get_software_by_alias
Search for malware and tools by alias to identify software entries in MITRE ATT&CK, with details on attack ID, name, and aliases.
Instructions
Find software/malware by alias (e.g., 'Beacon', 'Mimilib').
Many malware/tools have multiple alternative names. This tool searches
the software catalog for alias matches.
Args:
alias: Alias to search for.
domain: ATT&CK domain ("enterprise", "mobile", "ics").
include_description: Whether to include description fields.
Returns:
{
"alias": "<alias>",
"count": <number of matches>,
"software": [
{
"attack_id": "<SXXXX or MXXXX or None>",
"name": "<software name>",
"aliases": [...],
"stix_id": "<malware--UUID or tool--UUID>",
"type": "<malware|tool|...>",
"description": "<text or null>"
},
...
],
"formatted": "<human readable output>",
"message": "<status summary>"
}
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"alias": "<alias>"
},
"name": "get_software_by_alias"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| alias | Yes | ||
| domain | No | enterprise | |
| include_description | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |