Threat Actor
Threat Actors are actual individuals, groups, or organizations believed to be operating with malicious intent. A Threat Actor is not an Intrusion Set but may support or be affiliated with various Intrusion Sets, groups, or organizations over time.
Threat Actors leverage their resources, and possibly the resources of an Intrusion Set, to conduct attacks and run Campaigns against targets.
Threat Actors can be characterized by their motives, capabilities, goals, sophistication level, past activities, resources they have access to, and their role in the organization.
Properties
| Property | Type | Description |
|---|---|---|
typeoptional | string | The type of this object, which MUST be the literal `threat-actor`. |
threat_actor_typesoptional | list of string | This field specifies the type of threat actor. Open Vocab - threat-actor-type-ov |
namerequired | string | A name used to identify this Threat Actor or Threat Actor group. |
descriptionoptional | string | A description that provides more details and context about the Threat Actor. |
aliasesoptional | list of string | A list of other names that this Threat Actor is believed to use. |
rolesoptional | list of string | This is a list of roles the Threat Actor plays. Open Vocab - threat-actor-role-ov |
goalsoptional | list of string | The high level goals of this Threat Actor, namely, what are they trying to do. |
first_seenoptional | string | Represents timestamps across the CTI specifications. The format is an RFC3339 timestamp, with a required timezone specification of 'Z'. |
last_seenoptional | string | Represents timestamps across the CTI specifications. The format is an RFC3339 timestamp, with a required timezone specification of 'Z'. |
sophisticationoptional | string | The skill, specific knowledge, special training, or expertise a Threat Actor must have to perform the attack. Open Vocab - threat-actor-sophistication-ov |
resource_leveloptional | string | This defines the organizational level at which this Threat Actor typically works. Open Vocab - attack-resource-level-ov |
primary_motivationoptional | string | The primary reason, motivation, or purpose behind this Threat Actor. Open Vocab - attack-motivation-ov |
secondary_motivationsoptional | list of string | The secondary reasons, motivations, or purposes behind this Threat Actor. Open Vocab - attack-motivation-ov |
personal_motivationsoptional | list of string | The personal reasons, motivations, or purposes of the Threat Actor regardless of organizational goals. Open Vocab - attack-motivation-ov |
Relationships
These are the relationships explicitly defined between the Threat Actor object and other STIX Objects. The first section lists the embedded relationships by property name along with their corresponding target. The rest of the table identifies the relationships that can be made from this object type to another object type by way of the Relationship object. The reverse relationships section illustrates the relationships targeting this object type from another object type. They are included here for convenience. For their definitions, please see the "Source" object.
Relationships are not restricted to those listed below. Relationships can be created between any objects using the related-to relationship type or, as with open vocabularies, user-defined names.