Showing:

Annotations
Diagrams
Facets
Source
Used by
Main schema Win_Hook_Object.xsd
Namespace http://cybox.mitre.org/objects#WinHookObject-1
Annotations
 
This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org.
Element WinHookObj:Windows_Hook
Namespace http://cybox.mitre.org/objects#WinHookObject-1
Annotations
 
The Windows_Hook object is intended to characterize Windows hook procedures.
Diagram
Diagram Win_Hook_Object_xsd.tmp#WindowsHookObjectType_Type Win_Hook_Object_xsd.tmp#WindowsHookObjectType_Handle Win_Hook_Object_xsd.tmp#WindowsHookObjectType_Hooking_Function_Name Win_Hook_Object_xsd.tmp#WindowsHookObjectType_Hooking_Module Win_Hook_Object_xsd.tmp#WindowsHookObjectType_Thread_ID Win_Hook_Object_xsd.tmp#WindowsHookObjectType
Type WinHookObj:WindowsHookObjectType
Type hierarchy
Children WinHookObj:Handle, WinHookObj:Hooking_Function_Name, WinHookObj:Hooking_Module, WinHookObj:Thread_ID, WinHookObj:Type
Source
 
<xs:element name="Windows_Hook" type="WinHookObj:WindowsHookObjectType">
  <xs:annotation>
    <xs:documentation>The Windows_Hook object is intended to characterize Windows hook procedures.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinHookObj:WindowsHookObjectType / WinHookObj:Type
Namespace http://cybox.mitre.org/objects#WinHookObject-1
Annotations
 
The Type field specifies the type (i.e. WH_) of the Windows hook procedure, which refers to the type of event that the hook will intercept.
Diagram
Diagram Win_Hook_Object_xsd.tmp#WinHookType
Type WinHookObj:WinHookType
Type hierarchy
Source
 
<xs:element name="Type" type="WinHookObj:WinHookType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Type field specifies the type (i.e. WH_) of the Windows hook procedure, which refers to the type of event that the hook will intercept.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinHookObj:WindowsHookObjectType / WinHookObj:Handle
Namespace http://cybox.mitre.org/objects#WinHookObject-1
Annotations
 
The Handle field specifies the handle associated with the  Windows hook procedure. It uses the WindowsHandleObjectType type from the imported CybOX Windows Handle object.
Diagram
Diagram
Type WindowsHandleObjectType
Source
 
<xs:element name="Handle" type="WinHandleObj:WindowsHandleObjectType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Handle field specifies the handle associated with the Windows hook procedure. It uses the WindowsHandleObjectType type from the imported CybOX Windows Handle object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinHookObj:WindowsHookObjectType / WinHookObj:Hooking_Function_Name
Namespace http://cybox.mitre.org/objects#WinHookObject-1
Annotations
 
The Hooking_Function_Name field specifies the name of the hooking function used by the Windows hook procedure.
Diagram
Diagram
Type StringObjectPropertyType
Source
 
<xs:element minOccurs="0" name="Hooking_Function_Name" type="cyboxCommon:StringObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The Hooking_Function_Name field specifies the name of the hooking function used by the Windows hook procedure.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinHookObj:WindowsHookObjectType / WinHookObj:Hooking_Module
Namespace http://cybox.mitre.org/objects#WinHookObject-1
Annotations
 
The Hooking_Module field specifies the properties of the module that contains the hooking function used in the Windows hook procedure that is specified in the Hooking_Function_Name field. It uses the LibraryObjectType from the imported CybOX Library Object.
Diagram
Diagram
Type LibraryObjectType
Source
 
<xs:element minOccurs="0" name="Hooking_Module" type="LibraryObj:LibraryObjectType">
  <xs:annotation>
    <xs:documentation>The Hooking_Module field specifies the properties of the module that contains the hooking function used in the Windows hook procedure that is specified in the Hooking_Function_Name field. It uses the LibraryObjectType from the imported CybOX Library Object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinHookObj:WindowsHookObjectType / WinHookObj:Thread_ID
Namespace http://cybox.mitre.org/objects#WinHookObject-1
Annotations
 
The Thread_ID field specifies the ID of the thread associated with the Windows procedure, if applicable.
Diagram
Diagram
Type NonNegativeIntegerObjectPropertyType
Source
 
<xs:element minOccurs="0" name="Thread_ID" type="cyboxCommon:NonNegativeIntegerObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The Thread_ID field specifies the ID of the thread associated with the Windows procedure, if applicable.</xs:documentation>
  </xs:annotation>
</xs:element>
Complex Type WinHookObj:WindowsHookObjectType
Namespace http://cybox.mitre.org/objects#WinHookObject-1
Annotations
 
The WindowsHookObjectType type is intended to characterize Windows hook procedure objects.
 
For more information please see http://msdn.microsoft.com/en-us/library/windows/desktop/ms644990(v=vs.85).aspx.
Diagram
Diagram Win_Hook_Object_xsd.tmp#WindowsHookObjectType_Type Win_Hook_Object_xsd.tmp#WindowsHookObjectType_Handle Win_Hook_Object_xsd.tmp#WindowsHookObjectType_Hooking_Function_Name Win_Hook_Object_xsd.tmp#WindowsHookObjectType_Hooking_Module Win_Hook_Object_xsd.tmp#WindowsHookObjectType_Thread_ID
Type extension of ObjectPropertiesType
Type hierarchy
Used by
Children WinHookObj:Handle, WinHookObj:Hooking_Function_Name, WinHookObj:Hooking_Module, WinHookObj:Thread_ID, WinHookObj:Type
Source
 
<xs:complexType name="WindowsHookObjectType" mixed="false">
  <xs:annotation>
    <xs:documentation>The WindowsHookObjectType type is intended to characterize Windows hook procedure objects.</xs:documentation>
    <xs:documentation>For more information please see http://msdn.microsoft.com/en-us/library/windows/desktop/ms644990(v=vs.85).aspx.</xs:documentation>
  </xs:annotation>
  <xs:complexContent>
    <xs:extension base="cyboxCommon:ObjectPropertiesType">
      <xs:sequence>
        <xs:element name="Type" type="WinHookObj:WinHookType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Type field specifies the type (i.e. WH_) of the Windows hook procedure, which refers to the type of event that the hook will intercept.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Handle" type="WinHandleObj:WindowsHandleObjectType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Handle field specifies the handle associated with the Windows hook procedure. It uses the WindowsHandleObjectType type from the imported CybOX Windows Handle object.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element minOccurs="0" name="Hooking_Function_Name" type="cyboxCommon:StringObjectPropertyType">
          <xs:annotation>
            <xs:documentation>The Hooking_Function_Name field specifies the name of the hooking function used by the Windows hook procedure.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element minOccurs="0" name="Hooking_Module" type="LibraryObj:LibraryObjectType">
          <xs:annotation>
            <xs:documentation>The Hooking_Module field specifies the properties of the module that contains the hooking function used in the Windows hook procedure that is specified in the Hooking_Function_Name field. It uses the LibraryObjectType from the imported CybOX Library Object.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element minOccurs="0" name="Thread_ID" type="cyboxCommon:NonNegativeIntegerObjectPropertyType">
          <xs:annotation>
            <xs:documentation>The Thread_ID field specifies the ID of the thread associated with the Windows procedure, if applicable.</xs:documentation>
          </xs:annotation>
        </xs:element>
      </xs:sequence>
    </xs:extension>
  </xs:complexContent>
</xs:complexType>
Complex Type WinHookObj:WinHookType
Namespace http://cybox.mitre.org/objects#WinHookObject-1
Annotations
 
WinHookType specifies Windows hook procedure types, via a union of the WinHookTypeEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.
Diagram
Diagram
Type restriction of BaseObjectPropertyType
Type hierarchy
Used by
Source
 
<xs:complexType name="WinHookType">
  <xs:annotation>
    <xs:documentation>WinHookType specifies Windows hook procedure types, via a union of the WinHookTypeEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="WinHookObj:WinHookTypeEnum xs:string"/>
      </xs:simpleType>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Simple Type WinHookObj:WinHookTypeEnum
Namespace http://cybox.mitre.org/objects#WinHookObject-1
Annotations
 
