42.1  ProbingTacticalObjectivesEnum-1.0 
The ProbingTacticalObjectivesEnum is a non-exhaustive enumeration of Tactical Objectives of the probing Capability. 
 

Enumeration Value 

Description 

identify os 

check for proxy 

check for firewall 

check for network drives 

map local network 

inventory system applications 

check language 

check for internet connectivity 

Indicates that the malware instance is able to identify the operating system under which it executes. 
Indicates that the malware instance is able to check whether the network environment in which it executes 
contains a hardware or software proxy. 
Indicates that the malware instance is able to check whether the network environment in which it executes 
contains a hardware or software firewall. 
Indicates that the malware instance is able to check for network drives that may be present in the network 
environment. 
Indicates that the malware instance is able to map the layout of the local network environment in which it 
executes. 
Indicates that the malware instance is able to inventory the applications installed on the system on which it 
executes. 
Indicates that the malware instance is able to check the language of the host system on which it executes. 
Indicates that the malware instance is able to check whether the network environment in which it executes 
is connected to the internet. 

2.6.43 RemoteMachineManipulationStrategicObjectivesVocab-1.0 
The RemoteMachineManipulationStrategicObjectivesVocab is the default MAEC vocabulary for Strategic Objectives 
of the remote machine manipulation Capability. The names of these Strategic Objectives are captured in the Name field, a child of 
the Strategic_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

92 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

 
The MAEC RemoteMachineManipulationStrategicObjectivesVocab-1.0 extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the maecVocabs: 
RemoteMachineManipulationStrategicObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC Default 
Remove Machine Manipulation Capability Strategic Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabularies
.xsd#RemoteMachineManipulationStrategicObjectivesVocab-1.0.’ 

2.6.43.1  RemoteMachineManipulationStrategicObjectivesEnum-1.0 
The RemoteMachineManipulationStrategicObjectivesEnum is a non-exhaustive enumeration of Strategic Objectives 
of the remote machine manipulation Capability. 
 

Enumeration Value 

access remote machine 
search for remote machine 

Indicates that the malware instance is able to access a remote machine. 
Indicates that the malware instance is able to search for remote machines to target. 

Description 

2.6.44 RemoteMachineManipulationTacticalObjectivesVocab-1.0 
The RemoteMachineManipulationTacticalObjectivesVocab is the default MAEC vocabulary for Tactical Objectives of 
the remote machine manipulation Capability. The names of these Tactical Objectives are captured in the Name field, a child of the 
Tactical_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC RemoteMachineManipulationTacticalObjectivesVocab-1.0 extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

93 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

restricted to the enumerated entries contained in the maecVocabs: 
RemoteMachineManipulationTacticalObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Remote Machine Manipulation Capability Tactical Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#RemoteMachineManipulationTacticalObjectivesVocab-1.0.’ 

2.6.44.1  RemoteMachineManipulationTacticalObjectivesEnum-1.0 
The RemoteMachineManipulationTacticalObjectivesEnum is a non-exhaustive enumeration of Tactical Objectives of 
the remote machine manipulation Capability. 
 

Enumeration Value 

Description 

compromise remote machine 

Indicates that the malware instance is able to gain control of a remote machine through compromise. 

2.6.45 SecondaryOperationPropertiesVocab-1.0 
The SecondaryOperationPropertiesVocab is the default MAEC vocabulary for properties of the secondary operation 
Capability and its child Objectives. The names of these properties are captured in the Name field, a child of the Property field of 
type CapabilityPropertyType.  The Property field is found on the CapabilityType (which is used to define a 
Capability) and on the CapabilityObjectiveType (which is used to define a Strategic Objective or a Tactical Objective).  All 
aforementioned types are defined in the MAEC Bundle schema. 
   
The MAEC SecondaryOperationPropertiesVocab-1.0 extends the ControlledVocabularyStringType defined 
in CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:SecondaryOperationPropertiesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

94 

vocab_name 

string 

vocab_reference 

anyURI 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Secondary Operation Capability and Objective Properties.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#SecondaryOperationPropertiesVocab-1.0.’ 

