schemas.v1.1.1.cybox.objects.File_Object.xsd Maven / Gradle / Ivy
Go to download
Show more of this group Show more artifacts with this name
Show all versions of stix Show documentation
Show all versions of stix Show documentation
The Java bindings for STIX v.1.2.0.2
This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org.
File_Object
2.1
01/22/2014
The following specifies the fields and types that compose this defined CybOX Object type. Each defined object is an extension of the abstract ObjectPropertiesType, defined in CybOX Common. For more information on this extension mechanism, please see the CybOX Specification. This document is intended for developers and assumes some familiarity with XML.
Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the CybOX License located at http://cybox.mitre.org/about/termsofuse.html. See the CybOX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the CybOX Schema, this license header must be included.
The File object is intended to characterize a generic file.
The File_ObjectType type is intended to characterize generic files.
The File_Name field specifies the base name of the file (including an extension, if present).
The File_Path field specifies the relative or fully-qualified path to the file, not including the path to the device where the file system containing the file resides. Whether the path is relative or fully-qualified can be specified via the 'fully_qualified' attribute of this field. The File_Path field may include the name of the file; if so, it must not conflict with the File_Name field. If not, the File_Path field should contain the path of the directory containing the file, and should end with a terminating path separator("\" or "/").
The Device_Path field specifies the path to the physical device where the file system containing the file resides.
The Full_Path field specifies the complete path to the file, including the device path. It should contain the contents that would otherwise be in the Device_Path and File_Path fields, and can be used in case the producer is unable or does not wish to separate the Device_Path and File_Path fields. If the Full_Path field is specified along with the File_Path and/or Device_Path fields, it must not conflict with either. The Full_Path field may include the name of the file; if so, it must not conflict with the File_Name field. If not, the File_Path field should contain the path of the directory containing the file, and should end with a terminating path separator("\" or "/").
The File_Extension field specifies the extension of the name of the file. The File_Extension field must not conflict with the ending of the File_Name field. The File_Extension field should not begin with a "." character, but may contain a "." character in the case of a compound file extension, such as "tar.gz".
The Size_In_Bytes field specifies the size of the file, in bytes.
The Magic_Number specifies the particular magic number (typically a hexadecimal constant used to identify a file format) corresponding to the file, if applicable.
The File_Format field specifies the particular file format of the file, most typically specified by a tool such as the UNIX file command.
The Hashes field specifies any hashes of the file.
The Digital_Signatures field is optional and captures one or more digital signatures for the file.
The Modified_Time field specifies the date/time the file was last modified.
The Accessed_Time field specifies the date/time the file was last accessed.
The Created_Time field specifies the date/time the file was created.
The File_Attributes_List field specifies the particular special attributes set for the file. Since this is a platform-specific Object property, it is defined here as an abstract type and then implemented in any platform specific derived file objects.
The Permissions field specifies that particular permissions that a file may have. Since this is a platform-specific Object property, it is defined here as an abstract type and then implemented in any platform specific derived file objects.
The User_Owner field specifies the name of the user that owns the file.
The Packer_List field specifies any packers that the file may be packed with. The term 'packer' here refers to packers, as well as things like archivers and installers.
The Peak_Entropy field specifies the calculated peak entropy of the file.
The Sym_Links field specifies any symbolic links that may exist for the file.
The Byte_Runs field contains a list of byte runs from the raw file or its storage medium.
A description of features extracted from this file.
The Encryption_Algorithm field specifies the algorithm used to encrypt the file.
The Decryption_Key field specifies the key used to decrypt the file.
The Compression_Method field specifies the method used to compress the file.
The Compression_Version field specifies the version of the compression method used to compress the file.
The Compression_Comment field specifies the comment string associated with the compressed file.
The is_packed field is used to indicate whether the file is packed or not.
The is_masqueraded field specifies whether the file is masqueraded as another type of file; e.g., a PDF file that has had its extension changed to TXT to masquerade itself as a text file.
The FilePathType type specifies the path to the file, not including the device. Whether the path is relative or fully-qualified can be specified via the 'fully_qualified' attribute.
The fully_qualified field specifies whether the path is fully qualified.
The FileAttributeType type specifies attribute(s) of a file. Since this Object property(ies) is platform-specific, it is defined here as an abstract type.
The FilePermissionsType type specifies a permission of a file. Since this is a platform-specific Object property, it is defined here as an abstract type and then implemented in any platform specific derived file objects.
The PackerListType type specifies a list of file packers.
The Packer field specifies a single file packer.
The PackerType specifies the fields that characterize a particular file packer, such as name and version.
The Name field specifies the name of the packer.
The Version field specifies the version of the packer.
The Entry_Point field specifies the entry point address of the packer, if applicable.
The Signature field specifies the matching signature detected for the packer, if applicable.
The Type field specifies the type of packer being characterized.
The Detected_Entrypoint_Signatures field specifies the entrypoint signatures that were detected for the packer.
The EP_Jump_Codes field characterizes the entry point jump codes of the packer.
PackerCassType specifies packer classes, via a union of the PackerTypeEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.
This field is optional and specifies the expected type for the value of the specified field.
Specifies an entry-point jump code used by a packer.
The frequency that a jump instruction is found to be immediately followed by another jump instruction within the PE(Portable Executable) entry point.
The hex value of the bytes located at the jump location for a relative jump identified in the PE(Portable Executable) entry point up to 10 bytes or the end of the RVA(Relative Virtual Address) section.
Specifies an entry point signature for a packer.
Specifies the signature name.
Specifies the type of entry point detected (e.g., packer, compiled file).
The DetectedTypeEnum is an enumeration of entry point signature detection types.
Specifies a type other than those listed.
Specifies an executable that acts as a compiler.
Specifies an executable that acts as a packer.
Specifies an executable that acts as an installer.
Species a list of entry point signatures for a packer.
Specifies a single field in a list of entry point signatures.
The PackerTypeEnum type is a (non-exhaustive) enumeration of packer classes.
Indicates that the packer is an archiver.
Indicates that the packer is an installer.
Indicates that the packer is a self-extracting archiver.
Indicates that the packer is a crypter.
Indicates a packer.
Indicates that the packer is a protector.
Indicates that the packer is a bundler.
Indicates a different type of packer from the ones listed.
The SymLinksListType specifies a list of symbolic links.
The Sym_Link element specifies a single symbolic link.