Class: WindowsServiceExt

The Windows Service extension specifies properties specific to Windows services. Used as the value of the 'windows-service-ext' key in a Process object's extensions dictionary.

URI: attack:WindowsServiceExt

 classDiagram
    class WindowsServiceExt
    click WindowsServiceExt href "../WindowsServiceExt/"
      CommonSchemaComponent <|-- WindowsServiceExt
        click CommonSchemaComponent href "../CommonSchemaComponent/"

      WindowsServiceExt : description

      WindowsServiceExt : descriptions

      WindowsServiceExt : display_name

      WindowsServiceExt : group_name

      WindowsServiceExt : id

      WindowsServiceExt : name

      WindowsServiceExt : service_dll_refs

      WindowsServiceExt : service_name

      WindowsServiceExt : service_status





        WindowsServiceExt --> "0..1" WindowsServiceStatusEnum : service_status
        click WindowsServiceStatusEnum href "../WindowsServiceStatusEnum/"



      WindowsServiceExt : service_type





        WindowsServiceExt --> "0..1" WindowsServiceTypeEnum : service_type
        click WindowsServiceTypeEnum href "../WindowsServiceTypeEnum/"



      WindowsServiceExt : start_type





        WindowsServiceExt --> "0..1" WindowsServiceStartEnum : start_type
        click WindowsServiceStartEnum href "../WindowsServiceStartEnum/"



      WindowsServiceExt : type

Inheritance

StixEntity
- CommonSchemaComponent
  - WindowsServiceExt

Slots

Name	Cardinality and Range	Description	Inheritance
service_name	0..1 String	Specifies the name of the service	direct
descriptions	* String	Specifies the descriptions defined for the service	direct
display_name	0..1 String	Human-friendly display name	direct
group_name	0..1 String	Specifies the name of the load ordering group of which the service is a membe...	direct
start_type	0..1 WindowsServiceStartEnum	Specifies the start options defined for the service	direct
service_dll_refs	* StixIdentifier	Specifies the DLLs loaded by the service	direct
service_type	0..1 WindowsServiceTypeEnum	Specifies the type of the service	direct
service_status	0..1 WindowsServiceStatusEnum	Specifies the current status of the service	direct
id	0..1 StixIdentifier	STIX object identifier	StixEntity
type	0..1 StixTypeName	STIX object type	StixEntity
name	0..1 String	Human-readable name	StixEntity
description	0..1 String	Human-readable description	StixEntity

In Subsets

Observables

Comments

stix_extension_key: windows-service-ext stix_parent_type: process jsonschema_source: https://github.com/oasis-open/cti-stix2-json-schemas/tree/master/schemas/observables/process.json

Identifier and Mapping Information

Schema Source

from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type	Mapped Value
self	attack:WindowsServiceExt
native	attack:WindowsServiceExt

LinkML Source

Direct

name: WindowsServiceExt
description: The Windows Service extension specifies properties specific to Windows
  services. Used as the value of the 'windows-service-ext' key in a Process object's
  extensions dictionary.
comments:
- 'stix_extension_key: windows-service-ext stix_parent_type: process jsonschema_source:
  https://github.com/oasis-open/cti-stix2-json-schemas/tree/master/schemas/observables/process.json'
in_subset:
- observables
from_schema: https://w3id.org/lmodel/attack
is_a: CommonSchemaComponent
slots:
- service_name
- descriptions
- display_name
- group_name
- start_type
- service_dll_refs
- service_type
- service_status
slot_usage:
  service_dll_refs:
    name: service_dll_refs
    comments:
    - 'jsonschema_minItems: "1"'
  descriptions:
    name: descriptions
    comments:
    - 'jsonschema_minItems: "1"'