2.6.45.1  SecondaryOperationPropertiesEnum-1.0 
The SecondaryOperationPropertiesEnum is a non-exhaustive enumeration of secondary operation Capability, Strategic 
Objective, and Tactical Objective properties. 
 

Enumeration Value 

trigger type 

Refers to a description of the trigger used to wake or terminate the malware instance in the ‘lie 
dormant’ or ‘suicide exit’ Strategic Objectives, respectively. 

Description 

2.6.46 SecondaryOperationStrategicObjectivesVocab-1.0 
The SecondaryOperationStrategicObjectivesVocab is the default MAEC vocabulary for Strategic Objectives of the 
secondary operation Capability. The names of these Strategic Objectives are captured in the Name field, a child of the 
Strategic_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC SecondaryOperationStrategicObjectivesVocab-1.0 extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the 
maecVocabs:SecondaryOperationStrategicObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Secondary Operation Capability Strategic Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#SecondaryOperationStrategicObjectivesVocab-1.0.’ 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

95 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.6.46.1  SecondaryOperationStrategicObjectivesEnum-1.0 
The SecondaryOperationStrategicObjectivesEnum is a non-exhaustive enumeration of Strategic Objectives of the 
secondary operation Capability. 
 

Enumeration Value 

patch operating system file(s) 

remove traces of infection 
log activity 
lay dormant 

install other components 

suicide exit 

Description 

Indicates that the malware instance is able to patch or modify the critical system files of the operating 
system under which it executes. 
Indicates that the malware instance is able to remove traces of its infection of a system. 
Indicates that the malware instance is able to log its own activity. 
Indicates that the malware instance is able to lay dormant on a system for some period of time. 
Indicates that the malware instance is able to install additional components.  This encompasses the 
dropping/downloading of other malicious components such as libraries, other malware, and tools. 
Indicates that the malware instance is able to terminate itself based on some condition or value. 

2.6.47 SecondaryOperationTacticalObjectivesVocab-1.0 
The SecondaryOperationTacticalObjectivesVocab is the default MAEC vocabulary for Tactical Objectives of the 
secondary operation Capability. The names of these Tactical Objectives are captured in the Name field, a child of the 
Tactical_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC SecondaryOperationTacticalObjectivesVocab-1.0 extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the maecVocabs: 
SecondaryOperationTacticalObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Secondary Operation Capability Tactical Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#SecondaryOperationTacticalObjectivesVocab-1.0.’ 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

96 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.6.47.1  SecondaryOperationTacticalObjectivesEnum-1.0 
The SecondaryOperationTacticalObjectivesEnum is a non-exhaustive enumeration of Tactical Objectives of the 
secondary operation Capability. 
 

Enumeration Value 

install secondary module 
install secondary malware 
install legitimate software 
remove self 
remove system artifacts 

Description 

Indicates that the malware instance is able to install a secondary module (typically related to itself). 
Indicates that the malware instance is able to install another malware instance. 
Indicates that the malware instance is able to install legitimate software. 
Indicates that the malware instance is able to remove itself from the system. 
Indicates that the malware instance is able to remove its artifacts from a system. 

2.6.48 SecurityDegradationPropertiesVocab-1.0 
The SecurityDegradationPropertiesVocab is the default MAEC vocabulary for properties of the security degradation 
Capability and its child Objectives. The names of these properties are captured in the Name field, a child of the Property field of 
type CapabilityPropertyType.  The Property field is found on the CapabilityType (which is used to define a 
Capability) and on the CapabilityObjectiveType (which is used to define a Strategic Objective or a Tactical Objective).  All 
aforementioned types are defined in the MAEC Bundle schema. 
   
The MAEC SecurityDegradationPropertiesVocab-1.0 extends the ControlledVocabularyStringType 
defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained 
in the maecVocabs:SecurityDegradationPropertiesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Security Degradation Capability and Objective Properties.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#SecurityDegradationPropertiesVocab-1.0.’ 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

97 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.6.48.1  SecurityDegradationPropertiesEnum-1.0 
The SecurityDegradationPropertiesEnum is a non-exhaustive enumeration of security degradation Capability, Strategic 
Objective, and Tactical Objective properties. 
 

