diff --git a/objects/windows-service/definition.json b/objects/windows-service/definition.json new file mode 100644 index 0000000..f3e2cee --- /dev/null +++ b/objects/windows-service/definition.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "comment": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "display": { + "description": "Display name/information of the service.", + "misp-attribute": "windows-service-displayname", + "ui-priority": 0 + }, + "group": { + "description": "Group to which the system/driver belong to.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "Base", + "Boot Bus Extender", + "Boot File System", + "Cryptography", + "Extended base", + "Event Log", + "Filter", + "FSFilter Bottom", + "FSFilter Infrastructure", + "File System", + "FSFilter Virtualization", + "Keyboard Port", + "Network", + "NDIS", + "Parallel arbitrator", + "Pointer Port", + "PnP Filter", + "ProfSvc_Group", + "PNP_TDI", + "SCSI Miniport", + "SCSI CDROM Class", + "System Bus Extender", + "Video Save", + "other" + ], + "ui-priority": 0 + }, + "image-path": { + "description": "Path of the service/drive", + "misp-attribute": "text", + "ui-priority": 0 + }, + "name": { + "description": "name of the service", + "misp-attribute": "windows-service-name", + "ui-priority": 0 + }, + "start": { + "description": "When the service/driver starts or executes.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "Boot start", + "System start", + "Auto start", + "Manual", + "Disabled" + ], + "ui-priority": 0 + }, + "type": { + "description": "Service/driver type.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "Kernel driver", + "File system driver", + "Own process", + "Share process", + "Interactive", + "Other" + ], + "ui-priority": 0 + } + }, + "description": "Windows service and detailed about a service running a Windows operating system", + "meta-category": "misc", + "name": "windows-service", + "required": [ + "name" + ], + "uuid": "7598cc63-7ba3-4d0a-91c0-b875c6013035", + "version": 1 +} \ No newline at end of file