Comments (8)
So I think the biggest issue here is that the name
property is duplicative with respect to binary_ref.name
. Given that the "name" of a process tends to almost always be the filename of the binary, I would suggest that we deprecate name
.
from cti-stix2.
As far as command_line
, I would suggest updating the description from the existing:
"Specifies the full command line used in executing the process, including the process name (depending on the operating system)."
To the new version:
"Specifies the full command line used in executing the process, including the process name (which may be specified individually via the binary_ref.name property) and any arguments."
from cti-stix2.
FYI, this is what Osquery has for these properties:
name | TEXT | The process path or shorthand argv[0]
path | TEXT | Path to executed binary
cmdline | TEXT | Complete argv
from cti-stix2.
I've had this same question, definitely agree with fixing this for 2.1.
from cti-stix2.
There are plenty of cases where a process name doesn't align with the binary filepath. For example, in *nix, where you have one binary with a number of different executable symlinks pointing to it and the binary alters its behavior based on how it's called (i.e., argv[0].) Similarly, in Windows™ where you have a callable DLL (with a main() function) with symbolic links as in the previous example.
from cti-stix2.
@treyka interesting. I ran an experiment on this on my MacBook, and it least in OS X it looks like the name of the symlink is captured in the command-line (CMD) but not the name of the process.
ikirillov@foo-PC:~$ top
58548 iBooks
ikirillov@foo-PC:~$ ps -p 58548
PID TTY TIME CMD
58548 ttys010 0:01.00 ./iBooks-foo
from cti-stix2.
@jordan2175 it looks like we've already made these changes to the Process SCO (name
has been deprecated, the description for command_line
has been updated, etc.), so there's nothing else that needs to be done here.
from cti-stix2.
Looks like this was done some time back. Closing.
from cti-stix2.
Related Issues (20)
- Add some normative text about when the lat/long on a Location object is not consistent with the other properties
- Do we need any text to give guidance to valid times when an Indicator is revoked HOT 1
- minor typos/errata for correction consideration
- Should Observed Data objects be referred to in sighting_of_ref property of Sightings HOT 1
- Link to Open Vocabs in Section 10 from property descriptions HOT 4
- Spec property decorations fail accessibility guidelines HOT 1
- definition and definition-type properties are deprecated with implications for STIX 2.2
- typos in participants names
- Better link for Shannon Entropy and inclusion as informative reference
- typo in header C.2.2
- Vocabulary/Enumeration Table Headers HOT 1
- Feedback about external references not being available on File SCOs HOT 1
- The UUIDv5 SCO ids should be checked to make sure they agree with the generate_id method in python-stix2
- the Industry sectors' vocab doesn't have "legal"
- Embedded references in SCOs HOT 3
- Predefined/Subtype extensions should be possible when defining a new STIX object extension definition, even with new SDOs
- ITU Feedback HOT 4
- Update Best Practices Guide HOT 1
- 6.12.2 HTTP Request Extension example is invalid: request_header must be a list of type string HOT 1
- trademark on website
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cti-stix2.