Enumeration Value 

targeted program 

Refers to the name of a program targeted by the ‘degrade security programs’ Strategic Objective or 
one of its child Tactical Objectives. 

Description 

2.6.49 SecurityDegradationStrategicObjectivesVocab-1.0 
The SecurityDegradationStrategicObjectivesVocab is the default MAEC vocabulary for Strategic Objectives of the 
security degradation Capability. The names of these Strategic Objectives are captured in the Name field of the 
Strategic_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC SecurityDegradationStrategicObjectivesVocab-1.0 extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the 
maecVocabs:SecurityDegradationStrategicObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Security Degradation Capability Strategic Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#SecurityDegradationStrategicObjectivesVocab-1.0.’ 

2.6.49.1  SecurityDegradationStrategicObjectivesEnum-1.0 
The SecurityDegradationStrategicObjectivesEnum is a non-exhaustive enumeration of Strategic Objectives of the 
security degradation Capability. 
 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

98 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

Enumeration Value 

disable server provider security features 

degrade security programs 

disable system updates 

disable os security features 

disable [host-based or os] access controls 

Description 

Indicates that the malware instance is able to bypass or disable third-party security features that 
would otherwise identify or notify users of its presence. 
Indicates that the malware instance is able to degrade security programs running on a system, 
either by stopping them from executing or by making changes to their code or configuration 
parameters. 
Indicates that the malware instance is able to disable the downloading and installation of system 
updates. 
Indicates that the malware instance is able to bypass inherent operating system security 
mechanisms that typically involve elevated privileges. 
Indicates that the malware instance is able to bypass access control mechanisms designed to 
prevent unauthorized or unprivileged use or execution of applications or files. 

2.6.50 SecurityDegradationTacticalObjectivesVocab-1.0 
The SecurityDegradationTacticalObjectivesVocab is the default MAEC vocabulary for Tactical Objectives of the 
security degradation Capability. The names of these Tactical Objectives are captured in the Name field, a child of the 
Tactical_Objective field of type CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC SecurityDegradationTacticalObjectivesVocab-1.0 extends the 
ControlledVocabularyStringType defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are 
restricted to the enumerated entries contained in the maecVocabs: 
SecurityDegradationTacticalObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Security Degradation Capability Tactical Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#SecurityDegradationTacticalObjectivesVocab-1.0.’ 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

99 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.6.50.1  SecurityDegradationTacticalObjectivesEnum-1.0 
The SecurityDegradationTacticalObjectivesEnum is a non-exhaustive enumeration of Tactical Objectives of the 
security degradation Capability. 
 

Enumeration Value 

stop execution of security program 

disable firewall 

disable access right checking 

disable kernel patching protection 

prevent access to security websites 

remove sms warning messages 

modify security program configuration 

prevent security program from running 

disable system update services/daemons 

disable system service pack/patch installation 

disable system file overwrite protection 

disable privilege limiting 

gather security product info 

 

Description 

Indicates that the malware instance is able to stop one or more security programs that may 
already be executing on a system. 
Indicates that the malware instance is able to evade or disable the host-based firewall or 
otherwise prevent the blocking of network communications. 
Indicates that the malware instance is able to bbypass, disable, or modify the access tokens or 
access control lists, thereby enabling the malware to read, write, or execute a file with one or 
more of these controls set. 
Indicates that the malware instance is able to bypass or disable PatchGuard; thus it is capable 
of operating at the same level as the kernel and kernel mode drivers (KMD). 
Indicates that the malware instance is able to prevent access from a system to one or more 
security vendor or security-related websites. 
Indicates that the malware instance is able to capture the message body of incoming SMS 
messages and abort the broadcasting of a message that meets a certain criteria. 
Indicates that the malware instance is able to modify the configuration of one or more security 
programs running on a system in order to hamper their usefulness and ability to detect the 
malware instance. 
Indicates that the malware instance is able to prevent one or more security programs from 
running on a system. 
Indicates that the malware instance is able to disable system update services or daemons that 
may be running on a system. 
Indicates that the malware instance is able to disable the system's ability to install service 
packs or patches. 
Indicates that the malware instance is able to bypass or disable the Windows file protection 
feature; thus, enabling system files to be modified or replaced. 
Indicates that the malware instance is able to bypass controls that limit the privileges that can 
be granted to a user or entity. 
Indicates that the malware instance is able to gather information about the security products 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

