Object Relationships

This page contains a listing of some of the available CybOX Object → Object relationships (from the ObjectRelationshipVocab-1.1 vocabulary), and adds some additional context for each relationship. This includes a richer definition, a listing and description of the Objects that the relationship is most applicable to (note that it may be applicable to others not covered here), its inverse (if existing), and an example XML snippet that demonstrates the relationship in use.

Overview

Name Inverse Applicable Objects (Source) Applicable Objects (Related)
Created Deleted, Killed Archive File, Process File, Process, Mutex, Win Registry Key, Win Service, Win Thread
Created_By Deleted_By, Killed_By File, Process, Mutex, Win Registry Key, Win Service, Win Thread Archive File, Process
Deleted Created Process File, Mutex, Win Registry Key, Win Service
Deleted_By Created_By File, Mutex, Win Registry Key, Win Service Process
Modified_Properties_Of n/a Process File, Win Registry Key, Win Service
Properties_Modified_By n/a File, Win Registry Key, Win Service Process
Downloaded_From n/a File URI, Domain Name, Address, Hostname
Downloaded_To Uploaded_To URI, File File
Downloaded Uploaded Process File
Downloaded_By Uploaded_By File Process
Uploaded Downloaded Process File
Uploaded_By Downloaded_By File Process
Uploaded_To Downloaded_To File URI, Domain Name, Address, Hostname
Sent_To Received_From File Address
Received_From Sent_To File Address
Values_Enumerated n/a Process Win Registry Key
Values_Enumerated_By n/a Win Registry Key Process
Killed Created Process Process, Win Thread
Killed_By Created_By Process, Win Thread Process
Locked Unlocked Process File
Locked_By Unlocked_By File Process
Unlocked Locked Process File
Unlocked_By Locked_By File Process
Listened_On n/a Process Port, Network Socket
Renamed_From n/a File File
Renamed_To n/a File File
Renamed n/a Process File
Renamed_By n/a File Process
Moved_From n/a File File
Moved_To n/a File File
Moved n/a Process File
Moved_By n/a File Process
Copied_From n/a File File
Copied_To n/a File File
Copied n/a Process File
Copied_By n/a File Process
Contains n/a File, Archive File, Email Message, URI, DNS Record, ARP Cache, URL History, Win Registry Key File, Link, Domain Name, Address, URI, Win Registry Key
Contained_Within n/a File, Link, Domain Name, Address, URI, Win Registry Key File, Archive File, Email Message, URI, DNS Record, ARP Cache, URL History, Win Registry Key
Extracted_From n/a File, URI, Link File, Archive File, Email Message
Connected_To n/a Process Address, Socket Address, Hostname, Network Socket
Parent_Of Child_Of Process Process, Win Thread
Child_Of Parent_Of Process, Win Thread Process
Redirects_To n/a URI, Domain Name URI, Domain Name
Suspended Resumed Process Process, Win Thread
Suspended_By Resumed_By Process, Win Thread Process
Paused Resumed Process Win Service
Paused_By Resumed_By Win Service Process
Resumed Suspended, Paused Process Process, Win Thread, Win Service
Resumed_By Suspended_By, Paused_By Process, Win Thread, Win Service Process
Wrote_To Read_From Process Process, File, Pipe, Win Mailslot
Written_To_By Read_From_By Process, File, Pipe, Win Mailslot Process
Read_From Wrote_To Process Process, File, Pipe, Win Mailslot
Read_From_By Written_To_By Process, File, Pipe, Win Mailslot Process
Allocated Freed Process Memory, Win Memory Page Region
Allocated_By Freed_By Memory, Win Memory Page Region Process
Freed Allocated Process Memory, Win Memory Page Region
Freed_By Allocated_By Memory, Win Memory Page Region Process
Opened Closed Process File, Win Filemapping, Mutex, Semaphore, Port, Win Event, Win Critical Section, Win Handle, Win Registry Key, Win Service
Opened_By Closed_By File, Win Filemapping, Mutex, Semaphore, Port, Win Event, Win Critical Section, Win Handle, Win Registry Key, Win Service Process
Closed Opened Process File, Win Filemapping, Port, Win Handle, Win Registry Key
Closed_By Opened_By File, Win Filemapping, Port, Win Handle, Win Registry Key Process
Characterizes n/a File, DNS Record, WHOIS Artifact, Domain Name
Characterized_By n/a Artifact, Domain Name File, DNS Record, WHOIS
Resolved_To n/a Domain Name, Hostname, Address Domain Name, Hostname, Address
Sub-domain_Of Supra-domain_Of Domain Name Domain Name
Supra-domain_Of Sub-domain_Of Domain Name Domain Name
FQDN_Of n/a Domain Name Domain Name, Hostname
Dropped n/a File File
Dropped_By n/a File File

“Created”

The source Object Created the related Object. Applicable to a wide range of Objects, particularly in the context of a Process that creates other Objects.

Inverse

Deleted

Applicable Objects

Source Object Related Object Description
Archive File File A self-extracting archive file created a file upon extraction.
Process File A process created a file during its execution.
Process Process A process created another process during its execution.
Process Win Registry Key A process created a Windows registry key or registry key value during its execution.
Process Win Service A process created a Windows service during its execution.
Process Mutex A process created a mutex during its execution.
Process Win Thread A process created a Windows thread during its execution.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Created</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Created_By”

The source Object was Created by the related Object. Applicable to a wide range of Objects, particularly in the context of Objects that were created by a Process.

