MAEC™ International in scope and free for public use, MAEC is a standardized language for encoding and communicating high-fidelity information about malware based upon attributes such as behaviors, artifacts, and attack patterns.

By eliminating the ambiguity and inaccuracy that currently exists in malware descriptions and by reducing reliance on signatures, MAEC aims to improve human-to-human, human-to-tool, tool-to-tool, and tool-to-human communication about malware; reduce potential duplication of malware analysis efforts by researchers; and allow for the faster development of countermeasures by enabling the ability to leverage responses to previously observed malware instances.

	Related Efforts Cyber Observables (CybOX) Attack Patterns (CAPEC) Software Weakness Types (CWE) Platforms (CPE) Configurations (CCE) Assessment Language (OVAL) Log Format (CEE) Vulnerabilities (CVE) Vulnerability Scoring System (CVSS) Making Security Measurable

FOCUS ON

MAEC Language Version 2.1

Version 2.1 of the MAEC Language is now available on the Releases page on the MAEC Web site. This version represents a minor update to Version 2.0 and is focused primarily on integrating the Version 1.0 (Draft) Cyber Observables Expression (CybOX™) Schema in order to permit increased expressiveness and consistency in MAEC, particularly with regards to the representation of MAEC Actions and Objects. Downloads and documentation for this release include the Version 2.1 Schema, Version 2.1 Example Files, and Version 2.1 Schematron rules.

Feedback on all of these items is welcome on the MAEC Development Group on Handshake, MAEC Discussion List, and/or maec@mitre.org.

Page Last Updated: May 11, 2012