100 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

disable os security alerts 

disable user account control 

installed or running on a system. 
Indicates that the malware instance is able to evade or disable identification and/or 
notification of its presence by inherent features of the operating system. 
Indicates that the malware instance is able to bypass or disable user account control (UAC); 
thus, enabling a user to run an application with elevated privileges. 

2.6.51 SpyingStrategicObjectivesVocab-1.0 
The SpyingStrategicObjectivesVocab is the default MAEC vocabulary for Strategic Objectives of the spying Capability. 
The names of these Strategic Objectives are captured in the Name field, a child of the Strategic_Objective field of type 
CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC SpyingStrategicObjectivesVocab-1.0 extends the ControlledVocabularyStringType defined in 
CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:SpyingStrategicObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Spying Capability Strategic Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#SpyingStrategicObjectivesVocab-1.0.’ 

2.6.51.1  SpyingStrategicObjectivesEnum-1.0 
The SpyingStrategicObjectivesEnum is a non-exhaustive enumeration of Strategic Objectives of the spying Capability. 
 

Enumeration Value 

capture system input peripheral data 

capture system state data 

capture system interface data 

 

Description 

Indicates that the malware instance is able to capture data from a system's input peripheral devices. 
Indicates that the malware instance is able to capture information about a system's state (e.g., from 
its RAM). 
Indicates that the malware instance is able to capture data from a system's interfaces. 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

101 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

capture system output peripheral data 

indicates that the malware instance is able to capture data sent to a system's output peripheral 
devices. 

2.6.52 SpyingTacticalObjectivesVocab-1.0 
The SpyingTacticalObjectivesVocab is the default MAEC vocabulary for Tactical Objectives of the spying Capability. The 
namesof these Tactical Objectives are captured in the Name field, a child of the Tactical_Objective field of type 
CapabilityObjectiveType (defined in the MAEC Bundle schema).   
 
The MAEC SpyingTacticalObjectivesVocab-1.0 extends the ControlledVocabularyStringType defined in 
CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:SpyingTacticalObjectivesTypeEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Spying Capability Tactical Objectives.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#SpyingTacticalObjectivesVocab-1.0.’ 

2.6.52.1  SpyingTacticalObjectivesEnum-1.0 
The SpyingTacticalObjectivesEnum is a non-exhaustive enumeration of Tactical Objectives of the spying Capability. 
 

Enumeration Value 

capture system screenshot 

capture camera input 
capture file system 
capture printer output 
capture gps data 
capture keyboard input 
 

Description 

Indicates that the malware instance is able to capture images of what is currently being displayed on a 
system's screen, either locally or remotely via a remote desktop protocol. 
Indicates that the malware instance is able to capture data from a system's camera. 
Indicates that the malware instance is able to capture data from a system's file system. 
Indicates that the malware instance is able to capture data sent to a system's printer. 
Indicates that the malware instance is able to capture system GPS data. 
Indicates that the malware instance is able to capture data from a system's keyboard. 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

102 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

capture mouse input 
capture microphone input 
capture system network traffic 
capture touchscreen input 
capture system memory 

Indicates that the malware instance is able to capture data from a system's mouse. 
Indicates that the malware instance is able to capture data from a system's microphone. 
Indicates that the malware instance is able to capture system network traffic. 
Indicates that the malware instance is able to capture data from a system's touchscreen. 
Indicates that the malware instance is able to capture data from a system's RAM. 

2.7  Malware Subject-Related Default Vocabularies 
The default vocabularies in this section are related to the Malware Subjects in a MAEC Package. 

