ruby-stix2 0.1.0 → 0.1.2

data/lib/stix2/cyberobservable_objects/process.rb

@@ -0,0 +1,17 @@
+module Stix2
+  module CyberobservableObject
+    class Process < Base
+      property :is_hidden, coerce: ->(value) { Stix2.to_bool(value) }
+      property :pid, coerce: Integer
+      property :created_time, coerce: Time
+      property :cwd, coerce: String
+      property :command_line, coerce: String
+      property :environment_variables, coerce: Hash
+      property :opened_connection_refs, coerce: [Identifier]
+      property :creator_user_ref, coerce: Identifier
+      property :image_ref, coerce: Identifier
+      property :parent_ref, coerce: Identifier
+      property :child_refs, coerce: [Identifier]
+    end
+  end
+end

data/lib/stix2/cyberobservable_objects/software.rb

@@ -4,7 +4,7 @@ module Stix2
       property :name, required: true, coerce: String
       property :cpe, coerce: String
       property :swid, coerce: String
-      property :languages, coerce: Array[String]
+      property :languages, coerce: [String]
       property :vendor, coerce: String
       property :version, coerce: String
     end

data/lib/stix2/cyberobservable_objects/user_account.rb

@@ -6,10 +6,10 @@ module Stix2
       property :account_login, coerce: String
       property :account_type, values: ACCOUNT_TYPE_OV
       property :display_name, coerce: String
-      property :is_service_account, coerce: Stix2::Boolean
-      property :is_privileged, coerce: Stix2::Boolean
-      property :can_escalate_privs, coerce: Stix2::Boolean
-      property :is_disabled, coerce: Stix2::Boolean
+      property :is_service_account, coerce: ->(value) { Stix2.to_bool(value) }
+      property :is_privileged, coerce: ->(value) { Stix2.to_bool(value) }
+      property :can_escalate_privs, coerce: ->(value) { Stix2.to_bool(value) }
+      property :is_disabled, coerce: ->(value) { Stix2.to_bool(value) }
       property :account_created, coerce: Time
       property :account_expires, coerce: Time
       property :credential_last_changed, coerce: Time

data/lib/stix2/cyberobservable_objects/x509_certificate.rb

@@ -1,8 +1,10 @@
+require "stix2/cyberobservable_objects/x509_v3_extension_type"
+
 module Stix2
   module CyberobservableObject
     class X509Certificate < Base
-      property :is_self_signed, coerce: ->(v){ boolean(v) }
-      property :hashes, coerce: ->(hsh){ hash_dict(hsh) }
+      property :is_self_signed, coerce: ->(v) { Stix2.to_bool(v) }
+      property :hashes, coerce: ->(hsh) { hash_dict(hsh) }
       property :version, coerce: String
       property :serial_number, coerce: String
       property :signature_algorithm, coerce: String

data/lib/stix2/domain_objects/attack_pattern.rb

@@ -2,11 +2,11 @@ module Stix2
   module DomainObject
     class AttackPattern < Base
       property :type, required: true, coerce: String
-      property :external_references, coerce: Array[Stix2::ExternalReference]
+      property :external_references, coerce: [Stix2::ExternalReference]
       property :name, coerce: String
       property :description, coerce: String
-      property :aliases, coerce: Array[String]
-      property :kill_chain_phases, coerce: Array[Stix2::KillChainPhase]
+      property :aliases, coerce: [String]
+      property :kill_chain_phases, coerce: [Stix2::KillChainPhase]
     end
   end
 end

data/lib/stix2/domain_objects/campaign.rb

@@ -3,7 +3,7 @@ module Stix2
     class Campaign < Base
       property :name, coerce: String
       property :description, coerce: String
-      property :aliases, coerce: Array[String]
+      property :aliases, coerce: [String]
       property :first_seen, coerce: Time
       property :last_seen, coerce: Time
       property :objective, coerce: String