Inverse

Deleted_By

Applicable Objects

Source Object Related Object Description
File Archive File A file was created by a self-extracting archive file as part of its extraction operation.
File Process A file was created by a process during its execution.
Process Process A process was created by another process during its execution.
Win Registry Key Process A Windows registry key or registry key value was created by a process during its execution.
Win Service Process A Windows service was created by a process during its execution.
Mutex Process A mutex was created by a process during its execution.
Win Thread Process A Windows thread was created by a process during its execution.

Example

<cybox:Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Created_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Deleted”

The source Object Deleted the related Object. Applicable to a wide range of Objects, particularly in the context of a Process that deleted other Objects.

Inverse

Created

Applicable Objects

Source Object Related Object Description
Process File A process deleted a file during its execution.
Process Win Registry Key A process deleted a Windows registry key or registry key value during its execution.
Process Win Service A process deleted a Windows service during its execution.
Process Mutex A process deleted a mutex during its execution.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Deleted</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Deleted_By”

The source Object was Deleted by the related Object. Applicable to a wide range of Objects, particularly in the context of Objects that were deleted by a Process.

Inverse

Created_By

Applicable Objects

Source Object Related Object Description
File Process A file was deleted by a process during its execution.
Win Registry Key Process A Windows registry key or registry key value was deleted by a process during its execution.
Win Service Process A Windows service was deleted by a process during its execution.
Mutex Process A mutex was deleted by a process during its execution.

Example

<cybox:Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Deleted_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Modified_Properties_Of”

The source Object Modifed the properties of the related Object. Applicable to a wide range of Objects, particularly in the context of a Process that modified the properties of other Objects.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
Process File A process modified the properties of a file during its execution.
Process Win Registry Key A process modified the properties of a Windows registry key or registry key value during its execution.
Process Win Service A process modified the properties of a Windows service during its execution.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Modified_Properties_Of</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Properties_Modified_By”

The source Object had its Properties modified by the related Object. Applicable to a wide range of Objects, particularly in the context of Objects whose properties were modified by a Process.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
File Process A file had its properties modified by a process during its execution.
Win Registry Key Process A Windows registry key or registry key value had its properties modified by a process during its execution.
Win Service Process A Windows service had its properties modified by a process during its execution.

Example

<cybox:Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Properties_Modified_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Downloaded_From”

The source Object was Downloaded from the related Object. Commonly used for expressing the fact that a file was downloaded from some network location.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
File URI A file was downloaded from some particular URL.
File Domain Name A file was downloaded from some particular domain name.
File Address A file was downloaded from some particular IP address.
File Hostname A file was downloaded from some device identified by a particular hostname.

Example

<cybox:Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-d9f7b338-a20f-47b2-9efd-21f5a42b54f1">
			<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
				<DomainNameObj:Value>example.com</DomainNameObj:Value>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Downloaded_From</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Downloaded”

The source Object Downloaded the related Object. Commonly used for expressing the fact that a process downloaded a file.

Inverse

Uploaded

Applicable Objects

Source Object Related Object Description
Process File A process downloaded a particular file during its execution.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Downloaded</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Downloaded_To”

The source Object was Downloaded to the related Object. Commonly used for expressing the fact that a file or URL that refers to a file was downloaded as another file (e.g., “abcd.exe” downloaded as “fun.jpg”) or to a particular location.

Inverse

Uploaded_To

Applicable Objects

Source Object Related Object Description
URI File A file specified by a URL was downloaded and stored as another file or at some particular location.
File File A file was downloaded and stored as another file or at some particular location.

Example

<cybox:Object id="example:object-51b8828d-3068-4a6d-96e9-7b19d3b3ef1a">
	<cybox:Properties xsi:type="URIObj:URIObjectType" type="URL">
		<URIObj:Value>http://example.com/asdfg.jpg</URIObj:Value>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-31a600e7-7357-4845-9604-70327c9a7dfc">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Path>/usr/tmp/test.bin</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Downloaded_To</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Downloaded_By”

The source Object was Downloaded by the related Object. Commonly used for expressing the fact that a file was downloaded by a process.

Inverse

Uploaded_By

Applicable Objects

Source Object Related Object Description
File Process A file was downloaded by a particular process during its execution.

Example

<cybox:Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Downloaded_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Uploaded”

The source Object Uploaded the related Object. Commonly used for expressing the fact that a process uploaded a particular file.

Inverse

Downloaded

Applicable Objects

Source Object Related Object Description
Process File A process uploaded a particular file during its execution.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Uploaded</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Uploaded_By”

The source Object was Uploaded by the related Object. Commonly used for expressing the fact that a file was uploaded by a process.

Inverse

Downloaded_By

Applicable Objects

Source Object Related Object Description
File Process A file was uploaded by a particular process during its execution.

Example

<cybox:Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Uploaded_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Uploaded_To”

The source Object was Uploaded to the related Object. Commonly used for expressing the fact that a file was uploaded to a particular network location.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
File URI A file was uploaded to a particular URL.
File Domain Name A file was uploaded to a particular domain name.
File Address A file was uploaded to a particular IP address.
File Hostname A file was uploaded to a device identified by a particular hostname.

