stix_schema_spy 1.2.3 → 1.3

data/config/1.2/stix/cybox/objects/Win_Kernel_Object.xsd

@@ -0,0 +1,128 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:WinKernelObj="http://cybox.mitre.org/objects#WinKernelObject-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" targetNamespace="http://cybox.mitre.org/objects#WinKernelObject-2" elementFormDefault="qualified" attributeFormDefault="unqualified" version="2.1">
+	<xs:annotation>
+		<xs:documentation>This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org.</xs:documentation>
+		<xs:appinfo>
+			<schema>Win_Kernel_Object</schema>
+			<version>2.1</version>
+			<date>01/22/2014</date>			
+			<short_description>The following specifies the fields and types that compose this defined CybOX Object type. Each defined object is an extension of the abstract ObjectPropertiesType, defined in CybOX Common. For more information on this extension mechanism, please see the CybOX Specification. This document is intended for developers and assumes some familiarity with XML. </short_description>
+			<terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the CybOX License located at http://cybox.mitre.org/about/termsofuse.html. See the CybOX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the CybOX Schema, this license header must be included.</terms_of_use>
+		</xs:appinfo>
+	</xs:annotation>
+	<xs:import namespace="http://cybox.mitre.org/common-2" schemaLocation="../cybox_common.xsd"/>
+	<xs:element name="Windows_Kernel" type="WinKernelObj:WindowsKernelObjectType">
+		<xs:annotation>
+			<xs:documentation>The Windows_Kernel object is intended to characterize Windows Kernel structures.</xs:documentation>
+		</xs:annotation>
+	</xs:element>
+	<xs:complexType name="WindowsKernelObjectType">
+		<xs:annotation>
+			<xs:documentation>The WindowsKernelObjectType type is intended to characterize Windows Kernel structures.</xs:documentation>
+		</xs:annotation>
+		<xs:complexContent>
+			<xs:extension base="cyboxCommon:ObjectPropertiesType">
+				<xs:sequence>
+					<xs:element name="IDT" type="WinKernelObj:IDTEntryListType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The IDT field characterizes the Windows Interrupt Descriptor Table (IDT).</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="SSDT" type="WinKernelObj:SSDTEntryListType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The SSDT field characterizes the Windows System Service Descriptor Table (SSDT). The SSDT is a structure that kernel uses to dispatch functions. KeServiceDescriptorTable is a table exported by the kernel that contains pointers to four SSDTs, one for the native API, one for user/GDI support, one of IIS SPUD (in Windows 2000), and one unused.See http://www.honeynet.org/node/438; Sven Boris Schreiber, Undocumented Windows 2000 Secrets (http://undocumented.rawol.com/sbs-w2k-2-the-windows-2000-native-api.pdf); Greg Hoglund and James Butler, Rootkits: Subverting the WIndows kernel.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+				</xs:sequence>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:complexType name="SSDTEntryListType">
+		<xs:annotation>
+			<xs:documentation>The SSDTEntryListType type specifies a listing of the entries in the System Service Descriptor Table (SSDT).</xs:documentation>
+		</xs:annotation>
+		<xs:sequence>
+			<xs:element name="SSDT_Entry" type="WinKernelObj:SSDTEntryType" maxOccurs="unbounded">
+				<xs:annotation>
+					<xs:documentation>Specifies an entry in the System Service Descriptor Table.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+		</xs:sequence>
+	</xs:complexType>
+	<xs:complexType name="SSDTEntryType">
+		<xs:annotation>
+			<xs:documentation>The SSDTEntryType type specifies a single entry in the System Service Descriptor Table (SSDT).</xs:documentation>
+		</xs:annotation>
+		<xs:sequence>
+			<xs:element name="Service_Table_Base" type="cyboxCommon:HexBinaryObjectPropertyType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>Pointer to the system service dispatch table, an array of function addresses which is indexed by the system call number.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="Service_Counter_Table_Base" type="cyboxCommon:HexBinaryObjectPropertyType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>Pointer to an array of usage counters.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="Number_Of_Services" type="cyboxCommon:NonNegativeIntegerObjectPropertyType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>Number of entries in the system service dispatch table.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="Argument_Table_Base" type="cyboxCommon:HexBinaryObjectPropertyType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>Pointer to an array of bytes, which indicate the number of bytes used by the function's arguments.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+		</xs:sequence>
