Skip to content
attack

Class: StixWindowsServiceExtension

The Windows Service extension specifies a default extension for capturing properties specific to Windows services.

URI: attack:StixWindowsServiceExtension

 classDiagram
    class StixWindowsServiceExtension
    click StixWindowsServiceExtension href "../StixWindowsServiceExtension/"
      StixWindowsServiceExtension : descriptions
        
      StixWindowsServiceExtension : display_name
        
      StixWindowsServiceExtension : group_name
        
      StixWindowsServiceExtension : service_dll_refs
        
          
    
        
        
        StixWindowsServiceExtension --> "1..*" StixFile : service_dll_refs
        click StixFile href "../StixFile/"
    

        
      StixWindowsServiceExtension : service_name
        
      StixWindowsServiceExtension : service_status
        
          
    
        
        
        StixWindowsServiceExtension --> "0..1" StixWindowsServiceStatus : service_status
        click StixWindowsServiceStatus href "../StixWindowsServiceStatus/"
    

        
      StixWindowsServiceExtension : service_type
        
          
    
        
        
        StixWindowsServiceExtension --> "0..1" StixWindowsServiceType : service_type
        click StixWindowsServiceType href "../StixWindowsServiceType/"
    

        
      StixWindowsServiceExtension : start_type
        
          
    
        
        
        StixWindowsServiceExtension --> "0..1" StixWindowsServiceStartType : start_type
        click StixWindowsServiceStartType href "../StixWindowsServiceStartType/"

Slots

Section titled “Slots”
Name Cardinality and Range Description Inheritance
service_name 0..1
String		 Specifies the name of the service direct
descriptions 1..*
String		 Specifies the descriptions defined for the service direct
display_name 0..1
String		 A name for display direct
group_name 0..1
String		 Specifies the name of the load ordering group of which the service is a membe… direct
start_type 0..1
StixWindowsServiceStartType		 Specifies the start options defined for the service direct
service_dll_refs 1..*
StixFile		 Specifies the DLLs loaded by the service, as a reference to one or more File … direct
service_type 0..1
StixWindowsServiceType		 Specifies the type of the service direct
service_status 0..1
StixWindowsServiceStatus		 Specifies the current status of the service direct
Expressions & Logic

Any Of

Section titled “Any Of”

The class must satisfy at least one of:

  • AnonymousClassExpression({ ‘slot_conditions’: {‘service_name’: SlotDefinition({‘name’: ‘service_name’, ‘required’: True})} })
  • AnonymousClassExpression({ ‘slot_conditions’: {‘descriptions’: SlotDefinition({‘name’: ‘descriptions’, ‘required’: True})} })
  • AnonymousClassExpression({ ‘slot_conditions’: {‘display_name’: SlotDefinition({‘name’: ‘display_name’, ‘required’: True})} })
  • AnonymousClassExpression({ ‘slot_conditions’: {‘group_name’: SlotDefinition({‘name’: ‘group_name’, ‘required’: True})} })
  • AnonymousClassExpression({ ‘slot_conditions’: {‘start_type’: SlotDefinition({‘name’: ‘start_type’, ‘required’: True})} })
  • AnonymousClassExpression({ ‘slot_conditions’: {‘service_dll_refs’: SlotDefinition({‘name’: ‘service_dll_refs’, ‘required’: True})} })
  • AnonymousClassExpression({ ‘slot_conditions’: {‘service_type’: SlotDefinition({‘name’: ‘service_type’, ‘required’: True})} })
  • AnonymousClassExpression({ ‘slot_conditions’: {‘service_status’: SlotDefinition({‘name’: ‘service_status’, ‘required’: True})} })

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Annotations

Section titled “Annotations”
property value
stix_extension_name windows-service-ext

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self attack:StixWindowsServiceExtension
native attack:StixWindowsServiceExtension
close uco-observable:WindowsServiceFacet