Induced

name: WindowsServiceExt
description: The Windows Service extension specifies properties specific to Windows
  services. Used as the value of the 'windows-service-ext' key in a Process object's
  extensions dictionary.
comments:
- 'stix_extension_key: windows-service-ext stix_parent_type: process jsonschema_source:
  https://github.com/oasis-open/cti-stix2-json-schemas/tree/master/schemas/observables/process.json'
in_subset:
- observables
from_schema: https://w3id.org/lmodel/attack
is_a: CommonSchemaComponent
slot_usage:
  service_dll_refs:
    name: service_dll_refs
    comments:
    - 'jsonschema_minItems: "1"'
  descriptions:
    name: descriptions
    comments:
    - 'jsonschema_minItems: "1"'
attributes:
  service_name:
    name: service_name
    description: Specifies the name of the service.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: service_name
    owner: WindowsServiceExt
    domain_of:
    - WindowsServiceExt
    range: string
  descriptions:
    name: descriptions
    description: Specifies the descriptions defined for the service.
    comments:
    - 'jsonschema_minItems: "1"'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: descriptions
    owner: WindowsServiceExt
    domain_of:
    - WindowsServiceExt
    range: string
    multivalued: true
  display_name:
    name: display_name
    description: Human-friendly display name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: display_name
    owner: WindowsServiceExt
    domain_of:
    - EmailAddr
    - UserAccount
    - WindowsServiceExt
    range: string
  group_name:
    name: group_name
    description: Specifies the name of the load ordering group of which the service
      is a member.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: group_name
    owner: WindowsServiceExt
    domain_of:
    - WindowsServiceExt
    range: string
  start_type:
    name: start_type
    description: Specifies the start options defined for the service.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: start_type
    owner: WindowsServiceExt
    domain_of:
    - WindowsServiceExt
    range: WindowsServiceStartEnum
  service_dll_refs:
    name: service_dll_refs
    description: Specifies the DLLs loaded by the service.
    comments:
    - 'jsonschema_minItems: "1"'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: service_dll_refs
    owner: WindowsServiceExt
    domain_of:
    - WindowsServiceExt
    range: stix_identifier
    multivalued: true
  service_type:
    name: service_type
    description: Specifies the type of the service.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: service_type
    owner: WindowsServiceExt
    domain_of:
    - WindowsServiceExt
    range: WindowsServiceTypeEnum
  service_status:
    name: service_status
    description: Specifies the current status of the service.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: service_status
    owner: WindowsServiceExt
    domain_of:
    - WindowsServiceExt
    range: WindowsServiceStatusEnum
  id:
    name: id
    description: STIX object identifier.
    from_schema: https://w3id.org/lmodel/attack
    related_mappings:
    - unified_cyber_ontology:externalReference
    rank: 1000
    alias: id
    owner: WindowsServiceExt
    domain_of:
    - StixEntity
    - Bundle
    - Core
    - CyberObservableCore
    - ExtensionDefinition
    - LanguageContent
    - MarkingDefinition
    - File
    range: stix_identifier
  type:
    name: type
    description: STIX object type.
    from_schema: https://w3id.org/lmodel/attack
    related_mappings:
    - unified_cyber_ontology:state
    rank: 1000
    alias: type
    owner: WindowsServiceExt
    domain_of:
    - StixEntity
    - Bundle
    - Core
    - CyberObservableCore
    - ExtensionDefinition
    - LanguageContent
    - MarkingDefinition
    - File
    range: stix_type_name
  name:
    name: name
    description: Human-readable name.
    from_schema: https://w3id.org/lmodel/attack
    exact_mappings:
    - unified_cyber_ontology:name
    rank: 1000
    alias: name
    owner: WindowsServiceExt
    domain_of:
    - RelatedAsset
    - StixEntity
    - ExtensionDefinition
    - MarkingDefinition
    - AutonomousSystem
    - File
    range: string
  description:
    name: description
    description: Human-readable description.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:description
    rank: 1000
    alias: description
    owner: WindowsServiceExt
    domain_of:
    - RelatedAsset
    - MutableElement
    - StixEntity
    - ExtensionDefinition
    - ExternalReference
    range: string