1
2
3
4
5
6
7
8 from modules.processing.behavior import fix_key
9
10 api_call_mappings = {
11 "NtCreateFile" : {"action_name" : "create file",
12 "action_vocab" : "maecVocabs:FileActionNameVocab-1.0",
13 "parameter_associated_objects" : {"FileHandle" : {"associated_object_type" : "WindowsHandleObjectType",
14 "associated_object_element" : "ID",
15 "association_type" : "output",
16 "forced" : {"associated_object_element" : "Type",
17 "value" : "File"}},
18 "FileName" : {"associated_object_type" : "FileObjectType",
19 "associated_object_element" : "File_Path",
20 "association_type" : "output"}}},
21 "NtOpenFile" : {"action_name" : "open file",
22 "action_vocab" : "maecVocabs:FileActionNameVocab-1.0",
23 "parameter_associated_objects" : {"FileHandle" : {"associated_object_type" : "WindowsHandleObjectType",
24 "associated_object_element" : "ID",
25 "association_type" : "output",
26 "forced" : {"associated_object_element" : "Type",
27 "value" : "File"}},
28 "FileName" : {"associated_object_type" : "FileObjectType",
29 "associated_object_element" : "File_Path",
30 "association_type" : "input"}}},
31 "NtReadFile" : {"action_name" : "read from file",
32 "action_vocab" : "maecVocabs:FileActionNameVocab-1.0",
33 "parameter_associated_objects" : {"FileHandle" : {"associated_object_type" : "WindowsHandleObjectType",
34 "associated_object_element" : "ID",
35 "association_type" : "input",
36 "forced" : {"associated_object_element" : "Type",
37 "value" : "File"}}}},
38 "NtWriteFile" : {"action_name" : "write to file",
39 "action_vocab" : "maecVocabs:FileActionNameVocab-1.0",
40 "parameter_associated_objects" : {"FileHandle" : {"associated_object_type" : "WindowsHandleObjectType",
41 "associated_object_element" : "ID",
42 "association_type" : "input",
43 "forced" : {"associated_object_element" : "Type",
44 "value" : "File"}}}},
45 "NtDeleteFile" : {"action_name" : "delete file",
46 "action_vocab" : "maecVocabs:FileActionNameVocab-1.0",
47 "parameter_associated_objects" : {"FileName" : {"associated_object_type" : "FileObjectType",
48 "associated_object_element" : "File_Path",
49 "association_type" : "input"}}},
50 "NtDeviceIoControlFile" : {"action_name" : "send control code to file",
51 "action_vocab" : "maecVocabs:FileActionNameVocab-1.0",
52 "parameter_associated_objects" : {"FileHandle" : {"associated_object_type" : "WindowsHandleObjectType",
53 "associated_object_element" : "ID",
54 "association_type" : "input",
55 "forced" : {"associated_object_element" : "Type",
56 "value" : "File"}}}},
57 "NtQueryDirectoryFile" : {"action_name" : "find file",
58 "action_vocab" : "maecVocabs:FileActionNameVocab-1.0",
59 "parameter_associated_objects" : {"FileHandle" : {"associated_object_type" : "WindowsHandleObjectType",
60 "associated_object_element" : "ID",
61 "association_type" : "input",
62 "forced" : {"associated_object_element" : "Type",
63 "value" : "File"}},
64 "FileName" : {"associated_object_type" : "FileObjectType",
65 "associated_object_element" : "File_Path",
66 "association_type" : "input"}}},
67 "NtQueryInformationFile" : {"action_name" : "get file attributes",
68 "action_vocab" : "maecVocabs:FileActionNameVocab-1.0",
69 "parameter_associated_objects" : {"FileHandle" : {"associated_object_type" : "WindowsHandleObjectType",
70 "associated_object_element" : "ID",
71 "association_type" : "input",
72 "forced" : {"associated_object_element" : "Type",
73 "value" : "File"}}}},
74 "NtSetInformationFile" : {"action_name" : "set file attributes",
75 "action_vocab" : "maecVocabs:FileActionNameVocab-1.0",
76 "parameter_associated_objects" : {"FileHandle" : {"associated_object_type" : "WindowsHandleObjectType",
77 "associated_object_element" : "ID",
78 "association_type" : "input",
79 "forced" : {"associated_object_element" : "Type",
80 "value" : "File"}}}},
81 "NtCreateDirectoryObject" : {"action_name" : "create directory",
82 "action_vocab" : "maecVocabs:DirectoryActionNameVocab-1.0",
83 "parameter_associated_objects" : {"DirectoryHandle" : {"associated_object_type" : "WindowsHandleObjectType",
84 "associated_object_element" : "ID",
85 "association_type" : "output",
86 "forced" : {"associated_object_element" : "Type",
87 "value" : "File"}}}},
88 "CreateDirectoryW" : {"action_name" : "create directory",
89 "action_vocab" : "maecVocabs:DirectoryActionNameVocab-1.0",
90 "parameter_associated_objects" : {"DirectoryName" : {"associated_object_type" : "FileObjectType",
91 "associated_object_element" : "File_Path",
92 "association_type" : "output"}}},
93 "CreateDirectoryExW" : {"action_name" : "create directory",
94 "action_vocab" : "maecVocabs:DirectoryActionNameVocab-1.0",
95 "parameter_associated_objects" : {"DirectoryName" : {"associated_object_type" : "FileObjectType",
96 "associated_object_element" : "File_Path",
97 "association_type" : "output"}}},
98 "RemoveDirectoryA" : {"action_name" : "delete directory",
99 "action_vocab" : "maecVocabs:DirectoryActionNameVocab-1.0",
100 "parameter_associated_objects" : {"DirectoryName" : {"associated_object_type" : "FileObjectType",
101 "associated_object_element" : "File_Path",
102 "association_type" : "input"}}},
103 "RemoveDirectoryW" : {"action_name" : "delete directory",
104 "action_vocab" : "maecVocabs:DirectoryActionNameVocab-1.0",
105 "parameter_associated_objects" : {"DirectoryName" : {"associated_object_type" : "FileObjectType",
106 "associated_object_element" : "File_Path",
107 "association_type" : "input"}}},
108 "MoveFileWithProgressW" : {"action_name" : "move file",
109 "action_vocab" : "maecVocabs:FileActionNameVocab-1.0",
110 "parameter_associated_objects" : {"ExistingFileName" : {"associated_object_type" : "FileObjectType",
111 "associated_object_element" : "File_Path",
112 "association_type" : "input"},
113 "NewFileName" : {"associated_object_type" : "FileObjectType",
114 "associated_object_element" : "File_Path",
115 "association_type" : "output"}}},
116 "FindFirstFileExA" : {"action_name" : "find file",
117 "action_vocab" : "maecVocabs:FileActionNameVocab-1.0",
118 "parameter_associated_objects" : {"FileName" : {"associated_object_type" : "FileObjectType",
119 "associated_object_element" : "File_Path",
120 "association_type" : "input"}}},
121 "FindFirstFileExW" : {"action_name" : "find file",
122 "action_vocab" : "maecVocabs:FileActionNameVocab-1.0",
123 "parameter_associated_objects" : {"FileName" : {"associated_object_type" : "FileObjectType",
124 "associated_object_element" : "File_Path",
125 "association_type" : "input"}}},
126 "CopyFileA" : {"action_name" : "copy file",
127 "action_vocab" : "maecVocabs:FileActionNameVocab-1.0",
128 "parameter_associated_objects" : {"ExistingFileName" : {"associated_object_type" : "FileObjectType",
129 "associated_object_element" : "File_Path",
130 "association_type" : "input"},
131 "NewFileName" : {"associated_object_type" : "FileObjectType",
132 "associated_object_element" : "File_Path",
133 "association_type" : "output"}}},
134 "CopyFileW" : {"action_name" : "copy file",
135 "action_vocab" : "maecVocabs:FileActionNameVocab-1.0",
136 "parameter_associated_objects" : {"ExistingFileName" : {"associated_object_type" : "FileObjectType",
137 "associated_object_element" : "File_Path",
138 "association_type" : "input"},
139 "NewFileName" : {"associated_object_type" : "FileObjectType",
140 "associated_object_element" : "File_Path",
141 "association_type" : "output"}}},
142 "CopyFileExW" : {"action_name" : "copy file",
143 "action_vocab" : "maecVocabs:FileActionNameVocab-1.0",
144 "parameter_associated_objects" : {"ExistingFileName" : {"associated_object_type" : "FileObjectType",
145 "associated_object_element" : "File_Path",
146 "association_type" : "input"},
147 "NewFileName" : {"associated_object_type" : "FileObjectType",
148 "associated_object_element" : "File_Path",
149 "association_type" : "output"}}},
150 "DeleteFileA" : {"action_name" : "delete file",
151 "action_vocab" : "maecVocabs:FileActionNameVocab-1.0",
152 "parameter_associated_objects" : {"FileName" : {"associated_object_type" : "FileObjectType",
153 "associated_object_element" : "File_Path",
154 "association_type" : "input"}}},
155 "DeleteFileW" : {"action_name" : "delete file",
156 "action_vocab" : "maecVocabs:FileActionNameVocab-1.0",
157 "parameter_associated_objects" : {"FileName" : {"associated_object_type" : "FileObjectType",
158 "associated_object_element" : "File_Path",
159 "association_type" : "input"}}},
160 "RegOpenKeyExA" : {"action_name" : "open registry key",
161 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
162 "parameter_associated_objects" : {"Registry" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
163 "associated_object_element" : "Hive",
164 "association_type" : "input",
165 "post_processing" : "hiveHexToString"},
166 "SubKey" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
167 "associated_object_element" : "Key",
168 "association_type" : "input",},
169 "Handle" : {"associated_object_type" : "WindowsHandleObjectType",
170 "associated_object_element" : "ID",
171 "association_type" : "output",
172 "forced" : {"associated_object_element" : "Type",
173 "value" : "RegistryKey"}},
174 "group_together" : ["Registry", "SubKey"]}},
175 "RegOpenKeyExW" : {"action_name" : "open registry key",
176 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
177 "parameter_associated_objects" : {"Registry" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
178 "associated_object_element" : "Hive",
179 "association_type" : "input",
180 "post_processing" : "hiveHexToString"},
181 "SubKey" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
182 "associated_object_element" : "Key",
183 "association_type" : "input",},
184 "Handle" : {"associated_object_type" : "WindowsHandleObjectType",
185 "associated_object_element" : "ID",
186 "association_type" : "output",
187 "forced" : {"associated_object_element" : "Type",
188 "value" : "RegistryKey"}},
189 "group_together" : ["Registry", "SubKey"]}},
190 "RegCreateKeyExA" : {"action_name" : "create registry key",
191 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
192 "parameter_associated_objects" : {"Registry" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
193 "associated_object_element" : "Hive",
194 "association_type" : "output",
195 "post_processing" : "hiveHexToString"},
196 "SubKey" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
197 "associated_object_element" : "Key",
198 "association_type" : "output"},
199 "Handle" : {"associated_object_type" : "WindowsHandleObjectType",
200 "associated_object_element" : "ID",
201 "association_type" : "output",
202 "forced" : {"associated_object_element" : "Type",
203 "value" : "RegistryKey"}},
204 "group_together" : ["Registry", "SubKey"]}},
205 "RegCreateKeyExW" : {"action_name" : "create registry key",
206 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
207 "parameter_associated_objects" : {"Registry" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
208 "associated_object_element" : "Hive",
209 "association_type" : "output",
210 "post_processing" : "hiveHexToString"},
211 "SubKey" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