LinkML Source

Section titled “LinkML Source”

Direct

Section titled “Direct”
name: StixWindowsServiceExtension
annotations:
  stix_extension_name:
    tag: stix_extension_name
    value: windows-service-ext
description: The Windows Service extension specifies a default extension for capturing
  properties specific to Windows services.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:WindowsServiceFacet
slots:
- service_name
- descriptions
- display_name
- group_name
- start_type
- service_dll_refs
- service_type
- service_status
any_of:
- slot_conditions:
    service_name:
      name: service_name
      required: true
- slot_conditions:
    descriptions:
      name: descriptions
      required: true
- slot_conditions:
    display_name:
      name: display_name
      required: true
- slot_conditions:
    group_name:
      name: group_name
      required: true
- slot_conditions:
    start_type:
      name: start_type
      required: true
- slot_conditions:
    service_dll_refs:
      name: service_dll_refs
      required: true
- slot_conditions:
    service_type:
      name: service_type
      required: true
- slot_conditions:
    service_status:
      name: service_status
      required: true

Induced

Section titled “Induced”
name: StixWindowsServiceExtension
annotations:
  stix_extension_name:
    tag: stix_extension_name
    value: windows-service-ext
description: The Windows Service extension specifies a default extension for capturing
  properties specific to Windows services.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:WindowsServiceFacet
attributes:
  service_name:
    name: service_name
    description: Specifies the name of the service.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:service_name
    owner: StixWindowsServiceExtension
    domain_of:
    - StixWindowsServiceExtension
    range: string
  descriptions:
    name: descriptions
    description: Specifies the descriptions defined for the service.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:descriptions
    owner: StixWindowsServiceExtension
    domain_of:
    - StixWindowsServiceExtension
    range: string
    multivalued: true
    minimum_cardinality: 1
  display_name:
    name: display_name
    description: A name for display.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:display_name
    owner: StixWindowsServiceExtension
    domain_of:
    - StixEmailAddress
    - StixUserAccount
    - StixWindowsServiceExtension
    range: string
  group_name:
    name: group_name
    description: Specifies the name of the load ordering group of which the service
      is a member.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:group_name
    owner: StixWindowsServiceExtension
    domain_of:
    - StixWindowsServiceExtension
    range: string
  start_type:
    name: start_type
    description: Specifies the start options defined for the service. windows-service-start-enum.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:start_type
    owner: StixWindowsServiceExtension
    domain_of:
    - StixWindowsServiceExtension
    range: StixWindowsServiceStartType
  service_dll_refs:
    name: service_dll_refs
    description: Specifies the DLLs loaded by the service, as a reference to one or
      more File Objects.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:service_dll_refs
    owner: StixWindowsServiceExtension
    domain_of:
    - StixWindowsServiceExtension
    range: StixFile
    multivalued: true
    pattern: ^file--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  service_type:
    name: service_type
    description: Specifies the type of the service. windows-service-enum.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:service_type
    owner: StixWindowsServiceExtension
    domain_of:
    - StixWindowsServiceExtension
    range: StixWindowsServiceType
  service_status:
    name: service_status
    description: Specifies the current status of the service. windows-service-status-enum.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:service_status
    owner: StixWindowsServiceExtension
    domain_of:
    - StixWindowsServiceExtension
    range: StixWindowsServiceStatus
any_of:
- slot_conditions:
    service_name:
      name: service_name
      required: true
- slot_conditions:
    descriptions:
      name: descriptions
      required: true
- slot_conditions:
    display_name:
      name: display_name
      required: true
- slot_conditions:
    group_name:
      name: group_name
      required: true
- slot_conditions:
    start_type:
      name: start_type
      required: true
- slot_conditions:
    service_dll_refs:
      name: service_dll_refs
      required: true
- slot_conditions:
    service_type:
      name: service_type
      required: true
- slot_conditions:
    service_status:
      name: service_status
      required: true