Class: StixProcess

The Process Object represents common properties of an instance of a computer program as executed on an operating system.

URI: attack:StixProcess

 classDiagram
    class StixProcess
    click StixProcess href "../StixProcess/"
      StixCyberObservableObject <|-- StixProcess
        click StixCyberObservableObject href "../StixCyberObservableObject/"
      
      StixProcess : child_refs
        
          
    
        
        
        StixProcess --> "1..*" StixProcess : child_refs
        click StixProcess href "../StixProcess/"
    

        
      StixProcess : command_line
        
      StixProcess : created_time
        
      StixProcess : creator_user_ref
        
          
    
        
        
        StixProcess --> "0..1" StixUserAccount : creator_user_ref
        click StixUserAccount href "../StixUserAccount/"
    

        
      StixProcess : cwd
        
      StixProcess : defanged
        
      StixProcess : environment_variables
        
          
    
        
        
        StixProcess --> "0..1" StixDictionary : environment_variables
        click StixDictionary href "../StixDictionary/"
    

        
      StixProcess : extensions
        
          
    
        
        
        StixProcess --> "0..1" StixProcessExtensions : extensions
        click StixProcessExtensions href "../StixProcessExtensions/"
    

        
      StixProcess : granular_markings
        
          
    
        
        
        StixProcess --> "1..*" StixGranularMarking : granular_markings
        click StixGranularMarking href "../StixGranularMarking/"
    

        
      StixProcess : id
        
      StixProcess : image_ref
        
          
    
        
        
        StixProcess --> "0..1" StixFile : image_ref
        click StixFile href "../StixFile/"
    

        
      StixProcess : is_hidden
        
      StixProcess : object_marking_refs
        
          
    
        
        
        StixProcess --> "1..*" StixMarkingDefinition : object_marking_refs
        click StixMarkingDefinition href "../StixMarkingDefinition/"
    

        
      StixProcess : opened_connection_refs
        
          
    
        
        
        StixProcess --> "1..*" StixNetworkTraffic : opened_connection_refs
        click StixNetworkTraffic href "../StixNetworkTraffic/"
    

        
      StixProcess : parent_ref
        
          
    
        
        
        StixProcess --> "0..1" StixProcess : parent_ref
        click StixProcess href "../StixProcess/"
    

        
      StixProcess : pid
        
      StixProcess : spec_version
        
          
    
        
        
        StixProcess --> "0..1" StixSpecVersion : spec_version
        click StixSpecVersion href "../StixSpecVersion/"
    

        
      StixProcess : type
        
      

Inheritance

• StixObject
  • StixCyberObservableObject
    • StixProcess

Slots

Name	Cardinality and Range	Description	Inheritance
is_hidden	0..1 Boolean	Specifies whether the process is hidden	direct
pid	0..1 Integer	Specifies the Process ID, or PID, of the process	direct
created_time	0..1 StixTimestamp	Specifies the date/time at which the process was created	direct
cwd	0..1 String	Specifies the current working directory of the process	direct
command_line	0..1 String	Specifies the full command line used in executing the process, including the …	direct
environment_variables	0..1 StixDictionary	Specifies the list of environment variables associated with the process as a …	direct
opened_connection_refs	1..* StixNetworkTraffic	Specifies the list of network connections opened by the process, as a referen…	direct
creator_user_ref	0..1 StixUserAccount	A reference to the user account that created the object	direct
image_ref	0..1 StixFile	Specifies the executable binary that was executed as the process image, as a …	direct
parent_ref	0..1 StixProcess	Specifies the other process that spawned (i	direct
child_refs	1..* StixProcess	Specifies the other processes that were spawned by (i	direct
defanged	0..1 Boolean	Defines whether or not the data contained within the object has been defanged	StixCyberObservableObject
id	1 StixIdentifier	The identifier of the object: its STIX type, two hyphens and a UUID	StixObject
type	1 String	The STIX type name of the object, such as attack-pattern	StixObject
spec_version	0..1 StixSpecVersion	The version of the STIX specification used to represent the object	StixObject
object_marking_refs	1..* StixMarkingDefinition	References to the marking definitions that apply to the object	StixObject
granular_markings	1..* StixGranularMarking	The granular markings that apply to parts of the object	StixObject
extensions	0..1 StixProcessExtensions	The object’s extensions, as a dictionary keyed by extension name	StixObject