The WinHookTypeEnum type is an enumeration of Windows hook procedure types.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration WH_CALLWNDPROC 
Specifies a hook procedure that monitors messages before the system sends them to the destination window procedure.
enumeration WH_CALLWNDPROCRET 
Specifies a hook procedure that monitors messages after they have been processed by the destination window procedure.
enumeration WH_CBT 
Specifies a hook procedure that receives notifications useful to a CBT application.
enumeration WH_DEBUG 
Specifies a hook procedure useful for debugging other hook procedures.
enumeration WH_FOREGROUNDIDLE 
Specifies a hook procedure that will be called when the application's foreground thread is about to become idle.
enumeration WH_GETMESSAGE 
Specifies a hook procedure that monitors messages posted to a message queue.
enumeration WH_JOURNALPLAYBACK 
Specifies a hook procedure that posts messages previously recorded by a WH_JOURNALRECORD hook procedure.
enumeration WH_JOURNALRECORD 
Specifies a hook procedure that records input messages posted to the system message queue.
enumeration WH_KEYBOARD 
Specifies a hook procedure that monitors keystroke messages.
enumeration WH_KEYBOARD_LL 
Specifies a hook procedure that monitors low-level keyboard input events.
enumeration WH_MOUSE 
Specifies a hook procedure that monitors mouse messages.
enumeration WH_MOUSE_LL 
Specifies a hook procedure that monitors low-level mouse input events.
enumeration WH_MSGFILTER 
Specifies a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar.
enumeration WH_SHELL 
Specifies a hook procedure that receives notifications useful to shell applications.
enumeration WH_SYSMSGFILTER 
Specifies a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar.
Source
 
<xs:simpleType name="WinHookTypeEnum">
  <xs:annotation>
    <xs:documentation>The WinHookTypeEnum type is an enumeration of Windows hook procedure types.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="WH_CALLWNDPROC">
      <xs:annotation>
        <xs:documentation>Specifies a hook procedure that monitors messages before the system sends them to the destination window procedure.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="WH_CALLWNDPROCRET">
      <xs:annotation>
        <xs:documentation>Specifies a hook procedure that monitors messages after they have been processed by the destination window procedure.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="WH_CBT">
      <xs:annotation>
        <xs:documentation>Specifies a hook procedure that receives notifications useful to a CBT application.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="WH_DEBUG">
      <xs:annotation>
        <xs:documentation>Specifies a hook procedure useful for debugging other hook procedures.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="WH_FOREGROUNDIDLE">
      <xs:annotation>
        <xs:documentation>Specifies a hook procedure that will be called when the application's foreground thread is about to become idle.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="WH_GETMESSAGE">
      <xs:annotation>
        <xs:documentation>Specifies a hook procedure that monitors messages posted to a message queue.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="WH_JOURNALPLAYBACK">
      <xs:annotation>
        <xs:documentation>Specifies a hook procedure that posts messages previously recorded by a WH_JOURNALRECORD hook procedure.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="WH_JOURNALRECORD">
      <xs:annotation>
        <xs:documentation>Specifies a hook procedure that records input messages posted to the system message queue.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="WH_KEYBOARD">
      <xs:annotation>
        <xs:documentation>Specifies a hook procedure that monitors keystroke messages.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="WH_KEYBOARD_LL">
      <xs:annotation>
        <xs:documentation>Specifies a hook procedure that monitors low-level keyboard input events.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="WH_MOUSE">
      <xs:annotation>
        <xs:documentation>Specifies a hook procedure that monitors mouse messages.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="WH_MOUSE_LL">
      <xs:annotation>
        <xs:documentation>Specifies a hook procedure that monitors low-level mouse input events.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="WH_MSGFILTER">
      <xs:annotation>
        <xs:documentation>Specifies a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="WH_SHELL">
      <xs:annotation>
        <xs:documentation>Specifies a hook procedure that receives notifications useful to shell applications.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="WH_SYSMSGFILTER">
      <xs:annotation>
        <xs:documentation>Specifies a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
  </xs:restriction>
</xs:simpleType>
XML Schema documentation generated by ® XML Editor.