Tools

Tools are legitimate software that are used by threat actors to perform attacks. Tools apply for STIX 2.x.

Tools enable you to know how and when threat actors use them for executing campaigns. Unlike malware, these tools or software packages are often found on a system and have legitimate purposes for power users, administrators, network administrators, or even normal users.

For example, remote access tools (RDP) and network scanning tools (Nmap) are tools that a threat actor uses during an attack.

• Define tools
  Define tools as legitimate software that is used to perform attacks.

Related concepts

• Attack modes and methods
• Indicators of compromise
• Observables
• Attack patterns
• Campaigns
• Course of actions
• Identities
• Infrastructure
• Intrusion set
• Locations
• Malware
• Malware analysis
• Observed data
• Threat actors
• Threat groupings
• Marking definitions
• Threat notes
• Threat opinions
• Threat reports
• Sightings
• Vulnerabilities
• Relationships
• STIX Visualizer