Example

<cybox:Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-0eaf497e-1062-4d52-97fa-670c4426ff3b">
			<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr">
				<AddressObj:Address_Value>10.1.2.3</AddressObj:Address_Value>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Uploaded_To</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Sent_To”

The source Object was Sent to the related Object. Commonly used for expressing the fact that a file was sent to a particular email address.

Inverse

Received_From

Applicable Objects

Source Object Related Object Description
File Address A file was sent to a particular email address.

Example

<cybox:Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-54710212-ca56-4eb6-8b4a-f8bf083303ae">
			<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="e-mail">
				<AddressObj:Address_Value>bob@example.com</AddressObj:Address_Value>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Sent_To</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Received_From”

The source Object was Received from the related Object. Commonly used for expressing the fact that a file was received from an email sent from a particular email address.

Inverse

Sent_To

Applicable Objects

Source Object Related Object Description
File Address A file was received from an email sent from particular email address.

Example

<cybox:Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-238f4ee7-d986-4c6c-9e50-4474270582a2">
			<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="e-mail">
				<AddressObj:Address_Value>sue@example.com</AddressObj:Address_Value>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Received_From</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Values_Enumerated”

The source Object Enumerated the values of the related Object. Commonly used for expressing the fact that a process enumerated the values of a particular Windows registry key.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
Process Win Registry Key A process enumerated the values of a particular Windows registry key during its execution.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-0eaf497e-1062-4d52-97fa-670c4426ff3b">
			<cybox:Properties xsi:type="WinRegistryKeyObj:WindowsRegistryKeyObjectType">
				<WinRegistryKeyObj:Key>System\services\ACPI</WinRegistryKeyObj:Key>
				<WinRegistryKeyObj:Hive>HKEY_LOCAL_MACHINE</WinRegistryKeyObj:Hive>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Values_Enumerated</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Values_Enumerated_By”

The source Object had its Values enumerated by the related Object. Commonly used for expressing the fact that a Windows registry key had its values enumerated by a particular process.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
Win Registry Key Process A Windows registry key had its values enumerated by a particular process during its execution.

Example

<cybox:Object id="example:object-0eaf497e-1062-4d52-97fa-670c4426ff3b">
	<cybox:Properties xsi:type="WinRegistryKeyObj:WindowsRegistryKeyObjectType">
		<WinRegistryKeyObj:Key>System\services\ACPI</WinRegistryKeyObj:Key>
		<WinRegistryKeyObj:Hive>HKEY_LOCAL_MACHINE</WinRegistryKeyObj:Hive>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Values_Enumerated_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Killed”

The source Object Killed the related Object. Commonly used for expressing the fact that a process killed (or terminated) another process or thread.

Inverse

Killed

Applicable Objects

Source Object Related Object Description
Process Process A process killed (or terminated) another process during its execution.
Process Win Thread A process killed (or terminated) a thread during its execution.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-b464a2a1-876b-4e29-9b5f-705f66ca1327">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>another_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Killed</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Killed_By”

The source Object was Killed by the related Object. Commonly used for expressing the fact that a process or thread was killed (or terminated) by another process.

Inverse

Created_By

Applicable Objects

Source Object Related Object Description
Process Process A process was killed (or terminated) by another process during its execution.
Win Thread Process A Windows thread was killed (or terminated) by a process during its execution.

Example

<cybox:Object id="example:object-b464a2a1-876b-4e29-9b5f-705f66ca1327">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>another_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Killed_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Locked”

The source Object Locked the related Object. Commonly used for expressing the fact that a process locked (in terms of read, write, or delete access) a particular file.

Inverse

Unlocked

Applicable Objects

Source Object Related Object Description
Process File A process locked (in terms of read, write, or delete access) a particular file during its execution.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Locked</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Locked_By”

The source Object was Locked by the related Object. Commonly used for expressing the fact that a file was locked (in terms of read, write, or delete access) by a particular process.

Inverse

Unlocked_By

Applicable Objects

Source Object Related Object Description
File Process A file was locked (in terms of read, write, or delete access) by a particular process during its execution.

Example

<cybox:Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Locked_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Unlocked”

The source Object Unlocked the related Object. Commonly used for expressing the fact that a process unlocked (in terms of read, write, or delete access) a particular file.

Inverse

Locked

Applicable Objects

|Source Object|Related Object|Description| |————-|————–|———–| |Process|File|A process unlocked (in terms of read, write, or delete access) a particular file during its execution.|

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Unlocked</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Unlocked_By”

The source Object was Unlocked by the related Object. Commonly used for expressing the fact that a file was unlocked (in terms of read, write, or delete access) by a particular process.

Inverse

Locked_By

Applicable Objects

Source Object Related Object Description
File Process A file was unlocked (in terms of read, write, or delete access) by a particular process during its execution.

Example

<cybox:Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Unlocked_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Listened_On”

The source Object Listened on the related Object. Commonly used for expressing the fact that a process listened on a particular port or socket.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
Process Port A process listened on a particular port during its execution.
Process Network Socket A process listened on a particular network socket during its execution.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-892a4b26-59af-4dcf-88f3-f55f3837fbde">
			<cybox:Properties xsi:type="PortObj:PortObjectType">
			  <PortObj:Port_Value>1234</PortObj:Port_Value>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Listened_On</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Renamed”

The source Object Renamed the related Object. Commonly used for expressing the fact that a process renamed a particular file.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
Process File A process renamed a file during its execution.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Renamed</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Renamed_By”

The source Object was Renamed by the related Object. Commonly used for expressing the fact that a file was renamed by a particular process.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
File Process A file was renamed by a particular process during its execution.

