Package lib :: Package maec :: Module maec40
[hide private]
[frames] | no frames]

Source Code for Module lib.maec.maec40

   1  # Copyright (c) 2013, The MITRE Corporation 
   2  # Copyright (c) 2010-2014, Cuckoo Developers 
   3  # All rights reserved. 
   4   
   5  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
   6  # See the file "docs/LICENSE" for copying permission. 
   7   
   8  from modules.processing.behavior import fix_key 
   9   
  10  api_call_mappings = { 
  11  "NtCreateFile" : {"action_name" : "create file", 
  12                            "action_vocab" : "maecVocabs:FileActionNameVocab-1.0", 
  13                            "parameter_associated_objects" : {"FileHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
  14                                                                                                      "associated_object_element" : "ID", 
  15                                                                                                        "association_type" : "output", 
  16                                                                                                        "forced" : {"associated_object_element" : "Type",  
  17                                                                                                                    "value" : "File"}}, 
  18                                                                                "FileName" : {"associated_object_type" : "FileObjectType", 
  19                                                                                                  "associated_object_element" : "File_Path", 
  20                                                                                                  "association_type" : "output"}}}, 
  21  "NtOpenFile" : {"action_name" : "open file", 
  22                  "action_vocab" : "maecVocabs:FileActionNameVocab-1.0", 
  23                  "parameter_associated_objects" : {"FileHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
  24                                                                    "associated_object_element" : "ID", 
  25                                                                    "association_type" : "output", 
  26                                                                    "forced" : {"associated_object_element" : "Type",  
  27                                                                                "value" : "File"}}, 
  28                                                    "FileName" : {"associated_object_type" : "FileObjectType", 
  29                                                                  "associated_object_element" : "File_Path", 
  30                                                                  "association_type" : "input"}}}, 
  31  "NtReadFile" : {"action_name" : "read from file", 
  32                  "action_vocab" : "maecVocabs:FileActionNameVocab-1.0", 
  33                  "parameter_associated_objects" : {"FileHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
  34                                                                    "associated_object_element" : "ID", 
  35                                                                    "association_type" : "input", 
  36                                                                    "forced" : {"associated_object_element" : "Type",  
  37                                                                                "value" : "File"}}}}, 
  38  "NtWriteFile" : {"action_name" : "write to file", 
  39                   "action_vocab" : "maecVocabs:FileActionNameVocab-1.0", 
  40                   "parameter_associated_objects" : {"FileHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
  41                                                                     "associated_object_element" : "ID", 
  42                                                                     "association_type" : "input", 
  43                                                                      "forced" : {"associated_object_element" : "Type",  
  44                                                                                  "value" : "File"}}}}, 
  45  "NtDeleteFile" : {"action_name" : "delete file", 
  46                    "action_vocab" : "maecVocabs:FileActionNameVocab-1.0", 
  47                    "parameter_associated_objects" : {"FileName" : {"associated_object_type" : "FileObjectType", 
  48                                                                    "associated_object_element" : "File_Path", 
  49                                                                    "association_type" : "input"}}}, 
  50  "NtDeviceIoControlFile" : {"action_name" : "send control code to file", 
  51                             "action_vocab" : "maecVocabs:FileActionNameVocab-1.0", 
  52                             "parameter_associated_objects" : {"FileHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
  53                                                                               "associated_object_element" : "ID", 
  54                                                                               "association_type" : "input", 
  55                                                                               "forced" : {"associated_object_element" : "Type",  
  56                                                                                           "value" : "File"}}}}, 
  57  "NtQueryDirectoryFile" : {"action_name" : "find file", 
  58                            "action_vocab" : "maecVocabs:FileActionNameVocab-1.0", 
  59                            "parameter_associated_objects" : {"FileHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
  60                                                                              "associated_object_element" : "ID", 
  61                                                                              "association_type" : "input", 
  62                                                                              "forced" : {"associated_object_element" : "Type",  
  63                                                                                          "value" : "File"}}, 
  64                                                              "FileName" : {"associated_object_type" : "FileObjectType", 
  65                                                                            "associated_object_element" : "File_Path", 
  66                                                                            "association_type" : "input"}}}, 
  67  "NtQueryInformationFile" : {"action_name" : "get file attributes", 
  68                              "action_vocab" : "maecVocabs:FileActionNameVocab-1.0", 
  69                              "parameter_associated_objects" : {"FileHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
  70                                                                                "associated_object_element" : "ID", 
  71                                                                                "association_type" : "input", 
  72                                                                                "forced" : {"associated_object_element" : "Type",  
  73                                                                                             "value" : "File"}}}}, 
  74  "NtSetInformationFile" : {"action_name" : "set file attributes", 
  75                            "action_vocab" : "maecVocabs:FileActionNameVocab-1.0", 
  76                            "parameter_associated_objects" : {"FileHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
  77                                                                              "associated_object_element" : "ID", 
  78                                                                              "association_type" : "input", 
  79                                                                              "forced" : {"associated_object_element" : "Type",  
  80                                                                                          "value" : "File"}}}}, 
  81  "NtCreateDirectoryObject" : {"action_name" : "create directory", 
  82                               "action_vocab" : "maecVocabs:DirectoryActionNameVocab-1.0", 
  83                               "parameter_associated_objects" : {"DirectoryHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
  84                                                                                      "associated_object_element" : "ID", 
  85                                                                                      "association_type" : "output", 
  86                                                                                      "forced" : {"associated_object_element" : "Type",  
  87                                                                                      "value" : "File"}}}}, 
  88  "CreateDirectoryW" : {"action_name" : "create directory", 
  89                        "action_vocab" : "maecVocabs:DirectoryActionNameVocab-1.0", 
  90                        "parameter_associated_objects" : {"DirectoryName" : {"associated_object_type" : "FileObjectType", 
  91                                                                             "associated_object_element" : "File_Path", 
  92                                                                             "association_type" : "output"}}}, 
  93  "CreateDirectoryExW" : {"action_name" : "create directory", 
  94                          "action_vocab" : "maecVocabs:DirectoryActionNameVocab-1.0", 
  95                          "parameter_associated_objects" : {"DirectoryName" : {"associated_object_type" : "FileObjectType", 
  96                                                                               "associated_object_element" : "File_Path", 
  97                                                                               "association_type" : "output"}}}, 
  98  "RemoveDirectoryA" : {"action_name" : "delete directory", 
  99                        "action_vocab" : "maecVocabs:DirectoryActionNameVocab-1.0", 
 100                        "parameter_associated_objects" : {"DirectoryName" : {"associated_object_type" : "FileObjectType", 
 101                                                                             "associated_object_element" : "File_Path", 
 102                                                                             "association_type" : "input"}}}, 
 103  "RemoveDirectoryW" : {"action_name" : "delete directory", 
 104                        "action_vocab" : "maecVocabs:DirectoryActionNameVocab-1.0", 
 105                        "parameter_associated_objects" : {"DirectoryName" : {"associated_object_type" : "FileObjectType", 
 106                                                                             "associated_object_element" : "File_Path", 
 107                                                                             "association_type" : "input"}}}, 
 108  "MoveFileWithProgressW" : {"action_name" : "move file", 
 109                             "action_vocab" : "maecVocabs:FileActionNameVocab-1.0", 
 110                             "parameter_associated_objects" : {"ExistingFileName" : {"associated_object_type" : "FileObjectType", 
 111                                                                                     "associated_object_element" : "File_Path", 
 112                                                                                     "association_type" : "input"}, 
 113                                                               "NewFileName" : {"associated_object_type" : "FileObjectType", 
 114                                                                                "associated_object_element" : "File_Path", 
 115                                                                                "association_type" : "output"}}}, 
 116  "FindFirstFileExA" : {"action_name" : "find file", 
 117                        "action_vocab" : "maecVocabs:FileActionNameVocab-1.0", 
 118                        "parameter_associated_objects" : {"FileName" : {"associated_object_type" : "FileObjectType", 
 119                                                                        "associated_object_element" : "File_Path", 
 120                                                                        "association_type" : "input"}}}, 
 121  "FindFirstFileExW" : {"action_name" : "find file", 
 122                        "action_vocab" : "maecVocabs:FileActionNameVocab-1.0", 
 123                        "parameter_associated_objects" : {"FileName" : {"associated_object_type" : "FileObjectType", 
 124                                                                        "associated_object_element" : "File_Path", 
 125                                                                        "association_type" : "input"}}}, 
 126  "CopyFileA" : {"action_name" : "copy file", 
 127                 "action_vocab" : "maecVocabs:FileActionNameVocab-1.0", 
 128                 "parameter_associated_objects" : {"ExistingFileName" : {"associated_object_type" : "FileObjectType", 
 129                                                                         "associated_object_element" : "File_Path", 
 130                                                                         "association_type" : "input"}, 
 131                                                   "NewFileName" : {"associated_object_type" : "FileObjectType", 
 132                                                                    "associated_object_element" : "File_Path", 
 133                                                                    "association_type" : "output"}}}, 
 134  "CopyFileW" : {"action_name" : "copy file", 
 135                 "action_vocab" : "maecVocabs:FileActionNameVocab-1.0", 
 136                 "parameter_associated_objects" : {"ExistingFileName" : {"associated_object_type" : "FileObjectType", 
 137                                                                         "associated_object_element" : "File_Path", 
 138                                                                         "association_type" : "input"}, 
 139                                                   "NewFileName" : {"associated_object_type" : "FileObjectType", 
 140                                                                    "associated_object_element" : "File_Path", 
 141                                                                    "association_type" : "output"}}}, 
 142  "CopyFileExW" : {"action_name" : "copy file", 
 143                   "action_vocab" : "maecVocabs:FileActionNameVocab-1.0", 
 144                   "parameter_associated_objects" : {"ExistingFileName" : {"associated_object_type" : "FileObjectType", 
 145                                                                           "associated_object_element" : "File_Path", 
 146                                                                           "association_type" : "input"}, 
 147                                                     "NewFileName" : {"associated_object_type" : "FileObjectType", 
 148                                                                      "associated_object_element" : "File_Path", 
 149                                                                      "association_type" : "output"}}}, 
 150  "DeleteFileA" : {"action_name" : "delete file", 
 151                   "action_vocab" : "maecVocabs:FileActionNameVocab-1.0", 
 152                   "parameter_associated_objects" : {"FileName" : {"associated_object_type" : "FileObjectType", 
 153                                                                   "associated_object_element" : "File_Path", 
 154                                                                   "association_type" : "input"}}}, 
 155  "DeleteFileW" : {"action_name" : "delete file", 
 156                   "action_vocab" : "maecVocabs:FileActionNameVocab-1.0", 
 157                   "parameter_associated_objects" : {"FileName" : {"associated_object_type" : "FileObjectType", 
 158                                                                   "associated_object_element" : "File_Path", 
 159                                                                   "association_type" : "input"}}}, 
 160  "RegOpenKeyExA" : {"action_name" : "open registry key", 
 161                     "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 162                     "parameter_associated_objects" : {"Registry" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 163                                                                     "associated_object_element" : "Hive", 
 164                                                                     "association_type" : "input", 
 165                                                                     "post_processing" : "hiveHexToString"}, 
 166                                                       "SubKey" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 167                                                                   "associated_object_element" : "Key", 
 168                                                                   "association_type" : "input",}, 
 169                                                       "Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
 170                                                                    "associated_object_element" : "ID", 
 171                                                                    "association_type" : "output", 
 172                                                                    "forced" : {"associated_object_element" : "Type",  
 173                                                                                "value" : "RegistryKey"}}, 
 174                                                       "group_together" : ["Registry", "SubKey"]}}, 
 175  "RegOpenKeyExW" : {"action_name" : "open registry key", 
 176                     "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 177                     "parameter_associated_objects" : {"Registry" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 178                                                                     "associated_object_element" : "Hive", 
 179                                                                     "association_type" : "input", 
 180                                                                     "post_processing" : "hiveHexToString"}, 
 181                                                       "SubKey" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 182                                                                   "associated_object_element" : "Key", 
 183                                                                   "association_type" : "input",}, 
 184                                                       "Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
 185                                                                    "associated_object_element" : "ID", 
 186                                                                    "association_type" : "output", 
 187                                                                    "forced" : {"associated_object_element" : "Type",  
 188                                                                                "value" : "RegistryKey"}}, 
 189                                                       "group_together" : ["Registry", "SubKey"]}}, 
 190  "RegCreateKeyExA" : {"action_name" : "create registry key", 
 191                       "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 192                       "parameter_associated_objects" : {"Registry" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 193                                                                     "associated_object_element" : "Hive", 
 194                                                                     "association_type" : "output", 
 195                                                                     "post_processing" : "hiveHexToString"}, 
 196                                                       "SubKey" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 197                                                                   "associated_object_element" : "Key", 
 198                                                                   "association_type" : "output"}, 
 199                                                       "Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
 200                                                                    "associated_object_element" : "ID", 
 201                                                                    "association_type" : "output", 
 202                                                                    "forced" : {"associated_object_element" : "Type",  
 203                                                                                "value" : "RegistryKey"}}, 
 204                                                       "group_together" : ["Registry", "SubKey"]}}, 
 205  "RegCreateKeyExW" : {"action_name" : "create registry key", 
 206                       "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 207                       "parameter_associated_objects" : {"Registry" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 208                                                                     "associated_object_element" : "Hive", 
