Add Basic Malware Instance Capture Idiom

[ikiril01]

We should an Idiom that explains how to capture the basic properties of a malware instance as part of a TTP, using. This could also be done by refactoring the existing (Malware Characterization with MAEC) Idiom.

[benjaminxscott]

Not entirely sure what you're looking for (message may have been cut off at 'TTP, using')

Current examples that use TTPs and malware are incident plus malware
and mal email and malware hash