1# Copyright (c) 2017, The MITRE Corporation. All rights reserved.
2# See LICENSE.txt for complete terms.
3
4from mixbox import entities
5from mixbox import fields
6
7import cybox.bindings.win_service_object as win_service_binding
8from cybox.common import HashList
9from cybox.objects.win_process_object import WinProcess
10from cybox.common import ObjectProperties, String
11
12
13class ServiceDescriptionList(entities.EntityList):
14    _binding = win_service_binding
15    _binding_class = win_service_binding.ServiceDescriptionListType
16    _namespace = "http://cybox.mitre.org/objects#WinServiceObject-2"
17
18    description = fields.TypedField("Description", String, multiple=True)
19
20
21class WinService(WinProcess):
22    _binding = win_service_binding
23    _binding_class = win_service_binding.WindowsServiceObjectType
24    _namespace = "http://cybox.mitre.org/objects#WinServiceObject-2"
25    _XSI_NS = "WinServiceObj"
26    _XSI_TYPE = "WindowsServiceObjectType"
27
28    service_dll_signature_exists = fields.TypedField("service_dll_signature_exists")
29    service_dll_signature_verified = fields.TypedField("service_dll_signature_verified")
30    description_list = fields.TypedField("Description_List", ServiceDescriptionList)
31    display_name = fields.TypedField("Display_Name", String)
32    group_name = fields.TypedField("Group_Name", String)
33    service_name = fields.TypedField("Service_Name", String)
34    service_dll = fields.TypedField("Service_DLL", String)
35    service_dll_certificate_issuer = fields.TypedField("Service_DLL_Certificate_Issuer", String)
36    service_dll_certificate_subject = fields.TypedField("Service_DLL_Certificate_Subject", String)
37    service_dll_hashes = fields.TypedField("Service_DLL_Hashes", HashList)
38    service_dll_signature_description = fields.TypedField("Service_DLL_Signature_Description", String)
39    startup_command_line = fields.TypedField("Startup_Command_Line", String)
40    startup_type = fields.TypedField("Startup_Type", String)
41    service_status = fields.TypedField("Service_Status", String)
42    service_type = fields.TypedField("Service_Type", String)
43    started_as = fields.TypedField("Started_As", String)
44