@prefix skos: <http://www.w3.org/2004/02/skos/core#> .
@prefix dcterms: <http://purl.org/dc/terms/> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
@prefix foaf: <http://xmlns.com/foaf/0.1/> .
@prefix mcr: <https://registry.apicrafter.io/vocab#> .
@prefix dt: <https://registry.apicrafter.io/datatype/> .
@prefix cat: <https://registry.apicrafter.io/category/> .
@prefix country: <https://registry.apicrafter.io/country/> .
@prefix tool: <https://registry.apicrafter.io/tool/> .

dt:microsoft_malware_name a skos:Concept ;
    skos:inScheme <https://registry.apicrafter.io/> ;
    skos:notation "microsoft_malware_name" ;
    skos:prefLabel "Microsoft malware name"@en ;
    skos:definition "Name that Microsoft Defender and other Microsoft anti-malware products give to a detected threat, following the CARO scheme in the form Type:Platform/Family.Variant!Suffix. Type says what the threat does (Trojan, Backdoor, Ransom, HackTool, PUA and others), Platform names the operating system, script language, macro type or file format it targets (Win32, AndroidOS, MSIL, O97M), Family groups related samples, the Variant letters are assigned in sequence (.A, .B, ... .AF), and a suffix after ! is an internal Microsoft indicator. VirusTotal shows it as the result of the Microsoft engine."@en ;
    skos:broader dt:malware_detection_name ;
    skos:example "Trojan:Win32/Wacatac.B!ml" ;
    mcr:status "draft" ;
    mcr:isPII false ;
    mcr:classification "categorical" ;
    mcr:regexp "^[A-Za-z]+:[A-Za-z0-9_]+/[A-Za-z0-9_-]+(?:\\.[A-Za-z0-9]+)*(?:![A-Za-z0-9]+)?$" ;
    rdfs:seeAlso <https://learn.microsoft.com/en-us/defender-xdr/malware-naming> .