data/lib/stix2/domain_objects/grouping.rb

@@ -4,7 +4,7 @@ module Stix2
       property :name, coerce: String
       property :description, coerce: String
       property :context, values: Stix2::GROUPING_CONTEXT_OV
-      property :object_refs, coerce: Array[Identifier]
+      property :object_refs, coerce: [Identifier]
     end
   end
 end

data/lib/stix2/domain_objects/identity.rb

@@ -3,7 +3,7 @@ module Stix2
     class Identity < Base
       property :name, required: true, coerce: String
       property :description, coerce: String
-      property :roles, coerce: Array[String]
+      property :roles, coerce: [String]
       property :identity_class, coerce: String, values: IDENTITY_CLASS_OV
       property :sectors, coerce: String, values: INDUSTRY_SECTOR_OV
       property :contact_information, coerce: String

data/lib/stix2/domain_objects/indicator.rb

@@ -3,13 +3,13 @@ module Stix2
     class Indicator < Base
       property :name, coerce: String
       property :description, coerce: String
-      property :indicator_types, coerce: ->(v){ validate_array(v, Stix2::INDICATOR_TYPE_OV) }
+      property :indicator_types, coerce: ->(v) { validate_array(v, Stix2::INDICATOR_TYPE_OV) }
       property :pattern, coerce: String
       property :pattern_type, coerce: String, values: PATTERN_TYPE_OV
       property :pattern_version, coerce: String
       property :valid_from, coerce: Time
       property :valid_until, coerce: Time
-      property :kill_chain_phases, coerce: Array[KillChainPhase]
+      property :kill_chain_phases, coerce: [KillChainPhase]
     end
   end
 end

data/lib/stix2/domain_objects/infrastructure.rb

@@ -3,9 +3,9 @@ module Stix2
     class Infrastructure < Base
       property :name, required: true, coerce: String
       property :description, coerce: String
-      property :infrastructure_types, coerce: ->(v){ validate_array(v, Stix2::INFRASTRUCTURE_TYPE_OV) }
-      property :aliases, coerce: Array[String]
-      property :kill_chain_phases, coerce: Array[KillChainPhase]
+      property :infrastructure_types, coerce: ->(v) { validate_array(v, Stix2::INFRASTRUCTURE_TYPE_OV) }
+      property :aliases, coerce: [String]
+      property :kill_chain_phases, coerce: [KillChainPhase]
       property :first_seen, coerce: Time
       property :last_seen, coerce: Time
     end

data/lib/stix2/domain_objects/intrusion-set.rb

@@ -3,13 +3,13 @@ module Stix2
     class IntrusionSet < Base
       property :name, required: true, coerce: String
       property :description, coerce: String
-      property :aliases, coerce: Array[String]
+      property :aliases, coerce: [String]
       property :first_seen, coerce: Time
       property :last_seen, coerce: Time
-      property :goals, coerce: Array[String]
+      property :goals, coerce: [String]
       property :resource_level, values: ATTACK_RESOURCE_LEVEL_OV
       property :primary_motivation, values: ATTACK_MOTIVATION_OV
-      property :secondary_motivations, coerce: ->(v){ validate_array(v, Stix2::ATTACK_MOTIVATION_OV) }
+      property :secondary_motivations, coerce: ->(v) { validate_array(v, Stix2::ATTACK_MOTIVATION_OV) }
     end
   end
 end