+		<xs:attribute name="hooked" type="xs:boolean">
+			<xs:annotation>
+				<xs:documentation>The hooked attribute specifies whether the SSDT entry is hooked.</xs:documentation>
+			</xs:annotation>
+		</xs:attribute>
+	</xs:complexType>
+	<xs:complexType name="IDTEntryListType">
+		<xs:annotation>
+			<xs:documentation>The IDTEntryListType type specifies a listing of the entries in the Interrupt Descriptor Table (IDT). The IDT is specific to the I386 architecture, indicating where the Protected mode Interrupt Service Routines (ISR) are located. See http://wiki.osdev.org/Interrupt_Descriptor_Table.</xs:documentation>
+		</xs:annotation>
+		<xs:sequence>
+			<xs:element name="IDT_Entry" type="WinKernelObj:IDTEntryType" maxOccurs="unbounded">
+				<xs:annotation>
+					<xs:documentation>Specifies an entry in the Interrupt Descriptor Table.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+		</xs:sequence>
+	</xs:complexType>
+	<xs:complexType name="IDTEntryType">
+		<xs:annotation>
+			<xs:documentation>The IDTEntryType type specifies a single entry in the Interrupt Descriptor Table (IDT). Entries can be interrupt gates, task gates, and trap gates.</xs:documentation>
+		</xs:annotation>
+		<xs:sequence>
+			<xs:element name="Type_Attr" type="cyboxCommon:HexBinaryObjectPropertyType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>A byte that encodes the gate type and interrupt attributes (e.g., the Descriptor Privilege Level).</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="Offset_High" type="cyboxCommon:HexBinaryObjectPropertyType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>Higher part of the interrupt function's offset address bits 16-31 in 32-bit, bits 32-63 in 64-bit).</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="Offset_Low" type="cyboxCommon:HexBinaryObjectPropertyType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>Lower part of the interrupt function's offset address (bits 0-15).</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="Offset_Middle" type="cyboxCommon:HexBinaryObjectPropertyType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>In 64-bit architectures, middle part of the interrupt function's offset address (bits 16-31).</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+			<xs:element name="Selector" type="cyboxCommon:HexBinaryObjectPropertyType" minOccurs="0">
+				<xs:annotation>
+					<xs:documentation>A 16-bit value that points to a code segment selector in the Global Descriptot Table.</xs:documentation>
+				</xs:annotation>
+			</xs:element>
+		</xs:sequence>
+	</xs:complexType>
+</xs:schema>

data/config/1.2/stix/cybox/objects/Win_Mailslot_Object.xsd

@@ -0,0 +1,56 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:WinMailslotObj="http://cybox.mitre.org/objects#WinMailslotObject-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" xmlns:WinHandleObj="http://cybox.mitre.org/objects#WinHandleObject-2" targetNamespace="http://cybox.mitre.org/objects#WinMailslotObject-2" elementFormDefault="qualified" attributeFormDefault="unqualified" version="2.1">
+	<xs:annotation>
+		<xs:documentation>This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org.</xs:documentation>
+		<xs:appinfo>
+			<schema>Win_Mailslot_Object</schema>
+			<version>2.1</version>
+			<date>01/22/2014</date>			
+			<short_description>The following specifies the fields and types that compose this defined CybOX Object type. Each defined object is an extension of the abstract ObjectPropertiesType, defined in CybOX Common. For more information on this extension mechanism, please see the CybOX Specification. This document is intended for developers and assumes some familiarity with XML. </short_description>
+			<terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the CybOX License located at http://cybox.mitre.org/about/termsofuse.html. See the CybOX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the CybOX Schema, this license header must be included.</terms_of_use>
+		</xs:appinfo>
+	</xs:annotation>
+	<xs:import namespace="http://cybox.mitre.org/common-2" schemaLocation="../cybox_common.xsd"/>
+	<xs:import namespace="http://cybox.mitre.org/objects#WinHandleObject-2" schemaLocation="Win_Handle_Object.xsd"/>
+	<xs:element name="Windows_Mailslot" type="WinMailslotObj:WindowsMailslotObjectType">
+		<xs:annotation>
+			<xs:documentation>The Windows_Mailslot object is intended to characterize Windows mailslot objects. See also: http://msdn.microsoft.com/en-us/library/windows/desktop/aa365576(v=vs.85).aspx.</xs:documentation>
