There is a need for STIX to represent Personas utilized by a Threat Actor as part of their TTP.
This would typically be used for characterizing a Threat Actor impersonating something else.
An example would be a malicious website or URL impersonating a benign entity like eBay, Google, etc.