1# Copyright (c) 2017, The MITRE Corporation. All rights reserved. 2# See LICENSE.txt for complete terms. 3 4from mixbox import entities 5from mixbox import fields 6 7import cybox.bindings.win_service_object as win_service_binding 8from cybox.common import HashList 9from cybox.objects.win_process_object import WinProcess 10from cybox.common import ObjectProperties, String 11 12 13class ServiceDescriptionList(entities.EntityList): 14 _binding = win_service_binding 15 _binding_class = win_service_binding.ServiceDescriptionListType 16 _namespace = "http://cybox.mitre.org/objects#WinServiceObject-2" 17 18 description = fields.TypedField("Description", String, multiple=True) 19 20 21class WinService(WinProcess): 22 _binding = win_service_binding 23 _binding_class = win_service_binding.WindowsServiceObjectType 24 _namespace = "http://cybox.mitre.org/objects#WinServiceObject-2" 25 _XSI_NS = "WinServiceObj" 26 _XSI_TYPE = "WindowsServiceObjectType" 27 28 service_dll_signature_exists = fields.TypedField("service_dll_signature_exists") 29 service_dll_signature_verified = fields.TypedField("service_dll_signature_verified") 30 description_list = fields.TypedField("Description_List", ServiceDescriptionList) 31 display_name = fields.TypedField("Display_Name", String) 32 group_name = fields.TypedField("Group_Name", String) 33 service_name = fields.TypedField("Service_Name", String) 34 service_dll = fields.TypedField("Service_DLL", String) 35 service_dll_certificate_issuer = fields.TypedField("Service_DLL_Certificate_Issuer", String) 36 service_dll_certificate_subject = fields.TypedField("Service_DLL_Certificate_Subject", String) 37 service_dll_hashes = fields.TypedField("Service_DLL_Hashes", HashList) 38 service_dll_signature_description = fields.TypedField("Service_DLL_Signature_Description", String) 39 startup_command_line = fields.TypedField("Startup_Command_Line", String) 40 startup_type = fields.TypedField("Startup_Type", String) 41 service_status = fields.TypedField("Service_Status", String) 42 service_type = fields.TypedField("Service_Type", String) 43 started_as = fields.TypedField("Started_As", String) 44