Example

<cybox:Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Renamed_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Renamed_From”

The source Object was Renamed from the related Object. Commonly used for expressing the fact that a file was renamed from a version of the file with a different name.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
File File A file was renamed from another version of the file with a different name.

Example

<cybox:Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-d64e3ee9-39bf-4149-ae77-9b2df9c203e3">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Path>C:\temp\asdfg.bin</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Renamed_From</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Renamed_To”

The source Object was Renamed to the related Object. Commonly used for expressing the fact that a file was renamed to a version of the file with a different name.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
File File A file was renamed to another version of the file with a different name.

Example

<cybox:Object id="example:object-d64e3ee9-39bf-4149-ae77-9b2df9c203e3">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\asdfg.bin</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Renamed_To</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Moved”

The source Object Moved the related Object. Commonly used for expressing the fact that a process moved a particular file from one location to another.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
Process File A process moved a file during its execution, from one location to another.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Moved</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Moved_By”

The source Object was Moved by the related Object. Commonly used for expressing the fact that a file was moved by a particular process, from one location to another.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
File Process A file was moved by a particular process during its execution, from one location to another.

Example

<cybox:Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Moved_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Moved_From”

The source Object was Moved from the related Object. Commonly used for expressing the fact that a file was moved from one location to another.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
File File A file was moved from one location to another (represented as a separate file).

Example

<cybox:Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-d64e3ee9-39bf-4149-ae77-9b2df9c203e3">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Path>C:\temp\asdfg.bin</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Moved_From</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Moved_To”

The source Object was Moved to the related Object. Commonly used for expressing the fact that a file was moved from one location to another.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
File File A file was moved from one location to another (represented as a separate file).

Example

<cybox:Object id="example:object-d64e3ee9-39bf-4149-ae77-9b2df9c203e3">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\asdfg.bin</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Moved_To</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Copied”

The source Object Copied the related Object. Commonly used for expressing the fact that a process copied a particular file from one location to another.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
Process File A process copied a file during its execution, from one location to another.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Copied</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Copied_By”

The source Object was Copied by the related Object. Commonly used for expressing the fact that a file was copied by a particular process, from one location to another.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
File Process A file was copied by a particular process during its execution, from one location to another.

Example

<cybox:Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Copied_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Copied_From”

The source Object was Copied from the related Object. Commonly used for expressing the fact that a file was copied from one location to another.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
File File A file was copied from one location to another (represented as a separate file).

Example

<cybox:Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-d64e3ee9-39bf-4149-ae77-9b2df9c203e3">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Path>C:\temp\asdfg.bin</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Copied_From</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Copied_To”

The source Object was Copied to the related Object. Commonly used for expressing the fact that a file was copied to one location from another.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
File File A file was copied to one location from another (represented as a separate file).

Example

<cybox:Object id="example:object-d64e3ee9-39bf-4149-ae77-9b2df9c203e3">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\asdfg.bin</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Copied_To</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Contains”

The source Object Contains the related Object. Used for expressing the fact that an object contains another object inside of it.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
File File A file contains another file inside of it (e.g., appended to it).
Archive File File An archive file contains another file inside of it.
Email Message File An email message contains a file as an attachment.
Email Message Link An email message contains a link within its message body.
URI Domain Name A URL contains a domain name as part of its structure.
DNS Record Address A DNS record contains an IP address that resolves to the domain identified by the record.
ARP Cache Address An ARP cache contains a physical (i.e., MAC) address or IP address in one of its entries.
URL History URI A URL history cache contains a particular URL in one of its entries.
Win Registry Key Win Registry Key A Windows registry key contains another Windows registry key, as a subkey.

Example

<cybox:Object id="example:object-210ff682-5362-4391-be79-dfa60f947c07">
	<cybox:Properties xsi:type="ArchiveFileObj:ArchiveFileObjectType">
		<FileObj:File_Path>archive.zip</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-a4a74a15-e2ae-4df2-ab4e-c24cf4178fe9">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Path>README.txt</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Contains</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Contained_Within”

The source Object is Contained within the related Object. Used for expressing the fact that an object is contained within another object.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
File File A file is contained within another file (e.g., appended to it).
File Archive File A file is contained within an archive file.
File Email Message A file is contained within an email message, as an attachment.
Link Email Message A link is contained within the body of an email message.
Domain Name URI A domain name is contained within the structure of a URL.
Address DNS Record A IP address is contained within a DNS record that resolves to the domain identified by the record.
Address ARP Cache A physical (i.e., MAC) address or IP address is contained within one of the entries of an ARP cache.
URI URL History A URL is contained within one of the entries of a URL history cache.
Win Registry Key Win Registry Key A Windows registry key is contained within another Windows registry key, as a subkey.

Example

<cybox:Object id="example:object-a4a74a15-e2ae-4df2-ab4e-c24cf4178fe9">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>README.txt</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-210ff682-5362-4391-be79-dfa60f947c07">
			<cybox:Properties xsi:type="ArchiveFileObj:ArchiveFileObjectType">
				<FileObj:File_Path>archive.zip</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Contained_Within</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Extracted_From”

The source Object was Extracted from the related Object. Used for expressing the fact that an object was extracted from another object, in the sense that the extracted object was physically encapsulated in the structure of the object that it was extracted from, as in a file extracted from an archive file.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
File File A file was extracted from inside of another file.
File Archive File A file was extracted from an archive file.
URI Email Message A URL was extracted from the body of an email message.
Link Email Message A link was extracted from the body of an email message.

