Skip to content

Navigation Menu

Appearance settings

GitHub Copilot
Write better code with AI

GitHub Spark New
Build and deploy intelligent apps

GitHub Models New
Manage and compare prompts

GitHub Advanced Security
Find and fix vulnerabilities

Actions
Automate any workflow
Codespaces
Instant dev environments

Issues
Plan and track work

Code Review
Manage code changes

Discussions
Collaborate outside of code

Code Search
Find more, search less
Explore

Why GitHub

Documentation

GitHub Skills

Blog
Integrations

GitHub Marketplace

MCP Registry
View all features
By company size

Enterprises

Small and medium teams

Startups

Nonprofits
By use case

App Modernization

DevSecOps

DevOps

CI/CD

View all use cases
By industry

Healthcare

Financial services

Manufacturing

Government

View all industries
View all solutions
Topics

AI

DevOps

Security

Software Development

View all
Explore

Learning Pathways

Events & Webinars

Ebooks & Whitepapers

Customer Stories

Partners

Executive Insights
GitHub Sponsors
Fund open source developers
The ReadME Project
GitHub community articles
Repositories

Topics

Trending

Collections
Enterprise platform
AI-powered developer platform
Available add-ons

GitHub Advanced Security
Enterprise-grade security features

Copilot for business
Enterprise-grade AI features

Premium Support
Enterprise-grade 24/7 support
Pricing

Search code, repositories, users, issues, pull requests...

Search

Clear

Search syntax tips

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Saved searches

Use saved searches to filter your results more quickly

Name

Query

To see all available qualifiers, see our documentation.

Appearance settings

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

MAECProject / schemas Public

Notifications You must be signed in to change notification settings
Fork 16
Star 89

Code
Issues 61
Pull requests
Actions
Projects
Wiki
Security
Insights

Additional navigation options

Code
Issues
Pull requests
Actions
Projects
Wiki
Security
Insights

Home

Jump to bottom

MAECProject edited this page Oct 18, 2012 · 6 revisions

Welcome to the Schemas wiki!

