From 1a08f2c9b8a330f9ade996ef2c82d292a5bdcd71 Mon Sep 17 00:00:00 2001
From: Deborah Servili <deborah.servili@gmail.com>
Date: Fri, 5 Apr 2019 11:13:21 +0200
Subject: [PATCH] add ransomware taxonomy WIP

---
 ransomware/machinetag.json | 58 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 ransomware/machinetag.json

diff --git a/ransomware/machinetag.json b/ransomware/machinetag.json
new file mode 100644
index 0000000..83f18b1
--- /dev/null
+++ b/ransomware/machinetag.json
@@ -0,0 +1,58 @@
+{
+  "namespace": "ransomware",
+  "expanded": "ransomware types and elements",
+  "description": "Ransomware is used to define ransomware types and the elements that compose them.",
+  "version": 1,
+  "predicates": [
+    {
+      "value": "type",
+      "expanded": "Type",
+      "description": "Type is used to describe the type of a ransomware and how it works."
+    },
+    {
+      "value": "element",
+      "expanded": "Element",
+      "description": "Elements that composed or are linked to a ransomware and its execution."
+    }
+  ],
+  "values": [
+    {
+      "predicate": "type",
+      "entry": [
+        {
+          "value": "scareware",
+          "expanded": ""
+        },
+        {
+          "value": "locker",
+          "expanded": ""
+        },
+        {
+          "value": "cryptolocker",
+          "expanded": ""
+        }
+      ],
+    },
+    {
+      "predicate": "type",
+      "entry": [
+        {
+          "value": "ransomnote",
+          "expanded": ""
+        },
+        {
+          "value": "decoy",
+          "expanded": ""
+        },
+        {
+          "value": "crypter",
+          "expanded": ""
+        },
+        {
+          "value": "downloader",
+          "expanded": ""
+        }
+      ]
+    }
+  ]
+}