+		</xs:annotation>
+	</xs:element>
+	<xs:complexType name="WindowsMailslotObjectType" mixed="false">
+		<xs:annotation>
+			<xs:documentation>The WindowsMailslotObjectType is intended to characterize Windows mailslot objects.</xs:documentation>
+		</xs:annotation>
+		<xs:complexContent>
+			<xs:extension base="cyboxCommon:ObjectPropertiesType">
+				<xs:sequence>
+					<xs:element name="Handle" type="WinHandleObj:WindowsHandleObjectType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Handle field specifies the open Windows handle to the mailslot. It imports and uses the WindowsHandleObjectType from the CybOX Windows Handle Object.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Max_Message_Size" type="cyboxCommon:NonNegativeIntegerObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Max_Message_Size field specifies the maximum message size for the mailslot, in bytes.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Name" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Name field specifies the name of the mailslot.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Read_Timeout" type="cyboxCommon:NonNegativeIntegerObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Read_Timeout field specifies the amount of time, in milliseconds, a read operation can wait for a message to be written to the mailslot before a time-out occurs.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="Security_Attributes" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The Security_Attributes field specifies the Windows security attributes for the mailslot.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+				</xs:sequence>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+</xs:schema>

data/config/1.2/stix/cybox/objects/Win_Memory_Page_Region_Object.xsd

@@ -0,0 +1,198 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:WinMemoryPageRegionObj="http://cybox.mitre.org/objects#WinMemoryPageRegionObject-2" xmlns:MemoryObj="http://cybox.mitre.org/objects#MemoryObject-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" targetNamespace="http://cybox.mitre.org/objects#WinMemoryPageRegionObject-2" elementFormDefault="qualified" attributeFormDefault="unqualified" version="2.1">
+	<xs:annotation>
+		<xs:documentation>This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org.</xs:documentation>
+		<xs:appinfo>
+			<schema>Win_Memory_Page_Region_Object</schema>
+			<version>2.1</version>
+			<date>01/22/2014</date>			
+			<short_description>The following specifies the fields and types that compose this defined CybOX Object type. Each defined object is an extension of the abstract ObjectPropertiesType, defined in CybOX Common. For more information on this extension mechanism, please see the CybOX Specification. This document is intended for developers and assumes some familiarity with XML. </short_description>
+			<terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the CybOX License located at http://cybox.mitre.org/about/termsofuse.html. See the CybOX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the CybOX Schema, this license header must be included.</terms_of_use>
+		</xs:appinfo>
+	</xs:annotation>
+	<xs:import namespace="http://cybox.mitre.org/common-2" schemaLocation="../cybox_common.xsd"/>
+	<xs:import namespace="http://cybox.mitre.org/objects#MemoryObject-2" schemaLocation="Memory_Object.xsd"/>
+	<xs:element name="Windows_Memory_Page_Region" type="WinMemoryPageRegionObj:WindowsMemoryPageRegionObjectType">
+		<xs:annotation>
+			<xs:documentation>The Windows_Memory_Page_Region object is intended represent a single Windows memory page region.</xs:documentation>
+		</xs:annotation>
+	</xs:element>
+	<xs:complexType name="WindowsMemoryPageRegionObjectType" mixed="false">
+		<xs:annotation>
+			<xs:documentation>The WindowsMemoryPageRegionObjectType type is intended to characterize Windows memory page regions.</xs:documentation>
+		</xs:annotation>
+		<xs:complexContent>
+			<xs:extension base="MemoryObj:MemoryObjectType">
+				<xs:sequence>
+					<xs:element minOccurs="0" name="Type" type="WinMemoryPageRegionObj:MemoryPageTypeType">
+						<xs:annotation>
+							<xs:documentation>The Type field specifies the type of pages in the memory page region.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element minOccurs="0" name="Allocation_Base_Address" type="cyboxCommon:HexBinaryObjectPropertyType">
+						<xs:annotation>
+							<xs:documentation>The Allocation_Base_Address field specifies the base address of the memory page region when the region was first allocated.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element minOccurs="0" name="Allocation_Protect" type="WinMemoryPageRegionObj:MemoryPageProtectionType">