data/lib/stix2/domain_objects/malware.rb

@@ -3,17 +3,17 @@ module Stix2
     class Malware < Base
       property :name, coerce: String
       property :description, coerce: String
-      property :malware_types, coerce: ->(v){ validate_array(v, Stix2::MALWARE_TYPE_OV) }
-      property :is_family, coerce: ->(v){ is_boolean?(v) }
-      property :aliases, coerce: Array[String]
-      property :kill_chain_phases, coerce: Array[KillChainPhase]
+      property :malware_types, coerce: ->(v) { validate_array(v, Stix2::MALWARE_TYPE_OV) }
+      property :is_family, coerce: ->(v) { Stix2.to_bool(v) }
+      property :aliases, coerce: [String]
+      property :kill_chain_phases, coerce: [KillChainPhase]
       property :first_seen, coerce: Time
       property :last_seen, coerce: Time
-      property :operating_system_refs, coerce: Array[Identifier]
-      property :architecture_execution_envs, coerce: ->(v){ validate_array(v, Stix2::PROCESSOR_ARCHITECTURE_OV) }
-      property :implementation_languages, coerce: ->(v){ validate_array(v, Stix2::IMPLEMENTATION_LANGUAGE_OV) }
-      property :capabilities, coerce: ->(v){ validate_array(v, Stix2::IMPLEMENTATION_CAPABILITIES_OV) }
-      property :sample_refs, coerce: Array[Identifier]
+      property :operating_system_refs, coerce: [Identifier]
+      property :architecture_execution_envs, coerce: ->(v) { validate_array(v, Stix2::PROCESSOR_ARCHITECTURE_OV) }
+      property :implementation_languages, coerce: ->(v) { validate_array(v, Stix2::IMPLEMENTATION_LANGUAGE_OV) }
+      property :capabilities, coerce: ->(v) { validate_array(v, Stix2::IMPLEMENTATION_CAPABILITIES_OV) }
+      property :sample_refs, coerce: [Identifier]
     end
   end
 end

data/lib/stix2/domain_objects/malware_analysis.rb

@@ -5,9 +5,9 @@ module Stix2
       property :version, coerce: String
       property :host_vm_ref, coerce: Identifier
       property :operating_system_ref, coerce: Identifier
-      property :installed_software_refs, coerce: Array[Identifier]
+      property :installed_software_refs, coerce: [Identifier]
       property :configuration_version, coerce: String
-      property :modules, coerce: Array[String]
+      property :modules, coerce: [String]
       property :analysis_engine_version, coerce: String
       property :analysis_definition_version, coerce: String
       property :submitted, coerce: Time
@@ -15,7 +15,7 @@ module Stix2
       property :analysis_ended, coerce: Time
       property :result_name, coerce: String
       property :result, values: MALWARE_RESULT_OV
-      property :analysis_sco_refs, coerce: Array[Identifier]
+      property :analysis_sco_refs, coerce: [Identifier]
       property :sample_ref, coerce: Identifier
     end
   end

data/lib/stix2/domain_objects/note.rb

@@ -3,8 +3,8 @@ module Stix2
     class Note < Base
       property :abstract, coerce: String
       property :content, coerce: String
-      property :authors, coerce: Array[String]
-      property :object_refs, coerce: Array[Identifier]
+      property :authors, coerce: [String]
+      property :object_refs, coerce: [Identifier]
     end
   end
 end

data/lib/stix2/domain_objects/observed_data.rb

@@ -5,7 +5,7 @@ module Stix2
       property :last_observed, required: true, coerce: Time
       property :number_observed, required: true, coerce: Integer
       property :objects, coerce: Hash
-      property :object_refs, coerce: Array[Identifier]
+      property :object_refs, coerce: [Identifier]
     end
   end
 end

data/lib/stix2/domain_objects/opinion.rb

@@ -2,9 +2,9 @@ module Stix2
   module DomainObject
     class Opinion < Base
       property :explanation, coerce: String
-      property :authors, coerce: Array[String]
+      property :authors, coerce: [String]
       property :opinion, values: OPINION_ENUM
-      property :object_refs, coerce: Array[Identifier]
+      property :object_refs, coerce: [Identifier]
     end
   end
 end

data/lib/stix2/domain_objects/report.rb

@@ -3,9 +3,9 @@ module Stix2
     class Report < Base
       property :name, required: true, coerce: String
       property :description, coerce: String
-      property :report_types, coerce: ->(v){ validate_array(v, Stix2::REPORT_TYPE_OV) }
+      property :report_types, coerce: ->(v) { validate_array(v, Stix2::REPORT_TYPE_OV) }
       property :published, coerce: Time
-      property :object_refs, coerce: Array[Identifier]
+      property :object_refs, coerce: [Identifier]
     end
   end
 end