Example

<cybox:Object id="example:object-210ff682-5362-4391-be79-dfa60f947c07">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\README.txt</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-210ff682-5362-4391-be79-dfa60f947c07">
			<cybox:Properties xsi:type="ArchiveFileObj:ArchiveFileObjectType">
				<FileObj:File_Path>archive.zip</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Extracted_From</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Connected_To”

The source Object Connected to the related Object. Commonly used for expressing the fact that a process connected to some network location or resource.

Inverse

n/a

Applicable Objects

|Source Object|Related Object|Description| |————-|————–|———–| |Process|Address|A process connected to an IP address.| |Process|Hostname|A process connected to a hostname.| |Process|Socket Address|A process connected to a socket address.| |Process|Network Socket|A process connected to a network socket.|

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-dec3774a-ee00-4fe8-9a19-924d51f7a46a">
			<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr">
				<AddressObj:Address_Value>10.1.2.5</AddressObj:Address_Value>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Connected_To</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Parent_Of”

The source Object is the Parent of the related Object. Commonly used for expressing the fact that a process spawned another process or thread and is therefore its parent.

Inverse

Child_Of

Applicable Objects

|Source Object|Related Object|Description| |————-|————–|———–| |Process|Process|A process is the parent of another process (which it spawned).| |Process|Win Thread|A process is the parent of a Windows thread (which it spawned).|

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-b464a2a1-876b-4e29-9b5f-705f66ca1327">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>another_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Parent_Of</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Child_Of”

The source Object is a Child of the related Object. Commonly used for expressing the fact that a process or thread was spawned by another process and is therefore its child.

Inverse

Parent_Of

Applicable Objects

|Source Object|Related Object|Description| |————-|————–|———–| |Process|Process|A process is the child of another process (which spawned it).| |Win Thread|Process|A Windows thread is the child of a process (which spawned it).|

Example

<cybox:Object id="example:object-b464a2a1-876b-4e29-9b5f-705f66ca1327">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>another_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Child_Of</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Redirects_To”

The source Object Redirects to the related Object. Commonly used for expressing URL or domain name redirection, where a URL redirects to another URL, or a Domain Name redirects to another Domain Name, respectively.

Inverse

n/a

Applicable Objects

|Source Object|Related Object|Description| |————-|————–|———–| |URI|URI|A URL redirects to another URL.| |Domain Name|Domain Name|A domain name redirects to another domain name.|

Examples

<cybox:Object id="example:object-ee973e87-6811-4bb0-aba2-59ffbd6e110d">
	<cybox:Properties xsi:type="URIObj:URIObjectType">
		<URIObj:Value>http://example.com/redir</URIObj:Value>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-ac8fd3b0-ad06-4c66-8cc9-39581e2c0564">
			<cybox:Properties xsi:type="URIObj:URIObjectType">
				<URIObj:Value>http://example.net/another_page</URIObj:Value>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Redirects_To</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Suspended”

The source Object Suspended the related Object. Commonly used for expressing the fact that a process suspended the execution of another process or thread.

Inverse

Resumed

Applicable Objects

Source Object Related Object Description
Process Process A process suspended the execution of another process.
Process Win Thread A process suspended the execution of a Windows thread.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-b464a2a1-876b-4e29-9b5f-705f66ca1327">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>another_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Suspended</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Suspended_By”

The source Object was Suspended by the related Object. Commonly used for expressing the fact that the execution of a process or thread was suspended by another process.

Inverse

Resumed_By

Applicable Objects

Source Object Related Object Description
Process Process A process was suspended by another process.
Win Thread Process A Windows thread was suspended by a process.

Example

<cybox:Object id="example:object-b464a2a1-876b-4e29-9b5f-705f66ca1327">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>another_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Suspended_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Paused”

The source Object Paused the related Object. Commonly used for expressing the fact that a process paused the execution of a Windows service.

Inverse

Resumed

Applicable Objects

Source Object Related Object Description
Process Win Service A process paused the execution of a Windows service.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-355010b4-33de-4627-92d7-9a634dea668d">
			<cybox:Properties xsi:type="WinServiceObj:WindowsServiceObjectType">
				<WinServiceObj:Display_Name>boot svc</WinServiceObj:Display_Name>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Paused</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Paused_By”

The source Object was Paused by the related Object. Commonly used for expressing the fact that the execution of a Windows service was paused by a process.

Inverse

Resumed_By

Applicable Objects

Source Object Related Object Description
Win Service Process A Windows service was paused by a process.

Example

<cybox:Object id="example:object-355010b4-33de-4627-92d7-9a634dea668d">
	<cybox:Properties xsi:type="WinServiceObj:WindowsServiceObjectType">
		<WinServiceObj:Display_Name>boot svc</WinServiceObj:Display_Name>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Paused_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Resumed”

The source Object Resumed the related Object. Commonly used for expressing the fact that a process resumed the execution of another process, thread, or Windows service.

