Skip to content
attack

Class: StixWindowsRegistryKey

The Registry Key Object represents the properties of a Windows registry key.

URI: attack:StixWindowsRegistryKey

 classDiagram
    class StixWindowsRegistryKey
    click StixWindowsRegistryKey href "../StixWindowsRegistryKey/"
      StixCyberObservableObject <|-- StixWindowsRegistryKey
        click StixCyberObservableObject href "../StixCyberObservableObject/"
      
      StixWindowsRegistryKey : creator_user_ref
        
          
    
        
        
        StixWindowsRegistryKey --> "0..1" StixUserAccount : creator_user_ref
        click StixUserAccount href "../StixUserAccount/"
    

        
      StixWindowsRegistryKey : defanged
        
      StixWindowsRegistryKey : extensions
        
          
    
        
        
        StixWindowsRegistryKey --> "0..1" StixExtensions : extensions
        click StixExtensions href "../StixExtensions/"
    

        
      StixWindowsRegistryKey : granular_markings
        
          
    
        
        
        StixWindowsRegistryKey --> "1..*" StixGranularMarking : granular_markings
        click StixGranularMarking href "../StixGranularMarking/"
    

        
      StixWindowsRegistryKey : id
        
      StixWindowsRegistryKey : key
        
      StixWindowsRegistryKey : modified_time
        
      StixWindowsRegistryKey : number_of_subkeys
        
      StixWindowsRegistryKey : object_marking_refs
        
          
    
        
        
        StixWindowsRegistryKey --> "1..*" StixMarkingDefinition : object_marking_refs
        click StixMarkingDefinition href "../StixMarkingDefinition/"
    

        
      StixWindowsRegistryKey : spec_version
        
          
    
        
        
        StixWindowsRegistryKey --> "0..1" StixSpecVersion : spec_version
        click StixSpecVersion href "../StixSpecVersion/"
    

        
      StixWindowsRegistryKey : type
        
      StixWindowsRegistryKey : values
        
          
    
        
        
        StixWindowsRegistryKey --> "1..*" StixWindowsRegistryValue : values
        click StixWindowsRegistryValue href "../StixWindowsRegistryValue/"

Inheritance

Section titled “Inheritance”

Slots

Section titled “Slots”
Name Cardinality and Range Description Inheritance
key 0..1
String		 Specifies the full registry key including the hive direct
values 1..*
StixWindowsRegistryValue		 Specifies the values found under the registry key direct
modified_time 0..1
StixTimestamp		 Specifies the last date/time that the registry key was modified direct
creator_user_ref 0..1
StixUserAccount		 A reference to the user account that created the object direct
number_of_subkeys 0..1
Integer		 Specifies the number of subkeys contained under the registry key direct
defanged 0..1
Boolean		 Defines whether or not the data contained within the object has been defanged StixCyberObservableObject
id 1
StixIdentifier		 The identifier of the object: its STIX type, two hyphens and a UUID StixObject
type 1
String		 The STIX type name of the object, such as attack-pattern StixObject
spec_version 0..1
StixSpecVersion		 The version of the STIX specification used to represent the object StixObject
object_marking_refs 1..*
StixMarkingDefinition		 References to the marking definitions that apply to the object StixObject
granular_markings 1..*
StixGranularMarking		 The granular markings that apply to parts of the object StixObject
extensions 0..1
StixExtensions		 The object’s extensions, as a dictionary keyed by extension name StixObject
Expressions & Logic

Any Of

Section titled “Any Of”

The class must satisfy at least one of:

  • AnonymousClassExpression({‘slot_conditions’: {‘key’: SlotDefinition({‘name’: ‘key’, ‘required’: True})}})
  • AnonymousClassExpression({ ‘slot_conditions’: {‘values’: SlotDefinition({‘name’: ‘values’, ‘required’: True})} })
  • AnonymousClassExpression({ ‘slot_conditions’: {‘modified_time’: SlotDefinition({‘name’: ‘modified_time’, ‘required’: True})} })
  • AnonymousClassExpression({ ‘slot_conditions’: {‘creator_user_ref’: SlotDefinition({‘name’: ‘creator_user_ref’, ‘required’: True})} })
  • AnonymousClassExpression({ ‘slot_conditions’: {‘number_of_subkeys’: SlotDefinition({‘name’: ‘number_of_subkeys’, ‘required’: True})} })

