Which threat intelligence standard contains malware hashes?

Advanced Persistent Threat (APT) describes a type of sophisticated, prolonged cyberattack, not a threat intelligence standard itself.

Open Command and Control (OpenC2) is a standard for command and control of cyber defense systems, not a standard for threat intelligence content.

Structured Threat Information Expression (STIX) is a standard for representing and exchanging cyber threat intelligence, designed to convey a full range of CTI data, including indicators like malware hashes, IP addresses, and domain names. This enables automated sharing and analysis of threat information across organizations and security tools.

Trusted Automated Exchange of Indicator Information (TAXII) is a standard for *exchanging* cyber threat intelligence, working in conjunction with STIX, but STIX is the standard that *contains* the threat intelligence itself, like malware hashes.