data/lib/stix2/domain_objects/threat_actor.rb

@@ -3,17 +3,17 @@ module Stix2
     class ThreatActor < Base
       property :name, required: true, coerce: String
       property :description, coerce: String
-      property :threat_actor_types, coerce: ->(v){ validate_array(v, THREAT_ACTOR_TYPE_OV) }
-      property :aliases, coerce: Array[String]
+      property :threat_actor_types, coerce: ->(v) { validate_array(v, THREAT_ACTOR_TYPE_OV) }
+      property :aliases, coerce: [String]
       property :first_seen, coerce: Time
       property :last_seen, coerce: Time
-      property :roles, coerce: ->(v){ validate_array(v, THREAT_ACTOR_ROLE_OV) }
-      property :goals, coerce: Array[String]
+      property :roles, coerce: ->(v) { validate_array(v, THREAT_ACTOR_ROLE_OV) }
+      property :goals, coerce: [String]
       property :sophistication, values: THREAT_ACTOR_SOPHISTICATION_OV
       property :resource_level, values: ATTACK_RESOURCE_LEVEL_OV
       property :primary_motivation, values: ATTACK_MOTIVATION_OV
-      property :secondary_motivations, coerce: ->(v){ validate_array(v, ATTACK_MOTIVATION_OV) }
-      property :personal_motivations, coerce: ->(v){ validate_array(v, ATTACK_MOTIVATION_OV) }
+      property :secondary_motivations, coerce: ->(v) { validate_array(v, ATTACK_MOTIVATION_OV) }
+      property :personal_motivations, coerce: ->(v) { validate_array(v, ATTACK_MOTIVATION_OV) }
     end
   end
 end

data/lib/stix2/domain_objects/tool.rb

@@ -3,9 +3,9 @@ module Stix2
     class Tool < Base
       property :name, required: true, coerce: String
       property :description, coerce: String
-      property :tool_types, coerce: ->(v){ validate_array(v, TOOL_TYPES_OV) }
-      property :aliases, coerce: Array[String]
-      property :kill_chain_phases, coerce: Array[KillChainPhase]
+      property :tool_types, coerce: ->(v) { validate_array(v, TOOL_TYPES_OV) }
+      property :aliases, coerce: [String]
+      property :kill_chain_phases, coerce: [KillChainPhase]
       property :tool_version, coerce: String
     end
   end

data/lib/stix2/enum.rb

@@ -1,32 +1,91 @@
 module Stix2
   OPINION_ENUM = [
-    'strongly-disagree',
-    'disagree',
-    'neutral',
-    'agree',
-    'strongly-agree'
+    "strongly-disagree",
+    "disagree",
+    "neutral",
+    "agree",
+    "strongly-agree"
   ].freeze
 
   ENCRYPTION_ALGORITHM_ENUM = [
-    'AES-256-GCM',
-    'ChaCha20-Poly1305',
-    'mime-type-indicated'
+    "AES-256-GCM",
+    "ChaCha20-Poly1305",
+    "mime-type-indicated"
   ].freeze
 