212 "associated_object_element" : "Key",
213 "association_type" : "output"},
214 "Handle" : {"associated_object_type" : "WindowsHandleObjectType",
215 "associated_object_element" : "ID",
216 "association_type" : "output",
217 "forced" : {"associated_object_element" : "Type",
218 "value" : "RegistryKey"}},
219 "group_together" : ["Registry", "SubKey"]}},
220 "RegDeleteKeyA" : {"action_name" : "delete registry key",
221 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
222 "parameter_associated_objects" : {"SubKey" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
223 "associated_object_element" : "Key",
224 "association_type" : "input"},
225 "Handle" : {"associated_object_type" : "WindowsHandleObjectType",
226 "associated_object_element" : "ID",
227 "association_type" : "input",
228 "forced" : {"associated_object_element" : "Type",
229 "value" : "RegistryKey"}}}},
230 "RegDeleteKeyW" : {"action_name" : "delete registry key",
231 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
232 "parameter_associated_objects" : {"SubKey" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
233 "associated_object_element" : "Key",
234 "association_type" : "input"},
235 "Handle" : {"associated_object_type" : "WindowsHandleObjectType",
236 "associated_object_element" : "ID",
237 "association_type" : "input",
238 "forced" : {"associated_object_element" : "Type",
239 "value" : "RegistryKey"}}}},
240 "RegEnumKeyW" : {"action_name" : "enumerate registry key subkeys",
241 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
242 "parameter_associated_objects" : {"Name" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
243 "associated_object_element" : "Key",
244 "association_type" : "output"},
245 "Handle" : {"associated_object_type" : "WindowsHandleObjectType",
246 "associated_object_element" : "ID",
247 "association_type" : "input",
248 "forced" : {"associated_object_element" : "Type",
249 "value" : "RegistryKey"}}}},
250 "RegEnumKeyExA" : {"action_name" : "enumerate registry key subkeys",
251 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
252 "parameter_associated_objects" : {"Name" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
253 "associated_object_element" : "Key",
254 "association_type" : "output"},
255 "Handle" : {"associated_object_type" : "WindowsHandleObjectType",
256 "associated_object_element" : "ID",
257 "association_type" : "input",
258 "forced" : {"associated_object_element" : "Type",
259 "value" : "RegistryKey"}}}},
260 "RegEnumKeyExW" : {"action_name" : "enumerate registry key subkeys",
261 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
262 "parameter_associated_objects" : {"Name" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
263 "associated_object_element" : "Key",
264 "association_type" : "output"},
265 "Handle" : {"associated_object_type" : "WindowsHandleObjectType",
266 "associated_object_element" : "ID",
267 "association_type" : "input",
268 "forced" : {"associated_object_element" : "Type",
269 "value" : "RegistryKey"}}}},
270 "RegEnumValueA" : {"action_name" : "enumerate registry key values",
271 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
272 "parameter_associated_objects" : {"Handle" : {"associated_object_type" : "WindowsHandleObjectType",
273 "associated_object_element" : "ID",
274 "association_type" : "input",
275 "forced" : {"associated_object_element" : "Type",
276 "value" : "RegistryKey"}},
277 "group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "ValueName", "element_name" : "Name"},
278 {"parameter_name" : "Type", "element_name" : "Datatype",
279 "post_processing":"regDatatypeToString"},
280 {"parameter_name" : "Data", "element_name" : "Data"}],
281 "associated_object_type" : "WindowsRegistryKeyObjectType",
282 "associated_object_element" : "Values/list__",
283 "association_type" : "output"}}},
284 "RegEnumValueW" : {"action_name" : "enumerate registry key values",
285 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
286 "parameter_associated_objects" : {"Handle" : {"associated_object_type" : "WindowsHandleObjectType",
287 "associated_object_element" : "ID",
288 "association_type" : "input",
289 "forced" : {"associated_object_element" : "Type",
290 "value" : "RegistryKey"}},
291 "group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "ValueName", "element_name" : "Name"},
292 {"parameter_name" : "Type", "element_name" : "Datatype",
293 "post_processing":"regDatatypeToString"},
294 {"parameter_name" : "Data", "element_name" : "Data"}],
295 "associated_object_type" : "WindowsRegistryKeyObjectType",
296 "associated_object_element" : "Values/list__",
297 "association_type" : "output"}}},
298 "RegSetValueExA" : {"action_name" : "modify registry key value",
299 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
300 "parameter_associated_objects" : {"Handle" : {"associated_object_type" : "WindowsHandleObjectType",
301 "associated_object_element" : "ID",
302 "association_type" : "input",
303 "forced" : {"associated_object_element" : "Type",
304 "value" : "RegistryKey"}},
305 "group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "ValueName", "element_name" : "Name"},
306 {"parameter_name" : "Type", "element_name" : "Datatype",
307 "post_processing":"regDatatypeToString"},
308 {"parameter_name" : "Buffer", "element_name" : "Data"}],
309 "associated_object_type" : "WindowsRegistryKeyObjectType",
310 "associated_object_element" : "Values/list__",
311 "association_type" : "output"}}},
312 "RegSetValueExW" : {"action_name" : "modify registry key value",
313 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
314 "parameter_associated_objects" : {"Handle" : {"associated_object_type" : "WindowsHandleObjectType",
315 "associated_object_element" : "ID",
316 "association_type" : "input",
317 "forced" : {"associated_object_element" : "Type",
318 "value" : "RegistryKey"}},
319 "group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "ValueName", "element_name" : "Name"},
320 {"parameter_name" : "Type", "element_name" : "Datatype",
321 "post_processing":"regDatatypeToString"},
322 {"parameter_name" : "Buffer", "element_name" : "Data"}],
323 "associated_object_type" : "WindowsRegistryKeyObjectType",
324 "associated_object_element" : "Values/list__",
325 "association_type" : "output"}}},
326 "RegQueryValueExA" : {"action_name" : "read registry key value",
327 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
328 "parameter_associated_objects" : {"ValueName" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
329 "associated_object_element" : "Values/list__Name",
330 "association_type" : "input"},
331 "Handle" : {"associated_object_type" : "WindowsHandleObjectType",
332 "associated_object_element" : "ID",
333 "association_type" : "input",
334 "forced" : {"associated_object_element" : "Type",
335 "value" : "RegistryKey"}},
336 "group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "Type", "element_name" : "Datatype",
337 "post_processing":"regDatatypeToString"},
338 {"parameter_name" : "Data", "element_name" : "Data"}],
339 "associated_object_type" : "WindowsRegistryKeyObjectType",
340 "associated_object_element" : "Values/list__",
341 "association_type" : "output"}}},
342 "RegQueryValueExW" : {"action_name" : "read registry key value",
343 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
344 "parameter_associated_objects" : {"ValueName" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
345 "associated_object_element" : "Values/list__Name",
346 "association_type" : "input"},
347 "Handle" : {"associated_object_type" : "WindowsHandleObjectType",
348 "associated_object_element" : "ID",
349 "association_type" : "input",
350 "forced" : {"associated_object_element" : "Type",
351 "value" : "RegistryKey"}},
352 "group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "Type", "element_name" : "Datatype",
353 "post_processing":"regDatatypeToString"},
354 {"parameter_name" : "Data", "element_name" : "Data"}],
355 "associated_object_type" : "WindowsRegistryKeyObjectType",
356 "associated_object_element" : "Values/list__",
357 "association_type" : "output"}}},
358 "RegDeleteValueA" : {"action_name" : "delete registry key value",
359 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
360 "parameter_associated_objects" : {"ValueName" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
361 "associated_object_element" : "Values/list__Name",
362 "association_type" : "input"},
363 "Handle" : {"associated_object_type" : "WindowsHandleObjectType",
364 "associated_object_element" : "ID",
365 "association_type" : "input",
366 "forced" : {"associated_object_element" : "Type",
367 "value" : "RegistryKey"}}}},
368 "RegDeleteValueW" : {"action_name" : "delete registry key value",
369 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
370 "parameter_associated_objects" : {"ValueName" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
371 "associated_object_element" : "Values/list__Name",
372 "association_type" : "input"},
373 "Handle" : {"associated_object_type" : "WindowsHandleObjectType",
374 "associated_object_element" : "ID",
375 "association_type" : "input",
376 "forced" : {"associated_object_element" : "Type",
377 "value" : "RegistryKey"}}}},
378 "RegQueryInfoKeyA" : {"action_name" : "get registry key attributes",
379 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
380 "parameter_associated_objects" : {"KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType",
381 "associated_object_element" : "ID",
382 "association_type" : "input",
383 "forced" : {"associated_object_element" : "Type",
384 "value" : "RegistryKey"}}}},
385 "RegQueryInfoKeyW" : {"action_name" : "get registry key attributes",
386 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
387 "parameter_associated_objects" : {"KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType",
388 "associated_object_element" : "ID",
389 "association_type" : "input",
390 "forced" : {"associated_object_element" : "Type",
391 "value" : "RegistryKey"}}}},
392 "RegCloseKey" : {"action_name" : "close registry key",
393 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
394 "parameter_associated_objects" : {"Handle" : {"associated_object_type" : "WindowsHandleObjectType",
395 "associated_object_element" : "ID",
396 "association_type" : "input",
397 "forced" : {"associated_object_element" : "Type",
398 "value" : "RegistryKey"}}}},
399 "NtCreateKey" : {"action_name" : "create registry key",
400 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
401 "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "ObjectAttributes", "element_name" : "Hive",
402 "post_processing": "regStringToHive"},
403 {"parameter_name" : "ObjectAttributes", "element_name" : "Key",
404 "post_processing":"regStringToKey"}],
405 "associated_object_type" : "WindowsRegistryKeyObjectType",
406 "association_type" : "output"},
407 "KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType",
408 "associated_object_element" : "ID",
409 "association_type" : "output",
410 "forced" : {"associated_object_element" : "Type",
411 "value" : "RegistryKey"}}}},
412 "NtOpenKey" : {"action_name" : "open registry key",
413 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