+						<xs:annotation>
+							<xs:documentation>The Allocation_Protect field specifies the memory protection option for the memory page region when the region was initially allocated.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element minOccurs="0" name="State" type="WinMemoryPageRegionObj:MemoryPageStateType">
+						<xs:annotation>
+							<xs:documentation>The State field specifies the state of the memory pages in the region.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element minOccurs="0" name="Protect" type="WinMemoryPageRegionObj:MemoryPageProtectionType">
+						<xs:annotation>
+							<xs:documentation>The Protect field specifies the access protection of the memory pages in the region.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+				</xs:sequence>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:complexType name="MemoryPageProtectionType">
+		<xs:annotation>
+			<xs:documentation>MemoryPageProtectionType specifies memory protection constant types, via a union of the MemoryPageProtectionEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation>
+		</xs:annotation>
+		<xs:simpleContent>
+			<xs:restriction base="cyboxCommon:BaseObjectPropertyType">
+				<xs:simpleType>
+					<xs:union memberTypes="WinMemoryPageRegionObj:MemoryPageProtectionEnum xs:string"/>
+				</xs:simpleType>
+				<xs:attribute fixed="string" name="datatype" type="cyboxCommon:DatatypeEnum">
+					<xs:annotation>
+						<xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+			</xs:restriction>
+		</xs:simpleContent>
+	</xs:complexType>
+	<xs:simpleType name="MemoryPageProtectionEnum">
+		<xs:annotation>
+			<xs:documentation>The MemoryPageProtectionEnum defines an enumeration of memory page protection constants. As a further reference, please see: http://msdn.microsoft.com/en-us/library/windows/desktop/aa366786(v=vs.85).aspx.</xs:documentation>
+		</xs:annotation>
+		<xs:restriction base="xs:string">
+			<xs:enumeration value="PAGE_EXECUTE">
+				<xs:annotation>
+					<xs:documentation>From Microsoft: "Enables execute access to the committed region of pages. An attempt to read from or write to the committed region results in an access violation.".</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PAGE_EXECUTE_READ">
+				<xs:annotation>
+					<xs:documentation>From Microsoft: "Enables execute or read-only access to the committed region of pages. An attempt to write to the committed region results in an access violation.".</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PAGE_EXECUTE_READWRITE">
+				<xs:annotation>
+					<xs:documentation>From Microsoft: "Enables execute, read-only, or read/write access to the committed region of pages.".</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PAGE_EXECUTE_WRITECOPY">
+				<xs:annotation>
+					<xs:documentation>From Microsoft: "Enables execute, read-only, or copy-on-write access to a mapped view of a file mapping object. An attempt to write to a committed copy-on-write page results in a private copy of the page being made for the process. The private page is marked as PAGE_EXECUTE_READWRITE, and the change is written to the new page.".</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PAGE_NOACCESS">
+				<xs:annotation>
+					<xs:documentation>From Microsoft: "Disables all access to the committed region of pages. An attempt to read from, write to, or execute the committed region results in an access violation.".</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PAGE_READONLY">
+				<xs:annotation>
+					<xs:documentation>From Microsoft: "Enables read-only access to the committed region of pages. An attempt to write to the committed region results in an access violation. If Data Execution Prevention is enabled, an attempt to execute code in the committed region results in an access violation.".</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PAGE_READWRITE">
+				<xs:annotation>
+					<xs:documentation>From Microsoft: "Enables read-only or read/write access to the committed region of pages. If Data Execution Prevention is enabled, attempting to execute code in the committed region results in an access violation.".</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="PAGE_WRITECOPY">
+				<xs:annotation>
+					<xs:documentation>From Microsoft: "Enables read-only or copy-on-write access to a mapped view of a file mapping object. An attempt to write to a committed copy-on-write page results in a private copy of the page being made for the process. The private page is marked as PAGE_READWRITE, and the change is written to the new page. If Data Execution Prevention is enabled, attempting to execute code in the committed region results in an access violation.".</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+		</xs:restriction>