2.7.1  MalwareConfigurationParameterVocab-1.0 
MalwareConfigurationParameterVocab is the default MAEC vocabulary for malware configuration parameter names, 
which are captured in the Configuration_Details field (of type MalwareConfigurationDetailsType) of a Malware 
Subject.  More specifically, the name of a configuration parameter is captured via the Name field, a child of the 
Configuration_Parameter field (of type MalwareConfiguationParameterType), itself a child of the 
Configuration_Details field.  
 
The MAEC MalwareConfigurationParameterVocab-1.0 type extends ControlledVocabularyStringType 
defined in CybOX Common.  Thus, Name fields that make use of this vocabulary are restricted to the enumerated entries contained 
in the maecVocabs:MalwareConfigurationParameterEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Malware Configuration Parameter Names.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#MalwareConfigurationParameterVocab-1.0.’ 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

103 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

2.7.1.1 MalwareConfigurationParameterEnum-1.0 
The MalwareConfigurationParameterEnum is a non-exhaustive enumeration of malware configuration parameter names 
associated with a Malware Subject. 
 

Enumeration Value 

magic number 

id 
group id 
mutex 

filename 

installation path 

Description 

Refers to a configuration parameter that captures a file signature that may be used to identify or validate the 
content the malware instance. 
Refers to a configuration parameter that captures an identifier for the malware instance. 
Refers to a configuration parameter that captures an identifier for a collection of malware instances. 
Refers to a configuration parameter that captures a unique mutex value associated the malware instance. 
Refers to a configuration parameter that captures the name of a malicious binary such as one that is 
downloaded or embedded within the malware instance. 
Refers to a configuration parameter that captures a location on disk to which the malware instance is 
installed, copied, or moved. 

2.7.2  MalwareDevelopmentToolVocab-1.0 
The MalwareDevelopmentToolVocab is the default MAEC vocabulary for the tool types used in the development of the 
malware instance characterized by the Malware Subject.  The type of a tool is captured in the Type field, a child of the Tool field 
(of type cyboxCommon:ToolInformationType), itself a child of the Tools field (of type 
cyboxCommon:ToolsInformationType).  The Tools field is a child of the Development_Environment field (of type 
MalwareDevelopmentEnvironmentType) in a Malware Subject.   
 
The MAEC MalwareDevelopmentToolVocab-1.0 type extends ControlledVocabularyStringType defined in CybOX 
Common.  Thus, Type fields that make use of this vocabulary are restricted to the enumerated entries contained in the 
maecVocabs:MalwareDevelopmentToolEnum-1.0; extended fields are shown below. 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

vocab_reference 

 

string 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Malware Development Tool Types.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

104 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#MalwareDevelopmentToolVocab-1.0.’ 

2.7.2.1 MalwareDevelopmentToolEnum-1.0 
The MalwareDevelopmentToolEnum is a non-exhaustive enumeration of tool types associated with the development of 
malware instances characterized by Malware Subjects. 
 

Enumeration Value 

Description 

builder 

compiler 
linker 

packer 

crypter 

protector 

Specifies a malware builder tool (commonly used to mass-produce malware) that was used to generate 
the malware instance. 
Specifies a compiler tool that was used to compile the code composing the malware instance. 
Specifies a linker tool that was used to link the object files associated with the malware instance. 
Specifies a packer tool that was used to shrink the size of the executable binary associated with the 
malware instance. Packers are also sometimes referred to as 'compressors'. 
Specifies a crypter tool that was used to encrypt the executable binary associated with the malware 
instance. 
Specifies a protector tool that was used to obfuscate the executable binary associated with the malware 
instance to make it more difficult to reverse engineer. 

2.7.3  MalwareSubjectRelationshipTypeVocab-1.1 
The MalwareSubjectRelationshipTypeVocab is the default MAEC vocabulary for the Malware Subject relationships in a 
MAEC Package, which are captured in Malware Subjects via the Type field of MalwareSubjectRelationshipType, defined 
in the MAEC Package schema.   
 
The MAEC MalwareSubjectRelationshipTypeVocab-1.1 type extends ControlledVocabularyStringType 
defined in CybOX Common.  Thus, Type fields that make use of this vocabulary are restricted to the enumerated entries contained 
in the maecVocabs:MalwareSubjectRelationshipTypeEnum-1.1; extended fields are shown below. 
 