Expressions & Logic

Any Of

The class must satisfy at least one of:

• AnonymousClassExpression({ ‘slot_conditions’: {‘extensions’: SlotDefinition({‘name’: ‘extensions’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘is_hidden’: SlotDefinition({‘name’: ‘is_hidden’, ‘required’: True})} })
• AnonymousClassExpression({‘slot_conditions’: {‘pid’: SlotDefinition({‘name’: ‘pid’, ‘required’: True})}})
• AnonymousClassExpression({ ‘slot_conditions’: {‘created_time’: SlotDefinition({‘name’: ‘created_time’, ‘required’: True})} })
• AnonymousClassExpression({‘slot_conditions’: {‘cwd’: SlotDefinition({‘name’: ‘cwd’, ‘required’: True})}})
• AnonymousClassExpression({ ‘slot_conditions’: {‘command_line’: SlotDefinition({‘name’: ‘command_line’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘environment_variables’: SlotDefinition({‘name’: ‘environment_variables’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘opened_connection_refs’: SlotDefinition({‘name’: ‘opened_connection_refs’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘creator_user_ref’: SlotDefinition({‘name’: ‘creator_user_ref’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘image_ref’: SlotDefinition({‘name’: ‘image_ref’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘parent_ref’: SlotDefinition({‘name’: ‘parent_ref’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘child_refs’: SlotDefinition({‘name’: ‘child_refs’, ‘required’: True})} })

Usages

used by	used in	type	used
StixProcess	parent_ref	range	StixProcess
StixProcess	child_refs	range	StixProcess

Identifier and Mapping Information

Annotations

property	value
stix_type	process

Schema Source

• from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type	Mapped Value
self	attack:StixProcess
native	attack:StixProcess
close	uco-observable:Process

LinkML Source

Direct

name: StixProcess
annotations:
  stix_type:
    tag: stix_type
    value: process
description: The Process Object represents common properties of an instance of a computer
  program as executed on an operating system.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:Process
is_a: StixCyberObservableObject
slots:
- is_hidden
- pid
- created_time
- cwd
- command_line
- environment_variables
- opened_connection_refs
- creator_user_ref
- image_ref
- parent_ref
- child_refs
slot_usage:
  id:
    name: id
    pattern: ^process--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: process
  extensions:
    name: extensions
    range: StixProcessExtensions
any_of:
- slot_conditions:
    extensions:
      name: extensions
      required: true
- slot_conditions:
    is_hidden:
      name: is_hidden
      required: true
- slot_conditions:
    pid:
      name: pid
      required: true
- slot_conditions:
    created_time:
      name: created_time
      required: true
- slot_conditions:
    cwd:
      name: cwd
      required: true
- slot_conditions:
    command_line:
      name: command_line
      required: true
- slot_conditions:
    environment_variables:
      name: environment_variables
      required: true
- slot_conditions:
    opened_connection_refs:
      name: opened_connection_refs
      required: true
- slot_conditions:
    creator_user_ref:
      name: creator_user_ref
      required: true
- slot_conditions:
    image_ref:
      name: image_ref
      required: true
- slot_conditions:
    parent_ref:
      name: parent_ref
      required: true
- slot_conditions:
    child_refs:
      name: child_refs
      required: true