414 "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "ObjectAttributes", "element_name" : "Hive",
415 "post_processing": "regStringToHive"},
416 {"parameter_name" : "ObjectAttributes", "element_name" : "Key",
417 "post_processing":"regStringToKey"}],
418 "associated_object_type" : "WindowsRegistryKeyObjectType",
419 "association_type" : "input"},
420 "KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType",
421 "associated_object_element" : "ID",
422 "association_type" : "output",
423 "forced" : {"associated_object_element" : "Type",
424 "value" : "RegistryKey"}}}},
425 "NtOpenKeyEx" : {"action_name" : "open registry key",
426 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
427 "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "ObjectAttributes", "element_name" : "Hive",
428 "post_processing": "regStringToHive"},
429 {"parameter_name" : "ObjectAttributes", "element_name" : "Key",
430 "post_processing":"regStringToKey"}],
431 "associated_object_type" : "WindowsRegistryKeyObjectType",
432 "association_type" : "input"},
433 "KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType",
434 "associated_object_element" : "ID",
435 "association_type" : "output",
436 "forced" : {"associated_object_element" : "Type",
437 "value" : "RegistryKey"}}}},
438 "NtRenameKey" : {"action_name" : "rename registry key",
439 "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "NewName", "element_name" : "Hive",
440 "post_processing": "regStringToHive"},
441 {"parameter_name" : "NewName", "element_name" : "Key",
442 "post_processing":"regStringToKey"}],
443 "associated_object_type" : "WindowsRegistryKeyObjectType",
444 "association_type" : "input"},
445 "KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType",
446 "associated_object_element" : "ID",
447 "association_type" : "input",
448 "forced" : {"associated_object_element" : "Type",
449 "value" : "RegistryKey"}}}},
450 "NtReplaceKey" : {"action_name" : "save hive key to file",
451 "parameter_associated_objects" : {"NewHiveFileName" : {"associated_object_type" : "FileObjectType",
452 "associated_object_element" : "File_Path",
453 "association_type" : "output"},
454 "OldHiveFileName" : {"associated_object_type" : "FileObjectType",
455 "associated_object_element" : "File_Path",
456 "association_type" : "input"},
457 "KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType",
458 "associated_object_element" : "ID",
459 "association_type" : "input",
460 "forced" : {"associated_object_element" : "Type",
461 "value" : "RegistryKey"}}}},
462 "NtEnumerateKey" : {"action_name" : "enumerate registry key subkeys",
463 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
464 "parameter_associated_objects" : {"KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType",
465 "associated_object_element" : "ID",
466 "association_type" : "input",
467 "forced" : {"associated_object_element" : "Type",
468 "value" : "RegistryKey"}}}},
469 "NtEnumerateValueKey" : {"action_name" : "enumerate registry key values",
470 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
471 "parameter_associated_objects" : {"KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType",
472 "associated_object_element" : "ID",
473 "association_type" : "input",
474 "forced" : {"associated_object_element" : "Type",
475 "value" : "RegistryKey"}}}},
476 "NtSetValueKey" : {"action_name" : "modify registry key value",
477 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
478 "parameter_associated_objects" : {"KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType",
479 "associated_object_element" : "ID",
480 "association_type" : "input",
481 "forced" : {"associated_object_element" : "Type",
482 "value" : "RegistryKey"}},
483 "group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "ValueName", "element_name" : "Name"},
484 {"parameter_name" : "Type", "element_name" : "Datatype",
485 "post_processing":"regDatatypeToString"},
486 {"parameter_name" : "Buffer", "element_name" : "Data"}],
487 "associated_object_type" : "WindowsRegistryKeyObjectType",
488 "associated_object_element" : "Values/list__",
489 "association_type" : "output"}}},
490 "NtQueryValueKey" : {"action_name" : "read registry key value",
491 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
492 "parameter_associated_objects" : {"ValueName" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
493 "associated_object_element" : "Values/list__Name",
494 "association_type" : "input"},
495 "KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType",
496 "associated_object_element" : "ID",
497 "association_type" : "input",
498 "forced" : {"associated_object_element" : "Type",
499 "value" : "RegistryKey"}},
500 "group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "Type", "element_name" : "Datatype",
501 "post_processing":"regDatatypeToString"},
502 {"parameter_name" : "Information", "element_name" : "Data"}],
503 "associated_object_type" : "WindowsRegistryKeyObjectType",
504 "associated_object_element" : "Values/list__",
505 "association_type" : "output"}}},
506 "NtQueryMultipleValueKey" : {"action_name" : "read registry key value",
507 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
508 "parameter_associated_objects" : {"ValueName" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
509 "associated_object_element" : "Values/list__Name",
510 "association_type" : "input"},
511 "ValueBuffer" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
512 "associated_object_element" : "Values/list__Data",
513 "association_type" : "output"},
514 "KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType",
515 "associated_object_element" : "ID",
516 "association_type" : "input",
517 "forced" : {"associated_object_element" : "Type",
518 "value" : "RegistryKey"}}}},
519 "NtDeleteKey" : {"action_name" : "delete registry key",
520 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
521 "parameter_associated_objects" : {"KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType",
522 "associated_object_element" : "ID",
523 "association_type" : "input",
524 "forced" : {"associated_object_element" : "Type",
525 "value" : "RegistryKey"}}}},
526 "NtDeleteValueKey" : {"action_name" : "delete registry key value",
527 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
528 "parameter_associated_objects" : {"ValueName" : {"associated_object_type" : "WindowsRegistryKeyObjectType",
529 "associated_object_element" : "Values/list__Name",
530 "association_type" : "input"},
531 "KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType",
532 "associated_object_element" : "ID",
533 "association_type" : "input",
534 "forced" : {"associated_object_element" : "Type",
535 "value" : "RegistryKey"}}}},
536 "NtLoadKey" : {"action_name" : "load registry keys from file",
537 "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "TargetKey", "element_name" : "Hive",
538 "post_processing": "regStringToHive"},
539 {"parameter_name" : "TargetKey", "element_name" : "Key",
540 "post_processing":"regStringToKey"}],
541 "associated_object_type" : "WindowsRegistryKeyObjectType",
542 "association_type" : "input"},
543 "SourceFile" : {"associated_object_type" : "FileObjectType",
544 "associated_object_element" : "File_Path",
545 "association_type" : "input",
546 "forced" : {"associated_object_element" : "Type",
547 "value" : "RegistryKey"}}}},
548 "NtLoadKey2" : {"action_name" : "load registry keys from file",
549 "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "TargetKey", "element_name" : "Hive",
550 "post_processing": "regStringToHive"},
551 {"parameter_name" : "TargetKey", "element_name" : "Key",
552 "post_processing":"regStringToKey"}],
553 "associated_object_type" : "WindowsRegistryKeyObjectType",
554 "association_type" : "input"},
555 "SourceFile" : {"associated_object_type" : "FileObjectType",
556 "associated_object_element" : "File_Path",
557 "association_type" : "input",
558 "forced" : {"associated_object_element" : "Type",
559 "value" : "RegistryKey"}}}},
560 "NtLoadKeyEx" : {"action_name" : "load registry keys from file",
561 "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "TargetKey", "element_name" : "Hive",
562 "post_processing": "regStringToHive"},
563 {"parameter_name" : "TargetKey", "element_name" : "Key",
564 "post_processing":"regStringToKey"}],
565 "associated_object_type" : "WindowsRegistryKeyObjectType",
566 "association_type" : "input"},
567 "SourceFile" : {"associated_object_type" : "FileObjectType",
568 "associated_object_element" : "File_Path",
569 "association_type" : "input",
570 "forced" : {"associated_object_element" : "Type",
571 "value" : "RegistryKey"}}}},
572 "NtQueryKey" : {"action_name" : "get registry key attributes",
573 "action_vocab" : "maecVocabs:RegistryActionNameVocab-1.0",
574 "parameter_associated_objects" : {"KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType",
575 "associated_object_element" : "ID",
576 "association_type" : "input",
577 "forced" : {"associated_object_element" : "Type",
578 "value" : "RegistryKey"}}}},
579 "NtSaveKey" : {"action_name" : "save registry key subtree to file",
580 "parameter_associated_objects" : {"KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType",
581 "associated_object_element" : "ID",
582 "association_type" : "input"},
583 "FileHandle" : {"associated_object_type" : "WindowsHandleObjectType",
584 "associated_object_element" : "ID",
585 "association_type" : "input",
586 "forced" : {"associated_object_element" : "Type",
587 "value" : "RegistryKey"}}}},
588 "NtSaveKeyEx" : {"action_name" : "save registry key subtree to file",
589 "parameter_associated_objects" : {"KeyHandle" : {"associated_object_type" : "WindowsHandleObjectType",
590 "associated_object_element" : "ID",
591 "association_type" : "input"},
592 "FileHandle" : {"associated_object_type" : "WindowsHandleObjectType",
593 "associated_object_element" : "ID",
594 "association_type" : "input",
595 "forced" : {"associated_object_element" : "Type",
596 "value" : "Process"}}}},
597 "NtCreateProcess" : {"action_name" : "create process",
598 "action_vocab" : "maecVocabs:ProcessActionNameVocab-1.0",
599 "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType",
600 "associated_object_element" : "ID",
601 "association_type" : "output",
602 "forced" : {"associated_object_element" : "Type",
603 "value" : "Process"}},
604 "FileName" : {"associated_object_type" : "FileObjectType",
605 "associated_object_element" : "File_Path",
606 "association_type" : "input"}}},
607 "NtCreateProcessEx" : {"action_name" : "create process",
608 "action_vocab" : "maecVocabs:ProcessActionNameVocab-1.0",
609 "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType",
610 "associated_object_element" : "ID",
611 "association_type" : "output",
612 "forced" : {"associated_object_element" : "Type",
613 "value" : "Process"}},
614 "FileName" : {"associated_object_type" : "FileObjectType",
615 "associated_object_element" : "File_Path",
616 "association_type" : "input"}}},
617 "NtCreateUserProcess" : {"action_name" : "create process",
618 "action_vocab" : "maecVocabs:ProcessActionNameVocab-1.0",