+	</xs:simpleType>
+	<xs:complexType name="MemoryPageStateType">
+		<xs:annotation>
+			<xs:documentation>MemoryPageStateType specifies memory protection states, via a union of the MemoryPageStateEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation>
+		</xs:annotation>
+		<xs:simpleContent>
+			<xs:restriction base="cyboxCommon:BaseObjectPropertyType">
+				<xs:simpleType>
+					<xs:union memberTypes="WinMemoryPageRegionObj:MemoryPageStateEnum xs:string"/>
+				</xs:simpleType>
+				<xs:attribute fixed="string" name="datatype" type="cyboxCommon:DatatypeEnum">
+					<xs:annotation>
+						<xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+			</xs:restriction>
+		</xs:simpleContent>
+	</xs:complexType>
+	<xs:simpleType name="MemoryPageStateEnum">
+		<xs:annotation>
+			<xs:documentation>The MemoryPageStateEnum defines an enumeration of memory page states. As a further reference, please see: http://msdn.microsoft.com/en-us/library/windows/desktop/aa366775(v=vs.85).aspx.</xs:documentation>
+		</xs:annotation>
+		<xs:restriction base="xs:string">
+			<xs:enumeration value="MEM_COMMIT">
+				<xs:annotation>
+					<xs:documentation>From Microsoft: "Indicates committed pages for which physical storage has been allocated, either in memory or in the paging file on disk.".</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MEM_FREE">
+				<xs:annotation>
+					<xs:documentation>From Microsoft: "Indicates free pages not accessible to the calling process and available to be allocated. For free pages, the information in the AllocationBase, AllocationProtect, Protect, and Type members is undefined.".</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MEM_RESERVE">
+				<xs:annotation>
+					<xs:documentation>From Microsoft: "Indicates reserved pages where a range of the process's virtual address space is reserved without any physical storage being allocated. For reserved pages, the information in the Protect member is undefined.".</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+		</xs:restriction>
+	</xs:simpleType>
+	<xs:complexType name="MemoryPageTypeType">
+		<xs:annotation>
+			<xs:documentation>MemoryPageTypeType specifies memory protection type, via a union of the MemoryPageTypeEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation>
+		</xs:annotation>
+		<xs:simpleContent>
+			<xs:restriction base="cyboxCommon:BaseObjectPropertyType">
+				<xs:simpleType>
+					<xs:union memberTypes="WinMemoryPageRegionObj:MemoryPageTypeEnum xs:string"/>
+				</xs:simpleType>
+				<xs:attribute fixed="string" name="datatype" type="cyboxCommon:DatatypeEnum">
+					<xs:annotation>
+						<xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+			</xs:restriction>
+		</xs:simpleContent>
+	</xs:complexType>
+	<xs:simpleType name="MemoryPageTypeEnum">
+		<xs:annotation>
+			<xs:documentation>The MemoryPageTypeEnum defines an enumeration of memory page types. As a further reference, please see: http://msdn.microsoft.com/en-us/library/windows/desktop/aa366775(v=vs.85).aspx.</xs:documentation>
+		</xs:annotation>
+		<xs:restriction base="xs:string">
+			<xs:enumeration value="MEM_IMAGE">
+				<xs:annotation>
+					<xs:documentation>From Microsoft: "Indicates that the memory pages within the region are mapped into the view of an image section.".</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MEM_MAPPED">
+				<xs:annotation>
+					<xs:documentation>From Microsoft: "Indicates that the memory pages within the region are mapped into the view of a section.".</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MEM_PRIVATE">
+				<xs:annotation>
+					<xs:documentation>From Microsoft: "Indicates that the memory pages within the region are private (that is, not shared by other processes).".</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+		</xs:restriction>
+	</xs:simpleType>
+</xs:schema>

data/config/1.2/stix/cybox/objects/Win_Mutex_Object.xsd

@@ -0,0 +1,42 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:WinMutexObj="http://cybox.mitre.org/objects#WinMutexObject-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" xmlns:WinHandleObj="http://cybox.mitre.org/objects#WinHandleObject-2" xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2" targetNamespace="http://cybox.mitre.org/objects#WinMutexObject-2" elementFormDefault="qualified" attributeFormDefault="unqualified" version="2.1">
+	<xs:annotation>
+		<xs:documentation>This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org.</xs:documentation>
+		<xs:appinfo>
+			<schema>Win_Mutex_Object</schema>
+			<version>2.1</version>