Field 

vocab_name 
 

Type 

Multiplicity 

Description 

string 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

105 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

vocab_reference 

anyURI 

0..1 

Default Malware Subject Relationship Types.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#MalwareSubjectRelationshipTypeVocab-1.1.’ 

2.7.3.1 MalwareSubjectRelationshipTypeEnum-1.1 
The MalwareSubjectRelationshipTypeEnum is a non-exhaustiveenumeration of relationships between 
Malware_Subjects. 
 

Enumeration Value 

Description 

downloads 
downloaded by 
drops 

dropped by 

extracts 

extracted from 

direct descendant of 

direct ancestor of 

memory image of 

contained in memory image 

disk image of 

contained in disk image 

network traffic capture of 

 

Specifies that the Malware Subject downloads one or more other Malware Subject (s). 
Specifies that the current Malware Subject was downloaded by one or more other Malware Subject(s). 
Specifies that the Malware Subject drops (or writes to disk) one or more other Malware Subject(s). 
Specifies that the current Malware Subject was dropped (or written to disk) by one or more other 
Malware Subject(s). 
Specifies that the Malware Subject extracts (from an embedded archive or another container) one or 
more other Malware Subject(s). 
Specifies that the current Malware Subject was extracted from one or more other Malware Subject(s). 
Specifies that the current Malware Subject is a direct descendant (i.e. in terms of development lineage) 
of one or more other Malware Subject(s). 
Specifies that the current Malware Subject is a direct ancestor (i.e. in terms of development lineage) of 
one or more other Malware Subject(s). 
Specifies that the current Malware Subject represents a memory image associated with one or more 
other Malware Subject(s). 
Specifies that the current Malware Subject is a malware binary or component contained in one or more 
other Malware Subject(s) that represent memory images. 
Specifies that the current Malware Subject represents a disk image associated with one or more other 
Malware Subject(s). 
Specifies that the current Malware Subject is a malware binary or component contained in one or more 
other Malware Subject(s) that represent disk images. 
Specifies that the current Malware Subject represents captured network traffic associated with one or 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

106 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

contained in network traffic capture 

packed version of 

unpacked version of 

installs 
installed by 
64-bit version of 
32-bit version of 

encrypted version of 

decrypted version of 

more other Malware Subject(s). 
Specifies that the current Malware Subject is a malware binary or component contained in one or more 
other Malware Subject(s) that represent captures of network traffic. 
Specifies that the current Malware Subject represents a packed version (in terms of executable binary 
packing) of one or more other Malware Subject(s). 
Specifies that the current Malware Subject represents an unpacked version (in terms of executable 
binary packing) of one or more other Malware Subject(s). 
Specifies that the current Malware Subject installs one or more other Malware Subject(s). 
Specifies that the current Malware Subject is installed by one or more other Malware Subject(s). 
Specifies that the current Malware Subject is a 64-bit version of one or more other Malware Subject(s). 
Specifies that the current Malware Subject is a 32-bit version of one or more other Malware Subject(s). 
Specifies that the current Malware Subject is an encrypted version of one or more other Malware 
Subject(s). 
Specifies that the current Malware Subject is a decrypted version of one or more other Malware 
Subject(s). 

2.8  Package-Related Default Vocabularies 
The default vocabularies in this section are related to MAEC Packages. 

2.8.1  GroupingRelationshipTypeVocab-1.0 
The GroupingRelationshipTypeVocab is the default MAEC vocabulary for the grouping relationship types in a MAEC 
Package, which are captured in Grouping_Relationships fields via the Type field of GroupingRelationshipType 
defined in the MAEC Package schema.   
 
The MAEC GroupingRelationshipActionNameVocab-1.0 type extends ControlledVocabularyStringType 
defined in CybOX Common.  Thus, Type fields that make use of this vocabulary are restricted to the enumerated entries contained 
in the maecVocabs:GroupingRelationshipTypeEnum-1.0; extended fields are shown below. 
 