   WINDOWS_REGISTRY_DATATYPE_ENUM = [
-    'REG_NONE',
-    'REG_SZ',
-    'REG_EXPAND_SZ',
-    'REG_BINARY',
-    'REG_DWORD',
-    'REG_DWORD_BIG_ENDIAN',
-    'REG_DWORD_LITTLE_ENDIAN',
-    'REG_LINK',
-    'REG_MULTI_SZ',
-    'REG_RESOURCE_LIST',
-    'REG_FULL_RESOURCE_DESCRIPTION',
-    'REG_RESOURCE_REQUIREMENTS_LIST',
-    'REG_QWORD',
-    'REG_INVALID_TYPE'
+    "REG_NONE",
+    "REG_SZ",
+    "REG_EXPAND_SZ",
+    "REG_BINARY",
+    "REG_DWORD",
+    "REG_DWORD_BIG_ENDIAN",
+    "REG_DWORD_LITTLE_ENDIAN",
+    "REG_LINK",
+    "REG_MULTI_SZ",
+    "REG_RESOURCE_LIST",
+    "REG_FULL_RESOURCE_DESCRIPTION",
+    "REG_RESOURCE_REQUIREMENTS_LIST",
+    "REG_QWORD",
+    "REG_INVALID_TYPE"
+  ].freeze
+
+  EXTENSION_TYPE_ENUM = [
+    "new-sdo",
+    "new-sco",
+    "new-sro",
+    "property-extension",
+    "toplevel-property-extension"
+  ].freeze
+
+  NETWORK_SOCKET_ADDRESS_FAMILY_ENUM = [
+    "AF_UNSPEC",
+    "AF_INET",
+    "AF_IPX",
+    "AF_APPLETALK",
+    "AF_NETBIOS",
+    "AF_INET6",
+    "AF_IRDA",
+    "AF_BTH"
+  ].freeze
+
+  NETWORK_SOCKET_TYPE_ENUM = [
+    "SOCK_STREAM",
+    "AF_ISOCK_DGRAMNET",
+    "SOCK_RAW",
+    "SOCK_RDM",
+    "SOCK_SEQPACKET"
+  ].freeze
+
+  WINDOWS_INTEGRITY_LEVEL_ENUM = [
+    "low",
+    "medium",
+    "high",
+    "system"
+  ].freeze
+
+  WINDOWS_SERVICE_START_TYPE_ENUM = [
+    "SERVICE_AUTO_START",
+    "SERVICE_BOOT_START",
+    "SERVICE_DEMAND_START",
+    "SERVICE_DISABLED",
+    "SERVICE_SYSTEM_ALERT"
+  ].freeze
+
+  WINDOWS_SERVICE_TYPE_ENUM = [
+    "SERVICE_KERNEL_DRIVER",
+    "SERVICE_FILE_SYSTEM_DRIVER",
+    "SERVICE_WIN32_OWN_PROCESS",
+    "SERVICE_WIN32_SHARE_PROCESS"
+  ].freeze
+
+  WINDOWS_SERVICE_STATUS_ENUM = [
+    "SERVICE_CONTINUE_PENDING",
+    "SERVICE_PAUSE_PENDING",
+    "SERVICE_PAUSED",
+    "SERVICE_RUNNING",
+    "SERVICE_START_PENDING",
+    "SERVICE_STOP_PENDING",
+    "SERVICE_STOPPED"
   ].freeze
 end

data/lib/stix2/extension_definition.rb

@@ -0,0 +1,10 @@
+module Stix2
+  class ExtensionDefinition < Stix2::Common
+    property :name, required: true, coerce: String
+    property :description, coerce: String
+    property :schema, required: true, coerce: String
+    property :version, required: true, coerce: String
+    property :extension_types, required: true, coerce: ->(values) { validate_array(values, EXTENSION_TYPE_ENUM) }
+    property :extension_properties, coerce: [String]
+  end
+end

data/lib/stix2/extensions/alternate_data_stream_type.rb

@@ -0,0 +1,9 @@
+module Stix2
+  module Extensions
+    class AlternateDataStreamType < Stix2::Base
+      property :name, required: true, coerce: String
+      property :hashes, coerce: ->(hsh) { hash_dict(hsh) }
+      property :size, coerce: Integer
+    end
+  end
+end

data/lib/stix2/extensions/archive_file.rb

@@ -0,0 +1,8 @@
+module Stix2
+  module Extensions
+    class ArchiveFile < Stix2::Base
+      property :contains_refs, required: true, coerce: [Identifier]
+      property :comment, coerce: String
+    end
+  end
+end

data/lib/stix2/extensions/http_request.rb

@@ -0,0 +1,12 @@
+module Stix2
+  module Extensions
+    class HttpRequest < Stix2::Base
+      property :request_method, required: true, coerce: String
+      property :request_value, required: true, coerce: String
+      property :request_version, coerce: String
+      property :request_header, coerce: Hash
+      property :message_body_length, coerce: Integer
+      property :message_body_data_ref, coerce: Identifier
+    end
+  end
+end

