The ProcessTreeNodeType captures a single process, or node, in the process tree. It imports and extends the ProcessObjectType from the Cyber Observable eXpression (CybOX™) Process Object.
| Field Name | Type | Description |
|---|---|---|
| @object_referenceoptional | QName |
The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to. |
| Custom_Properties0..1 | CustomPropertiesType |
The Custom_Properties construct is optional and enables the specification of a set of custom Object Properties that may not be defined in existing Properties schemas. |
| @is_hiddenoptional | boolean |
The is_hidden field specifies whether the process is hidden or not. |
| PID0..1 | UnsignedIntegerObjectPropertyType |
The PID field specifies the Process ID, or PID, of the process. |
| Name0..1 | StringObjectPropertyType |
The Name field specifies the name of the process. |
| Creation_Time0..1 | DateTimeObjectPropertyType |
The Creation_Time field specifies the local date/time at which the process was created. |
| Parent_PID0..1 | UnsignedIntegerObjectPropertyType |
The Parent_PID field specifies the process ID (PID) of the parent process (i.e. the process that spawned this one), if applicable. NOTE: this field will be deprecated in the next major version of this object, at which point the parent process of this process should be specified using a Related_Object with the "Child_Of" Relationship value. |
| Child_PID_List0..1 | ChildPIDListType |
The Child_PID_List field specifies any children spawned by the process being characterized, by way of a list of PIDs. NOTE: this field will be deprecated in the next major version of this object, at which point child processes of this process should be specified using a Related_Object with the "Parent_Of" Relationship value. |
| Image_Info0..1 | ImageInfoType |
The Image_Info field specifies information about the image associated with the process, such as its file name and path. |
| Argument_List0..1 | ArgumentListType |
The Argument_List field is optional and specifies a list of arguments utilized in initiating the process. |
| Environment_Variable_List0..1 | EnvironmentVariableListType |
The Environment_Variable_List field specifies any environment variables associated with the process. This field imports and uses the EnvironmentVariableListType from the CybOX Common Types. |
| Kernel_Time0..1 | DurationObjectPropertyType |
The Kernel_Time field specifies the duration of time that the process has executed in kernel mode. |
| Port_List0..1 | PortListType |
The Port_List field is optional and specifies a list of ports owned by the process. |
| Network_Connection_List0..1 | NetworkConnectionListType |
The Network_Connection_List field specifies information about any network connections opened or initiated by the process. |
| Start_Time0..1 | DateTimeObjectPropertyType |
The Start_Time field specifies the local date/time at which the process was started. |
| Status0..1 | ProcessStatusType |
The Status field specifies the current status of the process. Since this is an operating system specific Object property, this is defined here as an abstract type which is then used as a base type in any OS-specific extensions. |
| Username0..1 | StringObjectPropertyType |
The Username field specifies the name of the user that created the process. |
| User_Time0..1 | DurationObjectPropertyType |
The User_Time field specifies the duration of time that the process has executed in user mode. |
| Extracted_Features0..1 | ExtractedFeaturesType |
A description of features extracted from the memory image of this process. |
| @idrequired | QName |
The required id field specifies a unique ID for the Process Node. |
| @parent_action_idrefoptional | QName |
The parent_action_idref field specifies the id of the action that created or injected this process. |
| @ordinal_positionoptional | positiveInteger |
The ordinal_position field specifies the ordinal position of the process with respect to the other processes spawned or injected by the malware. |
| Initiated_Actions0..1 | ActionReferenceListType |
The Initiated_Actions field captures, via references, the actions (found inside the top-level Actions element, or an Action Collection inside the top-level Collections element) initiated by the Process. |
| Spawned_Process0..n | ProcessTreeNodeType |
The Spawned_Process field captures a single child process spawned by this process. |
| Injected_Process0..n | ProcessTreeNodeType |
The Injected_Process field captures a single process that was injected by this process. |