+			<date>01/22/2014</date>			
+			<short_description>The following specifies the fields and types that compose this defined CybOX Object type. Each defined object is an extension of the abstract ObjectPropertiesType, defined in CybOX Common. For more information on this extension mechanism, please see the CybOX Specification. This document is intended for developers and assumes some familiarity with XML. </short_description>
+			<terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the CybOX License located at http://cybox.mitre.org/about/termsofuse.html. See the CybOX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the CybOX Schema, this license header must be included.</terms_of_use>
+		</xs:appinfo>
+	</xs:annotation>
+	<xs:import namespace="http://cybox.mitre.org/common-2" schemaLocation="../cybox_common.xsd"/>
+	<xs:import namespace="http://cybox.mitre.org/objects#WinHandleObject-2" schemaLocation="Win_Handle_Object.xsd"/>
+	<xs:import namespace="http://cybox.mitre.org/objects#MutexObject-2" schemaLocation="Mutex_Object.xsd"/>
+	<xs:element name="Windows_Mutex" type="WinMutexObj:WindowsMutexObjectType">
+		<xs:annotation>
+			<xs:documentation>The Windows_Mutex object is intended to characterize Windows mutual exclusion (mutex) objects.</xs:documentation>
+		</xs:annotation>
+	</xs:element>
+	<xs:complexType name="WindowsMutexObjectType" mixed="false">
+		<xs:annotation>
+			<xs:documentation>The WindowsMutexObjectType type is intended to characterize Windows mutual exclusion (mutex) objects.</xs:documentation>
+		</xs:annotation>
+		<xs:complexContent mixed="false">
+			<xs:extension base="MutexObj:MutexObjectType">
+				<xs:sequence>
+					<xs:element name="Handle" minOccurs="0" type="WinHandleObj:WindowsHandleObjectType">
+						<xs:annotation>
+							<xs:documentation>The Handle field specifies the open Windows handle to the mutex. It imports and uses the WindowsHandleObjectType from the CybOX Windows Handle Object.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element minOccurs="0" name="Security_Attributes" type="cyboxCommon:StringObjectPropertyType">
+						<xs:annotation>
+							<xs:documentation>The Security_Attributes field specifies the Windows security attributes for the mutex.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+				</xs:sequence>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+</xs:schema>

data/config/1.2/stix/cybox/objects/Win_Network_Route_Entry_Object.xsd

@@ -0,0 +1,200 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:NetworkRouteEntryObj="http://cybox.mitre.org/objects#NetworkRouteEntryObject-2" xmlns:WinNetworkRouteEntryObj="http://cybox.mitre.org/objects#WinNetworkRouteEntryObject-2" xmlns:cyboxCommon="http://cybox.mitre.org/common-2" targetNamespace="http://cybox.mitre.org/objects#WinNetworkRouteEntryObject-2" elementFormDefault="qualified" attributeFormDefault="unqualified" version="2.1">
+	<xs:annotation>
+		<xs:documentation>This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org.</xs:documentation>
+		<xs:appinfo>
+			<schema>Win_Network_Route_Entry_Object</schema>
+			<version>2.1</version>
+			<date>01/22/2014</date>			
+			<short_description>The following specifies the fields and types that compose this defined CybOX Object type. Each defined object is an extension of the abstract ObjectPropertiesType, defined in CybOX Common. For more information on this extension mechanism, please see the CybOX Specification. This document is intended for developers and assumes some familiarity with XML. </short_description>
+			<terms_of_use>Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the CybOX License located at http://cybox.mitre.org/about/termsofuse.html. See the CybOX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the CybOX Schema, this license header must be included.</terms_of_use>
+		</xs:appinfo>
+	</xs:annotation>
+	<xs:import namespace="http://cybox.mitre.org/common-2" schemaLocation="../cybox_common.xsd"/>
+	<xs:import namespace="http://cybox.mitre.org/objects#NetworkRouteEntryObject-2" schemaLocation="Network_Route_Entry_Object.xsd"/>
+	<xs:import namespace="http://cybox.mitre.org/objects#AddressObject-2" schemaLocation="Address_Object.xsd"/>
+	<xs:element name="Windows_Network_Route_Entry" type="WinNetworkRouteEntryObj:WindowsNetworkRouteEntryObjectType">
+		<xs:annotation>
+			<xs:documentation>he Windows_Network_Route_Entry object is intended to characterize Windows network routing table entries.</xs:documentation>
+		</xs:annotation>
+	</xs:element>
+	<xs:complexType name="WindowsNetworkRouteEntryObjectType" mixed="false">
+		<xs:annotation>
+			<xs:documentation>The WindowsNetworkRouteEntryObjectType type is intended to characterize Windows network routing table entries.</xs:documentation>