 209                                                                     "association_type" : "output", 
 210                                                                     "post_processing" : "hiveHexToString"}, 
 211                                                       "SubKey" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 212                                                                   "associated_object_element" : "Key", 
 213                                                                   "association_type" : "output"}, 
 214                                                       "Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
 215                                                                    "associated_object_element" : "ID", 
 216                                                                    "association_type" : "output", 
 217                                                                    "forced" : {"associated_object_element" : "Type",  
 218                                                                                "value" : "RegistryKey"}}, 
 219                                                       "group_together" : ["Registry", "SubKey"]}}, 
 220  "RegDeleteKeyA" : {"action_name" : "delete registry key", 
 221                     "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 222                     "parameter_associated_objects" : {"SubKey" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 223                                                                   "associated_object_element" : "Key", 
 224                                                                   "association_type" : "input"}, 
 225                                                       "Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
 226                                                                    "associated_object_element" : "ID", 
 227                                                                    "association_type" : "input", 
 228                                                                    "forced" : {"associated_object_element" : "Type",  
 229                                                                                "value" : "RegistryKey"}}}}, 
 230  "RegDeleteKeyW" : {"action_name" : "delete registry key", 
 231                     "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 232                     "parameter_associated_objects" : {"SubKey" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 233                                                                   "associated_object_element" : "Key", 
 234                                                                   "association_type" : "input"}, 
 235                                                       "Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
 236                                                                    "associated_object_element" : "ID", 
 237                                                                    "association_type" : "input", 
 238                                                                    "forced" : {"associated_object_element" : "Type",  
 239                                                                                "value" : "RegistryKey"}}}}, 
 240  "RegEnumKeyW" : {"action_name" : "enumerate registry key subkeys", 
 241                   "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 242                   "parameter_associated_objects" : {"Name" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 243                                                              "associated_object_element" : "Key", 
 244                                                              "association_type" : "output"}, 
 245                                                    "Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
 246                                                                "associated_object_element" : "ID", 
 247                                                                "association_type" : "input", 
 248                                                                "forced" : {"associated_object_element" : "Type",  
 249                                                                                "value" : "RegistryKey"}}}}, 
 250  "RegEnumKeyExA" : {"action_name" : "enumerate registry key subkeys", 
 251                     "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 252                     "parameter_associated_objects" : {"Name" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 253                                                                "associated_object_element" : "Key", 
 254                                                                "association_type" : "output"}, 
 255                                                      "Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
 256                                                                  "associated_object_element" : "ID", 
 257                                                                  "association_type" : "input", 
 258                                                                  "forced" : {"associated_object_element" : "Type",  
 259                                                                                "value" : "RegistryKey"}}}}, 
 260  "RegEnumKeyExW" : {"action_name" : "enumerate registry key subkeys", 
 261                     "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 262                     "parameter_associated_objects" : {"Name" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 263                                                                "associated_object_element" : "Key", 
 264                                                                "association_type" : "output"}, 
 265                                                      "Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
 266                                                                  "associated_object_element" : "ID", 
 267                                                                  "association_type" : "input", 
 268                                                                  "forced" : {"associated_object_element" : "Type",  
 269                                                                                "value" : "RegistryKey"}}}}, 
 270  "RegEnumValueA" : {"action_name" : "enumerate registry key values", 
 271                     "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 272                     "parameter_associated_objects" : {"Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
 273                                                                  "associated_object_element" : "ID", 
 274                                                                  "association_type" : "input", 
 275                                                                  "forced" : {"associated_object_element" : "Type",  
 276                                                                                "value" : "RegistryKey"}}, 
 277                                                      "group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "ValueName", "element_name" : "Name"}, 
 278                                                                                                         {"parameter_name" : "Type", "element_name" : "Datatype", 
 279                                                                                                          "post_processing":"regDatatypeToString"}, 
 280                                                                                                         {"parameter_name" : "Data", "element_name" : "Data"}], 
 281                                                                                     "associated_object_type" : "WindowsRegistryKeyObjectType", 
 282                                                                                     "associated_object_element" : "Values/list__", 
 283                                                                                     "association_type" : "output"}}}, 
 284  "RegEnumValueW" : {"action_name" : "enumerate registry key values", 
 285                     "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 286                     "parameter_associated_objects" : {"Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
 287                                                                  "associated_object_element" : "ID", 
 288                                                                  "association_type" : "input", 
 289                                                                  "forced" : {"associated_object_element" : "Type",  
 290                                                                                "value" : "RegistryKey"}}, 
 291                                                      "group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "ValueName", "element_name" : "Name"}, 
 292                                                                                                         {"parameter_name" : "Type", "element_name" : "Datatype", 
 293                                                                                                          "post_processing":"regDatatypeToString"}, 
 294                                                                                                         {"parameter_name" : "Data", "element_name" : "Data"}], 
 295                                                                                     "associated_object_type" : "WindowsRegistryKeyObjectType", 
 296                                                                                     "associated_object_element" : "Values/list__", 
 297                                                                                     "association_type" : "output"}}}, 
 298  "RegSetValueExA" : {"action_name" : "modify registry key value", 
 299                     "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 300                     "parameter_associated_objects" : {"Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
 301                                                                  "associated_object_element" : "ID", 
 302                                                                  "association_type" : "input", 
 303                                                                  "forced" : {"associated_object_element" : "Type",  
 304                                                                                "value" : "RegistryKey"}}, 
 305                                                      "group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "ValueName", "element_name" : "Name"}, 
 306                                                                                                         {"parameter_name" : "Type", "element_name" : "Datatype", 
 307                                                                                                          "post_processing":"regDatatypeToString"}, 
 308                                                                                                         {"parameter_name" : "Buffer", "element_name" : "Data"}], 
 309                                                                                     "associated_object_type" : "WindowsRegistryKeyObjectType", 
 310                                                                                     "associated_object_element" : "Values/list__", 
 311                                                                                     "association_type" : "output"}}}, 
 312  "RegSetValueExW" : {"action_name" : "modify registry key value", 
 313                     "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 314                     "parameter_associated_objects" : {"Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
 315                                                                  "associated_object_element" : "ID", 
 316                                                                  "association_type" : "input", 
 317                                                                  "forced" : {"associated_object_element" : "Type",  
 318                                                                                "value" : "RegistryKey"}}, 
 319                                                      "group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "ValueName", "element_name" : "Name"}, 
 320                                                                                                         {"parameter_name" : "Type", "element_name" : "Datatype", 
 321                                                                                                          "post_processing":"regDatatypeToString"}, 
 322                                                                                                         {"parameter_name" : "Buffer", "element_name" : "Data"}], 
 323                                                                                     "associated_object_type" : "WindowsRegistryKeyObjectType", 
 324                                                                                     "associated_object_element" : "Values/list__", 
 325                                                                                     "association_type" : "output"}}}, 
 326  "RegQueryValueExA" : {"action_name" : "read registry key value", 
 327                        "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 328                        "parameter_associated_objects" : {"ValueName" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 329                                                                         "associated_object_element" : "Values/list__Name", 
 330                                                                         "association_type" : "input"}, 
 331                                                          "Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
 332                                                                      "associated_object_element" : "ID", 
 333                                                                      "association_type" : "input", 
 334                                                                      "forced" : {"associated_object_element" : "Type",  
 335                                                                                "value" : "RegistryKey"}}, 
 336                                                          "group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "Type", "element_name" : "Datatype", 
 337                                                                                                              "post_processing":"regDatatypeToString"}, 
 338                                                                                                             {"parameter_name" : "Data", "element_name" : "Data"}], 
 339                                                                                     "associated_object_type" : "WindowsRegistryKeyObjectType", 
 340                                                                                     "associated_object_element" : "Values/list__", 
 341                                                                                     "association_type" : "output"}}}, 
 342  "RegQueryValueExW" : {"action_name" : "read registry key value", 
 343                        "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 344                        "parameter_associated_objects" : {"ValueName" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 345                                                                         "associated_object_element" : "Values/list__Name", 
 346                                                                         "association_type" : "input"}, 
 347                                                          "Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
 348                                                                      "associated_object_element" : "ID", 
 349                                                                      "association_type" : "input", 
 350                                                                      "forced" : {"associated_object_element" : "Type",  
 351                                                                                "value" : "RegistryKey"}}, 
 352                                                          "group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "Type", "element_name" : "Datatype", 
 353                                                                                                              "post_processing":"regDatatypeToString"}, 
 354                                                                                                             {"parameter_name" : "Data", "element_name" : "Data"}], 
 355                                                                                     "associated_object_type" : "WindowsRegistryKeyObjectType", 
 356                                                                                     "associated_object_element" : "Values/list__", 
 357                                                                                     "association_type" : "output"}}}, 
 358  "RegDeleteValueA" : {"action_name" : "delete registry key value", 
 359                       "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 360                       "parameter_associated_objects" : {"ValueName" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 361                                                                         "associated_object_element" : "Values/list__Name", 
 362                                                                         "association_type" : "input"}, 
 363                                                          "Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
 364                                                                      "associated_object_element" : "ID", 
 365                                                                      "association_type" : "input", 
 366                                                                      "forced" : {"associated_object_element" : "Type",  
 367                                                                                "value" : "RegistryKey"}}}}, 
 368  "RegDeleteValueW" : {"action_name" : "delete registry key value", 
 369                       "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 370                       "parameter_associated_objects" : {"ValueName" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 371                                                                         "associated_object_element" : "Values/list__Name", 
 372                                                                         "association_type" : "input"}, 
 373                                                          "Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
 374                                                                      "associated_object_element" : "ID", 
 375                                                                      "association_type" : "input", 
 376                                                                      "forced" : {"associated_object_element" : "Type",  
 377                                                                                "value" : "RegistryKey"}}}}, 
 378  "RegQueryInfoKeyA" : {"action_name" : "get registry key attributes", 
 379                       "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 380                       "parameter_associated_objects" : {"KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 381                                                                      "associated_object_element" : "ID", 
 382                                                                      "association_type" : "input", 
 383                                                                      "forced" : {"associated_object_element" : "Type",  
 384                                                                                "value" : "RegistryKey"}}}}, 
 385  "RegQueryInfoKeyW" : {"action_name" : "get registry key attributes", 
 386                       "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 387                       "parameter_associated_objects" : {"KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 388                                                                      "associated_object_element" : "ID", 
 389                                                                      "association_type" : "input", 
 390                                                                      "forced" : {"associated_object_element" : "Type",  
 391                                                                                "value" : "RegistryKey"}}}}, 
 392  "RegCloseKey" : {"action_name" : "close registry key", 
 393                   "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 394                   "parameter_associated_objects" : {"Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
