Windows Resource

The Windows resource object describes a resource object managed by Windows, such as mutant or timer.

• Extends: _resource

Attributes

type_id

• Type: integer_t
• Requirement: required
• Values:
  • 0 - Unknown: The resource object type is unknown.
  • 1 - Directory
  • 2 - Event
  • 3 - Timer
  • 4 - Device
  • 5 - Mutant
  • 6 - Type
  • 7 - File
  • 8 - Token
  • 9 - Thread
  • 10 - Section
  • 11 - WindowStation
  • 12 - DebugObject
  • 13 - FilterCommunicationPort
  • 14 - EventPair
  • 15 - Driver
  • 16 - IoCompletion
  • 17 - Controller
  • 18 - SymbolicLink
  • 19 - WmiGuid
  • 20 - Process
  • 21 - Profile
  • 22 - Desktop
  • 23 - KeyedEvent
  • 24 - Adapter
  • 25 - Key
  • 26 - WaitablePort
  • 27 - Callback
  • 28 - Semaphore
  • 29 - Job
  • 30 - Port
  • 31 - FilterConnectionPort
  • 32 - ALPC Port
  • 33 - SAM_ALIAS
  • 34 - SAM_GROUP
  • 35 - SAM_USER
  • 36 - SAM_DOMAIN
  • 37 - SAM_SERVER
  • 99 - Other: The resource object type is not mapped. See the type attribute, which may contain a data source specific value.

The normalized type identifier of the Windows resource object accessed.

data_classification

• Type: data_classification
• Requirement: recommended

The Data Classification object includes information about data classification levels and data category types.

data_classifications

• Type: data_classification
• Requirement: recommended

A list of Data Classification objects, that include information about data classification levels and data category types, indentified by a classifier.

name

• Type: string_t
• Requirement: recommended

The name of the resource object.

uid

• Type: string_t
• Requirement: recommended

The Windows provided handle identifier for the resource object

data

• Type: json_t
• Requirement: optional

Additional data describing the resource.

details

• Type: string_t
• Requirement: optional

The string detailing the attributes of the resource object.

labels

• Type: string_t
• Requirement: optional

The list of labels associated to the resource.

svc_name

• Type: string_t
• Requirement: optional

The Windows service acting as the object server for the resource object, such as Security or Security Account Manager.

tags

• Type: key_value_object
• Requirement: optional

The list of tags; {key:value} pairs associated to the resource.

type

• Type: string_t
• Requirement: optional

The type of the Windows resource object.

Constraints

At least one of: name, uid

Used By

• win/windows_resource_activity