+		</xs:annotation>
+		<xs:complexContent>
+			<xs:extension base="NetworkRouteEntryObj:NetworkRouteEntryObjectType">
+				<xs:sequence>
+					<xs:element minOccurs="0" name="NL_ROUTE_PROTOCOL" type="WinNetworkRouteEntryObj:NLRouteProtocolType">
+						<xs:annotation>
+							<xs:documentation>The NL_ROUTE_PROTOCOL element captures the routing protocol specified for the network route, as detailed in the NL_ROUTE_PROTOCOL enumeration. For more information please see: http://msdn.microsoft.com/en-us/library/windows/desktop/aa814494(v=vs.85).aspx.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+					<xs:element name="NL_ROUTE_ORIGIN" type="WinNetworkRouteEntryObj:NLRouteOriginType" minOccurs="0">
+						<xs:annotation>
+							<xs:documentation>The NL_ROUTE_ORIGIN element specifies a network route origination point, as detailed in the NL_ROUTE_ORIGIN enumeration in the MIB_IPFORWARD_ROW2 structure. For more information, see http://msdn.microsoft.com/en-us/library/windows/desktop/aa814494(v=vs.85).aspx for the MIB_IPFORWARD_ROW2 structure and http://msdn.microsoft.com/en-us/library/windows/hardware/ff568764(v=vs.85).aspx for the NL_ROUTE_ORIGIN enumeration.</xs:documentation>
+						</xs:annotation>
+					</xs:element>
+				</xs:sequence>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:complexType name="NLRouteOriginType">
+		<xs:annotation>
+			<xs:documentation>NLRouteOriginType specifies Windows-centric network route origination values via a union of the RouteOriginEnum type and the atomic xs:string type. Its base type is the CybOX BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation>
+		</xs:annotation>
+		<xs:simpleContent>
+			<xs:restriction base="cyboxCommon:BaseObjectPropertyType">
+				<xs:simpleType>
+					<xs:union memberTypes="WinNetworkRouteEntryObj:NLRouteOriginEnum xs:string"/>
+				</xs:simpleType>
+				<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" fixed="string">
+					<xs:annotation>
+						<xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+			</xs:restriction>
+		</xs:simpleContent>
+	</xs:complexType>
+	<xs:simpleType name="NLRouteOriginEnum">
+		<xs:annotation>
+			<xs:documentation>The NLRouteOriginEnum type is a enumeration of network route origination points, as detailed in the NL_ROUTE_ORIGIN enumeration in the MIB_IPFORWARD_ROW2 structure. For more information, see http://msdn.microsoft.com/en-us/library/windows/desktop/aa814494(v=vs.85).aspx for the MIB_IPFORWARD_ROW2 structure and http://msdn.microsoft.com/en-us/library/windows/hardware/ff568764(v=vs.85).aspx for the NL_ROUTE_ORIGIN enumeration.</xs:documentation>
+		</xs:annotation>
+		<xs:restriction base="xs:string">
+			<xs:enumeration value="NlroManual">
+				<xs:annotation>
+					<xs:documentation>Specifies that the origin was determined as a result of manual configuration.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="NlroWellKnown">
+				<xs:annotation>
+					<xs:documentation>Specifies that the route is well-known.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="NlroDHCP">
+				<xs:annotation>
+					<xs:documentation>Specifies that the origin was determined as a result of DHCP configuration.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="NlroRouterAdvertisement">
+				<xs:annotation>
+					<xs:documentation>Specifies that the origin was determined as a result of router advertisement.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="Nlro6to4">
+				<xs:annotation>
+					<xs:documentation>Specifies that the origin was determined as a result of 6to4 tunneling.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+		</xs:restriction>
+	</xs:simpleType>
+	<xs:complexType name="NLRouteProtocolType">
+		<xs:annotation>
+			<xs:documentation>NLRouteProtocolType specifies Windows-centric network routing protocol values via a union of the NLRouteProtocolEnum type and the atomic xs:string type. Its base type is the CybOX BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation>
+		</xs:annotation>
+		<xs:simpleContent>
+			<xs:restriction base="cyboxCommon:BaseObjectPropertyType">
+				<xs:simpleType>
+					<xs:union memberTypes="WinNetworkRouteEntryObj:NLRouteProtocolEnum xs:string"/>
+				</xs:simpleType>
+				<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" fixed="string">
+					<xs:annotation>
+						<xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
+					</xs:annotation>
+				</xs:attribute>
+			</xs:restriction>
+		</xs:simpleContent>
+	</xs:complexType>
+	<xs:simpleType name="NLRouteProtocolEnum">
+		<xs:annotation>