Toggle table of contents Pages 260

Home
Access Premium Service
Access Remote Machine
Annoy Local System User
Annoy Remote User
Annoy User
Anti Behavioral Analysis
Anti Code Analysis
Anti Debugging
Anti Detection
Anti Disassembly
Anti Memory Forensics
Anti Removal
Anti Sandbox
Anti VM
Availability Violation
Capture Camera Input
Capture File System
Capture GPS Data
Capture Keyboard Input
Capture Microphone Input
Capture Mouse Input
Capture Printer Output
Capture System Input Peripheral Data
Capture System Interface Data
Capture System Memory
Capture System Network Traffic
Capture System Output Peripheral Data
Capture System Screenshot
Capture System State Data
Capture Touchscreen Input
Change Add Content
Check for Firewall
Check for Internet Connectivity
Check for Network Drives
Check for Payload
Check for Proxy
Check Language
Click Fraud
Code Obfuscation
Command and Control
Compromise Access to Information Assets
Compromise Data Availability
Compromise Local System Availability
Compromise Network Operational Integrity
Compromise Remote Machine
Compromise System Availability
Compromise System Data Integrity
Compromise System Operational Integrity
Compromise User Data Integrity
Consume System Resources
Control Local Machine
Control Machine via Remote Command
Control Malware via Remote Command
Corrupt System Data
Corrupt User Data
Crack Passwords
Data Exfiltration
Data Theft
Defeat Call Graph Generation
Defeat Flow oriented (Recursive Traversal) Disassembler
Defeat Linear Disassembler
Degrade Security Programs
Denial of Service
Destroy Firmware
Destroy Hardware
Destroy Physical Entity
Destroy Virtual Entity
Destruction
Detect Debugging
Detect Sandbox Environment
Detect VM Environment
Determine C2 Server
Disable [Host based or OS] Access Controls
Disable Access Right Checking
Disable Firewall
Disable Kernel Patching Protection
Disable OS Security Alerts
Disable OS Security Features
Disable Privilege Limiting
Disable Service Provider Security Features
Disable System File Overwrite Protection
Disable System Service Pack Patch Installation
Disable System Update Services Daemons
Disable System Updates
Disable User Account Control
Draft Proposal: Add Support for Characterizing Interesting Data
Drop Retrieve Debug Log File
Elevate CPU Mode
Encrypt Data
Encrypt Self
Ensure Compatibility
Erase Data
Escalate User Privilege
Execute Before External to Kernel Hypervisor
Execute Non Main CPU Code
Execute Stealthy Code
Exfiltrate via Covert Channel
Exfiltrate via Dumpster Dive
Exfiltrate via Fax
Exfiltrate via Network
Exfiltrate via Physical Media
Exfiltrate via VoIP Phone
Feed Misinformation During Physical Memory Acquisition
Fraud
Gather Information for Improvement
Gather Security Product Info
Generate C2 Domain Name(s)
Getting Started
Hide Arbitrary Virtual Memory
Hide Code in File
Hide Data
Hide Executing Code
Hide File System Artifacts
Hide Kernel Modules
Hide Malware Artifacts
Hide Network Traffic
Hide Non Executing Code
Hide Open Network Ports
Hide Processes
Hide Registry Artifacts
Hide Services
Hide Threads
Hide Userspace Libraries
Identify File
Identify Host IP Address
Identify OS
Identify Target Machine(s)
Impersonate User
Infect File
Infect Remote Machine
Infection Propagation
Install Backdoor
Install Legitimate Software
Install Other Components
Install Secondary Malware
Install Secondary Module
Integrity Violation
Intercept Manipulate Network Traffic
Inventory System Applications
Inventory Victims
Lay Dormant
Limit Application Type Version
Log Activity
Machine Access Control
MAEC v5.0 in a Nutshell
MAEC v5.0 Proposals: Round 1
MAEC v5.0 Proposals: Round 2
MAEC v5.0 Proposals: Round 3
Malware Capabilities
Map Local Network
Mine for CryptoCurrency
Modify File
Modify Security Program Configuration
Move Data to Staging Server
Obfuscate Artifact Properties
Obfuscate Data for Exfiltration
Obfuscate Imports
Obfuscate Instructions
Obfuscate Runtime Code
Overload Sandbox
Package Data
Patch Operating System File(s)
Perform Autonomous Remote Infection
Perform Data Exfiltration
Perform Social engineering Based Remote Infection
Persist After OS Install Reinstall
Persist After System Reboot
Persist Independent of Hard Disk OS Changes
Persist to Continuously Execute on System
Persist to Re infect System
Persistence
Premium Rate Fraud
Prevent Access to Security Websites
Prevent API Unhooking
Prevent Debugging
Prevent Execution in Sandbox
Prevent Execution in VM
Prevent File Access
Prevent File Deletion
Prevent Malware Artifact Access
Prevent Malware Artifact Deletion
Prevent Memory Access
Prevent Native API Hooking
Prevent Physical Memory Acquisition
Prevent Registry Access
Prevent Registry Deletion
Prevent Security Program from Running
Privilege Escalation
Probe Host Configuration
Probe Network Environment
Probing
Proposal: Add Ability to Capture Common Malware Family Names
Proposal: Add Field to AVClassificationType to Indicate AV Tool Detection
Proposal: Add Field to MalwareSubjectType to Capture Static Features
Proposal: Allow AV Classifications to be captured for any CybOX Object
Proposal: Deprecate MAEC Bundle (as a concept and output format)
Proposal: Deprecate MAEC Candidate Indicators in Favor of STIX Indicators
Proposal: Deprecate MAEC Container
Proposal: Deprecate Use of QNames for IDs
Proposal: Make Actions, Behaviors, and Capabilities Top Level Entities
Proposal: Make Collections Top Level Entities
Proposal: Make CybOX Objects Top Level Entities
Proposal: Make Relationships Top Level Entities
Proposal: Make Tools Top Level Entities
Proposal: Modify MalwareLabelEnum Enumeration
Proposal: Refactor Behaviors
Proposal: Refactor Capabilities
Proposal: Refactor Malware Actions
Proposal: Rename ExploitType and Expand Fields
Proposal: Rename Malware_Instance_Object_Attributes Field
Receive Data from C2 Server
Reinstantiate Self after Initial Detection
Remote Machine Manipulation
Remove Self
Remove SMS Warning Messages
Remove System Artifacts
Remove Traces of Infection
Restructure Arrays
Search For Remote Machines
Secondary Operation
Security Degradation
Security Software Evasion
Self Modification
Send Data to C2 Server
Send Heartbeat Data
Send System Information
Spying
Stage Data for Exfiltration
Steal Authentication Credentials
Steal Browser Cache
Steal Browser History
Steal Contact List Data
Steal Cookie
Steal Cryptocurrency Data
Steal Database Content
Steal Dialed Phone Numbers
Steal Documents
Steal Email Data
Steal Images
Steal Make Model
Steal Network Address
Steal Open Port
Steal Password Hash
Steal PKI Key
Steal PKI Software Certificate
Steal Referrer URLs
Steal Serial Numbers
Steal SMS Database
Steal Stored Information
Steal System Information
Steal User Data
Steal Web Network Credential
Stop Execution of Security Program
Subvert System
Suicide Exit
Transform Control Flow
Update Configuration
Validate Data
Write Code Into File

Clone this wiki locally

Footer

© 2025 GitHub, Inc.

Footer navigation

Terms
Privacy
Security
Status
Community
Docs
Contact

You can’t perform that action at this time.