 395                                                                      "associated_object_element" : "ID", 
 396                                                                      "association_type" : "input", 
 397                                                                      "forced" : {"associated_object_element" : "Type",  
 398                                                                                "value" : "RegistryKey"}}}}, 
 399  "NtCreateKey" : {"action_name" : "create registry key", 
 400                   "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 401                   "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "ObjectAttributes", "element_name" : "Hive", 
 402                                                                                                       "post_processing": "regStringToHive"}, 
 403                                                                                                      {"parameter_name" : "ObjectAttributes", "element_name" : "Key", 
 404                                                                                                       "post_processing":"regStringToKey"}], 
 405                                                                              "associated_object_type" : "WindowsRegistryKeyObjectType", 
 406                                                                              "association_type" : "output"}, 
 407                                                     "KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 408                                                                    "associated_object_element" : "ID", 
 409                                                                    "association_type" : "output", 
 410                                                                    "forced" : {"associated_object_element" : "Type",  
 411                                                                                "value" : "RegistryKey"}}}}, 
 412  "NtOpenKey" : {"action_name" : "open registry key", 
 413                 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 414                 "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "ObjectAttributes", "element_name" : "Hive", 
 415                                                                                                       "post_processing": "regStringToHive"}, 
 416                                                                                                      {"parameter_name" : "ObjectAttributes", "element_name" : "Key", 
 417                                                                                                       "post_processing":"regStringToKey"}], 
 418                                                                              "associated_object_type" : "WindowsRegistryKeyObjectType", 
 419                                                                              "association_type" : "input"}, 
 420                                                    "KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 421                                                                   "associated_object_element" : "ID", 
 422                                                                   "association_type" : "output", 
 423                                                                   "forced" : {"associated_object_element" : "Type",  
 424                                                                                "value" : "RegistryKey"}}}}, 
 425  "NtOpenKeyEx" : {"action_name" : "open registry key", 
 426                 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 427                 "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "ObjectAttributes", "element_name" : "Hive", 
 428                                                                                                       "post_processing": "regStringToHive"}, 
 429                                                                                                      {"parameter_name" : "ObjectAttributes", "element_name" : "Key", 
 430                                                                                                       "post_processing":"regStringToKey"}], 
 431                                                                              "associated_object_type" : "WindowsRegistryKeyObjectType", 
 432                                                                              "association_type" : "input"}, 
 433                                                    "KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 434                                                                   "associated_object_element" : "ID", 
 435                                                                   "association_type" : "output", 
 436                                                                   "forced" : {"associated_object_element" : "Type",  
 437                                                                                "value" : "RegistryKey"}}}}, 
 438  "NtRenameKey" : {"action_name" : "rename registry key", 
 439                   "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "NewName", "element_name" : "Hive", 
 440                                                                                                       "post_processing": "regStringToHive"}, 
 441                                                                                                      {"parameter_name" : "NewName", "element_name" : "Key", 
 442                                                                                                       "post_processing":"regStringToKey"}], 
 443                                                                              "associated_object_type" : "WindowsRegistryKeyObjectType", 
 444                                                                              "association_type" : "input"}, 
 445                                                    "KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 446                                                                   "associated_object_element" : "ID", 
 447                                                                   "association_type" : "input", 
 448                                                                   "forced" : {"associated_object_element" : "Type",  
 449                                                                                "value" : "RegistryKey"}}}}, 
 450  "NtReplaceKey" : {"action_name" : "save hive key to file", 
 451                    "parameter_associated_objects" : {"NewHiveFileName" : {"associated_object_type" : "FileObjectType", 
 452                                                                           "associated_object_element" : "File_Path", 
 453                                                                           "association_type" : "output"}, 
 454                                                    "OldHiveFileName" : {"associated_object_type" : "FileObjectType", 
 455                                                                         "associated_object_element" : "File_Path", 
 456                                                                         "association_type" : "input"}, 
 457                                                    "KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 458                                                                   "associated_object_element" : "ID", 
 459                                                                   "association_type" : "input", 
 460                                                                   "forced" : {"associated_object_element" : "Type",  
 461                                                                                "value" : "RegistryKey"}}}}, 
 462  "NtEnumerateKey" : {"action_name" : "enumerate registry key subkeys", 
 463                      "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 464                      "parameter_associated_objects" : {"KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 465                                                                "associated_object_element" : "ID", 
 466                                                                "association_type" : "input", 
 467                                                                "forced" : {"associated_object_element" : "Type",  
 468                                                                                "value" : "RegistryKey"}}}}, 
 469  "NtEnumerateValueKey" : {"action_name" : "enumerate registry key values", 
 470                           "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 471                           "parameter_associated_objects" : {"KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 472                                                                            "associated_object_element" : "ID", 
 473                                                                            "association_type" : "input", 
 474                                                                            "forced" : {"associated_object_element" : "Type",  
 475                                                                                "value" : "RegistryKey"}}}}, 
 476  "NtSetValueKey" : {"action_name" : "modify registry key value", 
 477                     "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 478                     "parameter_associated_objects" : {"KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 479                                                                      "associated_object_element" : "ID", 
 480                                                                      "association_type" : "input", 
 481                                                                      "forced" : {"associated_object_element" : "Type",  
 482                                                                                "value" : "RegistryKey"}}, 
 483                                                       "group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "ValueName", "element_name" : "Name"}, 
 484                                                                                                         {"parameter_name" : "Type", "element_name" : "Datatype", 
 485                                                                                                          "post_processing":"regDatatypeToString"}, 
 486                                                                                                         {"parameter_name" : "Buffer", "element_name" : "Data"}], 
 487                                                                                     "associated_object_type" : "WindowsRegistryKeyObjectType", 
 488                                                                                     "associated_object_element" : "Values/list__", 
 489                                                                                     "association_type" : "output"}}}, 
 490  "NtQueryValueKey" : {"action_name" : "read registry key value", 
 491                       "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 492                       "parameter_associated_objects" : {"ValueName" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 493                                                                        "associated_object_element" : "Values/list__Name", 
 494                                                                        "association_type" : "input"}, 
 495                                                          "KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 496                                                                         "associated_object_element" : "ID", 
 497                                                                         "association_type" : "input", 
 498                                                                         "forced" : {"associated_object_element" : "Type",  
 499                                                                                "value" : "RegistryKey"}}, 
 500                                                       "group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "Type", "element_name" : "Datatype", 
 501                                                                                                           "post_processing":"regDatatypeToString"}, 
 502                                                                                                         {"parameter_name" : "Information", "element_name" : "Data"}], 
 503                                                                                     "associated_object_type" : "WindowsRegistryKeyObjectType", 
 504                                                                                     "associated_object_element" : "Values/list__", 
 505                                                                                     "association_type" : "output"}}}, 
 506  "NtQueryMultipleValueKey" : {"action_name" : "read registry key value", 
 507                               "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 508                               "parameter_associated_objects" : {"ValueName" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 509                                                                                "associated_object_element" : "Values/list__Name", 
 510                                                                                "association_type" : "input"}, 
 511                                                                 "ValueBuffer" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 512                                                                                  "associated_object_element" : "Values/list__Data", 
 513                                                                                  "association_type" : "output"}, 
 514                                                                 "KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 515                                                                                "associated_object_element" : "ID", 
 516                                                                                "association_type" : "input", 
 517                                                                                "forced" : {"associated_object_element" : "Type",  
 518                                                                                "value" : "RegistryKey"}}}}, 
 519  "NtDeleteKey" : {"action_name" : "delete registry key", 
 520                   "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 521                   "parameter_associated_objects" : {"KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 522                                                                    "associated_object_element" : "ID", 
 523                                                                    "association_type" : "input", 
 524                                                                    "forced" : {"associated_object_element" : "Type",  
 525                                                                                "value" : "RegistryKey"}}}}, 
 526  "NtDeleteValueKey" : {"action_name" : "delete registry key value", 
 527                        "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 528                        "parameter_associated_objects" : {"ValueName" : {"associated_object_type" : "WindowsRegistryKeyObjectType", 
 529                                                                         "associated_object_element" : "Values/list__Name", 
 530                                                                         "association_type" : "input"}, 
 531                                                          "KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 532                                                                         "associated_object_element" : "ID", 
 533                                                                         "association_type" : "input", 
 534                                                                         "forced" : {"associated_object_element" : "Type",  
 535                                                                                "value" : "RegistryKey"}}}}, 
 536  "NtLoadKey" : {"action_name" : "load registry keys from file", 
 537                 "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "TargetKey", "element_name" : "Hive", 
 538                                                                                                       "post_processing": "regStringToHive"}, 
 539                                                                                                      {"parameter_name" : "TargetKey", "element_name" : "Key", 
 540                                                                                                       "post_processing":"regStringToKey"}], 
 541                                                                              "associated_object_type" : "WindowsRegistryKeyObjectType", 
 542                                                                              "association_type" : "input"}, 
 543                                                   "SourceFile" : {"associated_object_type" : "FileObjectType", 
 544                                                                   "associated_object_element" : "File_Path", 
 545                                                                   "association_type" : "input", 
 546                                                                   "forced" : {"associated_object_element" : "Type",  
 547                                                                                "value" : "RegistryKey"}}}}, 
 548  "NtLoadKey2" : {"action_name" : "load registry keys from file", 
 549                  "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "TargetKey", "element_name" : "Hive", 
 550                                                                                                       "post_processing": "regStringToHive"}, 
 551                                                                                                      {"parameter_name" : "TargetKey", "element_name" : "Key", 
 552                                                                                                       "post_processing":"regStringToKey"}], 
 553                                                                              "associated_object_type" : "WindowsRegistryKeyObjectType", 
 554                                                                              "association_type" : "input"}, 
 555                                                   "SourceFile" : {"associated_object_type" : "FileObjectType", 
 556                                                                   "associated_object_element" : "File_Path", 
 557                                                                   "association_type" : "input", 
 558                                                                   "forced" : {"associated_object_element" : "Type",  
 559                                                                                "value" : "RegistryKey"}}}}, 
 560  "NtLoadKeyEx" : {"action_name" : "load registry keys from file", 
 561                   "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "TargetKey", "element_name" : "Hive", 
 562                                                                                                       "post_processing": "regStringToHive"}, 
 563                                                                                                      {"parameter_name" : "TargetKey", "element_name" : "Key", 
 564                                                                                                       "post_processing":"regStringToKey"}], 
 565                                                                              "associated_object_type" : "WindowsRegistryKeyObjectType", 
 566                                                                              "association_type" : "input"}, 
 567                                                    "SourceFile" : {"associated_object_type" : "FileObjectType", 
 568                                                                    "associated_object_element" : "File_Path", 
 569                                                                    "association_type" : "input", 
 570                                                                    "forced" : {"associated_object_element" : "Type",  
 571                                                                                "value" : "RegistryKey"}}}}, 
 572  "NtQueryKey" : {"action_name" : "get registry key attributes", 
 573                  "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0", 
 574                  "parameter_associated_objects" : {"KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 575                                                                   "associated_object_element" : "ID", 
 576                                                                   "association_type" : "input", 
