Heads up! These docs are for STIX 1.1.1, which is not the latest version (1.2). View the latest!

WindowsFilemappingObjectTypeWin Filemapping Object Schema

The WindowsFilemappingObjectType type is intended to characterize Windows file mapping objects.


Fields

Field Name Type Description
@object_referenceoptional QName

The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.

Custom_Properties0..1 CustomPropertiesType

The Custom_Properties construct is optional and enables the specification of a set of custom Object Properties that may not be defined in existing Properties schemas.

Name0..1 StringObjectPropertyType

The Name field specifies the name of the file mapping.

File_Handle0..1 WindowsHandleObjectType

The File_Handle field specifies the Windows handle to the file from which the file mapping was created. It uses the WindowsHandleObjectType from the imported CybOX Windows Handle Object.

Handle0..1 WindowsHandleObjectType

The Handle field specifies the Windows handle to the file mapping. It uses the WindowsHandleObjectType from the imported CybOX Windows Handle Object.

Page_Protection_Value0..1 PageProtectionValueType

The Page_Protection field specifies the page protection value (i.e. PAGE_) specified for the file mapping.

Page_Protection_Attribute0..n PageProtectionAttributeType

The Page_Protection_Attribute field specifies a page protection attribute (i.e. SEC_) to be used in combination with the page protection value captured in the Page_Protection_Value field. One or more such attributes can be specified using this field.

Maximum_Size0..1 UnsignedLongObjectPropertyType

The Maximum_Size field specifies the maximum allowed size for the file mapping, in bytes. This value is typically initialized upon creation of the file mapping.

Actual_Size0..1 UnsignedLongObjectPropertyType

The Actual_Size field captures the actual size of the file mapping, in bytes.

Security_Attributes0..1 StringObjectPropertyType

The Security_Attributes field specifies the Windows security attributes for the file mapping.