 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

107 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

Field 

Type 

Multiplicity 

Description 

vocab_name 

string 

vocab_reference 

anyURI 

0..1 

0..1 

Specifies the name of the vocabulary.  The fixed value is ‘MAEC 
Default Grouping Relationship Types.’ 
Specifies the URI associated with the vocabulary.  The fixed value is 
‘https://maec.mitre.org/language/version4.1/maec_default_vocabula
ries.xsd#GroupingRelationshipTypeVocab-1.0.’ 

2.8.1.1 GroupingRelationshipTypeEnum-1.0 
The GroupingRelationshipTypeEnum is a non-exhaustive enumeration of Malware Subject grouping relationships. 
 

Enumeration Value 

same malware family 

clustered together 

observed together 

part of intrusion set 

same malware toolkit 

Description 

Indicates that the Malware Subjects in the MAEC Package are all part of the same malware family. 
Indicates that the Malware Subjects in the MAEC Package were clustered together by some algorithm or other 
mechanism. 
Indicates that the Malware Subjects in the MAEC Package were observed together, such as on a host system, in 
some archive, etc.  Note that there may not be any relationship between the Malware Subjects beyond co-location. 
Indicates that the Malware Subjects in the MAEC Package were found as part of the same malware intrusion set. 
Indicates that the Malware Subjects in the MAEC Package were all created using the same malware toolkit, 
independent of toolkit version. 

 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

108 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

Appendix – References 
References made in this document are listed below.  

A.1  MAEC Documents 
 
[MAECO] 
 
 
 
[MAECS] 

MAEC Overview 
http://maec.mitre.org/about/docs/MAEC_Overview.pdf 

Characterizing Malware with MAEC and STIX  
http://maec.mitre.org/about/docs/Characterizing_Malware_MAEC_and_STIX_v1.0.pdf 

 
[SPECB]  
 
 
 
[SPECP]  
 
 
 
[SPECC]  
 
 
 
[SPECV]  
 
 
 
[REQ] 
 

 
 

MAEC Bundle Specification 
http://maec.mitre.org/language/version4.1/MAEC_Bundle_Spec_v4_1.pdf 

MAEC Package Specification 
http://maec.mitre.org/language/version4.1/MAEC_Package_Spec_v2_1.pdf 

MAEC Container Specification 
http://maec.mitre.org/language/version4.1/MAEC_Container_Spec_v2_1.pdf 

MAEC Default Vocabularies Specification 
http://maec.mitre.org/language/version4.1/MAEC_Vocabs_Spec_v1_1.pdf 

Requirements and Recommendations for MAEC Compatibiity 
http://maec.mitre.org/compatible/Requirements_for_MAEC_Compatibility_V1.1.pdf  

A.2  MAEC Web Pages  
 
[EXAMW] 

MAEC v4.1 Release Examples 
http://maec.mitre.org/language/version4.1/#samples  

 
[EXAMG] 
 
 
 
[MAEC] 
 
 
 
[MAECC] 
 
 

 

MAEC Examples (GitHub repository) 
https://github.com/MAECProject/schemas/tree/master/examples 

MAEC Web Site 
https://maec.mitre.org 

MAEC Community 
https://maec.mitre.org/community/index.html 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

109 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

MAEC Discussion List Signup 
http://maec.mitre.org/community/discussionlist.html 

MAEC Handshake (send email to maec@mitre.org for access) 
https://handshake.mitre.org/ 

MAEC v4.1 Release 
https://maec.mitre.org/language/version4.1/  

MAEC Terminology 
http://maec.mitre.org/about/terminology.html  

Ties to Existing Standards 
http://maec.mitre.org/about/standards.html  

MAEC FAQ 
http://maec.mitre.org/about/faqs.html  

MAEC Terms of Use 
https://maec.mitre.org/about/termsofuse.html 

Versioning Policy 
http://maec.mitre.org/language/versioning_policy.html 

[MAECL] 
 
 
 
[MAECH] 
 
 
 
[REL4]   

 
[TERM]  
 
 
 
[TIES] 
 
 
[FAQ] 
    
 
[TOU]   
 