 577                                                                   "forced" : {"associated_object_element" : "Type",  
 578                                                                                "value" : "RegistryKey"}}}}, 
 579  "NtSaveKey" : {"action_name" : "save registry key subtree to file", 
 580                 "parameter_associated_objects" : {"KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 581                                                                  "associated_object_element" : "ID", 
 582                                                                  "association_type" : "input"}, 
 583                                                   "FileHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 584                                                                   "associated_object_element" : "ID", 
 585                                                                   "association_type" : "input", 
 586                                                                   "forced" : {"associated_object_element" : "Type",  
 587                                                                                "value" : "RegistryKey"}}}}, 
 588  "NtSaveKeyEx" : {"action_name" : "save registry key subtree to file", 
 589                   "parameter_associated_objects" : {"KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 590                                                                    "associated_object_element" : "ID", 
 591                                                                    "association_type" : "input"}, 
 592                                                     "FileHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 593                                                                     "associated_object_element" : "ID", 
 594                                                                     "association_type" : "input", 
 595                                                                     "forced" : {"associated_object_element" : "Type",  
 596                                                                                "value" : "Process"}}}},                                                                                                                                                   
 597  "NtCreateProcess" : {"action_name" : "create process", 
 598                       "action_vocab" : "maecVocabs:ProcessActionNameVocab-1.0", 
 599                        "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 600                                                                             "associated_object_element" : "ID", 
 601                                                                             "association_type" : "output", 
 602                                                                             "forced" : {"associated_object_element" : "Type",  
 603                                                                                         "value" : "Process"}}, 
 604                                                        "FileName" : {"associated_object_type" : "FileObjectType", 
 605                                                                      "associated_object_element" : "File_Path", 
 606                                                                      "association_type" : "input"}}}, 
 607  "NtCreateProcessEx" : {"action_name" : "create process", 
 608                         "action_vocab" : "maecVocabs:ProcessActionNameVocab-1.0", 
 609                         "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 610                                                                              "associated_object_element" : "ID", 
 611                                                                              "association_type" : "output", 
 612                                                                              "forced" : {"associated_object_element" : "Type",  
 613                                                                                          "value" : "Process"}}, 
 614                                                        "FileName" : {"associated_object_type" : "FileObjectType", 
 615                                                                      "associated_object_element" : "File_Path", 
 616                                                                      "association_type" : "input"}}}, 
 617  "NtCreateUserProcess" : {"action_name" : "create process", 
 618                           "action_vocab" : "maecVocabs:ProcessActionNameVocab-1.0", 
 619                           "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 620                                                                                "associated_object_element" : "ID", 
 621                                                                                "association_type" : "output", 
 622                                                                                "forced" : {"associated_object_element" : "Type",  
 623                                                                                            "value" : "Process"}}, 
 624                                                              "ThreadHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 625                                                                                "associated_object_element" : "ID", 
 626                                                                                "association_type" : "output", 
 627                                                                                "forced" : {"associated_object_element" : "Type",  
 628                                                                                            "value" : "Thread"}}, 
 629                                                              "ThreadName" : {"associated_object_type" : "WindowsThreadObjectType", 
 630                                                                              "associated_object_element" : "Thread_ID", 
 631                                                                              "association_type" : "output"}, 
 632                                                       "group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "ProcessFileName", "element_name" : "File_Name",}, 
 633                                                                                                         {"parameter_name" : "ImagePathName", "element_name" : "Path"}], 
 634                                                                                     "associated_object_type" : "ProcessObjectType", 
 635                                                                                     "associated_object_element" : "Image_Info", 
 636                                                                                     "association_type" : "output"}}}, 
 637  "RtlCreateUserProcess" : {"action_name" : "create process", 
 638                            "action_vocab" : "maecVocabs:ProcessActionNameVocab-1.0", 
 639                            "parameter_associated_objects" : {"ParentProcess" : {"associated_object_type" : "WindowsHandleObjectType", 
 640                                                                                 "associated_object_element" : "ID", 
 641                                                                                 "association_type" : "output", 
 642                                                                                 "forced" : {"associated_object_element" : "Type",  
 643                                                                                            "value" : "Process"}}, 
 644                                                              "ImagePath" : {"associated_object_type" : "ProcessObjectType", 
 645                                                                                 "associated_object_element" : "Image_Info/Path", 
 646                                                                                 "association_type" : "input"}}}, 
 647  "NtOpenProcess" : {"action_name" : "open process", 
 648                     "action_vocab" : "maecVocabs:ProcessActionNameVocab-1.0", 
 649                     "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 650                                                                          "associated_object_element" : "ID", 
 651                                                                          "association_type" : "output", 
 652                                                                          "forced" : {"associated_object_element" : "Type",  
 653                                                                                      "value" : "Process"}}, 
 654                                                       "ProcessIdentifier" : {"associated_object_type" : "ProcessObjectType", 
 655                                                                              "associated_object_element" : "PID", 
 656                                                                              "association_type" : "input"}}}, 
 657  "NtTerminateProcess" : {"action_name" : "kill process", 
 658                          "action_vocab" : "maecVocabs:ProcessActionNameVocab-1.0", 
 659                          "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 660                                                                               "associated_object_element" : "ID", 
 661                                                                               "association_type" : "input", 
 662                                                                               "forced" : {"associated_object_element" : "Type",  
 663                                                                                           "value" : "Process"}}}}, 
 664  "NtCreateSection" : {"action_name" : "create section", 
 665                       "parameter_associated_objects" : {"SectionHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 666                                                                            "associated_object_element" : "ID", 
 667                                                                            "association_type" : "output", 
 668                                                                            "forced" : {"associated_object_element" : "Type",  
 669                                                                                        "value" : "Section"}}, 
 670                                                         "FileHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 671                                                                         "associated_object_element" : "ID", 
 672                                                                         "association_type" : "input", 
 673                                                                         "forced" : {"associated_object_element" : "Type",  
 674                                                                                     "value" : "File"}}}},  
 675  "NtOpenSection" : {"action_name" : "open section", 
 676                     "parameter_associated_objects" : {"SectionHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 677                                                                            "associated_object_element" : "ID", 
 678                                                                            "association_type" : "output", 
 679                                                                            "forced" : {"associated_object_element" : "Type",  
 680                                                                                        "value" : "Section"}}, 
 681                                                       "ObjectAttributes" : {"associated_object_type" : "MemoryObjectType", 
 682                                                                            "associated_object_element" : "Name", 
 683                                                                            "association_type" : "input"}}}, 
 684  "CreateProcessInternalW" : {"action_name" : "create process", 
 685                              "action_vocab" : "maecVocabs:ProcessActionNameVocab-1.0", 
 686                              "parameter_associated_objects" : {"ProcessId" : {"associated_object_type" : "WindowsProcessObjectType", 
 687                                                                               "associated_object_element" : "PID", 
 688                                                                               "association_type" : "output"}, 
 689                                                                "ThreadId" : {"associated_object_type" : "WindowsThreadObjectType", 
 690                                                                              "associated_object_element" : "Thread_ID", 
 691                                                                              "association_type" : "output"}, 
 692                                                               "ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 693                                                                                  "associated_object_element" : "ID", 
 694                                                                                  "association_type" : "output", 
 695                                                                                  "forced" : {"associated_object_element" : "Type", 
 696                                                                                              "value" : "Process"}}, 
 697                                                               "ThreadHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 698                                                                                 "associated_object_element" : "ID", 
 699                                                                                 "association_type" : "output", 
 700                                                                                 "forced" : {"associated_object_element" : "Type",  
 701                                                                                             "value" : "Thread"}}}, 
 702                               "parameter_associated_arguments" : {"ApplicationName" : {"associated_argument_name" : "Application Name"}}}, 
 703  "ExitProcess" : {"action_name" : "kill process", 
 704                   "action_vocab" : "maecVocabs:ProcessActionNameVocab-1.0", 
 705                   "parameter_associated_arguments" : {"ExitCode" : {"associated_argument_name" : "Exit Code"}}}, 
 706   
 707  "ShellExecuteExW" : {"action_name" : "create process", 
 708                       "action_vocab" : "maecVocabs:ProcessActionNameVocab-1.0", 
 709                       "parameter_associated_objects" : {"FilePath" : {"associated_object_type" : "FileObjectType", 
 710                                                                       "associated_object_element" : "File_Path", 
 711                                                                       "association_type" : "input" }}}, 
 712  "NtUnmapViewOfSection" : {"action_name" : "unmap view of section", 
 713                            "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 714                                                                                  "associated_object_element" : "ID", 
 715                                                                                  "association_type" : "input", 
 716                                                                                  "forced" : {"associated_object_element" : "Type", 
 717                                                                                              "value" : "Process"}}}}, 
 718  "NtAllocateVirtualMemory" : {"action_name" : "allocate process virtual memory", 
 719                               "action_vocab" : "maecVocabs:ProcessMemoryActionNameVocab-1.0", 
 720                               "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 721                                                                                    "associated_object_element" : "ID", 
 722                                                                                    "association_type" : "input", 
 723                                                                                    "forced" : {"associated_object_element" : "Type",  
 724                                                                                                 "value" : "Process"}}}}, 
 725  "NtReadVirtualMemory" : {"action_name" : "read from process memory", 
 726                           "action_vocab" : "maecVocabs:ProcessMemoryActionNameVocab-1.0", 
 727                           "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 728                                                                                "associated_object_element" : "ID", 
 729                                                                                "association_type" : "input", 
 730                                                                                "forced" : {"associated_object_element" : "Type",  
 731                                                                                            "value" : "Process"}}}}, 
 732  "ReadProcessMemory" : {"action_name" : "read from process memory", 
 733                         "action_vocab" : "maecVocabs:ProcessMemoryActionNameVocab-1.0", 
 734                         "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 735                                                                              "associated_object_element" : "ID", 
 736                                                                              "association_type" : "input", 
 737                                                                              "forced" : {"associated_object_element" : "Type",  
 738                                                                                          "value" : "Process"}}}}, 
 739  "NtWriteVirtualMemory" : {"action_name" : "write to process memory", 
 740                            "action_vocab" : "maecVocabs:ProcessMemoryActionNameVocab-1.0", 
 741                            "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 742                                                                                "associated_object_element" : "ID", 
 743                                                                                "association_type" : "input", 
 744                                                                                "forced" : {"associated_object_element" : "Type",  
 745                                                                                            "value" : "Process"}}}}, 
 746  "WriteProcessMemory" : {"action_name" : "write to process memory", 
 747                          "action_vocab" : "maecVocabs:ProcessMemoryActionNameVocab-1.0", 
 748                          "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 749                                                                               "associated_object_element" : "ID", 
 750                                                                               "association_type" : "input", 
 751                                                                               "forced" : {"associated_object_element" : "Type",  
 752                                                                                           "value" : "Process"}}}}, 
 753  "NtProtectVirtualMemory" : {"action_name" : "modify process virtual memory protection", 
 754                              "action_vocab" : "maecVocabs:ProcessMemoryActionNameVocab-1.0", 
 755                              "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 756                                                                                   "associated_object_element" : "ID", 
 757                                                                                   "association_type" : "input", 
 758                                                                                   "forced" : {"associated_object_element" : "Type",  
 759                                                                                               "value" : "Process"}}}}, 
 760  "VirtualProtectEx" : {"action_name" : "modify process virtual memory protection", 
 761                        "action_vocab" : "maecVocabs:ProcessMemoryActionNameVocab-1.0", 
 762                        "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 763                                                                             "associated_object_element" : "ID", 
 764                                                                             "association_type" : "input", 
 765                                                                             "forced" : {"associated_object_element" : "Type",  
 766                                                                                         "value" : "Process"}}}}, 
 767  "NtFreeVirtualMemory" : {"action_name" : "free process virtual memory", 
 768                           "action_vocab" : "maecVocabs:ProcessMemoryActionNameVocab-1.0", 
