Class: StixWindowsProcessExtension

The Windows Process extension specifies a default extension for capturing properties specific to Windows processes.

URI: attack:StixWindowsProcessExtension

 classDiagram
    class StixWindowsProcessExtension
    click StixWindowsProcessExtension href "../StixWindowsProcessExtension/"
      StixWindowsProcessExtension : aslr_enabled
        
      StixWindowsProcessExtension : dep_enabled
        
      StixWindowsProcessExtension : integrity_level
        
          
    
        
        
        StixWindowsProcessExtension --> "0..1" StixWindowsIntegrityLevel : integrity_level
        click StixWindowsIntegrityLevel href "../StixWindowsIntegrityLevel/"
    

        
      StixWindowsProcessExtension : owner_sid
        
      StixWindowsProcessExtension : priority
        
      StixWindowsProcessExtension : startup_info
        
          
    
        
        
        StixWindowsProcessExtension --> "0..1" StixDictionary : startup_info
        click StixDictionary href "../StixDictionary/"
    

        
      StixWindowsProcessExtension : window_title
        
      

Slots

Name	Cardinality and Range	Description	Inheritance
aslr_enabled	0..1 Boolean	Specifies whether Address Space Layout Randomization (ASLR) is enabled for th…	direct
dep_enabled	0..1 Boolean	Specifies whether Data Execution Prevention (DEP) is enabled for the process	direct
priority	0..1 String	Specifies the current priority class of the process in Windows	direct
owner_sid	0..1 String	Specifies the Security ID (SID) value of the owner of the process	direct
window_title	0..1 String	Specifies the title of the main window of the process	direct
startup_info	0..1 StixDictionary	Specifies the STARTUP_INFO struct used by the process, as a dictionary	direct
integrity_level	0..1 StixWindowsIntegrityLevel	Specifies the Windows integrity level, or trustworthiness, of the process	direct

Expressions & Logic

Any Of

The class must satisfy at least one of:

• AnonymousClassExpression({ ‘slot_conditions’: {‘aslr_enabled’: SlotDefinition({‘name’: ‘aslr_enabled’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘dep_enabled’: SlotDefinition({‘name’: ‘dep_enabled’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘priority’: SlotDefinition({‘name’: ‘priority’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘owner_sid’: SlotDefinition({‘name’: ‘owner_sid’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘window_title’: SlotDefinition({‘name’: ‘window_title’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘startup_info’: SlotDefinition({‘name’: ‘startup_info’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘integrity_level’: SlotDefinition({‘name’: ‘integrity_level’, ‘required’: True})} })

Identifier and Mapping Information

Annotations

property	value
stix_extension_name	windows-process-ext

Schema Source

• from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type	Mapped Value
self	attack:StixWindowsProcessExtension
native	attack:StixWindowsProcessExtension
close	uco-observable:WindowsProcessFacet

LinkML Source

Direct

name: StixWindowsProcessExtension
annotations:
  stix_extension_name:
    tag: stix_extension_name
    value: windows-process-ext
description: The Windows Process extension specifies a default extension for capturing
  properties specific to Windows processes.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:WindowsProcessFacet
slots:
- aslr_enabled
- dep_enabled
- priority
- owner_sid
- window_title
- startup_info
- integrity_level
any_of:
- slot_conditions:
    aslr_enabled:
      name: aslr_enabled
      required: true
- slot_conditions:
    dep_enabled:
      name: dep_enabled
      required: true
- slot_conditions:
    priority:
      name: priority
      required: true
- slot_conditions:
    owner_sid:
      name: owner_sid
      required: true
- slot_conditions:
    window_title:
      name: window_title
      required: true
- slot_conditions:
    startup_info:
      name: startup_info
      required: true
- slot_conditions:
    integrity_level:
      name: integrity_level
      required: true

Induced

name: StixWindowsProcessExtension
annotations:
  stix_extension_name:
    tag: stix_extension_name
    value: windows-process-ext
description: The Windows Process extension specifies a default extension for capturing
  properties specific to Windows processes.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:WindowsProcessFacet
attributes:
  aslr_enabled:
    name: aslr_enabled
    description: Specifies whether Address Space Layout Randomization (ASLR) is enabled
      for the process.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:aslr_enabled
    owner: StixWindowsProcessExtension
    domain_of:
    - StixWindowsProcessExtension
    range: boolean
  dep_enabled:
    name: dep_enabled
    description: Specifies whether Data Execution Prevention (DEP) is enabled for
      the process.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:dep_enabled
    owner: StixWindowsProcessExtension
    domain_of:
    - StixWindowsProcessExtension
    range: boolean
  priority:
    name: priority
    description: Specifies the current priority class of the process in Windows.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:priority
    owner: StixWindowsProcessExtension
    domain_of:
    - StixWindowsProcessExtension
    range: string
  owner_sid:
    name: owner_sid
    description: Specifies the Security ID (SID) value of the owner of the process.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:owner_sid
    owner: StixWindowsProcessExtension
    domain_of:
    - StixWindowsProcessExtension
    range: string
  window_title:
    name: window_title
    description: Specifies the title of the main window of the process.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:window_title
    owner: StixWindowsProcessExtension
    domain_of:
    - StixWindowsProcessExtension
    range: string
  startup_info:
    name: startup_info
    description: Specifies the STARTUP_INFO struct used by the process, as a dictionary.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:startup_info
    owner: StixWindowsProcessExtension
    domain_of:
    - StixWindowsProcessExtension
    range: StixDictionary
    inlined: true
  integrity_level:
    name: integrity_level
    description: Specifies the Windows integrity level, or trustworthiness, of the
      process.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:integrity_level
    owner: StixWindowsProcessExtension
    domain_of:
    - StixWindowsProcessExtension
    range: StixWindowsIntegrityLevel
any_of:
- slot_conditions:
    aslr_enabled:
      name: aslr_enabled
      required: true
- slot_conditions:
    dep_enabled:
      name: dep_enabled
      required: true
- slot_conditions:
    priority:
      name: priority
      required: true
- slot_conditions:
    owner_sid:
      name: owner_sid
      required: true
- slot_conditions:
    window_title:
      name: window_title
      required: true
- slot_conditions:
    startup_info:
      name: startup_info
      required: true
- slot_conditions:
    integrity_level:
      name: integrity_level
      required: true