Manage malware

Manage the malware information that you imported from the MITRE TAXII collections. Malware is a type of TTP that represents malicious code. It refers to a program that is covertly inserted into a system. The intent of a malware is to compromise the confidentiality, integrity, or availability of the victim's data, applications, or operating system (OS).

Before you begin

Role required:

• sn_ti.admin: delete access
• sn_ti.read: read access
• sn_ti.write: create, write access

Procedure

1. Navigate to All > Threat Intelligence > MITRE ATT&CK Repository > Malware.

   You can view the listed malware.

2. Click a malware to view all the associated information.

   In the following illustration, you can view the details for the 3PARA RAT malware, its ID, source, and other related information.

1. To view how these objects are related, click Show Relationships.

What to do next

Use the techniques module to add or modify the malware data.

Parent Topic:MITRE-ATT&CK administration

Related topics

Get started with MITRE-ATT&CK framework

Understand the MITRE to STIX data model

Domain separation and MITRE-ATT&CK

Set up the MITRE-ATT&CK framework

Manage matrices

Manage techniques

Manage mitigations

Manage groups

Manage tools

Manage MITRE relationships

Manage CVE and technique mapping

Extend the MITRE-ATT&CK data

Define the data source and detection tool mapping

Define the data source and data component mapping

Define the technique detection coverage

Map your technique detection coverage to a technique

Define the mitigation coverage

Map your mitigation coverage to a technique

Create and map detection rules

Auto-extract technique rules for importing MITRE-ATT&CK information

Review threat group and MITRE-ATT&CK techniques mapping

Threat group to technique heatmap definition

Review the MITRE-ATT&CK system properties