 769                           "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 770                                                                                "associated_object_element" : "ID", 
 771                                                                                "association_type" : "input", 
 772                                                                                "forced" : {"associated_object_element" : "Type",  
 773                                                                                            "value" : "Process"}}}}, 
 774  "VirtualFreeEx" : {"action_name" : "free process virtual memory", 
 775                     "action_vocab" : "maecVocabs:ProcessMemoryActionNameVocab-1.0", 
 776                     "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 777                                                                          "associated_object_element" : "ID", 
 778                                                                          "association_type" : "input", 
 779                                                                          "forced" : {"associated_object_element" : "Type",  
 780                                                                                      "value" : "Process"}}}}, 
 781  "FindWindowA" : {"action_name" : "find window", 
 782                   "action_vocab" : "maecVocabs:GUIActionNameVocab-1.0", 
 783                   "parameter_associated_objects" : {"WindowName" : {"associated_object_type" : "GUIWindowObjectType", 
 784                                                                     "associated_object_element" : "Window_Display_Name", 
 785                                                                     "association_type" : "input"}}}, 
 786  "FindWindowW" : {"action_name" : "find window", 
 787                   "action_vocab" : "maecVocabs:GUIActionNameVocab-1.0", 
 788                   "parameter_associated_objects" : {"WindowName" : {"associated_object_type" : "GUIWindowObjectType", 
 789                                                                     "associated_object_element" : "Window_Display_Name", 
 790                                                                     "association_type" : "input"}}}, 
 791  "FindWindowExA" : {"action_name" : "find window", 
 792                     "action_vocab" : "maecVocabs:GUIActionNameVocab-1.0", 
 793                     "parameter_associated_objects" : {"WindowName" : {"associated_object_type" : "GUIWindowObjectType", 
 794                                                                       "associated_object_element" : "Window_Display_Name", 
 795                                                                       "association_type" : "input"}}}, 
 796  "FindWindowExW" : {"action_name" : "find window", 
 797                     "action_vocab" : "maecVocabs:GUIActionNameVocab-1.0", 
 798                     "parameter_associated_objects" : {"WindowName" : {"associated_object_type" : "GUIWindowObjectType", 
 799                                                                       "associated_object_element" : "Window_Display_Name", 
 800                                                                       "association_type" : "input"}}}, 
 801  "SetWindowsHookExA" : {"action_name" : "add windows hook", 
 802                         "action_vocab" : "maecVocabs:HookingActionNameVocab-1.0", 
 803                         "parameter_associated_objects" : {"HookIdentifier" : {"associated_object_type" : "WindowsKernelHookObjectType", 
 804                                                                               "associated_object_element" : "Type", 
 805                                                                               "association_type" : "input"}, 
 806                                                           "ProcedureAddress" : {"associated_object_type" : "WindowsKernelHookObjectType", 
 807                                                                                 "associated_object_element" : "Hooking_Address", 
 808                                                                                 "association_type" : "input"}, 
 809                                                           "ThreadId" : {"associated_object_type" : "WindowsThreadObjectType", 
 810                                                                         "associated_object_element" : "Thread_ID", 
 811                                                                         "association_type" : "input"}, 
 812                                                           "group_together" : ["HookIdentifier", "ProcedureAddress"]}}, 
 813  "SetWindowsHookExW" : {"action_name" : "add windows hook", 
 814                         "action_vocab" : "maecVocabs:HookingActionNameVocab-1.0", 
 815                         "parameter_associated_objects" : {"HookIdentifier" : {"associated_object_type" : "WindowsKernelHookObjectType", 
 816                                                                               "associated_object_element" : "Type", 
 817                                                                               "association_type" : "input"}, 
 818                                                           "ProcedureAddress" : {"associated_object_type" : "WindowsKernelHookObjectType", 
 819                                                                                 "associated_object_element" : "Hooking_Address", 
 820                                                                                 "association_type" : "input"}, 
 821                                                           "ThreadId" : {"associated_object_type" : "WindowsThreadObjectType", 
 822                                                                         "associated_object_element" : "Thread_ID", 
 823                                                                         "association_type" : "input"}, 
 824                                                           "group_together" : ["HookIdentifier", "ProcedureAddress"]}}, 
 825  "UnhookWindowsHookEx" : {"action_name" : "remove windows hook", 
 826                           "parameter_associated_objects" : {"HookHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 827                                                                                     "associated_object_element" : "ID", 
 828                                                                                     "association_type" : "input", 
 829                                                                                     "forced" : {"associated_object_element" : "Type",  
 830                                                                                                 "value" : "Hook"}}}},                                        
 831  "LdrLoadDll" : {"action_name" : "load library", 
 832                  "action_vocab" : "maecVocabs:LibraryActionNameVocab-1.0", 
 833                  "parameter_associated_objects" : {"FileName" : {"associated_object_type" : "LibraryObjectType", 
 834                                                                  "associated_object_element" : "Name", 
 835                                                                  "association_type" : "input"}, 
 836                                                    "BaseAddress" : {"associated_object_type" : "WindowsHandleObjectType", 
 837                                                                     "associated_object_element" : "ID", 
 838                                                                     "association_type" : "output", 
 839                                                                     "forced" : {"associated_object_element" : "Type",  
 840                                                                                 "value" : "Module"}}}}, 
 841  "LdrGetDllHandle" : {"action_name" : "get dll handle", 
 842                       "parameter_associated_objects" : {"FileName" : {"associated_object_type" : "LibraryObjectType", 
 843                                                                       "associated_object_element" : "Name", 
 844                                                                       "association_type" : "input"}, 
 845                                                         "ModuleHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 846                                                                           "associated_object_element" : "ID", 
 847                                                                           "association_type" : "output", 
 848                                                                           "forced" : {"associated_object_element" : "Type",  
 849                                                                                       "value" : "Module"}}}}, 
 850  "LdrGetProcedureAddress" : {"action_name" : "get function address", 
 851                              "action_vocab" : "maecVocabs:LibraryActionNameVocab-1.0", 
 852                              "parameter_associated_objects" : {"ModuleHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 853                                                                                  "associated_object_element" : "ID", 
 854                                                                                  "association_type" : "input", 
 855                                                                                  "forced" : {"associated_object_element" : "Type",  
 856                                                                                              "value" : "Module"}}, 
 857                                                                 "FunctionAddress" : {"associated_object_type" : "APIObjectType", 
 858                                                                                      "associated_object_element" : "Address", 
 859                                                                                      "association_type" : "output", 
 860                                                                                      "post_processing" : "intToHex"}, 
 861                                                                 "group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "FunctionName", "element_name" : "Function_Name"},  
 862                                                                                                                    {"parameter_name" : "Ordinal", "element_name" : "Ordinal"}], 
 863                                                                                              "associated_object_type" : "WindowsExecutableFileObjectType", 
 864                                                                                              "associated_object_element" : "Exports/Exported_Functions/list__", 
 865                                                                                              "association_type" : "input"}}}, 
 866  "DeviceIoControl" : {"action_name" : "send control code to driver", 
 867                        "parameter_associated_objects" : {"DeviceHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 868                                                                            "associated_object_element" : "ID", 
 869                                                                            "association_type" : "input", 
 870                                                                            "forced" : {"associated_object_element" : "Type",  
 871                                                                                        "value" : "Device"}}}, 
 872                       "parameter_associated_arguments" : {"IoControlCode" : {"associated_argument_name" : "Control Code", 
 873                                                                              "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}}}, 
 874  "ExitWindowsEx" : {"action_name" : "shutdown system", 
 875                     "action_vocab" : "maecVocabs:SystemActionNameVocab-1.0", 
 876                     "parameter_associated_arguments" : {"Flags" : {"associated_argument_name" : "Flags"}, 
 877                                                         "Reason" : {"associated_argument_name" : "Reason"}}}, 
 878  "IsDebuggerPresent" : {"action_name" : "check for remote debugger", 
 879                         "action_vocab" : "maecVocabs:DebuggingActionNameVocab-1.0"}, 
 880  "LookupPrivilegeValueW" : {"action_name" : "find privilege value", 
 881                             "parameter_associated_objects" : {"SystemName" : {"associated_object_type" : "SystemObjectType", 
 882                                                                                                               "associated_object_element" : "Hostname", 
 883                                                                                                               "association_type" : "input"}}, 
 884                             "parameter_associated_arguments" : {"PrivilegeName" : {"associated_argument_name" : "Privilege Name"}}}, 
 885  "NtClose" : {"action_name" : "close handle", 
 886                               "parameter_associated_objects" : {"Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
 887                                                                                                             "associated_object_element" : "ID", 
 888                                                                                                             "association_type" : "input"}}}, 
 889  "WriteConsoleA" : {"action_name" : "write to console", 
 890                     "parameter_associated_objects" : {"ConsoleHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 891                                                                                                      "associated_object_element" : "ID", 
 892                                                                                                      "association_type" : "input", 
 893                                                                                                      "forced" : {"associated_object_element" : "Type",  
 894                                                                                                                  "value" : "Console"}}}}, 
 895  "WriteConsoleW" : {"action_name" : "write to console", 
 896                     "parameter_associated_objects" : {"ConsoleHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 897                                                                                                      "associated_object_element" : "ID", 
 898                                                                                                      "association_type" : "input", 
 899                                                                                                      "forced" : {"associated_object_element" : "Type",  
 900                                                                                                                  "value" : "Console"}}}}, 
 901  "ZwMapViewOfSection" : {"action_name" : "map view of section", 
 902                          "parameter_associated_objects" : {"SectionHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 903                                                                               "associated_object_element" : "ID", 
 904                                                                               "association_type" : "input", 
 905                                                                               "forced" : {"associated_object_element" : "Type",  
 906                                                                                           "value" : "Section"}}, 
 907                                                            "ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
 908                                                                               "associated_object_element" : "ID", 
 909                                                                               "association_type" : "input", 
 910                                                                               "forced" : {"associated_object_element" : "Type",  
 911                                                                                           "value" : "Process"}}}, 
 912                          "parameter_associated_arguments" : {"BaseAddress" : {"associated_argument_name" : "Base Address", 
 913                                                                               "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}, 
 914                                                              "SectionOffset" : {"associated_argument_name" : "Section Offset"}}}, 
 915  "GetSystemMetrics" : {"action_name" : "get system metrics", 
 916                        "parameter_associated_arguments" : {"SystemMetricIndex" : {"associated_argument_name" : "System Metric Index"}}}, 
 917  "NtDelayExecution" : {"action_name" : "delay execution", 
 918                        "parameter_associated_arguments" : {"Milliseconds" : {"associated_argument_name" : "Milliseconds"}}}, 
 919  "GetLocalTime" : {"action_name" : "get system local time", 
 920                    "action_vocab" : "maecVocabs:SystemActionNameVocab-1.0"}, 
 921  "GetSystemTime" : {"action_name" : "get system time", 
 922                     "action_vocab" : "maecVocabs:SystemActionNameVocab-1.0"}, 
 923  "GetTickCount" : {"action_name" : "get tick count"}, 
 924  "NtQuerySystemTime" : {"action_name" : "get system time", 
 925                         "action_vocab" : "maecVocabs:SystemActionNameVocab-1.0"}, 
 926  "WSAStartup" : {"action_name" : "initialize winsock", 
 927                  "parameter_associated_arguments" : {"VersionRequested" : {"associated_argument_name" : "Version Requested"}}}, 
 928  "gethostbyname" : {"action_name" : "get host by name", 
 929                     "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0", 
 930                     "parameter_associated_arguments" : {"Name" : {"associated_argument_name" : "Hostname",  
 931                                                                    "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}}}, 
 932  "socket" : {"action_name" : "create socket", 
 933              "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0", 
 934              "parameter_associated_objects" : {"type" : {"associated_object_type" : "NetworkSocketObjectType", 
 935                                                          "associated_object_element" : "Type", 
 936                                                          "association_type" : "output", 
 937                                                          "post_processing" : "socketTypeToString"}, 
 938                                                "af" : {"associated_object_type" : "NetworkSocketObjectType", 
 939                                                        "associated_object_element" : "Address_Family", 
 940                                                        "association_type" : "output", 
 941                                                        "post_processing" : "socketAFToString"}, 
 942                                                "protocol" : {"associated_object_type" : "NetworkSocketObjectType", 
 943                                                              "associated_object_element" : "Protocol", 
 944                                                              "association_type" : "output", 
 945                                                              "post_processing" : "socketProtoToString"}, 
 946                                                "group_together" : ["type", "protocol", "af"]}}, 
 947  "connect" : {"action_name" : "connect to socket", 
 948               "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0", 
 949               "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}}, 
 950  "send" : {"action_name" : "send data on socket", 
 951            "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0", 
 952            "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}, 
 953                                                "buffer" : {"associated_argument_name" : "Data Buffer"}}}, 
 954  "sendto" : {"action_name" : "send data to address on socket", 
 955              "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0", 
 956              "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}, 
 957                                                  "buffer" : {"associated_argument_name" : "Data Buffer"}}}, 
 958  "recv" : {"action_name" : "receive data on socket", 
 959            "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0", 
 960            "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}, 
 961                                                "buffer" : {"associated_argument_name" : "Data Buffer"}}}, 
 962  "recvfrom" : {"action_name" : "receive data on socket", 
 963                "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0", 
 964                "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}, 
 965                                                    "buffer" : {"associated_argument_name" : "Data Buffer"}}}, 