Inverse

Suspended

Applicable Objects

Source Object Related Object Description
Process Process A process resumed the execution of another process.
Process Win Thread A process resumed the execution of a Windows thread.
Process Win Service A process resumed the execution of a Windows service.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-b464a2a1-876b-4e29-9b5f-705f66ca1327">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>another_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Resumed</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Resumed_By”

The source Object was Resumed by the related Object. Commonly used for expressing the fact that the execution of a process, thread, or Windows service was resumed by another process.

Inverse

Suspended_By

Applicable Objects

Source Object Related Object Description
Process Process A process was resumed by another process.
Win Thread Process A Windows thread was resumed by a process.
Win Service Process A Windows service was resumed by a process.

Example

<cybox:Object id="example:object-b464a2a1-876b-4e29-9b5f-705f66ca1327">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>another_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Resumed_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Wrote_To”

The source Object Wrote to the related Object. Commonly used for expressing the fact that a process wrote to another object during its execution.

Inverse

Read_From

Applicable Objects

Source Object Related Object Description
Process Process A process wrote to the memory space of another process during its execution.
Process File A process wrote to a file during its execution.
Process Pipe A process wrote to a pipe during its execution.
Process Win Mailslot A process wrote to a Windows mailslot during its execution.

Example

<cybox:Object id="example:object-b464a2a1-876b-4e29-9b5f-705f66ca1327">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>another_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Wrote_To</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Written_To_By”

The source Object was Written to by the related Object. Commonly used for expressing the fact that an object was written to by a process during its execution.

Inverse

Read_From_By

Applicable Objects

Source Object Related Object Description
Process Process The memory space of a process was written to by another process during its execution.
File Process A file was written to by a process during its execution.
Pipe Process A pipe was written to by a process during its execution.
Win Mailslot Process A Windows mailslot was written to by a process during its execution.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-b464a2a1-876b-4e29-9b5f-705f66ca1327">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>another_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Written_To_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Read_From”

The source Object Read from the related Object. Commonly used for expressing the fact that a process read from another object during its execution.

Inverse

Wrote_To

Applicable Objects

Source Object Related Object Description
Process Process A process read from the memory space of another process during its execution.
Process File A process read from a file during its execution.
Process Pipe A process read from a pipe during its execution.
Process Win Mailslot A process read from a Windows mailslot during its execution.

Example

<cybox:Object id="example:object-b464a2a1-876b-4e29-9b5f-705f66ca1327">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>another_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Read_From</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Read_From_By”

The source Object was Read from by the related Object. Commonly used for expressing the fact that an object was read from by a process during its execution.

Inverse

Written_To_By

Applicable Objects

Source Object Related Object Description
Process Process The memory space of a process was read from by another process during its execution.
File Process A file was read from by a process during its execution.
Pipe Process A pipe was read from by a process during its execution.
Win Mailslot Process A Windows mailslot was read from by a process during its execution.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-b464a2a1-876b-4e29-9b5f-705f66ca1327">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>another_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Read_From_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Allocated”

The source Object Allocated the related Object. Commonly used for expressing the fact that a process allocated a particular memory region.

Inverse

Freed

Applicable Objects

Source Object Related Object Description
Process Memory A process allocated a particular memory region.
Process Win Memory Page Region A process allocated a particular Windows memory page region.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-21dd8e8b-8608-46a6-aafc-87e3452fd836">
			<cybox:Properties xsi:type="MemoryObj:MemoryObjectType">
				<MemoryObj:Region_Size>192000</MemoryObj:Region_Size>
				<MemoryObj:Region_Start_Address>2F3CD1FF</MemoryObj:Region_Start_Address>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Allocated</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Allocated_By”

The source Object was Allocated by the related Object. Commonly used for expressing the fact that a memory region was allocated by a particular process.

Inverse

Freed_By

Applicable Objects

Source Object Related Object Description
Memory Process A memory region was allocated by a particular process during its execution.
Win Memory Page Region Process A Windows memory page region was allocated by a particular process during its execution.

Example

<cybox:Object id="example:object-21dd8e8b-8608-46a6-aafc-87e3452fd836">
	<cybox:Properties xsi:type="MemoryObj:MemoryObjectType">
		<MemoryObj:Region_Size>192000</MemoryObj:Region_Size>
		<MemoryObj:Region_Start_Address>2F3CD1FF</MemoryObj:Region_Start_Address>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Allocated_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Freed”

The source Object Freed the related Object. Commonly used for expressing the fact that a process freed a particular memory region.

Inverse

Allocated

Applicable Objects

Source Object Related Object Description
Process Memory A process freed a particular memory region.
Process Win Memory Page Region A process freed a particular Windows memory page region.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-21dd8e8b-8608-46a6-aafc-87e3452fd836">
			<cybox:Properties xsi:type="MemoryObj:MemoryObjectType">
				<MemoryObj:Region_Size>192000</MemoryObj:Region_Size>
				<MemoryObj:Region_Start_Address>2F3CD1FF</MemoryObj:Region_Start_Address>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Freed</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Freed_By”

The source Object was Freed by the related Object. Commonly used for expressing the fact that a memory region was freed by a particular process.

Inverse

Allocated_By

Applicable Objects

Source Object Related Object Description
Memory Process A memory region was freed by a particular process during its execution.
Win Memory Page Region Process A Windows memory page region was freed by a particular process during its execution.