data/lib/stix2/extensions/icmp.rb

@@ -0,0 +1,8 @@
+module Stix2
+  module Extensions
+    class Icmp < Stix2::Base
+      property :icmp_type_hex, required: true, coerce: ->(value) { Stix2.is_hex?(value) && value }
+      property :icmp_code_hex, required: true, coerce: ->(value) { Stix2.is_hex?(value) && value }
+    end
+  end
+end

data/lib/stix2/extensions/ntfs.rb

@@ -0,0 +1,10 @@
+require "stix2/extensions/alternate_data_stream_type"
+
+module Stix2
+  module Extensions
+    class Ntfs < Stix2::Base
+      property :sid, coerce: String
+      property :alternate_data_streams, coerce: [AlternateDataStreamType]
+    end
+  end
+end

data/lib/stix2/extensions/pdf.rb

@@ -0,0 +1,11 @@
+module Stix2
+  module Extensions
+    class Pdf < Stix2::Base
+      property :version, coerce: String
+      property :is_optimized, coerce: ->(value) { Stix2.to_bool(value) }
+      property :document_info_dict, {String => String}
+      property :pdfid0, coerce: String
+      property :pdfid1, coerce: String
+    end
+  end
+end

data/lib/stix2/extensions/raster_image.rb

@@ -0,0 +1,10 @@
+module Stix2
+  module Extensions
+    class RasterImage < Stix2::Base
+      property :image_height, coerce: Integer
+      property :image_width, coerce: Integer
+      property :bits_per_pixel, coerce: Integer
+      property :exif_tags, coerce: Hash
+    end
+  end
+end

data/lib/stix2/extensions/socket.rb

@@ -0,0 +1,13 @@
+module Stix2
+  module Extensions
+    class Socket < Stix2::Base
+      property :address_family, required: true, values: NETWORK_SOCKET_ADDRESS_FAMILY_ENUM
+      property :is_blocking, coerce: ->(value) { Stix2.to_bool(value) }
+      property :is_listening, coerce: ->(value) { Stix2.to_bool(value) }
+      property :options, coerce: ->(hsh) { hsh.keys.all? { |k| k.is_a?(Integer) } && hsh }
+      property :socket_type, values: NETWORK_SOCKET_TYPE_ENUM
+      property :socket_descriptor, coerce: Integer
+      property :socket_handle, coerce: Integer
+    end
+  end
+end

data/lib/stix2/extensions/tcp.rb

@@ -0,0 +1,8 @@
+module Stix2
+  module Extensions
+    class Tcp < Stix2::Base
+      property :src_flags_hex, coerce: ->(value) { Stix2.is_hex?(value) && value }
+      property :dst_flags_hex, coerce: ->(value) { Stix2.is_hex?(value) && value }
+    end
+  end
+end

data/lib/stix2/extensions/unix_account.rb

@@ -0,0 +1,10 @@
+module Stix2
+  module Extensions
+    class UnixAccount < Stix2::Base
+      property :gid, coerce: Integer
+      property :groups, coerce: [String]
+      property :home_dir, coerce: String
+      property :shell, coerce: String
+    end
+  end
+end