 966  "accept" : {"action_name" : "accept socket connection", 
 967              "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0", 
 968              "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}}, 
 969  "bind" : {"action_name" : "bind address to socket", 
 970            "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0", 
 971            "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "ip", "element_name" : "IP_Address/Address_Value"}, 
 972                                                                                                 {"parameter_name" : "port", "element_name" : "Port/Port_Value"}], 
 973                                                                         "associated_object_type" : "NetworkSocketObjectType", 
 974                                                                         "associated_object_element" : "Local_Address", 
 975                                                                         "association_type" : "input"}}, 
 976            "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}}, 
 977  "listen" : {"action_name" : "listen on socket", 
 978              "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0", 
 979              "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}}, 
 980  "select" : {"action_name" : "check for ready sockets", 
 981              "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}}, 
 982  "setsockopt" : {"action_name" : "set socket option", 
 983                  "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}}, 
 984  "ioctlsocket" : {"action_name" : "send command to socket", 
 985                   "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}, 
 986                                                       "command" : {"associated_argument_name" : "Command"}}}, 
 987  "closesocket" : {"action_name" : "close socket", 
 988                   "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0", 
 989                   "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}}, 
 990  "shutdown" : {"action_name" : "disable socket operation", 
 991                "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}, 
 992                                                    "how" : {"associated_argument_name" : "Operation"}}}, 
 993  "WSARecv" : {"action_name" : "receive data on socket", 
 994               "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0", 
 995               "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}}, 
 996  "WSARecvFrom" : {"action_name" : "receive data on socket", 
 997                   "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0", 
 998                   "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}}, 
 999  "WSASend" : {"action_name" : "send data on socket", 
1000               "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0", 
1001               "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}}, 
1002  "WSASendTo" : {"action_name" : "send data on socket", 
1003                 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0", 
1004                 "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}}, 
1005  "WSASocketA" : {"action_name" : "create socket", 
1006                  "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0", 
1007                  "parameter_associated_objects" : {"type" : {"associated_object_type" : "NetworkSocketObjectType", 
1008                                                              "associated_object_element" : "Type", 
1009                                                              "association_type" : "output", 
1010                                                              "post_processing" : "socketTypeToString"}, 
1011                                                "af" : {"associated_object_type" : "NetworkSocketObjectType", 
1012                                                        "associated_object_element" : "Address_Family", 
1013                                                        "association_type" : "output", 
1014                                                        "post_processing" : "socketAFToString"}, 
1015                                                "protocol" : {"associated_object_type" : "NetworkSocketObjectType", 
1016                                                              "associated_object_element" : "Protocol", 
1017                                                              "association_type" : "output", 
1018                                                              "post_processing" : "socketProtoToString"}, 
1019                                                "group_together" : ["type", "protocol", "af"]}}, 
1020  "WSASocketW" : {"action_name" : "create socket", 
1021                  "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0", 
1022                  "parameter_associated_objects" : {"type" : {"associated_object_type" : "NetworkSocketObjectType", 
1023                                                              "associated_object_element" : "Type", 
1024                                                              "association_type" : "output", 
1025                                                              "post_processing" : "socketTypeToString"}, 
1026                                                "af" : {"associated_object_type" : "NetworkSocketObjectType", 
1027                                                        "associated_object_element" : "Address_Family", 
1028                                                        "association_type" : "output", 
1029                                                        "post_processing" : "socketAFToString"}, 
1030                                                "protocol" : {"associated_object_type" : "NetworkSocketObjectType", 
1031                                                              "associated_object_element" : "Protocol", 
1032                                                              "association_type" : "output", 
1033                                                              "post_processing" : "socketProtoToString"}, 
1034                                                "group_together" : ["type", "protocol", "af"]}}, 
1035  "ConnectEx" : {"action_name" : "connect to socket", 
1036                 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0", 
1037                 "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}}, 
1038  "TransmitFile" : {"action_name" : "send file over socket", 
1039                    "parameter_associated_objects" : {"socket" : {"associated_object_type" : "WindowsHandleObjectType", 
1040                                                                  "associated_object_element" : "ID", 
1041                                                                  "association_type" : "input"}, 
1042                                                      "FileHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1043                                                                      "associated_object_element" : "ID", 
1044                                                                      "association_type" : "input", 
1045                                                                      "forced" : {"associated_object_element" : "Type",  
1046                                                                                  "value" : "File"}}, 
1047                                                      "NumberOfBytesToWrite" : {"associated_object_type" : "FileObjectType", 
1048                                                                                "associated_object_element" : "Size_In_Bytes", 
1049                                                                                "association_type" : "output"}}, 
1050                    "parameter_associated_arguments" : {"NumberOfBytesPerSend" : {"associated_argument_name" : "Send Data Block Size"}}}, 
1051  "NtCreateMutant" : {"action_name" : "create mutex", 
1052                      "action_vocab" : "maecVocabs:SynchronizationActionNameVocab-1.0", 
1053                      "parameter_associated_objects" : {"Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
1054                                                                    "associated_object_element" : "ID", 
1055                                                                    "association_type" : "output", 
1056                                                                    "forced" : {"associated_object_element" : "Type",  
1057                                                                                  "value" : "Mutex"}}, 
1058                                                        "MutexName" : {"associated_object_type" : "WindowsMutexObjectType", 
1059                                                                       "associated_object_element" : "Name", 
1060                                                                       "association_type" : "output"}}, 
1061                    "parameter_associated_arguments" : {"InitialOwner" : {"associated_argument_name" : "Initial Owner"}}}, 
1062  "NtOpenMutant" : {"action_name" : "open mutex", 
1063                    "action_vocab" : "maecVocabs:SynchronizationActionNameVocab-1.0", 
1064                    "parameter_associated_objects" : {"Handle" : {"associated_object_type" : "WindowsHandleObjectType", 
1065                                                                  "associated_object_element" : "ID", 
1066                                                                  "association_type" : "output", 
1067                                                                  "forced" : {"associated_object_element" : "Type",  
1068                                                                                  "value" : "Mutex"}}, 
1069                                                      "MutexName" : {"associated_object_type" : "WindowsMutexObjectType", 
1070                                                                     "associated_object_element" : "Name", 
1071                                                                     "association_type" : "input"}}}, 
1072  "NtCreateNamedPipeFile" : {"action_name" : "create named pipe", 
1073                             "action_vocab" : "maecVocabs:IPCActionNameVocab-1.0", 
1074                             "parameter_associated_objects" : {"NamedPipeHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1075                                                                                    "associated_object_element" : "ID", 
1076                                                                                    "association_type" : "output", 
1077                                                                                    "forced" : {"associated_object_element" : "Type",  
1078                                                                                                "value" : "NamedPipe"}}, 
1079                                                               "PipeName" : {"associated_object_type" : "WindowsPipeObjectType", 
1080                                                                             "associated_object_element" : "Name", 
1081                                                                             "association_type" : "output"}}, 
1082                             "parameter_associated_arguments" : {"DesiredAccess" : {"associated_argument_name" : "Access Mode",  
1083                                                                                    "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}, 
1084                                                                 "ShareAccess" : {"associated_argument_name" : "Share Access Mode"}}}, 
1085  "OpenSCManagerA" : {"action_name" : "open service control manager", 
1086                      "parameter_associated_objects" : {"MachineName" : {"associated_object_type" : "SystemObjectType", 
1087                                                                         "associated_object_element" : "Hostname", 
1088                                                                         "association_type" : "input"}}, 
1089                      "parameter_associated_arguments" : {"DesiredAccess" : {"associated_argument_name" : "Access Mode",  
1090                                                                             "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}, 
1091                                                          "DatabaseName" : {"associated_argument_name" : "Database Name"}}}, 
1092  "OpenSCManagerW" : {"action_name" : "open service control manager", 
1093                      "parameter_associated_objects" : {"MachineName" : {"associated_object_type" : "SystemObjectType", 
1094                                                                         "associated_object_element" : "Hostname", 
1095                                                                         "association_type" : "input"}}, 
1096                      "parameter_associated_arguments" : {"DesiredAccess" : {"associated_argument_name" : "Access Mode",  
1097                                                                             "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}, 
1098                                                          "DatabaseName" : {"associated_argument_name" : "Database Name"}}}, 
1099  "CreateServiceA" : {"action_name" : "create service", 
1100                      "action_vocab" : "maecVocabs:ServiceActionNameVocab-1.0", 
1101                      "parameter_associated_objects" : {"ServiceControlHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1102                                                                                  "associated_object_element" : "ID", 
1103                                                                                  "association_type" : "input", 
1104                                                                                  "forced" : {"associated_object_element" : "Type",  
1105                                                                                              "value" : "ServiceControlManager"}}, 
1106                                                        "ServiceName" : {"associated_object_type" : "WindowsServiceObjectType", 
1107                                                                         "associated_object_element" : "Service_Name", 
1108                                                                         "association_type" : "output"}, 
1109                                                        "DisplayName" : {"associated_object_type" : "WindowsServiceObjectType", 
1110                                                                         "associated_object_element" : "Display_Name", 
1111                                                                         "association_type" : "output"}, 
1112                                                        "ServiceType" : {"associated_object_type" : "WindowsServiceObjectType", 
1113                                                                         "associated_object_element" : "Service_Type", 
1114                                                                         "association_type" : "output"}, 
1115                                                        "StartType" : {"associated_object_type" : "WindowsServiceObjectType", 
1116                                                                       "associated_object_element" : "Startup_Type", 
1117                                                                       "association_type" : "output"}, 
1118                                                        "ServiceStartName" : {"associated_object_type" : "WindowsServiceObjectType", 
1119                                                                              "associated_object_element" : "Started_As", 
1120                                                                              "association_type" : "output"}, 
1121                                                        "BinaryPathName" : {"associated_object_type" : "WindowsServiceObjectType", 
1122                                                                            "associated_object_element" : "Image_Info/Path", 
1123                                                                            "association_type" : "output"}, 
1124                                                        "group_together" : ["ServiceName", "DisplayName", "ServiceType",  
1125                                                                            "StartType", "ServiceStartName", "BinaryPathName"]}, 
1126                      "parameter_associated_arguments" : {"DesiredAccess" : {"associated_argument_name" : "Access Mode",  
1127                                                                             "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}, 
1128                                                          "ErrorControl" : {"associated_argument_name" : "Error Control"}}}, 
1129  "CreateServiceW" : {"action_name" : "create service", 
1130                      "action_vocab" : "maecVocabs:ServiceActionNameVocab-1.0", 
1131                      "parameter_associated_objects" : {"ServiceControlHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1132                                                                                  "associated_object_element" : "ID", 
1133                                                                                  "association_type" : "input", 
1134                                                                                  "forced" : {"associated_object_element" : "Type",  
1135                                                                                              "value" : "ServiceControlManager"}}, 
1136                                                        "ServiceName" : {"associated_object_type" : "WindowsServiceObjectType", 
1137                                                                         "associated_object_element" : "Service_Name", 
1138                                                                         "association_type" : "output"}, 
1139                                                        "DisplayName" : {"associated_object_type" : "WindowsServiceObjectType", 
1140                                                                         "associated_object_element" : "Display_Name", 
1141                                                                         "association_type" : "output"}, 
1142                                                        "ServiceType" : {"associated_object_type" : "WindowsServiceObjectType", 
1143                                                                         "associated_object_element" : "Service_Type", 
1144                                                                         "association_type" : "output"}, 
1145                                                        "StartType" : {"associated_object_type" : "WindowsServiceObjectType", 
1146                                                                       "associated_object_element" : "Startup_Type", 
1147                                                                       "association_type" : "output"}, 
1148                                                        "ServiceStartName" : {"associated_object_type" : "WindowsServiceObjectType", 
1149                                                                              "associated_object_element" : "Started_As", 
1150                                                                              "association_type" : "output"}, 
1151                                                        "BinaryPathName" : {"associated_object_type" : "WindowsServiceObjectType", 
1152                                                                            "associated_object_element" : "Image_Info/Path", 
1153                                                                            "association_type" : "output"}, 
1154                                                        "group_together" : ["ServiceName", "DisplayName", "ServiceType",  
1155                                                                            "StartType", "ServiceStartName", "BinaryPathName"]}, 
1156                      "parameter_associated_arguments" : {"DesiredAccess" : {"associated_argument_name" : "Access Mode",  
1157                                                                             "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}, 
1158                                                          "ErrorControl" : {"associated_argument_name" : "Error Control"}}}, 
1159  "OpenServiceA" : {"action_name" : "open service", 
1160                    "action_vocab" : "maecVocabs:ServiceActionNameVocab-1.0", 
1161                    "parameter_associated_objects" : {"ServiceControlManager" : {"associated_object_type" : "WindowsHandleObjectType", 
1162                                                                                  "associated_object_element" : "ID", 
1163                                                                                  "association_type" : "input", 
1164                                                                                  "forced" : {"associated_object_element" : "Type",  
1165                                                                                              "value" : "ServiceControlManager"}}, 
1166                                                       "ServiceName" : {"associated_object_type" : "WindowsServiceObjectType", 
1167                                                                         "associated_object_element" : "Service_Name", 
1168                                                                         "association_type" : "input"}}, 
1169                      "parameter_associated_arguments" : {"DesiredAccess" : {"associated_argument_name" : "Access Mode",  
1170                                                                             "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}}}, 
1171  "OpenServiceW" : {"action_name" : "open service", 
1172                    "action_vocab" : "maecVocabs:ServiceActionNameVocab-1.0", 
1173                    "parameter_associated_objects" : {"ServiceControlManager" : {"associated_object_type" : "WindowsHandleObjectType", 
1174                                                                                 "associated_object_element" : "ID", 
1175                                                                                 "association_type" : "input", 
1176                                                                                 "forced" : {"associated_object_element" : "Type",  
1177                                                                                             "value" : "ServiceControlManager"}}, 
1178                                                       "ServiceName" : {"associated_object_type" : "WindowsServiceObjectType", 
1179                                                                         "associated_object_element" : "Service_Name", 
1180                                                                         "association_type" : "input"}}, 
1181                      "parameter_associated_arguments" : {"DesiredAccess" : {"associated_argument_name" : "Access Mode",  
1182                                                                             "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}}}, 
1183  "StartServiceA" : {"action_name" : "start service", 
1184                     "action_vocab" : "maecVocabs:ServiceActionNameVocab-1.0", 
1185                     "parameter_associated_objects" : {"ServiceHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1186                                                                         "associated_object_element" : "ID", 
1187                                                                         "association_type" : "input", 
1188                                                                         "forced" : {"associated_object_element" : "Type",  
1189                                                                                     "value" : "Service"}}}, 
1190                     "parameter_associated_arguments" : {"Arguments" : {"associated_argument_name" : "Access Mode"}}}, 
1191  "StartServiceW" : {"action_name" : "start service", 
1192                     "action_vocab" : "maecVocabs:ServiceActionNameVocab-1.0", 
1193                     "parameter_associated_objects" : {"ServiceHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1194                                                                         "associated_object_element" : "ID", 
1195                                                                         "association_type" : "input", 
1196                                                                         "forced" : {"associated_object_element" : "Type",  
1197                                                                                     "value" : "Service"}}}, 
1198                     "parameter_associated_arguments" : {"Arguments" : {"associated_argument_name" : "Access Mode"}}}, 
1199  "ControlService" : {"action_name" : "send control code to service", 
1200                     "action_vocab" : "maecVocabs:ServiceActionNameVocab-1.0", 
1201                     "parameter_associated_objects" : {"ServiceHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1202                                                                         "associated_object_element" : "ID", 
1203                                                                         "association_type" : "input", 
1204                                                                         "forced" : {"associated_object_element" : "Type",  
1205                                                                                     "value" : "Service"}}}, 
1206                     "parameter_associated_arguments" : {"ControlCode" : {"associated_argument_name" : "Control Code", 
1207                                                                          "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}}}, 
1208  "DeleteService" : {"action_name" : "delete service", 
1209                     "action_vocab" : "maecVocabs:ServiceActionNameVocab-1.0", 
1210                     "parameter_associated_objects" : {"ServiceHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1211                                                                         "associated_object_element" : "ID", 
1212                                                                         "association_type" : "input", 
1213                                                                         "forced" : {"associated_object_element" : "Type",  
1214                                                                                     "value" : "Service"}}}}, 
1215  "NtCreateThread" : {"action_name" : "create thread", 
1216                      "action_vocab" : "maecVocabs:ProcessThreadActionNameVocab-1.0", 
1217                      "parameter_associated_objects" : {"ThreadHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1218                                                                          "associated_object_element" : "ID", 
1219                                                                          "association_type" : "output", 
1220                                                                          "forced" : {"associated_object_element" : "Type",  
1221                                                                                      "value" : "Thread"}}, 
1222                                                        "ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1223                                                                           "associated_object_element" : "ID", 
1224                                                                           "association_type" : "input", 
1225                                                                           "forced" : {"associated_object_element" : "Type",  
1226                                                                                       "value" : "Process"}}}, 
1227                      "parameter_associated_arguments" : {"ObjectAttributes" : {"associated_argument_name" : "Options", 
1228                                                                             "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}}}, 
1229   
1230  "NtOpenThread" : {"action_name" : "open thread", 
1231                    "parameter_associated_objects" : {"ThreadHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1232                                                                        "associated_object_element" : "ID", 
1233                                                                        "association_type" : "output", 
1234                                                                        "forced" : {"associated_object_element" : "Type",  
1235                                                                                    "value" : "Thread"}}}, 
1236                      "parameter_associated_arguments" : {"DesiredAccess" : {"associated_argument_name" : "Access Mode", 
1237                                                                             "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}, 
1238                                                          "ObjectAttributes" : {"associated_argument_name" : "Options", 
1239                                                                                "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}}}, 
1240   
1241  "NtGetContextThread" : {"action_name" : "get thread context", 
1242                          "action_vocab" : "maecVocabs:ProcessThreadActionNameVocab-1.0", 
1243                          "parameter_associated_objects" : {"ThreadHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1244                                                                              "associated_object_element" : "ID", 
1245                                                                              "association_type" : "input", 
1246                                                                              "forced" : {"associated_object_element" : "Type",  
1247                                                                                          "value" : "Thread"}}}}, 
1248   
1249  "NtSetContextThread" : {"action_name" : "set thread context", 
1250                          "action_vocab" : "maecVocabs:ProcessThreadActionNameVocab-1.0", 
1251                          "parameter_associated_objects" : {"ThreadHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1252                                                                              "associated_object_element" : "ID", 
1253                                                                              "association_type" : "input", 
1254                                                                              "forced" : {"associated_object_element" : "Type",  
1255                                                                                          "value" : "Thread"}}}}, 
1256  "NtSuspendThread" : {"action_name" : "suspend thread", 
1257                       "parameter_associated_objects" : {"ThreadHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1258                                                                           "associated_object_element" : "ID", 
1259                                                                           "association_type" : "input", 
1260                                                                           "forced" : {"associated_object_element" : "Type",  
1261                                                                                       "value" : "Thread"}}}}, 
1262  "NtResumeThread" : {"action_name" : "resume thread", 
1263                      "parameter_associated_objects" : {"ThreadHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1264                                                                          "associated_object_element" : "ID", 
1265                                                                          "association_type" : "input", 
1266                                                                          "forced" : {"associated_object_element" : "Type",  
1267                                                                                      "value" : "Thread"}}}}, 
1268  "NtTerminateThread" : {"action_name" : "kill thread", 
1269                         "action_vocab" : "maecVocabs:ProcessThreadActionNameVocab-1.0", 
1270                         "parameter_associated_objects" : {"ThreadHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1271                                                                              "associated_object_element" : "ID", 
1272                                                                              "association_type" : "input", 
1273                                                                              "forced" : {"associated_object_element" : "Type",  
1274                                                                                          "value" : "Thread"}}}}, 
1275  "CreateThread" : {"action_name" : "create thread", 
1276                    "action_vocab" : "maecVocabs:ProcessThreadActionNameVocab-1.0", 
1277                    "parameter_associated_objects" : {"ThreadId" : {"associated_object_type" : "WindowsThreadObjectType", 
1278                                                                    "associated_object_element" : "Thread_ID", 
1279                                                                    "association_type" : "output"}}, 
1280                      "parameter_associated_arguments" : {"StartRoutine" : {"associated_argument_name" : "Code Address", 
1281                                                                             "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}, 
1282                                                          "Parameter" : {"associated_argument_name" : "Options", 
1283                                                                         "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}, 
1284                                                          "CreationFlags" : {"associated_argument_name" : "Creation Flags", 
1285                                                                             "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}}}, 
1286   
1287  "CreateRemoteThread" : {"action_name" : "create remote thread in process", 
1288                          "action_vocab" : "maecVocabs:ProcessThreadActionNameVocab-1.0", 
1289                          "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1290                                                                               "associated_object_element" : "ID", 
1291                                                                               "association_type" : "input"}, 
1292                                                            "ThreadId" : {"associated_object_type" : "WindowsThreadObjectType", 
1293                                                                          "associated_object_element" : "Thread_ID", 
1294                                                                          "association_type" : "output"}}, 
1295                          "parameter_associated_arguments" : {"StartRoutine" : {"associated_argument_name" : "Code Address", 
1296                                                                             "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}, 
1297                                                          "Parameter" : {"associated_argument_name" : "Options", 
1298                                                                         "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}, 
1299                                                          "CreationFlags" : {"associated_argument_name" : "Creation Flags", 
1300                                                                             "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}}}, 
1301  "ExitThread" : {"action_name" : "exit thread"},                          
1302  "RtlCreateUserThread" : {"action_name" : "create thread", 
1303                           "action_vocab" : "maecVocabs:ProcessThreadActionNameVocab-1.0", 
1304                           "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1305                                                                                "associated_object_element" : "ID", 
1306                                                                                "association_type" : "input"}, 
1307                                                             "ThreadHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1308                                                                               "associated_object_element" : "ID", 
1309                                                                               "association_type" : "output", 
1310                                                                               "forced" : {"associated_object_element" : "Type",  
1311                                                                                           "value" : "Thread"}}, 
1312                                                             "ThreadId" : {"associated_object_type" : "WindowsThreadObjectType", 
1313                                                                           "associated_object_element" : "Thread_ID", 
1314                                                                           "association_type" : "output"}}, 
1315                           "parameter_associated_arguments" : {"CreatedSuspended" : {"associated_argument_name" : "Control Parameter", 
1316                                                                                     "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}, 
1317                                                               "StartAddress" : {"associated_argument_name" : "Code Address", 
1318                                                                                 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}, 
1319                                                               "StartParameter" : {"associated_argument_name" : "Options", 
1320                                                                              "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}}}, 
1321  "URLDownloadToFileW" : {"action_name" : "download file", 
1322                          "action_vocab" : "maecVocabs:NetworkActionNameVocab-1.0", 
1323                          "parameter_associated_objects" : {"URL" : {"associated_object_type" : "URIObjectType", 
1324                                                                     "associated_object_element" : "Value", 
1325                                                                      "association_type" : "input"}, 
1326                                                            "FileName" : {"associated_object_type" : "FileObjectType", 
1327                                                                          "associated_object_element" : "File_Path", 
1328                                                                          "association_type" : "output"}}}, 
1329  "InternetOpenA" : {"action_name" : "initialize wininet", 
1330                     "parameter_associated_objects" : {"Agent" : {"associated_object_type" : "HTTPSessionObjectType", 
1331                                                                  "associated_object_element" : "list__HTTP_Request_Response/HTTP_Client_Request/HTTP_Request_Header/Parsed_Header/User_Agent", 
1332                                                                  "association_type" : "input"}}, 
1333                     "parameter_associated_arguments" : {"AccessType" : {"associated_argument_name" : "Access Mode", 
1334                                                                          "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}, 
1335                                                         "ProxyName" : {"associated_argument_name" : "Proxy Name"}, 
1336                                                         "ProxyBypass" : {"associated_argument_name" : "Proxy Bypass"}, 
1337                                                         "Flags" : {"associated_argument_name" : "Flags"}}},  
1338  "InternetOpenW" : {"action_name" : "initialize wininet", 
1339                     "parameter_associated_objects" : {"Agent" : {"associated_object_type" : "HTTPSessionObjectType", 
1340                                                                  "associated_object_element" : "list__HTTP_Request_Response/HTTP_Client_Request/HTTP_Request_Header/Parsed_Header/User_Agent", 
1341                                                                  "association_type" : "input"}}, 
1342                     "parameter_associated_arguments" : {"AccessType" : {"associated_argument_name" : "Access Mode", 
1343                                                                          "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}, 
1344                                                         "ProxyName" : {"associated_argument_name" : "Proxy Name"}, 
1345                                                         "ProxyBypass" : {"associated_argument_name" : "Proxy Bypass"}, 
1346                                                         "Flags" : {"associated_argument_name" : "Flags"}}}, 
1347  "InternetConnectA" : {"action_name" : "connect to server", 
1348                        "parameter_associated_objects" : {"InternetHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1349                                                                              "associated_object_element" : "ID", 
1350                                                                              "association_type" : "input", 
1351                                                                              "forced" : {"associated_object_element" : "Type",  
1352                                                                                          "value" : "Internet Resource"}}, 
1353                                                          "ServerName" : {"associated_object_type" : "URIObjectType", 
1354                                                                          "associated_object_element" : "Value", 
