get_software_by_alias
Search for malware and tools by alias to identify software entries in MITRE ATT&CK, with details on attack ID, name, and aliases.
Instructions
Find software/malware by alias (e.g., 'Beacon', 'Mimilib').
Many malware/tools have multiple alternative names. This tool searches
the software catalog for alias matches.
Args:
alias: Alias to search for.
domain: ATT&CK domain ("enterprise", "mobile", "ics").
include_description: Whether to include description fields.
Returns:
{
"alias": "<alias>",
"count": <number of matches>,
"software": [
{
"attack_id": "<SXXXX or MXXXX or None>",
"name": "<software name>",
"aliases": [...],
"stix_id": "<malware--UUID or tool--UUID>",
"type": "<malware|tool|...>",
"description": "<text or null>"
},
...
],
"formatted": "<human readable output>",
"message": "<status summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| alias | Yes | ||
| domain | No | enterprise | |
| include_description | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |