A threat intelligence platform receives a STIX 2.1 report describing an APT group's tactics. The report includes a Relationship object linking a Malware object to a Campaign object. What does this relationship describe?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because STIX 2.1 Relationship objects create typed, directional links between STIX Domain Objects; a Relationship from Malware to Campaign with relationship_type 'uses' or 'attributed-to' expresses that the malware was used in that campaign. A is wrong because CVSS scores are not part of the STIX Campaign-Malware relationship model.
Full explanation below image
Full Explanation
B is correct because STIX 2.1 Relationship objects create typed, directional links between STIX Domain Objects; a Relationship from Malware to Campaign with relationship_type 'uses' or 'attributed-to' expresses that the malware was used in that campaign. A is wrong because CVSS scores are not part of the STIX Campaign-Malware relationship model. C is wrong because geographic attribution is represented through separate Identity or Location objects, not this relationship type. D is wrong because discovery timelines are represented in the created or modified timestamps of STIX objects, not through Campaign-Malware relationships.