Example

<cybox:Object id="example:object-21dd8e8b-8608-46a6-aafc-87e3452fd836">
	<cybox:Properties xsi:type="MemoryObj:MemoryObjectType">
		<MemoryObj:Region_Size>192000</MemoryObj:Region_Size>
		<MemoryObj:Region_Start_Address>2F3CD1FF</MemoryObj:Region_Start_Address>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Freed_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Opened”

The source Object Opened the related Object. Commonly used for expressing the fact that a process opened an object for access, use, or modification.

Inverse

Closed

Applicable Objects

Source Object Related Object Description
Process File A process opened an existing file during its execution.
Process Win Filemapping A process opened an existing Windows filemapping during its execution.
Process Mutex A process opened an existing mutex during its execution.
Process Semaphore A process opened an existing semaphore during its execution.
Process Port A process opened a port during its execution.
Process Win Event A process opened an existing Windows event during its execution.
Process Win Critical Section A process opened an existing Windows critical section during its execution.
Process Win Handle A process opened an existing Windows handle during its execution.
Process Win Registry Key A process opened an existing Windows registry key during its execution.
Process Win Service A process opened an existing Windows service during its execution.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-a127818e-eb90-4290-ae7b-2fd1bf0801b0">
			<cybox:Properties xsi:type="MutexObj:MutexObjectType">
				<MutexObj:Name>some.mutex!</MutexObj:Name>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Opened</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Opened_By”

The source Object was Opened_By the related Object. Commonly used for expressing the fact that an object was opened by a process for access or modification.

Inverse

Closed_By

Applicable Objects

Source Object Related Object Description
File Process An existing file was opened by a particular process during its execution.
Win Filemapping Process An existing Windows filemapping was opened by a particular process during its execution.
Mutex Process An existing mutex was opened by a particular process during its execution.
Port Process A port was opened by a particular process during its execution.
Semaphore Process An existing semaphore was opened by a particular process during its execution.
Win Event Process An existing Windows event was opened by a particular process during its execution.
Win Critical Section Process An existing Windows critical section was opened by a particular process during its execution.
Win Handle Process An existing Windows handle was opened by a particular process during its execution.
Win Registry Key Process An existing Windows registry key was opened by a particular process during its execution.
Win Service Process An existing Windows service was opened by a particular process during its execution.

Example

<cybox:Object id="example:object-a127818e-eb90-4290-ae7b-2fd1bf0801b0">
	<cybox:Properties xsi:type="MutexObj:MutexObjectType">
		<MutexObj:Name>some.mutex!</MutexObj:Name>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Opened_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Closed”

The source Object Closed the related Object. Commonly used for expressing the fact that a process closed an object that was previously opened for access, use, or modification.

Inverse

Opened

Applicable Objects

Source Object Related Object Description
Process File A process closed an existing file during its execution.
Process Win Filemapping A process closed an existing Windows filemapping during its execution.
Process Port A process closed a port during its execution.
Process Win Handle A process closed an existing Windows handle during its execution.
Process Win Registry Key A process closed an existing Windows service during its execution.

Example

<cybox:Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
	<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
		<ProcessObj:Image_Info>
			<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
		</ProcessObj:Image_Info>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-265b2078-1b32-4c1e-aa49-d8a5162ee9f9">
			<cybox:Properties xsi:type="PortObj:PortObjectType">
				<PortObj:Port_Value>222</PortObj:Port_Value>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Closed</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Closed_By”

The source Object was Closed_By the related Object. Commonly used for expressing the fact that an object previously opened for access or modification was closed by a process.

Inverse

Opened_By

Applicable Objects

Source Object Related Object Description
File Process An existing file was closed by a particular process during its execution.
Win Filemapping Process An existing Windows filemapping was closed by a particular process during its execution.
Port Process A port was closed by a particular process during its execution.
Win Handle Process An existing Windows handle was closed by a particular process during its execution.
Win Registry Key Process An existing Windows registry key was closed by a particular process during its execution.

Example

<cybox:Object id="example:object-265b2078-1b32-4c1e-aa49-d8a5162ee9f9">
	<cybox:Properties xsi:type="PortObj:PortObjectType">
		<PortObj:Port_Value>222</PortObj:Port_Value>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-c822a70d-7b41-4553-983b-a07fd8c553a0">
			<cybox:Properties xsi:type="ProcessObj:ProcessObjectType">
				<ProcessObj:Image_Info>
					<ProcessObj:File_Name>some_process.exe</ProcessObj:File_Name>
				</ProcessObj:Image_Info>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Closed_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Characterizes”

The source Object Characterizes the related Object. Used for expressing the fact that an object characterizes or provides information on the features of another object.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
File Artifact A file defines the file-specific features that characterize an artifact.
DNS Record Domain Name A DNS record defines the DNS-record-specific features that characterize a domain name.
WHOIS Domain Name A WHOIS record defines the WHOIS-specific features that characterize a domain name.

Example

<cybox:Object id="example:object-2efb4279-86e6-4554-a8e0-8d6d2610e632">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Name>asdfg.dll</FileObj:File_Name>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-dfd1d908-a799-4d9b-b367-63c556979a89">
			<cybox:Properties xsi:type="ArtifactObj:ArtifactObjectType">
				<ArtifactObj:Raw_Artifact>ABCDFFFF</ArtifactObj:Raw_Artifact>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Characterizes</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>							
</cybox:Object>

“Characterized_By”

The source Object is Characterized by the related Object. Used for expressing the fact that an object is characterized by another object, which provides information on its features.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
Artifact File An artifact is characterized by a file, which defines its file-specific features.
Domain Name DNS Record A domain name is characterized by a DNS record, which defines its DNS-record-specific features.
Domain Name WHOIS A domain name is characterized by a WHOIS record, which defines its WHOIS-specific features.