619 "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType",
620 "associated_object_element" : "ID",
621 "association_type" : "output",
622 "forced" : {"associated_object_element" : "Type",
623 "value" : "Process"}},
624 "ThreadHandle" : {"associated_object_type" : "WindowsHandleObjectType",
625 "associated_object_element" : "ID",
626 "association_type" : "output",
627 "forced" : {"associated_object_element" : "Type",
628 "value" : "Thread"}},
629 "ThreadName" : {"associated_object_type" : "WindowsThreadObjectType",
630 "associated_object_element" : "Thread_ID",
631 "association_type" : "output"},
632 "group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "ProcessFileName", "element_name" : "File_Name",},
633 {"parameter_name" : "ImagePathName", "element_name" : "Path"}],
634 "associated_object_type" : "ProcessObjectType",
635 "associated_object_element" : "Image_Info",
636 "association_type" : "output"}}},
637 "RtlCreateUserProcess" : {"action_name" : "create process",
638 "action_vocab" : "maecVocabs:ProcessActionNameVocab-1.0",
639 "parameter_associated_objects" : {"ParentProcess" : {"associated_object_type" : "WindowsHandleObjectType",
640 "associated_object_element" : "ID",
641 "association_type" : "output",
642 "forced" : {"associated_object_element" : "Type",
643 "value" : "Process"}},
644 "ImagePath" : {"associated_object_type" : "ProcessObjectType",
645 "associated_object_element" : "Image_Info/Path",
646 "association_type" : "input"}}},
647 "NtOpenProcess" : {"action_name" : "open process",
648 "action_vocab" : "maecVocabs:ProcessActionNameVocab-1.0",
649 "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType",
650 "associated_object_element" : "ID",
651 "association_type" : "output",
652 "forced" : {"associated_object_element" : "Type",
653 "value" : "Process"}},
654 "ProcessIdentifier" : {"associated_object_type" : "ProcessObjectType",
655 "associated_object_element" : "PID",
656 "association_type" : "input"}}},
657 "NtTerminateProcess" : {"action_name" : "kill process",
658 "action_vocab" : "maecVocabs:ProcessActionNameVocab-1.0",
659 "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType",
660 "associated_object_element" : "ID",
661 "association_type" : "input",
662 "forced" : {"associated_object_element" : "Type",
663 "value" : "Process"}}}},
664 "NtCreateSection" : {"action_name" : "create section",
665 "parameter_associated_objects" : {"SectionHandle" : {"associated_object_type" : "WindowsHandleObjectType",
666 "associated_object_element" : "ID",
667 "association_type" : "output",
668 "forced" : {"associated_object_element" : "Type",
669 "value" : "Section"}},
670 "FileHandle" : {"associated_object_type" : "WindowsHandleObjectType",
671 "associated_object_element" : "ID",
672 "association_type" : "input",
673 "forced" : {"associated_object_element" : "Type",
674 "value" : "File"}}}},
675 "NtOpenSection" : {"action_name" : "open section",
676 "parameter_associated_objects" : {"SectionHandle" : {"associated_object_type" : "WindowsHandleObjectType",
677 "associated_object_element" : "ID",
678 "association_type" : "output",
679 "forced" : {"associated_object_element" : "Type",
680 "value" : "Section"}},
681 "ObjectAttributes" : {"associated_object_type" : "MemoryObjectType",
682 "associated_object_element" : "Name",
683 "association_type" : "input"}}},
684 "CreateProcessInternalW" : {"action_name" : "create process",
685 "action_vocab" : "maecVocabs:ProcessActionNameVocab-1.0",
686 "parameter_associated_objects" : {"ProcessId" : {"associated_object_type" : "WindowsProcessObjectType",
687 "associated_object_element" : "PID",
688 "association_type" : "output"},
689 "ThreadId" : {"associated_object_type" : "WindowsThreadObjectType",
690 "associated_object_element" : "Thread_ID",
691 "association_type" : "output"},
692 "ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType",
693 "associated_object_element" : "ID",
694 "association_type" : "output",
695 "forced" : {"associated_object_element" : "Type",
696 "value" : "Process"}},
697 "ThreadHandle" : {"associated_object_type" : "WindowsHandleObjectType",
698 "associated_object_element" : "ID",
699 "association_type" : "output",
700 "forced" : {"associated_object_element" : "Type",
701 "value" : "Thread"}}},
702 "parameter_associated_arguments" : {"ApplicationName" : {"associated_argument_name" : "Application Name"}}},
703 "ExitProcess" : {"action_name" : "kill process",
704 "action_vocab" : "maecVocabs:ProcessActionNameVocab-1.0",
705 "parameter_associated_arguments" : {"ExitCode" : {"associated_argument_name" : "Exit Code"}}},
706
707 "ShellExecuteExW" : {"action_name" : "create process",
708 "action_vocab" : "maecVocabs:ProcessActionNameVocab-1.0",
709 "parameter_associated_objects" : {"FilePath" : {"associated_object_type" : "FileObjectType",
710 "associated_object_element" : "File_Path",
711 "association_type" : "input" }}},
712 "NtUnmapViewOfSection" : {"action_name" : "unmap view of section",
713 "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType",
714 "associated_object_element" : "ID",
715 "association_type" : "input",
716 "forced" : {"associated_object_element" : "Type",
717 "value" : "Process"}}}},
718 "NtAllocateVirtualMemory" : {"action_name" : "allocate process virtual memory",
719 "action_vocab" : "maecVocabs:ProcessMemoryActionNameVocab-1.0",
720 "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType",
721 "associated_object_element" : "ID",
722 "association_type" : "input",
723 "forced" : {"associated_object_element" : "Type",
724 "value" : "Process"}}}},
725 "NtReadVirtualMemory" : {"action_name" : "read from process memory",
726 "action_vocab" : "maecVocabs:ProcessMemoryActionNameVocab-1.0",
727 "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType",
728 "associated_object_element" : "ID",
729 "association_type" : "input",
730 "forced" : {"associated_object_element" : "Type",
731 "value" : "Process"}}}},
732 "ReadProcessMemory" : {"action_name" : "read from process memory",
733 "action_vocab" : "maecVocabs:ProcessMemoryActionNameVocab-1.0",
734 "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType",
735 "associated_object_element" : "ID",
736 "association_type" : "input",
737 "forced" : {"associated_object_element" : "Type",
738 "value" : "Process"}}}},
739 "NtWriteVirtualMemory" : {"action_name" : "write to process memory",
740 "action_vocab" : "maecVocabs:ProcessMemoryActionNameVocab-1.0",
741 "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType",
742 "associated_object_element" : "ID",
743 "association_type" : "input",
744 "forced" : {"associated_object_element" : "Type",
745 "value" : "Process"}}}},
746 "WriteProcessMemory" : {"action_name" : "write to process memory",
747 "action_vocab" : "maecVocabs:ProcessMemoryActionNameVocab-1.0",
748 "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType",
749 "associated_object_element" : "ID",
750 "association_type" : "input",
751 "forced" : {"associated_object_element" : "Type",
752 "value" : "Process"}}}},
753 "NtProtectVirtualMemory" : {"action_name" : "modify process virtual memory protection",
754 "action_vocab" : "maecVocabs:ProcessMemoryActionNameVocab-1.0",
755 "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType",
756 "associated_object_element" : "ID",
757 "association_type" : "input",
758 "forced" : {"associated_object_element" : "Type",
759 "value" : "Process"}}}},
760 "VirtualProtectEx" : {"action_name" : "modify process virtual memory protection",
761 "action_vocab" : "maecVocabs:ProcessMemoryActionNameVocab-1.0",
762 "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType",
763 "associated_object_element" : "ID",
764 "association_type" : "input",
765 "forced" : {"associated_object_element" : "Type",
766 "value" : "Process"}}}},
767 "NtFreeVirtualMemory" : {"action_name" : "free process virtual memory",
768 "action_vocab" : "maecVocabs:ProcessMemoryActionNameVocab-1.0",
769 "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType",
770 "associated_object_element" : "ID",
771 "association_type" : "input",
772 "forced" : {"associated_object_element" : "Type",
773 "value" : "Process"}}}},
774 "VirtualFreeEx" : {"action_name" : "free process virtual memory",
775 "action_vocab" : "maecVocabs:ProcessMemoryActionNameVocab-1.0",
776 "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType",
777 "associated_object_element" : "ID",
778 "association_type" : "input",
779 "forced" : {"associated_object_element" : "Type",
780 "value" : "Process"}}}},
781 "FindWindowA" : {"action_name" : "find window",
782 "action_vocab" : "maecVocabs:GUIActionNameVocab-1.0",
783 "parameter_associated_objects" : {"WindowName" : {"associated_object_type" : "GUIWindowObjectType",
784 "associated_object_element" : "Window_Display_Name",
785 "association_type" : "input"}}},
786 "FindWindowW" : {"action_name" : "find window",
787 "action_vocab" : "maecVocabs:GUIActionNameVocab-1.0",
788 "parameter_associated_objects" : {"WindowName" : {"associated_object_type" : "GUIWindowObjectType",
789 "associated_object_element" : "Window_Display_Name",
790 "association_type" : "input"}}},
791 "FindWindowExA" : {"action_name" : "find window",
792 "action_vocab" : "maecVocabs:GUIActionNameVocab-1.0",
793 "parameter_associated_objects" : {"WindowName" : {"associated_object_type" : "GUIWindowObjectType",
794 "associated_object_element" : "Window_Display_Name",
795 "association_type" : "input"}}},
796 "FindWindowExW" : {"action_name" : "find window",
797 "action_vocab" : "maecVocabs:GUIActionNameVocab-1.0",
798 "parameter_associated_objects" : {"WindowName" : {"associated_object_type" : "GUIWindowObjectType",
799 "associated_object_element" : "Window_Display_Name",
800 "association_type" : "input"}}},
801 "SetWindowsHookExA" : {"action_name" : "add windows hook",
802 "action_vocab" : "maecVocabs:HookingActionNameVocab-1.0",
803 "parameter_associated_objects" : {"HookIdentifier" : {"associated_object_type" : "WindowsKernelHookObjectType",
804 "associated_object_element" : "Type",
805 "association_type" : "input"},
806 "ProcedureAddress" : {"associated_object_type" : "WindowsKernelHookObjectType",
807 "associated_object_element" : "Hooking_Address",
808 "association_type" : "input"},
809 "ThreadId" : {"associated_object_type" : "WindowsThreadObjectType",
810 "associated_object_element" : "Thread_ID",
811 "association_type" : "input"},
812 "group_together" : ["HookIdentifier", "ProcedureAddress"]}},
813 "SetWindowsHookExW" : {"action_name" : "add windows hook",
814 "action_vocab" : "maecVocabs:HookingActionNameVocab-1.0",
815 "parameter_associated_objects" : {"HookIdentifier" : {"associated_object_type" : "WindowsKernelHookObjectType",
816 "associated_object_element" : "Type",
817 "association_type" : "input"},
818 "ProcedureAddress" : {"associated_object_type" : "WindowsKernelHookObjectType",
819 "associated_object_element" : "Hooking_Address",
820 "association_type" : "input"},
821 "ThreadId" : {"associated_object_type" : "WindowsThreadObjectType",
822 "associated_object_element" : "Thread_ID",
823 "association_type" : "input"},
824 "group_together" : ["HookIdentifier", "ProcedureAddress"]}},