Induced

name: StixProcess
annotations:
  stix_type:
    tag: stix_type
    value: process
description: The Process Object represents common properties of an instance of a computer
  program as executed on an operating system.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:Process
is_a: StixCyberObservableObject
slot_usage:
  id:
    name: id
    pattern: ^process--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: process
  extensions:
    name: extensions
    range: StixProcessExtensions
attributes:
  is_hidden:
    name: is_hidden
    description: Specifies whether the process is hidden.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:is_hidden
    owner: StixProcess
    domain_of:
    - StixProcess
    range: boolean
  pid:
    name: pid
    description: Specifies the Process ID, or PID, of the process.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:pid
    owner: StixProcess
    domain_of:
    - StixProcess
    range: integer
  created_time:
    name: created_time
    description: Specifies the date/time at which the process was created.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:created_time
    owner: StixProcess
    domain_of:
    - StixProcess
    range: stix_timestamp
  cwd:
    name: cwd
    description: Specifies the current working directory of the process.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:cwd
    owner: StixProcess
    domain_of:
    - StixProcess
    range: string
  command_line:
    name: command_line
    description: Specifies the full command line used in executing the process, including
      the process name (which may be specified individually via the binary_ref.name
      property) and any arguments.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:command_line
    owner: StixProcess
    domain_of:
    - StixProcess
    range: string
  environment_variables:
    name: environment_variables
    description: Specifies the list of environment variables associated with the process
      as a dictionary.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:environment_variables
    owner: StixProcess
    domain_of:
    - StixProcess
    range: StixDictionary
    inlined: true
  opened_connection_refs:
    name: opened_connection_refs
    description: Specifies the list of network connections opened by the process,
      as a reference to one or more Network Traffic Objects.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:opened_connection_refs
    owner: StixProcess
    domain_of:
    - StixProcess
    range: StixNetworkTraffic
    multivalued: true
    pattern: ^network-traffic--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  creator_user_ref:
    name: creator_user_ref
    description: A reference to the user account that created the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:creator_user_ref
    owner: StixProcess
    domain_of:
    - StixProcess
    - StixWindowsRegistryKey
    range: StixUserAccount
    pattern: ^user-account--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  image_ref:
    name: image_ref
    description: Specifies the executable binary that was executed as the process
      image, as a reference to a File Object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:image_ref
    owner: StixProcess
    domain_of:
    - StixProcess
    range: StixFile
    pattern: ^file--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  parent_ref:
    name: parent_ref
    description: Specifies the other process that spawned (i.e. is the parent of)
      this one, as represented by a Process Object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:parent_ref
    owner: StixProcess
    domain_of:
    - StixProcess
    range: StixProcess
    pattern: ^process--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  child_refs:
    name: child_refs
    description: Specifies the other processes that were spawned by (i.e. children
      of) this process, as a reference to one or more other Process Objects.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:child_refs
    owner: StixProcess
    domain_of:
    - StixProcess
    range: StixProcess
    multivalued: true
    pattern: ^process--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  defanged:
    name: defanged
    description: Defines whether or not the data contained within the object has been
      defanged.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:defanged
    owner: StixProcess
    domain_of:
    - StixCyberObservableObject
    range: boolean
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: StixProcess
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
    pattern: ^process--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: StixProcess
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
    equals_string: process
  spec_version:
    name: spec_version
    description: The version of the STIX specification used to represent the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:spec_version
    owner: StixProcess
    domain_of:
    - StixObject
    range: StixSpecVersion
  object_marking_refs:
    name: object_marking_refs
    description: References to the marking definitions that apply to the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectMarking
    rank: 1000
    slot_uri: stix:object_marking_refs
    owner: StixProcess
    domain_of:
    - StixObject
    range: StixMarkingDefinition
    multivalued: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  granular_markings:
    name: granular_markings
    description: The granular markings that apply to parts of the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:granular_markings
    owner: StixProcess
    domain_of:
    - StixObject
    range: StixGranularMarking
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  extensions:
    name: extensions
    description: The object's extensions, as a dictionary keyed by extension name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:extensions
    owner: StixProcess
    domain_of:
    - StixObject
    range: StixProcessExtensions
    inlined: true
any_of:
- slot_conditions:
    extensions:
      name: extensions
      required: true
- slot_conditions:
    is_hidden:
      name: is_hidden
      required: true
- slot_conditions:
    pid:
      name: pid
      required: true
- slot_conditions:
    created_time:
      name: created_time
      required: true
- slot_conditions:
    cwd:
      name: cwd
      required: true
- slot_conditions:
    command_line:
      name: command_line
      required: true
- slot_conditions:
    environment_variables:
      name: environment_variables
      required: true
- slot_conditions:
    opened_connection_refs:
      name: opened_connection_refs
      required: true
- slot_conditions:
    creator_user_ref:
      name: creator_user_ref
      required: true
- slot_conditions:
    image_ref:
      name: image_ref
      required: true
- slot_conditions:
    parent_ref:
      name: parent_ref
      required: true
- slot_conditions:
    child_refs:
      name: child_refs
      required: true