data/lib/stix2/extensions/windows_pe_optional_header_type.rb

@@ -0,0 +1,37 @@
+module Stix2
+  module Extensions
+    class WindowsPeOptionalHeaderType < Stix2::Base
+      property :magic_hex, coerce: ->(value) { Stix2.is_hex?(value) && value }
+      property :major_linker_version, coerce: Integer
+      property :minor_linker_version, coerce: Integer
+      property :size_of_code, coerce: Integer
+      property :size_of_initialized_data, coerce: Integer
+      property :size_of_uninitialized_data, coerce: Integer
+      property :address_of_entry_point, coerce: Integer
+      property :base_of_code, coerce: Integer
+      property :base_of_data, coerce: Integer
+      property :image_base, coerce: Integer
+      property :section_alignment, coerce: Integer
+      property :file_alignment, coerce: Integer
+      property :major_os_version, coerce: Integer
+      property :minor_os_version, coerce: Integer
+      property :major_image_version, coerce: Integer
+      property :minor_image_version, coerce: Integer
+      property :major_subsystem_version, coerce: Integer
+      property :minor_subsystem_version, coerce: Integer
+      property :win32_version_value_hex, coerce: ->(value) { Stix2.is_hex?(value) && value }
+      property :size_of_image, coerce: Integer
+      property :size_of_headers, coerce: Integer
+      property :checksum_hex, coerce: ->(value) { Stix2.is_hex?(value) && value }
+      property :subsystem_hex, coerce: ->(value) { Stix2.is_hex?(value) && value }
+      property :dll_characteristics_hex, coerce: ->(value) { Stix2.is_hex?(value) && value }
+      property :size_of_stack_reserve, coerce: Integer
+      property :size_of_stack_commit, coerce: Integer
+      property :size_of_heap_reserve, coerce: Integer
+      property :size_of_heap_commit, coerce: Integer
+      property :loader_flags_hex, coerce: ->(value) { Stix2.is_hex?(value) && value }
+      property :number_of_rva_and_sizes, coerce: Integer
+      property :hashes, coerce: ->(hsh) { hash_dict(hsh) }
+    end
+  end
+end

data/lib/stix2/extensions/windows_pe_section_type.rb

@@ -0,0 +1,10 @@
+module Stix2
+  module Extensions
+    class WindowsPeSectionType < Stix2::Base
+      property :name, required: true, coerce: String
+      property :size, coerce: Integer
+      property :entropy, coerce: Float
+      property :hashes, coerce: ->(hsh) { hash_dict(hsh) }
+    end
+  end
+end

data/lib/stix2/extensions/windows_pebinary.rb

@@ -0,0 +1,21 @@
+require "stix2/extensions/windows_pe_optional_header_type"
+require "stix2/extensions/windows_pe_section_type"
+
+module Stix2
+  module Extensions
+    class WindowsPebinary < Stix2::Base
+      property :pe_type, required: true, values: WINDOWS_PEBINARY_TYPE_OV
+      property :imphash, coerce: String
+      property :machine_hex, coerce: ->(value) { Stix2.is_hex?(value) && value }
+      property :number_of_sections, coerce: Integer
+      property :time_date_stamp, coerce: Time
+      property :pointer_to_symbol_table_hex, coerce: ->(value) { Stix2.is_hex?(value) && value }
+      property :number_of_symbols, coerce: Integer
+      property :size_of_optional_header, coerce: Integer
+      property :characteristics_hex, coerce: ->(value) { Stix2.is_hex?(value) && value }
+      property :file_header_hashes, coerce: ->(hsh) { hash_dict(hsh) }
+      property :optional_header, coerce: WindowsPeOptionalHeaderType
+      property :sections, coerce: [WindowsPeSectionType]
+    end
+  end
+end

data/lib/stix2/extensions/windows_process.rb

@@ -0,0 +1,13 @@
+module Stix2
+  module Extensions
+    class WindowsProcess < Stix2::Base
+      property :aslr_enabled, coerce: ->(value) { Stix2.to_bool(value) }
+      property :dep_enabled, coerce: ->(value) { Stix2.to_bool(value) }
+      property :priority, coerce: String
+      property :owner_sid, coerce: String
+      property :window_title, coerce: String
+      property :startup_info, coerce: Hash
+      property :integrity_level, values: WINDOWS_INTEGRITY_LEVEL_ENUM
+    end
+  end
+end

data/lib/stix2/extensions/windows_service.rb

@@ -0,0 +1,14 @@
+module Stix2
+  module Extensions
+    class WindowsService < Stix2::Base
+      property :service_name, coerce: String
+      property :description, coerce: [String]
+      property :display_name, coerce: String
+      property :group_name, coerce: String
+      property :start_type, values: WINDOWS_SERVICE_START_TYPE_ENUM
+      property :service_dll_refs, coerce: [Identifier]
+      property :service_type, values: WINDOWS_SERVICE_TYPE_ENUM
+      property :service_status, values: WINDOWS_SERVICE_STATUS_ENUM
+    end
+  end
+end