825 "UnhookWindowsHookEx" : {"action_name" : "remove windows hook",
826 "parameter_associated_objects" : {"HookHandle" : {"associated_object_type" : "WindowsHandleObjectType",
827 "associated_object_element" : "ID",
828 "association_type" : "input",
829 "forced" : {"associated_object_element" : "Type",
830 "value" : "Hook"}}}},
831 "LdrLoadDll" : {"action_name" : "load library",
832 "action_vocab" : "maecVocabs:LibraryActionNameVocab-1.0",
833 "parameter_associated_objects" : {"FileName" : {"associated_object_type" : "LibraryObjectType",
834 "associated_object_element" : "Name",
835 "association_type" : "input"},
836 "BaseAddress" : {"associated_object_type" : "WindowsHandleObjectType",
837 "associated_object_element" : "ID",
838 "association_type" : "output",
839 "forced" : {"associated_object_element" : "Type",
840 "value" : "Module"}}}},
841 "LdrGetDllHandle" : {"action_name" : "get dll handle",
842 "parameter_associated_objects" : {"FileName" : {"associated_object_type" : "LibraryObjectType",
843 "associated_object_element" : "Name",
844 "association_type" : "input"},
845 "ModuleHandle" : {"associated_object_type" : "WindowsHandleObjectType",
846 "associated_object_element" : "ID",
847 "association_type" : "output",
848 "forced" : {"associated_object_element" : "Type",
849 "value" : "Module"}}}},
850 "LdrGetProcedureAddress" : {"action_name" : "get function address",
851 "action_vocab" : "maecVocabs:LibraryActionNameVocab-1.0",
852 "parameter_associated_objects" : {"ModuleHandle" : {"associated_object_type" : "WindowsHandleObjectType",
853 "associated_object_element" : "ID",
854 "association_type" : "input",
855 "forced" : {"associated_object_element" : "Type",
856 "value" : "Module"}},
857 "FunctionAddress" : {"associated_object_type" : "APIObjectType",
858 "associated_object_element" : "Address",
859 "association_type" : "output",
860 "post_processing" : "intToHex"},
861 "group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "FunctionName", "element_name" : "Function_Name"},
862 {"parameter_name" : "Ordinal", "element_name" : "Ordinal"}],
863 "associated_object_type" : "WindowsExecutableFileObjectType",
864 "associated_object_element" : "Exports/Exported_Functions/list__",
865 "association_type" : "input"}}},
866 "DeviceIoControl" : {"action_name" : "send control code to driver",
867 "parameter_associated_objects" : {"DeviceHandle" : {"associated_object_type" : "WindowsHandleObjectType",
868 "associated_object_element" : "ID",
869 "association_type" : "input",
870 "forced" : {"associated_object_element" : "Type",
871 "value" : "Device"}}},
872 "parameter_associated_arguments" : {"IoControlCode" : {"associated_argument_name" : "Control Code",
873 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}}},
874 "ExitWindowsEx" : {"action_name" : "shutdown system",
875 "action_vocab" : "maecVocabs:SystemActionNameVocab-1.0",
876 "parameter_associated_arguments" : {"Flags" : {"associated_argument_name" : "Flags"},
877 "Reason" : {"associated_argument_name" : "Reason"}}},
878 "IsDebuggerPresent" : {"action_name" : "check for remote debugger",
879 "action_vocab" : "maecVocabs:DebuggingActionNameVocab-1.0"},
880 "LookupPrivilegeValueW" : {"action_name" : "find privilege value",
881 "parameter_associated_objects" : {"SystemName" : {"associated_object_type" : "SystemObjectType",
882 "associated_object_element" : "Hostname",
883 "association_type" : "input"}},
884 "parameter_associated_arguments" : {"PrivilegeName" : {"associated_argument_name" : "Privilege Name"}}},
885 "NtClose" : {"action_name" : "close handle",
886 "parameter_associated_objects" : {"Handle" : {"associated_object_type" : "WindowsHandleObjectType",
887 "associated_object_element" : "ID",
888 "association_type" : "input"}}},
889 "WriteConsoleA" : {"action_name" : "write to console",
890 "parameter_associated_objects" : {"ConsoleHandle" : {"associated_object_type" : "WindowsHandleObjectType",
891 "associated_object_element" : "ID",
892 "association_type" : "input",
893 "forced" : {"associated_object_element" : "Type",
894 "value" : "Console"}}}},
895 "WriteConsoleW" : {"action_name" : "write to console",
896 "parameter_associated_objects" : {"ConsoleHandle" : {"associated_object_type" : "WindowsHandleObjectType",
897 "associated_object_element" : "ID",
898 "association_type" : "input",
899 "forced" : {"associated_object_element" : "Type",
900 "value" : "Console"}}}},
901 "ZwMapViewOfSection" : {"action_name" : "map view of section",
902 "parameter_associated_objects" : {"SectionHandle" : {"associated_object_type" : "WindowsHandleObjectType",
903 "associated_object_element" : "ID",
904 "association_type" : "input",
905 "forced" : {"associated_object_element" : "Type",
906 "value" : "Section"}},
907 "ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType",
908 "associated_object_element" : "ID",
909 "association_type" : "input",
910 "forced" : {"associated_object_element" : "Type",
911 "value" : "Process"}}},
912 "parameter_associated_arguments" : {"BaseAddress" : {"associated_argument_name" : "Base Address",
913 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"},
914 "SectionOffset" : {"associated_argument_name" : "Section Offset"}}},
915 "GetSystemMetrics" : {"action_name" : "get system metrics",
916 "parameter_associated_arguments" : {"SystemMetricIndex" : {"associated_argument_name" : "System Metric Index"}}},
917 "NtDelayExecution" : {"action_name" : "delay execution",
918 "parameter_associated_arguments" : {"Milliseconds" : {"associated_argument_name" : "Milliseconds"}}},
919 "GetLocalTime" : {"action_name" : "get system local time",
920 "action_vocab" : "maecVocabs:SystemActionNameVocab-1.0"},
921 "GetSystemTime" : {"action_name" : "get system time",
922 "action_vocab" : "maecVocabs:SystemActionNameVocab-1.0"},
923 "GetTickCount" : {"action_name" : "get tick count"},
924 "NtQuerySystemTime" : {"action_name" : "get system time",
925 "action_vocab" : "maecVocabs:SystemActionNameVocab-1.0"},
926 "WSAStartup" : {"action_name" : "initialize winsock",
927 "parameter_associated_arguments" : {"VersionRequested" : {"associated_argument_name" : "Version Requested"}}},
928 "gethostbyname" : {"action_name" : "get host by name",
929 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0",
930 "parameter_associated_arguments" : {"Name" : {"associated_argument_name" : "Hostname",
931 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}}},
932 "socket" : {"action_name" : "create socket",
933 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0",
934 "parameter_associated_objects" : {"type" : {"associated_object_type" : "NetworkSocketObjectType",
935 "associated_object_element" : "Type",
936 "association_type" : "output",
937 "post_processing" : "socketTypeToString"},
938 "af" : {"associated_object_type" : "NetworkSocketObjectType",
939 "associated_object_element" : "Address_Family",
940 "association_type" : "output",
941 "post_processing" : "socketAFToString"},
942 "protocol" : {"associated_object_type" : "NetworkSocketObjectType",
943 "associated_object_element" : "Protocol",
944 "association_type" : "output",
945 "post_processing" : "socketProtoToString"},
946 "group_together" : ["type", "protocol", "af"]}},
947 "connect" : {"action_name" : "connect to socket",
948 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0",
949 "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}},
950 "send" : {"action_name" : "send data on socket",
951 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0",
952 "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"},
953 "buffer" : {"associated_argument_name" : "Data Buffer"}}},
954 "sendto" : {"action_name" : "send data to address on socket",
955 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0",
956 "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"},
957 "buffer" : {"associated_argument_name" : "Data Buffer"}}},
958 "recv" : {"action_name" : "receive data on socket",
959 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0",
960 "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"},
961 "buffer" : {"associated_argument_name" : "Data Buffer"}}},
962 "recvfrom" : {"action_name" : "receive data on socket",
963 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0",
964 "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"},
965 "buffer" : {"associated_argument_name" : "Data Buffer"}}},
966 "accept" : {"action_name" : "accept socket connection",
967 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0",
968 "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}},
969 "bind" : {"action_name" : "bind address to socket",
970 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0",
971 "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "ip", "element_name" : "IP_Address/Address_Value"},
972 {"parameter_name" : "port", "element_name" : "Port/Port_Value"}],
973 "associated_object_type" : "NetworkSocketObjectType",
974 "associated_object_element" : "Local_Address",
975 "association_type" : "input"}},
976 "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}},
977 "listen" : {"action_name" : "listen on socket",
978 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0",
979 "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}},
980 "select" : {"action_name" : "check for ready sockets",
981 "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}},
982 "setsockopt" : {"action_name" : "set socket option",
983 "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}},
984 "ioctlsocket" : {"action_name" : "send command to socket",
985 "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"},
986 "command" : {"associated_argument_name" : "Command"}}},
987 "closesocket" : {"action_name" : "close socket",
988 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0",
989 "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}},
990 "shutdown" : {"action_name" : "disable socket operation",
991 "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"},
992 "how" : {"associated_argument_name" : "Operation"}}},
993 "WSARecv" : {"action_name" : "receive data on socket",
994 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0",
995 "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}},
996 "WSARecvFrom" : {"action_name" : "receive data on socket",
997 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0",
998 "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}},
999 "WSASend" : {"action_name" : "send data on socket",
1000 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0",
1001 "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}},
1002 "WSASendTo" : {"action_name" : "send data on socket",
1003 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0",
1004 "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}},
1005 "WSASocketA" : {"action_name" : "create socket",
1006 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0",
1007 "parameter_associated_objects" : {"type" : {"associated_object_type" : "NetworkSocketObjectType",
1008 "associated_object_element" : "Type",
1009 "association_type" : "output",
1010 "post_processing" : "socketTypeToString"},
1011 "af" : {"associated_object_type" : "NetworkSocketObjectType",
