sra-stix2-validator

{ "$id": "../observables/process.json", "$schema": "http://json-schema.org/draft-06/schema#", "title": "process", "description": "The Process Object represents common properties of an instance of a computer program as executed on an operating system.", "type": "object", "allOf": [ { "$ref": "../common/cyber-observable-core.json" }, { "properties": { "type": { "type": "string", "description": "The value of this property MUST be `process`.", "const": "process" }, "extensions": { "$ref": "#/definitions/process-extensions-dictionary", "description": "The Process Object defines the following extensions. In addition to these, producers MAY create their own. Extensions: windows-process-ext, windows-service-ext." }, "is_hidden": { "type": "boolean", "description": "Specifies whether the process is hidden." }, "pid": { "type": "integer", "description": "Specifies the Process ID, or PID, of the process." }, "name": { "type": "string", "description": "Specifies the name of the process." }, "created": { "$ref": "../common/timestamp.json", "description": "Specifies the date/time at which the process was created." }, "cwd": { "type": "string", "description": "Specifies the current working directory of the process." }, "arguments": { "type": "array", "description": "Specifies the list of arguments used in executing the process.", "items": { "type": "string", "pattern": "^((-{1,2}|\\/)[^\\s=]+ (?![-\\/]))?([^\\s\"'=|]+(=([^\\s\"'=|]+|\"([^\"]*)\"|'([^']*)'))?|\"([^\"]*)\"|'([^']*)')$" }, "minItems": 1 }, "command_line": { "type": "string", "description": "Specifies the full command line used in executing the process, including the process name (depending on the operating system)." }, "environment_variables": { "$ref": "../common/dictionary.json", "description": "Specifies the list of environment variables associated with the process as a dictionary." }, "opened_connection_refs": { "type": "array", "description": "Specifies the list of network connections opened by the process, as a reference to one or more Network Traffic Objects.", "items": { "type": "string" }, "minItems": 1 }, "creator_user_ref": { "type": "string", "description": "Specifies the user that created the process, as a reference to a User Account Object." }, "binary_ref": { "type": "string", "description": "Specifies the executable binary that was executed as the process, as a reference to a File Object." }, "parent_ref": { "type": "string", "description": "Specifies the other process that spawned (i.e. is the parent of) this one, as represented by a Process Object." }, "child_refs": { "type": "array", "description": "Specifies the other processes that were spawned by (i.e. children of) this process, as a reference to one or more other Process Objects.", "items": { "type": "string" }, "minItems": 1 } } }, { "anyOf": [ { "required": [ "extensions" ] }, { "required": [ "is_hidden" ] }, { "required": [ "pid" ] }, { "required": [ "name" ] }, { "required": [ "created" ] }, { "required": [ "cwd" ] }, { "required": [ "arguments" ] }, { "required": [ "command_line" ] }, { "required": [ "environment_variables" ] }, { "required": [ "opened_connection_refs" ] }, { "required": [ "creator_user_ref" ] }, { "required": [ "binary_ref" ] }, { "required": [ "parent_ref" ] }, { "required": [ "child_refs" ] } ] } ], "definitions": { "process-extensions-dictionary": { "type": "object", "patternProperties": { "^windows-process-ext$": { "type": "object", "description": "The Windows Process extension specifies a default extension for capturing properties specific to Windows processes.", "allOf": [ { "properties": { "aslr_enabled": { "type": "boolean", "description": "Specifies whether Address Space Layout Randomization (ASLR) is enabled for the process." }, "dep_enabled": { "type": "boolean", "description": "Specifies whether Data Execution Prevention (DEP) is enabled for the process." }, "priority": { "type": "string", "description": "Specifies the current priority class of the process in Windows." }, "owner_sid": { "type": "string", "description": "Specifies the Security ID (SID) value of the owner of the process." }, "window_title": { "type": "string", "description": "Specifies the title of the main window of the process." }, "startup_info": { "$ref": "#/definitions/startup-info-dictionary", "description": "Specifies the STARTUP_INFO struct used by the process, as a dictionary." } } }, { "anyOf": [ { "required": [ "aslr_enabled" ] }, { "required": [ "dep_enabled" ] }, { "required": [ "priority" ] }, { "required": [ "owner_sid" ] }, { "required": [ "window_title" ] }, { "required": [ "startup_info" ] } ] } ] }, "^windows-service-ext$": { "type": "object", "description": "The Windows Service extension specifies a default extension for capturing properties specific to Windows services.", "properties": { "service_name": { "type": "string", "description": "Specifies the name of the service." }, "descriptions": { "type": "array", "description": "Specifies the descriptions defined for the service.", "items": { "type": "string" }, "minItems": 1 }, "display_name": { "type": "string", "description": "Specifies the displayed name of the service in Windows GUI controls." }, "group_name": { "type": "string", "description": "Specifies the name of the load ordering group of which the service is a member." }, "start_type": { "type": "string", "description": "Specifies the start options defined for the service. windows-service-start-enum", "enum": [ "SERVICE_AUTO_START", "SERVICE_BOOT_START", "SERVICE_DEMAND_START", "SERVICE_DISABLED", "SERVICE_SYSTEM_ALERT" ] }, "service_dll_refs": { "type": "array", "description": "Specifies the DLLs loaded by the service, as a reference to one or more File Objects.", "items": { "type": "string" }, "minItems": 1 }, "service_type": { "type": "string", "description": "Specifies the type of the service. windows-service-enum", "enum": [ "SERVICE_KERNEL_DRIVER", "SERVICE_FILE_SYSTEM_DRIVER", "SERVICE_WIN32_OWN_PROCESS", "SERVICE_WIN32_SHARE_PROCESS" ] }, "service_status": { "type": "string", "description": "Specifies the current status of the service. windows-service-status-enum", "enum": [ "SERVICE_CONTINUE_PENDING", "SERVICE_PAUSE_PENDING", "SERVICE_PAUSED", "SERVICE_RUNNING", "SERVICE_START_PENDING", "SERVICE_STOP_PENDING", "SERVICE_STOPPED" ] } }, "required": [ "service_name" ] } }, "additionalProperties": { "$ref": "../common/dictionary.json", "description": "Custom file extension" } }, "startup-info-dictionary": { "type": "object", "patternProperties": { "^lpDesktop|lpTitle|dwFillAttribute|dwFlags|wShowWindow|hStdInput|hStdOutput|hStdError$": { "type": "string" }, "^lpReserved|lpReserved2$": { "type": "null" }, "^cb|dwX|dwY|dwXSize|dwYSize|dwXCountChars|dwYCountChars$": { "type": "integer" }, "^cbReserved2$": { "type": "integer", "minimum": 0, "maximum": 0 } }, "additionalProperties": false } } }