1355                                                                          "association_type" : "input"}, 
1356                                                          "ServerPort" : {"associated_object_type" : "PortObjectType", 
1357                                                                          "associated_object_element" : "Port_Value", 
1358                                                                          "association_type" : "input"}}, 
1359                        "parameter_associated_arguments" : {"Username" : {"associated_argument_name" : "Username"}, 
1360                                                            "Password" : {"associated_argument_name" : "Password"}, 
1361                                                            "Service" : {"associated_argument_name" : "Service Type"}, 
1362                                                            "Flags" : {"associated_argument_name" : "Flags"}}}, 
1363  "InternetConnectW" : {"action_name" : "connect to server", 
1364                        "parameter_associated_objects" : {"InternetHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1365                                                                              "associated_object_element" : "ID", 
1366                                                                              "association_type" : "input", 
1367                                                                              "forced" : {"associated_object_element" : "Type",  
1368                                                                                          "value" : "Internet Resource"}}, 
1369                                                          "ServerName" : {"associated_object_type" : "URIObjectType", 
1370                                                                          "associated_object_element" : "Value", 
1371                                                                          "association_type" : "input"}, 
1372                                                          "ServerPort" : {"associated_object_type" : "PortObjectType", 
1373                                                                          "associated_object_element" : "Port_Value", 
1374                                                                          "association_type" : "input"}}, 
1375                        "parameter_associated_arguments" : {"Username" : {"associated_argument_name" : "Username"}, 
1376                                                            "Password" : {"associated_argument_name" : "Password"}, 
1377                                                            "Service" : {"associated_argument_name" : "Service Type"}, 
1378                                                            "Flags" : {"associated_argument_name" : "Flags"}}}, 
1379  "InternetOpenURLA" : {"action_name" : "connect to url", 
1380                        "action_vocab" : "maecVocabs:NetworkActionNameVocab-1.0", 
1381                        "parameter_associated_objects" : {"ConnectionHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1382                                                                                "associated_object_element" : "ID", 
1383                                                                                "association_type" : "input", 
1384                                                                                "forced" : {"associated_object_element" : "Type",  
1385                                                                                            "value" : "Internet Connection"}}, 
1386                                                          "URL" : {"associated_object_type" : "URIObjectType", 
1387                                                                   "associated_object_element" : "Value", 
1388                                                                   "association_type" : "input"}, 
1389                                                          "Headers" : {"associated_object_type" : "HTTPSessionObjectType", 
1390                                                                       "associated_object_element" : "list__HTTP_Request_Response/HTTP_Client_Request/HTTP_Request_Header/Parsed_Header/Raw_Header", 
1391                                                                       "association_type" : "input"}}, 
1392                        "parameter_associated_arguments" : {"Flags" : {"associated_argument_name" : "Flags"}}}, 
1393  "InternetOpenURLW" : {"action_name" : "connect to url", 
1394                        "action_vocab" : "maecVocabs:NetworkActionNameVocab-1.0", 
1395                        "parameter_associated_objects" : {"ConnectionHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1396                                                                                "associated_object_element" : "ID", 
1397                                                                                "association_type" : "input", 
1398                                                                                "forced" : {"associated_object_element" : "Type",  
1399                                                                                            "value" : "Internet Connection"}}, 
1400                                                          "URL" : {"associated_object_type" : "URIObjectType", 
1401                                                                   "associated_object_element" : "Value", 
1402                                                                   "association_type" : "input"}, 
1403                                                          "Headers" : {"associated_object_type" : "HTTPSessionObjectType", 
1404                                                                       "associated_object_element" : "list__HTTP_Request_Response/HTTP_Client_Request/HTTP_Request_Header/Parsed_Header/Raw_Header", 
1405                                                                       "association_type" : "input"}}, 
1406                        "parameter_associated_arguments" : {"Flags" : {"associated_argument_name" : "Flags"}}}, 
1407  "HttpOpenRequestA" : { "action_name" : "open http request", 
1408                         "parameter_associated_objects" : {"InternetHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1409                                                                               "associated_object_element" : "ID", 
1410                                                                               "association_type" : "input", 
1411                                                                               "forced" : {"associated_object_element" : "Type",  
1412                                                                                           "value" : "Internet Resource"}}, 
1413                                                           "Path" : {"associated_object_type" : "URIObjectType", 
1414                                                                     "associated_object_element" : "Value", 
1415                                                                     "association_type" : "input"}}, 
1416                          "parameter_associated_arguments" : {"Flags" : {"associated_argument_name" : "Flags"}}}, 
1417   
1418  "HttpOpenRequestW" : { "action_name" : "open http request", 
1419                         "parameter_associated_objects" : {"InternetHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1420                                                                               "associated_object_element" : "ID", 
1421                                                                               "association_type" : "input", 
1422                                                                               "forced" : {"associated_object_element" : "Type",  
1423                                                                                           "value" : "Internet Resource"}}, 
1424                                                           "Path" : {"associated_object_type" : "URIObjectType", 
1425                                                                     "associated_object_element" : "Value", 
1426                                                                     "association_type" : "input"}}, 
1427                          "parameter_associated_arguments" : {"Flags" : {"associated_argument_name" : "Flags"}}}, 
1428  "InternetReadFile" : {"action_name" : "read from internet resource", 
1429                        "parameter_associated_objects" : {"InternetHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1430                                                                              "associated_object_element" : "ID", 
1431                                                                              "association_type" : "input", 
1432                                                                              "forced" : {"associated_object_element" : "Type",  
1433                                                                                          "value" : "Internet Resource"}}}}, 
1434   
1435  "InternetWriteFile" : {"action_name" : "write to internet resource", 
1436                        "parameter_associated_objects" : {"InternetHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1437                                                                              "associated_object_element" : "ID", 
1438                                                                              "association_type" : "input", 
1439                                                                              "forced" : {"associated_object_element" : "Type",  
1440                                                                                          "value" : "Internet Resource"}}}}, 
1441   
1442  "InternetCloseHandle" : {"action_name" : "close internet resource handle", 
1443                           "parameter_associated_objects" : {"InternetHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1444                                                                                 "associated_object_element" : "ID", 
1445                                                                                 "association_type" : "input", 
1446                                                                                 "forced" : {"associated_object_element" : "Type",  
1447                                                                                             "value" : "Internet Resource"}}}}, 
1448  "HttpSendRequestA" : {"action_name" : "send http request", 
1449                        "parameter_associated_objects" : {"RequestHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1450                                                                             "associated_object_element" :  "ID", 
1451                                                                             "association_type" : "input", 
1452                                                                             "forced" : {"associated_object_element" : "Type",  
1453                                                                                          "value" : "HTTPRequest"}}, 
1454                                                          "Headers" : {"associated_object_type" : "HTTPSessionObjectType", 
1455                                                                       "associated_object_element" : "list__HTTP_Request_Response/HTTP_Client_Request/HTTP_Request_Header/Raw_Header", 
1456                                                                       "association_type" : "input"}}, 
1457                      "parameter_associated_arguments" : {"PostData" : {"associated_argument_name" : "Post Data"}}}, 
1458  "HttpSendRequestW" : {"action_name" : "send http request", 
1459                        "parameter_associated_objects" : {"RequestHandle" : {"associated_object_type" : "WindowsHandleObjectType", 
1460                                                                             "associated_object_element" :  "ID", 
1461                                                                             "association_type" : "input", 
1462                                                                             "forced" : {"associated_object_element" : "Type",  
1463                                                                                         "value" : "HTTPRequest"}}, 
1464                                                          "Headers" : {"associated_object_type" : "HTTPSessionObjectType", 
1465                                                                       "associated_object_element" : "list__HTTP_Request_Response/HTTP_Client_Request/HTTP_Request_Header/Raw_Header", 
1466                                                                       "association_type" : "input"}}, 
1467                        "parameter_associated_arguments" : {"PostData" : {"associated_argument_name" : "Post Data"}}}, 
1468  "DnsQuery_A" : {"action_name" : "send dns query", 
1469                  "action_vocab" : "maecVocabs:DNSActionNameVocab-1.0", 
1470                  "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "Name", "element_name" : "QName/Value"}, 
1471                                                                                                       {"parameter_name" : "Type", "element_name" : "QType"}], 
1472                                                                                     "associated_object_type" : "DNSQueryObjectType", 
1473                                                                                     "associated_object_element" : "Question", 
1474                                                                                     "association_type" : "input"}}, 
1475                  "parameter_associated_arguments" : {"Options" : {"associated_argument_name" : "Options"}}}, 
1476  "DnsQuery_UTF8" : {"action_name" : "send dns query", 
1477                     "action_vocab" : "maecVocabs:DNSActionNameVocab-1.0", 
1478                     "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "Name", "element_name" : "QName/Value"}, 
1479                                                                                                       {"parameter_name" : "Type", "element_name" : "QType"}], 
1480                                                                                     "associated_object_type" : "DNSQueryObjectType", 
1481                                                                                     "associated_object_element" : "Question", 
1482                                                                                     "association_type" : "input"}}, 
1483                     "parameter_associated_arguments" : {"Options" : {"associated_argument_name" : "Options"}}}, 
1484  "DnsQuery_W" : {"action_name" : "send dns query", 
1485                  "action_vocab" : "maecVocabs:DNSActionNameVocab-1.0", 
1486                  "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "Name", "element_name" : "QName/Value"}, 
1487                                                                                                       {"parameter_name" : "Type", "element_name" : "QType"}], 
1488                                                                                     "associated_object_type" : "DNSQueryObjectType", 
1489                                                                                     "associated_object_element" : "Question", 
1490                                                                                     "association_type" : "input"}}, 
1491                  "parameter_associated_arguments" : {"Options" : {"associated_argument_name" : "Options"}}}, 
1492  "getaddrinfo" : {"action_name" : "get host by name", 
1493                   "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0", 
1494                   "parameter_associated_objects" : {"NodeName" : {"associated_object_type" : "URIObjectType", 
1495                                                                   "associated_object_element" : "Value", 
1496                                                                   "association_type" : "input"}}, 
1497                   "parameter_associated_arguments" : {"ServiceName" : {"associated_argument_name" : "Service Name"}}}, 
1498  "GetAddrInfoW" : {"action_name" : "get host by name", 
1499                    "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0", 
1500                    "parameter_associated_objects" : {"NodeName" : {"associated_object_type" : "URIObjectType", 
1501                                                                   "associated_object_element" : "Value", 
1502                                                                   "association_type" : "input"}}, 
1503                    "parameter_associated_arguments" : {"ServiceName" : {"associated_argument_name" : "Service Name"}}} 
1504   
1505  } 
1506   
1507 -def hiveHexToString(hive_hex_value):
1508 """Maps a Registry Hive hex input to its String (name) equivalent""" 1509 str_val = str(hive_hex_value) 1510 if str_val == "0x80000000" or str_val == "-2147483648" or str_val == "2147483648": 1511 return "HKEY_CLASSES_ROOT" 1512 elif str_val == "0x80000001" or str_val == "-2147483647" or str_val == "2147483649": 1513 return "HKEY_CURRENT_USER" 1514 elif str_val == "0x80000002" or str_val == "-2147483646" or str_val == "2147483650": 1515 return "HKEY_LOCAL_MACHINE" 1516 elif str_val == "0x80000003" or str_val == "-2147483645" or str_val == "2147483651": 1517 return "HKEY_USERS" 1518 elif str_val == "0x80000004": 1519 return "HKEY_PERFORMANCE_DATA" 1520 elif str_val == "0x80000005" or str_val == "2147483653": 1521 return "HKEY_CURRENT_CONFIG" 1522 elif str_val == "0x80000006": 1523 return "HKEY_DYN_DATA" 1524 else: 1525 return hive_hex_value
1526
1527 -def regDatatypeToString(datatype_int_value):
1528 """Maps a Registry Datatype integer input to its String (name) equivalent""" 1529 if str(datatype_int_value) == "1": 1530 return "REG_SZ" 1531 elif str(datatype_int_value) == "2": 1532 return "REG_EXPAND_SZ" 1533 elif str(datatype_int_value) == "3": 1534 return "REG_BINARY" 1535 elif str(datatype_int_value) == "4": 1536 return "REG_DWORD" 1537 elif str(datatype_int_value) == "5": 1538 return "REG_DWORD_BIG_ENDIAN" 1539 elif str(datatype_int_value) == "6": 1540 return "REG_LINK" 1541 elif str(datatype_int_value) == "7": 1542 return "REG_MULTI_SZ" 1543 elif str(datatype_int_value) == "8": 1544 return "REG_RESOURCE_LIST" 1545 elif str(datatype_int_value) == "9": 1546 return "REG_FULL_RESOURCE_DESCRIPTOR" 1547 elif str(datatype_int_value) == "10": 1548 return "REG_RESOURCE_REQUIREMENTS_LIST" 1549 elif str(datatype_int_value) == "11": 1550 return "REG_QWORD" 1551 else: 1552 return datatype_int_value
1553 1554
1555 -def socketProtoToString(proto_int_value):
1556 """Maps a Socket Protocol integer input to its String (name) equivalent""" 1557 if str(proto_int_value) == "1": 1558 return "IPPROTO_ICMP" 1559 elif str(proto_int_value) == "2": 1560 return "IPPROTO_IGMP" 1561 elif str(proto_int_value) == "3": 1562 return "BTHPROTO_RFCOMM" 1563 elif str(proto_int_value) == "6": 1564 return "IPPROTO_TCP" 1565 elif str(proto_int_value) == "17": 1566 return "IPPROTO_UDP" 1567 elif str(proto_int_value) == "58": 1568 return "IPPROTO_ICMPV6" 1569 elif str(proto_int_value) == "113": 1570 return "IPPROTO_RM" 1571 else: 1572 return proto_int_value
1573
1574 -def socketAFToString(af_int_value):
1575 """Maps a Socket Address Family integer input to its String (name) equivalent""" 1576 if str(af_int_value) == "0": 1577 return "AF_UNSPEC" 1578 elif str(af_int_value) == "2": 1579 return "AF_INET" 1580 elif str(af_int_value) == "6": 1581 return "AF_IPX" 1582 elif str(af_int_value) == "16": 1583 return "AF_APPLETALK" 1584 elif str(af_int_value) == "17": 1585 return "AF_NETBIOS" 1586 elif str(af_int_value) == "23": 1587 return "AF_INET6" 1588 elif str(af_int_value) == "26": 1589 return "AF_IRDA" 1590 elif str(af_int_value) == "32": 1591 return "AF_BTH" 1592 else: 1593 return af_int_value
1594
1595 -def socketTypeToString(type_int_value):
1596 """Maps a Socket Type integer input to its String (name) equivalent""" 1597 if str(type_int_value) == "1": 1598 return "SOCK_STREAM" 1599 elif str(type_int_value) == "2": 1600 return "SOCK_DGRAM" 1601 elif str(type_int_value) == "3": 1602 return "SOCK_RAW" 1603 elif str(type_int_value) == "4": 1604 return "SOCK_RDM" 1605 elif str(type_int_value) == "5": 1606 return "SOCK_SEQPACKET" 1607 else: 1608 return type_int_value
1609
1610 -def intToHex(value):
1611 """Convert an integer to a hex string""" 1612 if isinstance(value, int): 1613 value = "0x{0:08x}".format(value) 1614 1615 return value
1616
1617 -def regStringToHive(reg_string):
1618 """Maps a string representing a Registry Key from a NT* API call input to its normalized hive""" 1619 normalized_key = fix_key(reg_string) 1620 return normalized_key.split("\\")[0]
1621
1622 -def regStringToKey(reg_string):
1623 """Maps a string representing a Registry Key from a NT* API call input to its normalized key portion""" 1624 normalized_key = fix_key(reg_string) 1625 return "\\".join(normalized_key.split("\\")[1:])
1626