1012 "associated_object_element" : "Address_Family",
1013 "association_type" : "output",
1014 "post_processing" : "socketAFToString"},
1015 "protocol" : {"associated_object_type" : "NetworkSocketObjectType",
1016 "associated_object_element" : "Protocol",
1017 "association_type" : "output",
1018 "post_processing" : "socketProtoToString"},
1019 "group_together" : ["type", "protocol", "af"]}},
1020 "WSASocketW" : {"action_name" : "create socket",
1021 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0",
1022 "parameter_associated_objects" : {"type" : {"associated_object_type" : "NetworkSocketObjectType",
1023 "associated_object_element" : "Type",
1024 "association_type" : "output",
1025 "post_processing" : "socketTypeToString"},
1026 "af" : {"associated_object_type" : "NetworkSocketObjectType",
1027 "associated_object_element" : "Address_Family",
1028 "association_type" : "output",
1029 "post_processing" : "socketAFToString"},
1030 "protocol" : {"associated_object_type" : "NetworkSocketObjectType",
1031 "associated_object_element" : "Protocol",
1032 "association_type" : "output",
1033 "post_processing" : "socketProtoToString"},
1034 "group_together" : ["type", "protocol", "af"]}},
1035 "ConnectEx" : {"action_name" : "connect to socket",
1036 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0",
1037 "parameter_associated_arguments" : {"socket" : {"associated_argument_name" : "Socket Descriptor"}}},
1038 "TransmitFile" : {"action_name" : "send file over socket",
1039 "parameter_associated_objects" : {"socket" : {"associated_object_type" : "WindowsHandleObjectType",
1040 "associated_object_element" : "ID",
1041 "association_type" : "input"},
1042 "FileHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1043 "associated_object_element" : "ID",
1044 "association_type" : "input",
1045 "forced" : {"associated_object_element" : "Type",
1046 "value" : "File"}},
1047 "NumberOfBytesToWrite" : {"associated_object_type" : "FileObjectType",
1048 "associated_object_element" : "Size_In_Bytes",
1049 "association_type" : "output"}},
1050 "parameter_associated_arguments" : {"NumberOfBytesPerSend" : {"associated_argument_name" : "Send Data Block Size"}}},
1051 "NtCreateMutant" : {"action_name" : "create mutex",
1052 "action_vocab" : "maecVocabs:SynchronizationActionNameVocab-1.0",
1053 "parameter_associated_objects" : {"Handle" : {"associated_object_type" : "WindowsHandleObjectType",
1054 "associated_object_element" : "ID",
1055 "association_type" : "output",
1056 "forced" : {"associated_object_element" : "Type",
1057 "value" : "Mutex"}},
1058 "MutexName" : {"associated_object_type" : "WindowsMutexObjectType",
1059 "associated_object_element" : "Name",
1060 "association_type" : "output"}},
1061 "parameter_associated_arguments" : {"InitialOwner" : {"associated_argument_name" : "Initial Owner"}}},
1062 "NtOpenMutant" : {"action_name" : "open mutex",
1063 "action_vocab" : "maecVocabs:SynchronizationActionNameVocab-1.0",
1064 "parameter_associated_objects" : {"Handle" : {"associated_object_type" : "WindowsHandleObjectType",
1065 "associated_object_element" : "ID",
1066 "association_type" : "output",
1067 "forced" : {"associated_object_element" : "Type",
1068 "value" : "Mutex"}},
1069 "MutexName" : {"associated_object_type" : "WindowsMutexObjectType",
1070 "associated_object_element" : "Name",
1071 "association_type" : "input"}}},
1072 "NtCreateNamedPipeFile" : {"action_name" : "create named pipe",
1073 "action_vocab" : "maecVocabs:IPCActionNameVocab-1.0",
1074 "parameter_associated_objects" : {"NamedPipeHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1075 "associated_object_element" : "ID",
1076 "association_type" : "output",
1077 "forced" : {"associated_object_element" : "Type",
1078 "value" : "NamedPipe"}},
1079 "PipeName" : {"associated_object_type" : "WindowsPipeObjectType",
1080 "associated_object_element" : "Name",
1081 "association_type" : "output"}},
1082 "parameter_associated_arguments" : {"DesiredAccess" : {"associated_argument_name" : "Access Mode",
1083 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"},
1084 "ShareAccess" : {"associated_argument_name" : "Share Access Mode"}}},
1085 "OpenSCManagerA" : {"action_name" : "open service control manager",
1086 "parameter_associated_objects" : {"MachineName" : {"associated_object_type" : "SystemObjectType",
1087 "associated_object_element" : "Hostname",
1088 "association_type" : "input"}},
1089 "parameter_associated_arguments" : {"DesiredAccess" : {"associated_argument_name" : "Access Mode",
1090 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"},
1091 "DatabaseName" : {"associated_argument_name" : "Database Name"}}},
1092 "OpenSCManagerW" : {"action_name" : "open service control manager",
1093 "parameter_associated_objects" : {"MachineName" : {"associated_object_type" : "SystemObjectType",
1094 "associated_object_element" : "Hostname",
1095 "association_type" : "input"}},
1096 "parameter_associated_arguments" : {"DesiredAccess" : {"associated_argument_name" : "Access Mode",
1097 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"},
1098 "DatabaseName" : {"associated_argument_name" : "Database Name"}}},
1099 "CreateServiceA" : {"action_name" : "create service",
1100 "action_vocab" : "maecVocabs:ServiceActionNameVocab-1.0",
1101 "parameter_associated_objects" : {"ServiceControlHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1102 "associated_object_element" : "ID",
1103 "association_type" : "input",
1104 "forced" : {"associated_object_element" : "Type",
1105 "value" : "ServiceControlManager"}},
1106 "ServiceName" : {"associated_object_type" : "WindowsServiceObjectType",
1107 "associated_object_element" : "Service_Name",
1108 "association_type" : "output"},
1109 "DisplayName" : {"associated_object_type" : "WindowsServiceObjectType",
1110 "associated_object_element" : "Display_Name",
1111 "association_type" : "output"},
1112 "ServiceType" : {"associated_object_type" : "WindowsServiceObjectType",
1113 "associated_object_element" : "Service_Type",
1114 "association_type" : "output"},
1115 "StartType" : {"associated_object_type" : "WindowsServiceObjectType",
1116 "associated_object_element" : "Startup_Type",
1117 "association_type" : "output"},
1118 "ServiceStartName" : {"associated_object_type" : "WindowsServiceObjectType",
1119 "associated_object_element" : "Started_As",
1120 "association_type" : "output"},
1121 "BinaryPathName" : {"associated_object_type" : "WindowsServiceObjectType",
1122 "associated_object_element" : "Image_Info/Path",
1123 "association_type" : "output"},
1124 "group_together" : ["ServiceName", "DisplayName", "ServiceType",
1125 "StartType", "ServiceStartName", "BinaryPathName"]},
1126 "parameter_associated_arguments" : {"DesiredAccess" : {"associated_argument_name" : "Access Mode",
1127 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"},
1128 "ErrorControl" : {"associated_argument_name" : "Error Control"}}},
1129 "CreateServiceW" : {"action_name" : "create service",
1130 "action_vocab" : "maecVocabs:ServiceActionNameVocab-1.0",
1131 "parameter_associated_objects" : {"ServiceControlHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1132 "associated_object_element" : "ID",
1133 "association_type" : "input",
1134 "forced" : {"associated_object_element" : "Type",
1135 "value" : "ServiceControlManager"}},
1136 "ServiceName" : {"associated_object_type" : "WindowsServiceObjectType",
1137 "associated_object_element" : "Service_Name",
1138 "association_type" : "output"},
1139 "DisplayName" : {"associated_object_type" : "WindowsServiceObjectType",
1140 "associated_object_element" : "Display_Name",
1141 "association_type" : "output"},
1142 "ServiceType" : {"associated_object_type" : "WindowsServiceObjectType",
1143 "associated_object_element" : "Service_Type",
1144 "association_type" : "output"},
1145 "StartType" : {"associated_object_type" : "WindowsServiceObjectType",
1146 "associated_object_element" : "Startup_Type",
1147 "association_type" : "output"},
1148 "ServiceStartName" : {"associated_object_type" : "WindowsServiceObjectType",
1149 "associated_object_element" : "Started_As",
1150 "association_type" : "output"},
1151 "BinaryPathName" : {"associated_object_type" : "WindowsServiceObjectType",
1152 "associated_object_element" : "Image_Info/Path",
1153 "association_type" : "output"},
1154 "group_together" : ["ServiceName", "DisplayName", "ServiceType",
1155 "StartType", "ServiceStartName", "BinaryPathName"]},
1156 "parameter_associated_arguments" : {"DesiredAccess" : {"associated_argument_name" : "Access Mode",
1157 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"},
1158 "ErrorControl" : {"associated_argument_name" : "Error Control"}}},
1159 "OpenServiceA" : {"action_name" : "open service",
1160 "action_vocab" : "maecVocabs:ServiceActionNameVocab-1.0",
1161 "parameter_associated_objects" : {"ServiceControlManager" : {"associated_object_type" : "WindowsHandleObjectType",
1162 "associated_object_element" : "ID",
1163 "association_type" : "input",
1164 "forced" : {"associated_object_element" : "Type",
1165 "value" : "ServiceControlManager"}},
1166 "ServiceName" : {"associated_object_type" : "WindowsServiceObjectType",
1167 "associated_object_element" : "Service_Name",
1168 "association_type" : "input"}},
1169 "parameter_associated_arguments" : {"DesiredAccess" : {"associated_argument_name" : "Access Mode",
1170 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}}},
1171 "OpenServiceW" : {"action_name" : "open service",
1172 "action_vocab" : "maecVocabs:ServiceActionNameVocab-1.0",
1173 "parameter_associated_objects" : {"ServiceControlManager" : {"associated_object_type" : "WindowsHandleObjectType",
1174 "associated_object_element" : "ID",
1175 "association_type" : "input",
1176 "forced" : {"associated_object_element" : "Type",
1177 "value" : "ServiceControlManager"}},
1178 "ServiceName" : {"associated_object_type" : "WindowsServiceObjectType",
1179 "associated_object_element" : "Service_Name",
1180 "association_type" : "input"}},
1181 "parameter_associated_arguments" : {"DesiredAccess" : {"associated_argument_name" : "Access Mode",
1182 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}}},
1183 "StartServiceA" : {"action_name" : "start service",
1184 "action_vocab" : "maecVocabs:ServiceActionNameVocab-1.0",
1185 "parameter_associated_objects" : {"ServiceHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1186 "associated_object_element" : "ID",
1187 "association_type" : "input",
1188 "forced" : {"associated_object_element" : "Type",
1189 "value" : "Service"}}},
1190 "parameter_associated_arguments" : {"Arguments" : {"associated_argument_name" : "Access Mode"}}},
1191 "StartServiceW" : {"action_name" : "start service",
1192 "action_vocab" : "maecVocabs:ServiceActionNameVocab-1.0",
1193 "parameter_associated_objects" : {"ServiceHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1194 "associated_object_element" : "ID",
1195 "association_type" : "input",
1196 "forced" : {"associated_object_element" : "Type",
1197 "value" : "Service"}}},
1198 "parameter_associated_arguments" : {"Arguments" : {"associated_argument_name" : "Access Mode"}}},