Example

<cybox:Object id="example:object-dfd1d908-a799-4d9b-b367-63c556979a89">
	<cybox:Properties xsi:type="ArtifactObj:ArtifactObjectType">
		<ArtifactObj:Raw_Artifact>ABCDFFFF</ArtifactObj:Raw_Artifact>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-2efb4279-86e6-4554-a8e0-8d6d2610e632">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Name>asdfg.dll</FileObj:File_Name>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Characterized_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>							
</cybox:Object>

“Resolved_To”

The source Object Resolved to the related Object. Used for expressing resolution between network naming structures (e.g., domain names) and IP addresses, in either direction.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
Domain Name Address A domain name resolved to a particular IP address.
Hostname Address A hostname resolved to a particular IP address.
Address Domain Name An IP address resolved to a particular domain name.
Address Hostname An IP address resolved to a particular hostname.

Example

<cybox:Object id="example:object-711f7c33-e7b7-4843-aec7-2b0cdb7d132d">
	<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
		<DomainNameObj:Value>example.com</DomainNameObj:Value>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-10953c1c-c077-4db5-a35e-38094ac004c2">
			<cybox:Properties xsi:type="AddressObj:AddressObjectType">
				<AddressObj:Address_Value>1.2.3.4</AddressObj:Address_Value>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Resolved_To</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>							
</cybox:Object>

“Sub-domain_Of”

The source Object is a Sub-domain of the related Object. Used for expressing the fact that a domain is a sub-domain of another domain.

Inverse

Supra-domain_Of

Applicable Objects

Source Object Related Object Description
Domain Name Domain Name A domain name is a sub-domain of another domain name.

Example

<cybox:Object id="example:object-5d0268ae-3ddb-4eb4-b279-5f4b9f3800b6">
	<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
		<DomainNameObj:Value>test.example.com</DomainNameObj:Value>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-711f7c33-e7b7-4843-aec7-2b0cdb7d132d">
			<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
				<DomainNameObj:Value>example.com</DomainNameObj:Value>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Sub-domain_Of</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>							
</cybox:Object>

“Supra-domain_Of”

The source Object is a Supra-domain of the related Object. Used for expressing the fact that a domain is a supra-domain of another domain.

Inverse

Sub-domain_Of

Applicable Objects

Source Object Related Object Description
Domain Name Domain Name A domain name is a supra-domain of another domain name.

Example

<cybox:Object id="example:object-711f7c33-e7b7-4843-aec7-2b0cdb7d132d">
	<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
		<DomainNameObj:Value>example.com</DomainNameObj:Value>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-5d0268ae-3ddb-4eb4-b279-5f4b9f3800b6">
			<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
				<DomainNameObj:Value>test.example.com</DomainNameObj:Value>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Supra-domain_Of</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>							
</cybox:Object>

“FQDN_Of”

The source Object is the Fully qualified domain name of the related Object. Used for expressing the fact that a domain name represents a fully qualified domain name for a domain or hostname.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
Domain Name Domain Name A domain name is a fully qualified domain name for another domain name.
Domain Name Hostname A domain name is a fully qualified domain name for a hostname.

Example

<cybox:Object id="example:object-375ee123-277e-4f2d-ac7a-5d0ab823d1d1">
	<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
		<DomainNameObj:Value>www.example.com</DomainNameObj:Value>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-711f7c33-e7b7-4843-aec7-2b0cdb7d132d">
			<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
				<DomainNameObj:Value>example.com</DomainNameObj:Value>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">FQDN_Of</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>							
</cybox:Object>

“Dropped”

The source Object Dropped the related Object. Commonly used for expressing the fact that a file dropped another file, in the sense that the file, after being injected into or spawned as a process, created the other file.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
File File A file dropped another file.

Example

<cybox:Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-2c6a7384-e9bd-457c-84ed-44a4e9d9048c">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Path>C:\asdfg.bin</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Dropped</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>

“Dropped_By”

The source Object was Dropped by the related Object. Commonly used for expressing the fact that a file was dropped by another file, in the sense that it was created by the other file after it was injected or spawned as a process.

Inverse

n/a

Applicable Objects

Source Object Related Object Description
File File A file was dropped by another file.

Example

<cybox:Object id="example:object-2c6a7384-e9bd-457c-84ed-44a4e9d9048c">
	<cybox:Properties xsi:type="FileObj:FileObjectType">
		<FileObj:File_Path>C:\asdfg.bin</FileObj:File_Path>
	</cybox:Properties>
	<cybox:Related_Objects>
		<cybox:Related_Object id="example:object-e970c3df-0c01-4611-8257-6b01d188983c">
			<cybox:Properties xsi:type="FileObj:FileObjectType">
				<FileObj:File_Path>C:\temp\qwerty.dll</FileObj:File_Path>
			</cybox:Properties>
			<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Dropped_By</cybox:Relationship>
		</cybox:Related_Object>
	</cybox:Related_Objects>
</cybox:Object>