 
 
[VER] 
 

 
 

 
 

 
 

MAEC Bundle Model 
https://maec.mitre.org/language/version4.1/maec_bundle_schema.xsd  

MAEC Package Model 
https://maec.mitre.org/language/version4.1/maec_package_schema.xsd  

A.3  MAEC Schema 
 
[RELB]   
 
 
 
[RELP]   
 
 
 
[RELC]   
 
 
 
[RELD]   

MAEC Container Model 
https://maec.mitre.org/language/version4.1/maec_container_schema.xsd  

MAEC Default Vocabularies 
https://maec.mitre.org/language/version4.1/maec_default_vocabularies.xsd 

A.4  MAEC Development 
 
[DEV] 

MAEC GitHub Repositories 
https://github.com/MAECProject/ 

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

110 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

 
[DEVP]   

 
[DEVS] 
 
 
[DEVU] 

MAEC Python Library 
https://github.com/MAECProject/python-maec 

MAEC Schema Development 
https://github.com/MAECProject/schemas 

MAEC Utilities 
https://github.com/MAECProject/utils 

A.5  Other References 
 
[CPE] 

 

Common Platform Enumeration (CPE) 
http://nvd.nist.gov/cpe.cfm (Official CPE Dictionary) 
http://csrc.nist.gov/publications/PubsNISTIRs.html (CPE Specifications) 

 

 
 

 
[CUCKOO] 
 
 
[CVE] 
 
 
[CVSS]   
 
 
 
[CYBOX] 

Cuckoo Sandbox 
http://www.cuckoosandbox.org/ 

Common Vulnerabilities and Exposures (CVE) 
http://cve.mitre.org 

Common Vulnerability Scoring System 
http://www.first.org/cvss 

Cyber Observable eXpression (CybOX) 
http://cybox.mitre.org 

 
[IOC] 
 

 
 

[MMDEF] 

 
[OVAL]  
 
 
 
[RFC2119]  

 
[STIX]   
 
 

 

Open Indicators of Compromise (OpenIOC) 
http://openioc.org/ 
 
IEEE ICSG’s Malware Metadata Exchange Format 
http://standards.ieee.org/develop/indconn/icsg/mmdef.html 

Open Vulnerability and Assessment Language (OVAL) 
http://oval.mitre.org 

RFC 2119 – Key words for use in RFCs to Indicate Requirement Levels  
http://www.ietf.org/rfc/rfc2119.txt    

Structured Threat Information eXpression (STIX) 
http://stix.mitre.org  

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

111 

The MAEC™ Language Version 4.1 Specification – Default Vocabularies v1.1 
 

 
[W3C0]  
 
 
 
[W3C1]  

[W3C2]  

[W3C3]  

[W3C4]  

[W3C5]  

 
[W3C6]  
 
 

[W3C7]  

[W3C8]  

[W3C9]  

 

W3C Namespaces in XML 1.0 (Third Edition) 
http://www.w3.org/TR/REC-xml-names/ 

W3C Recommendation for Hex-Encoded Binary Data  
http://www.w3.org/TR/xmlSchema-2/#hexBinary  
 
W3C Recommendation for Boolean Data  
http://www.w3.org/TR/xmlSchema-2/#boolean  
 
W3C Recommendation for Double Data  
http://www.w3.org/TR/xmlschema-2/#double  
 
W3C Recommendation for Float Data  
http://www.w3.org/TR/xmlSchema-2/#float   
 
W3C Recommendation for Integer Data  
http://www.w3.org/TR/xmlSchema-2/#integer 

W3C Recommendation for XML Qualified Names 
http://www.w3.org/TR/xmlSchema-2/#QName   
 
W3C Recommendation for String Data  
http://www.w3.org/TR/xmlSchema-2/#string 
 
W3C Recommendation for unsigned int Data  
http://www.w3.org/TR/xmlschema-2/#unsignedInt 
 
W3C Recommendation for URI Data  
http://www.w3.org/TR/xmlschema-2/#anyURI  

 

Copyright © 2014, The MITRE Corporation.  All rights reserved. 

112