1199 "ControlService" : {"action_name" : "send control code to service",
1200 "action_vocab" : "maecVocabs:ServiceActionNameVocab-1.0",
1201 "parameter_associated_objects" : {"ServiceHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1202 "associated_object_element" : "ID",
1203 "association_type" : "input",
1204 "forced" : {"associated_object_element" : "Type",
1205 "value" : "Service"}}},
1206 "parameter_associated_arguments" : {"ControlCode" : {"associated_argument_name" : "Control Code",
1207 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}}},
1208 "DeleteService" : {"action_name" : "delete service",
1209 "action_vocab" : "maecVocabs:ServiceActionNameVocab-1.0",
1210 "parameter_associated_objects" : {"ServiceHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1211 "associated_object_element" : "ID",
1212 "association_type" : "input",
1213 "forced" : {"associated_object_element" : "Type",
1214 "value" : "Service"}}}},
1215 "NtCreateThread" : {"action_name" : "create thread",
1216 "action_vocab" : "maecVocabs:ProcessThreadActionNameVocab-1.0",
1217 "parameter_associated_objects" : {"ThreadHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1218 "associated_object_element" : "ID",
1219 "association_type" : "output",
1220 "forced" : {"associated_object_element" : "Type",
1221 "value" : "Thread"}},
1222 "ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1223 "associated_object_element" : "ID",
1224 "association_type" : "input",
1225 "forced" : {"associated_object_element" : "Type",
1226 "value" : "Process"}}},
1227 "parameter_associated_arguments" : {"ObjectAttributes" : {"associated_argument_name" : "Options",
1228 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}}},
1229
1230 "NtOpenThread" : {"action_name" : "open thread",
1231 "parameter_associated_objects" : {"ThreadHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1232 "associated_object_element" : "ID",
1233 "association_type" : "output",
1234 "forced" : {"associated_object_element" : "Type",
1235 "value" : "Thread"}}},
1236 "parameter_associated_arguments" : {"DesiredAccess" : {"associated_argument_name" : "Access Mode",
1237 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"},
1238 "ObjectAttributes" : {"associated_argument_name" : "Options",
1239 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}}},
1240
1241 "NtGetContextThread" : {"action_name" : "get thread context",
1242 "action_vocab" : "maecVocabs:ProcessThreadActionNameVocab-1.0",
1243 "parameter_associated_objects" : {"ThreadHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1244 "associated_object_element" : "ID",
1245 "association_type" : "input",
1246 "forced" : {"associated_object_element" : "Type",
1247 "value" : "Thread"}}}},
1248
1249 "NtSetContextThread" : {"action_name" : "set thread context",
1250 "action_vocab" : "maecVocabs:ProcessThreadActionNameVocab-1.0",
1251 "parameter_associated_objects" : {"ThreadHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1252 "associated_object_element" : "ID",
1253 "association_type" : "input",
1254 "forced" : {"associated_object_element" : "Type",
1255 "value" : "Thread"}}}},
1256 "NtSuspendThread" : {"action_name" : "suspend thread",
1257 "parameter_associated_objects" : {"ThreadHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1258 "associated_object_element" : "ID",
1259 "association_type" : "input",
1260 "forced" : {"associated_object_element" : "Type",
1261 "value" : "Thread"}}}},
1262 "NtResumeThread" : {"action_name" : "resume thread",
1263 "parameter_associated_objects" : {"ThreadHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1264 "associated_object_element" : "ID",
1265 "association_type" : "input",
1266 "forced" : {"associated_object_element" : "Type",
1267 "value" : "Thread"}}}},
1268 "NtTerminateThread" : {"action_name" : "kill thread",
1269 "action_vocab" : "maecVocabs:ProcessThreadActionNameVocab-1.0",
1270 "parameter_associated_objects" : {"ThreadHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1271 "associated_object_element" : "ID",
1272 "association_type" : "input",
1273 "forced" : {"associated_object_element" : "Type",
1274 "value" : "Thread"}}}},
1275 "CreateThread" : {"action_name" : "create thread",
1276 "action_vocab" : "maecVocabs:ProcessThreadActionNameVocab-1.0",
1277 "parameter_associated_objects" : {"ThreadId" : {"associated_object_type" : "WindowsThreadObjectType",
1278 "associated_object_element" : "Thread_ID",
1279 "association_type" : "output"}},
1280 "parameter_associated_arguments" : {"StartRoutine" : {"associated_argument_name" : "Code Address",
1281 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"},
1282 "Parameter" : {"associated_argument_name" : "Options",
1283 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"},
1284 "CreationFlags" : {"associated_argument_name" : "Creation Flags",
1285 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}}},
1286
1287 "CreateRemoteThread" : {"action_name" : "create remote thread in process",
1288 "action_vocab" : "maecVocabs:ProcessThreadActionNameVocab-1.0",
1289 "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1290 "associated_object_element" : "ID",
1291 "association_type" : "input"},
1292 "ThreadId" : {"associated_object_type" : "WindowsThreadObjectType",
1293 "associated_object_element" : "Thread_ID",
1294 "association_type" : "output"}},
1295 "parameter_associated_arguments" : {"StartRoutine" : {"associated_argument_name" : "Code Address",
1296 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"},
1297 "Parameter" : {"associated_argument_name" : "Options",
1298 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"},
1299 "CreationFlags" : {"associated_argument_name" : "Creation Flags",
1300 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}}},
1301 "ExitThread" : {"action_name" : "exit thread"},
1302 "RtlCreateUserThread" : {"action_name" : "create thread",
1303 "action_vocab" : "maecVocabs:ProcessThreadActionNameVocab-1.0",
1304 "parameter_associated_objects" : {"ProcessHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1305 "associated_object_element" : "ID",
1306 "association_type" : "input"},
1307 "ThreadHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1308 "associated_object_element" : "ID",
1309 "association_type" : "output",
1310 "forced" : {"associated_object_element" : "Type",
1311 "value" : "Thread"}},
1312 "ThreadId" : {"associated_object_type" : "WindowsThreadObjectType",
1313 "associated_object_element" : "Thread_ID",
1314 "association_type" : "output"}},
1315 "parameter_associated_arguments" : {"CreatedSuspended" : {"associated_argument_name" : "Control Parameter",
1316 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"},
1317 "StartAddress" : {"associated_argument_name" : "Code Address",
1318 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"},
1319 "StartParameter" : {"associated_argument_name" : "Options",
1320 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"}}},
1321 "URLDownloadToFileW" : {"action_name" : "download file",
1322 "action_vocab" : "maecVocabs:NetworkActionNameVocab-1.0",
1323 "parameter_associated_objects" : {"URL" : {"associated_object_type" : "URIObjectType",
1324 "associated_object_element" : "Value",
1325 "association_type" : "input"},
1326 "FileName" : {"associated_object_type" : "FileObjectType",
1327 "associated_object_element" : "File_Path",
1328 "association_type" : "output"}}},
1329 "InternetOpenA" : {"action_name" : "initialize wininet",
1330 "parameter_associated_objects" : {"Agent" : {"associated_object_type" : "HTTPSessionObjectType",
1331 "associated_object_element" : "list__HTTP_Request_Response/HTTP_Client_Request/HTTP_Request_Header/Parsed_Header/User_Agent",
1332 "association_type" : "input"}},
1333 "parameter_associated_arguments" : {"AccessType" : {"associated_argument_name" : "Access Mode",
1334 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"},
1335 "ProxyName" : {"associated_argument_name" : "Proxy Name"},
1336 "ProxyBypass" : {"associated_argument_name" : "Proxy Bypass"},
1337 "Flags" : {"associated_argument_name" : "Flags"}}},
1338 "InternetOpenW" : {"action_name" : "initialize wininet",
1339 "parameter_associated_objects" : {"Agent" : {"associated_object_type" : "HTTPSessionObjectType",
1340 "associated_object_element" : "list__HTTP_Request_Response/HTTP_Client_Request/HTTP_Request_Header/Parsed_Header/User_Agent",
1341 "association_type" : "input"}},
1342 "parameter_associated_arguments" : {"AccessType" : {"associated_argument_name" : "Access Mode",
1343 "associated_argument_vocab" : "cyboxVocabs:ActionArgumentNameVocab-1.0"},
1344 "ProxyName" : {"associated_argument_name" : "Proxy Name"},
1345 "ProxyBypass" : {"associated_argument_name" : "Proxy Bypass"},
1346 "Flags" : {"associated_argument_name" : "Flags"}}},
1347 "InternetConnectA" : {"action_name" : "connect to server",
1348 "parameter_associated_objects" : {"InternetHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1349 "associated_object_element" : "ID",
1350 "association_type" : "input",
1351 "forced" : {"associated_object_element" : "Type",
1352 "value" : "Internet Resource"}},
1353 "ServerName" : {"associated_object_type" : "URIObjectType",
1354 "associated_object_element" : "Value",
1355 "association_type" : "input"},
1356 "ServerPort" : {"associated_object_type" : "PortObjectType",
1357 "associated_object_element" : "Port_Value",
1358 "association_type" : "input"}},
1359 "parameter_associated_arguments" : {"Username" : {"associated_argument_name" : "Username"},
1360 "Password" : {"associated_argument_name" : "Password"},
1361 "Service" : {"associated_argument_name" : "Service Type"},
1362 "Flags" : {"associated_argument_name" : "Flags"}}},
1363 "InternetConnectW" : {"action_name" : "connect to server",
1364 "parameter_associated_objects" : {"InternetHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1365 "associated_object_element" : "ID",
1366 "association_type" : "input",
1367 "forced" : {"associated_object_element" : "Type",
1368 "value" : "Internet Resource"}},
1369 "ServerName" : {"associated_object_type" : "URIObjectType",
1370 "associated_object_element" : "Value",
1371 "association_type" : "input"},
1372 "ServerPort" : {"associated_object_type" : "PortObjectType",
1373 "associated_object_element" : "Port_Value",
1374 "association_type" : "input"}},
1375 "parameter_associated_arguments" : {"Username" : {"associated_argument_name" : "Username"},
1376 "Password" : {"associated_argument_name" : "Password"},
1377 "Service" : {"associated_argument_name" : "Service Type"},
1378 "Flags" : {"associated_argument_name" : "Flags"}}},
1379 "InternetOpenURLA" : {"action_name" : "connect to url",
1380 "action_vocab" : "maecVocabs:NetworkActionNameVocab-1.0",
1381 "parameter_associated_objects" : {"ConnectionHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1382 "associated_object_element" : "ID",
1383 "association_type" : "input",
1384 "forced" : {"associated_object_element" : "Type",
1385 "value" : "Internet Connection"}},
1386 "URL" : {"associated_object_type" : "URIObjectType",
1387 "associated_object_element" : "Value",