+			<xs:documentation>The NLRouteProtocolEnum type is a enumeration of network routing protocols, as detailed in the NL_ROUTE_PROTOCOL enumeration in the MIB_IPFORWARD_ROW2 structure. For more information, see http://msdn.microsoft.com/en-us/library/windows/desktop/aa814494(v=vs.85).aspx for the MIB_IPFORWARD_ROW2 structure.</xs:documentation>
+		</xs:annotation>
+		<xs:restriction base="xs:string">
+			<xs:enumeration value="MIB_IPPROTO_OTHER">
+				<xs:annotation>
+					<xs:documentation>Specifies that the routing mechanism was not specified.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MIB_IPPROTO_LOCAL">
+				<xs:annotation>
+					<xs:documentation>Specifies a local interface.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MIB_IPPROTO_NETMGMT">
+				<xs:annotation>
+					<xs:documentation>Specifies a static route. This value is used to identify route information for IP routing set through network management such as the Dynamic Host Configuration Protocol (DCHP), the Simple Network Management Protocol (SNMP), or by calls to the CreateIpForwardEntry2, DeleteIpForwardEntry2, or SetIpForwardEntry2 functions.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MIB_IPPROTO_ICMP">
+				<xs:annotation>
+					<xs:documentation>Specifies the result of an ICMP redirect.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MIB_IPPROTO_EGP">
+				<xs:annotation>
+					<xs:documentation>Specifies the Exterior Gateway Protocol (EGP), a dynamic routing protocol.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MIB_IPPROTO_GGP">
+				<xs:annotation>
+					<xs:documentation>Specifies the Gateway-to-Gateway Protocol (GGP), a dynamic routing protocol.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MIB_IPPROTO_HELLO">
+				<xs:annotation>
+					<xs:documentation>Specifies the hellospeak protocol, a dynamic routing protocol. This is a historical entry no longer in use and was an early routing protocol used by the original ARPANET routers that ran special software called the Fuzzball routing protocol, sometimes called Hellospeak, as described in RFC 891 and RFC 1305. For more information, see http://www.ietf.org/rfc/rfc891.txt and http://www.ietf.org/rfc/rfc1305.txt.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MIB_IPPROTO_RIP">
+				<xs:annotation>
+					<xs:documentation>Specifies the Berkeley Routing Information Protocol (RIP) or RIP-II, a dynamic routing protocol.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MIB_IPPROTO_IS_IS">
+				<xs:annotation>
+					<xs:documentation>Specifies the Intermediate System-to-Intermediate System (IS-IS) protocol, a dynamic routing protocol. The IS-IS protocol was developed for use in the Open Systems Interconnection (OSI) protocol suite.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MIB_IPPROTO_ES_IS">
+				<xs:annotation>
+					<xs:documentation>Specifies the End System-to-Intermediate System (ES-IS) protocol, a dynamic routing protocol. The ES-IS protocol was developed for use in the Open Systems Interconnection (OSI) protocol suite.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MIB_IPPROTO_CISCO">
+				<xs:annotation>
+					<xs:documentation>Specifies the Cisco Interior Gateway Routing Protocol (IGRP), a dynamic routing protocol.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MIB_IPPROTO_BBN">
+				<xs:annotation>
+					<xs:documentation>Specifies the Bolt, Beranek, and Newman (BBN) Interior Gateway Protocol (IGP) that used the Shortest Path First (SPF) algorithm. This was an early dynamic routing protocol.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MIB_IPPROTO_OSPF">
+				<xs:annotation>
+					<xs:documentation>Specifies the Open Shortest Path First (OSPF) protocol, a dynamic routing protocol.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MIB_IPPROTO_BGP">
+				<xs:annotation>
+					<xs:documentation>Specifies the Border Gateway Protocol (BGP), a dynamic routing protocol.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MIB_IPPROTO_NT_AUTOSTATIC">
+				<xs:annotation>
+					<xs:documentation>Specifies a Windows specific entry added originally by a routing protocol, but which is now static.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MIB_IPPROTO_NT_STATIC">
+				<xs:annotation>
+					<xs:documentation>Specifies a Windows specific entry added as a static route from the routing user interface or a routing command.</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+			<xs:enumeration value="MIB_IPPROTO_NT_STATIC_NON_DOD">
+				<xs:annotation>
+					<xs:documentation>Specifies a Windows specific entry added as an static route from the routing user interface or a routing command, except these routes do not cause Dial On Demand (DOD).</xs:documentation>
+				</xs:annotation>
+			</xs:enumeration>
+		</xs:restriction>
+	</xs:simpleType>
+</xs:schema>