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Annotations

Section titled “Annotations”
property value
stix_type windows-registry-key

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self attack:StixWindowsRegistryKey
native attack:StixWindowsRegistryKey
close uco-observable:WindowsRegistryKey

LinkML Source

Section titled “LinkML Source”

Direct

Section titled “Direct”
name: StixWindowsRegistryKey
annotations:
  stix_type:
    tag: stix_type
    value: windows-registry-key
description: The Registry Key Object represents the properties of a Windows registry
  key.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:WindowsRegistryKey
is_a: StixCyberObservableObject
slots:
- key
- values
- modified_time
- creator_user_ref
- number_of_subkeys
slot_usage:
  id:
    name: id
    pattern: ^windows-registry-key--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: windows-registry-key
any_of:
- slot_conditions:
    key:
      name: key
      required: true
- slot_conditions:
    values:
      name: values
      required: true
- slot_conditions:
    modified_time:
      name: modified_time
      required: true
- slot_conditions:
    creator_user_ref:
      name: creator_user_ref
      required: true
- slot_conditions:
    number_of_subkeys:
      name: number_of_subkeys
      required: true

Induced

Section titled “Induced”
name: StixWindowsRegistryKey
annotations:
  stix_type:
    tag: stix_type
    value: windows-registry-key
description: The Registry Key Object represents the properties of a Windows registry
  key.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:WindowsRegistryKey
is_a: StixCyberObservableObject
slot_usage:
  id:
    name: id
    pattern: ^windows-registry-key--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    equals_string: windows-registry-key
attributes:
  key:
    name: key
    description: Specifies the full registry key including the hive.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:key
    owner: StixWindowsRegistryKey
    domain_of:
    - StixWindowsRegistryKey
    range: string
  values:
    name: values
    description: Specifies the values found under the registry key.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:values
    owner: StixWindowsRegistryKey
    domain_of:
    - StixWindowsRegistryKey
    range: StixWindowsRegistryValue
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  modified_time:
    name: modified_time
    description: Specifies the last date/time that the registry key was modified.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:modified_time
    owner: StixWindowsRegistryKey
    domain_of:
    - StixWindowsRegistryKey
    range: stix_timestamp
  creator_user_ref:
    name: creator_user_ref
    description: A reference to the user account that created the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:creator_user_ref
    owner: StixWindowsRegistryKey
    domain_of:
    - StixProcess
    - StixWindowsRegistryKey
    range: StixUserAccount
    pattern: ^user-account--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  number_of_subkeys:
    name: number_of_subkeys
    description: Specifies the number of subkeys contained under the registry key.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:number_of_subkeys
    owner: StixWindowsRegistryKey
    domain_of:
    - StixWindowsRegistryKey
    range: integer
  defanged:
    name: defanged
    description: Defines whether or not the data contained within the object has been
      defanged.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:defanged
    owner: StixWindowsRegistryKey
    domain_of:
    - StixCyberObservableObject
    range: boolean
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: StixWindowsRegistryKey
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
    pattern: ^windows-registry-key--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: StixWindowsRegistryKey
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
    equals_string: windows-registry-key
  spec_version:
    name: spec_version
    description: The version of the STIX specification used to represent the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:spec_version
    owner: StixWindowsRegistryKey
    domain_of:
    - StixObject
    range: StixSpecVersion
  object_marking_refs:
    name: object_marking_refs
    description: References to the marking definitions that apply to the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectMarking
    rank: 1000
    slot_uri: stix:object_marking_refs
    owner: StixWindowsRegistryKey
    domain_of:
    - StixObject
    range: StixMarkingDefinition
    multivalued: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  granular_markings:
    name: granular_markings
    description: The granular markings that apply to parts of the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:granular_markings
    owner: StixWindowsRegistryKey
    domain_of:
    - StixObject
    range: StixGranularMarking
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  extensions:
    name: extensions
    description: The object's extensions, as a dictionary keyed by extension name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:extensions
    owner: StixWindowsRegistryKey
    domain_of:
    - StixObject
    range: StixExtensions
    inlined: true
any_of:
- slot_conditions:
    key:
      name: key
      required: true
- slot_conditions:
    values:
      name: values
      required: true
- slot_conditions:
    modified_time:
      name: modified_time
      required: true
- slot_conditions:
    creator_user_ref:
      name: creator_user_ref
      required: true
- slot_conditions:
    number_of_subkeys:
      name: number_of_subkeys
      required: true