1388 "association_type" : "input"},
1389 "Headers" : {"associated_object_type" : "HTTPSessionObjectType",
1390 "associated_object_element" : "list__HTTP_Request_Response/HTTP_Client_Request/HTTP_Request_Header/Parsed_Header/Raw_Header",
1391 "association_type" : "input"}},
1392 "parameter_associated_arguments" : {"Flags" : {"associated_argument_name" : "Flags"}}},
1393 "InternetOpenURLW" : {"action_name" : "connect to url",
1394 "action_vocab" : "maecVocabs:NetworkActionNameVocab-1.0",
1395 "parameter_associated_objects" : {"ConnectionHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1396 "associated_object_element" : "ID",
1397 "association_type" : "input",
1398 "forced" : {"associated_object_element" : "Type",
1399 "value" : "Internet Connection"}},
1400 "URL" : {"associated_object_type" : "URIObjectType",
1401 "associated_object_element" : "Value",
1402 "association_type" : "input"},
1403 "Headers" : {"associated_object_type" : "HTTPSessionObjectType",
1404 "associated_object_element" : "list__HTTP_Request_Response/HTTP_Client_Request/HTTP_Request_Header/Parsed_Header/Raw_Header",
1405 "association_type" : "input"}},
1406 "parameter_associated_arguments" : {"Flags" : {"associated_argument_name" : "Flags"}}},
1407 "HttpOpenRequestA" : { "action_name" : "open http request",
1408 "parameter_associated_objects" : {"InternetHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1409 "associated_object_element" : "ID",
1410 "association_type" : "input",
1411 "forced" : {"associated_object_element" : "Type",
1412 "value" : "Internet Resource"}},
1413 "Path" : {"associated_object_type" : "URIObjectType",
1414 "associated_object_element" : "Value",
1415 "association_type" : "input"}},
1416 "parameter_associated_arguments" : {"Flags" : {"associated_argument_name" : "Flags"}}},
1417
1418 "HttpOpenRequestW" : { "action_name" : "open http request",
1419 "parameter_associated_objects" : {"InternetHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1420 "associated_object_element" : "ID",
1421 "association_type" : "input",
1422 "forced" : {"associated_object_element" : "Type",
1423 "value" : "Internet Resource"}},
1424 "Path" : {"associated_object_type" : "URIObjectType",
1425 "associated_object_element" : "Value",
1426 "association_type" : "input"}},
1427 "parameter_associated_arguments" : {"Flags" : {"associated_argument_name" : "Flags"}}},
1428 "InternetReadFile" : {"action_name" : "read from internet resource",
1429 "parameter_associated_objects" : {"InternetHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1430 "associated_object_element" : "ID",
1431 "association_type" : "input",
1432 "forced" : {"associated_object_element" : "Type",
1433 "value" : "Internet Resource"}}}},
1434
1435 "InternetWriteFile" : {"action_name" : "write to internet resource",
1436 "parameter_associated_objects" : {"InternetHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1437 "associated_object_element" : "ID",
1438 "association_type" : "input",
1439 "forced" : {"associated_object_element" : "Type",
1440 "value" : "Internet Resource"}}}},
1441
1442 "InternetCloseHandle" : {"action_name" : "close internet resource handle",
1443 "parameter_associated_objects" : {"InternetHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1444 "associated_object_element" : "ID",
1445 "association_type" : "input",
1446 "forced" : {"associated_object_element" : "Type",
1447 "value" : "Internet Resource"}}}},
1448 "HttpSendRequestA" : {"action_name" : "send http request",
1449 "parameter_associated_objects" : {"RequestHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1450 "associated_object_element" : "ID",
1451 "association_type" : "input",
1452 "forced" : {"associated_object_element" : "Type",
1453 "value" : "HTTPRequest"}},
1454 "Headers" : {"associated_object_type" : "HTTPSessionObjectType",
1455 "associated_object_element" : "list__HTTP_Request_Response/HTTP_Client_Request/HTTP_Request_Header/Raw_Header",
1456 "association_type" : "input"}},
1457 "parameter_associated_arguments" : {"PostData" : {"associated_argument_name" : "Post Data"}}},
1458 "HttpSendRequestW" : {"action_name" : "send http request",
1459 "parameter_associated_objects" : {"RequestHandle" : {"associated_object_type" : "WindowsHandleObjectType",
1460 "associated_object_element" : "ID",
1461 "association_type" : "input",
1462 "forced" : {"associated_object_element" : "Type",
1463 "value" : "HTTPRequest"}},
1464 "Headers" : {"associated_object_type" : "HTTPSessionObjectType",
1465 "associated_object_element" : "list__HTTP_Request_Response/HTTP_Client_Request/HTTP_Request_Header/Raw_Header",
1466 "association_type" : "input"}},
1467 "parameter_associated_arguments" : {"PostData" : {"associated_argument_name" : "Post Data"}}},
1468 "DnsQuery_A" : {"action_name" : "send dns query",
1469 "action_vocab" : "maecVocabs:DNSActionNameVocab-1.0",
1470 "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "Name", "element_name" : "QName/Value"},
1471 {"parameter_name" : "Type", "element_name" : "QType"}],
1472 "associated_object_type" : "DNSQueryObjectType",
1473 "associated_object_element" : "Question",
1474 "association_type" : "input"}},
1475 "parameter_associated_arguments" : {"Options" : {"associated_argument_name" : "Options"}}},
1476 "DnsQuery_UTF8" : {"action_name" : "send dns query",
1477 "action_vocab" : "maecVocabs:DNSActionNameVocab-1.0",
1478 "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "Name", "element_name" : "QName/Value"},
1479 {"parameter_name" : "Type", "element_name" : "QType"}],
1480 "associated_object_type" : "DNSQueryObjectType",
1481 "associated_object_element" : "Question",
1482 "association_type" : "input"}},
1483 "parameter_associated_arguments" : {"Options" : {"associated_argument_name" : "Options"}}},
1484 "DnsQuery_W" : {"action_name" : "send dns query",
1485 "action_vocab" : "maecVocabs:DNSActionNameVocab-1.0",
1486 "parameter_associated_objects" : {"group_together_nested" : {"parameter_mappings" : [{"parameter_name" : "Name", "element_name" : "QName/Value"},
1487 {"parameter_name" : "Type", "element_name" : "QType"}],
1488 "associated_object_type" : "DNSQueryObjectType",
1489 "associated_object_element" : "Question",
1490 "association_type" : "input"}},
1491 "parameter_associated_arguments" : {"Options" : {"associated_argument_name" : "Options"}}},
1492 "getaddrinfo" : {"action_name" : "get host by name",
1493 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0",
1494 "parameter_associated_objects" : {"NodeName" : {"associated_object_type" : "URIObjectType",
1495 "associated_object_element" : "Value",
1496 "association_type" : "input"}},
1497 "parameter_associated_arguments" : {"ServiceName" : {"associated_argument_name" : "Service Name"}}},
1498 "GetAddrInfoW" : {"action_name" : "get host by name",
1499 "action_vocab" : "maecVocabs:SocketActionNameVocab-1.0",
1500 "parameter_associated_objects" : {"NodeName" : {"associated_object_type" : "URIObjectType",
1501 "associated_object_element" : "Value",
1502 "association_type" : "input"}},
1503 "parameter_associated_arguments" : {"ServiceName" : {"associated_argument_name" : "Service Name"}}}
1504
1505 }
1506
1508 """Maps a Registry Hive hex input to its String (name) equivalent"""
1509 str_val = str(hive_hex_value)
1510 if str_val == "0x80000000" or str_val == "-2147483648" or str_val == "2147483648":
1511 return "HKEY_CLASSES_ROOT"
1512 elif str_val == "0x80000001" or str_val == "-2147483647" or str_val == "2147483649":
1513 return "HKEY_CURRENT_USER"
1514 elif str_val == "0x80000002" or str_val == "-2147483646" or str_val == "2147483650":
1515 return "HKEY_LOCAL_MACHINE"
1516 elif str_val == "0x80000003" or str_val == "-2147483645" or str_val == "2147483651":
1517 return "HKEY_USERS"
1518 elif str_val == "0x80000004":
1519 return "HKEY_PERFORMANCE_DATA"
1520 elif str_val == "0x80000005" or str_val == "2147483653":
1521 return "HKEY_CURRENT_CONFIG"
1522 elif str_val == "0x80000006":
1523 return "HKEY_DYN_DATA"
1524 else:
1525 return hive_hex_value
1526
1528 """Maps a Registry Datatype integer input to its String (name) equivalent"""
1529 if str(datatype_int_value) == "1":
1530 return "REG_SZ"
1531 elif str(datatype_int_value) == "2":
1532 return "REG_EXPAND_SZ"
1533 elif str(datatype_int_value) == "3":
1534 return "REG_BINARY"
1535 elif str(datatype_int_value) == "4":
1536 return "REG_DWORD"
1537 elif str(datatype_int_value) == "5":
1538 return "REG_DWORD_BIG_ENDIAN"
1539 elif str(datatype_int_value) == "6":
1540 return "REG_LINK"
1541 elif str(datatype_int_value) == "7":
1542 return "REG_MULTI_SZ"
1543 elif str(datatype_int_value) == "8":
1544 return "REG_RESOURCE_LIST"
1545 elif str(datatype_int_value) == "9":
1546 return "REG_FULL_RESOURCE_DESCRIPTOR"
1547 elif str(datatype_int_value) == "10":
1548 return "REG_RESOURCE_REQUIREMENTS_LIST"
1549 elif str(datatype_int_value) == "11":
1550 return "REG_QWORD"
1551 else:
1552 return datatype_int_value
1553
1554
1556 """Maps a Socket Protocol integer input to its String (name) equivalent"""
1557 if str(proto_int_value) == "1":
1558 return "IPPROTO_ICMP"
1559 elif str(proto_int_value) == "2":
1560 return "IPPROTO_IGMP"
1561 elif str(proto_int_value) == "3":
1562 return "BTHPROTO_RFCOMM"
1563 elif str(proto_int_value) == "6":
1564 return "IPPROTO_TCP"
1565 elif str(proto_int_value) == "17":
1566 return "IPPROTO_UDP"
1567 elif str(proto_int_value) == "58":
1568 return "IPPROTO_ICMPV6"
1569 elif str(proto_int_value) == "113":
1570 return "IPPROTO_RM"
1571 else:
1572 return proto_int_value
1573
1575 """Maps a Socket Address Family integer input to its String (name) equivalent"""
1576 if str(af_int_value) == "0":
1577 return "AF_UNSPEC"
1578 elif str(af_int_value) == "2":
1579 return "AF_INET"
1580 elif str(af_int_value) == "6":
1581 return "AF_IPX"
1582 elif str(af_int_value) == "16":
1583 return "AF_APPLETALK"
1584 elif str(af_int_value) == "17":
1585 return "AF_NETBIOS"
1586 elif str(af_int_value) == "23":
1587 return "AF_INET6"
1588 elif str(af_int_value) == "26":
1589 return "AF_IRDA"
1590 elif str(af_int_value) == "32":
1591 return "AF_BTH"
1592 else:
1593 return af_int_value
1594
1596 """Maps a Socket Type integer input to its String (name) equivalent"""
1597 if str(type_int_value) == "1":
1598 return "SOCK_STREAM"
1599 elif str(type_int_value) == "2":
1600 return "SOCK_DGRAM"
1601 elif str(type_int_value) == "3":
1602 return "SOCK_RAW"
1603 elif str(type_int_value) == "4":
1604 return "SOCK_RDM"
1605 elif str(type_int_value) == "5":
1606 return "SOCK_SEQPACKET"
1607 else:
1608 return type_int_value
1609
1611 """Convert an integer to a hex string"""
1612 if isinstance(value, int):
1613 value = "0x{0:08x}".format(value)
1614
1615 return value
1616
1618 """Maps a string representing a Registry Key from a NT* API call input to its normalized hive"""
1619 normalized_key = fix_key(reg_string)
1620 return normalized_key.split("\\")[0]
1621
1623 """Maps a string representing a Registry Key from a NT* API call input to its normalized key portion"""
1624 normalized_key = fix_key(reg_string)
1625 return "\\".join(normalized_key.split("\\")[1:])
1626