#NEWLINE# def create_win_task_obj( search_string , content_string , condition ) : #NEWLINE# #INDENT# from cybox.objects.win_task_object import WinTask , TaskAction , TaskActionList , IComHandlerAction , IExecAction , Trigger , TriggerList , IShowMessageAction #NEWLINE# attrmap = { #NEWLINE# #INDENT# 'TaskItem/AccountLogonType' : 'account_logon_type' , #NEWLINE# 'TaskItem/AccountName' : 'account_name' , #NEWLINE# 'TaskItem/AccountRunLevel' : 'account_run_level' , #NEWLINE# 'TaskItem/ApplicationName' : 'application_name' , #NEWLINE# 'TaskItem/Comment' : 'comment' , #NEWLINE# 'TaskItem/CreationDate' : 'creation_date' , #NEWLINE# 'TaskItem/Creator' : 'creator' , #NEWLINE# 'TaskItem/ExitCode' : 'exit_code' , #NEWLINE# 'TaskItem/MaxRunTime' : 'max_run_time' , #NEWLINE# 'TaskItem/MostRecentRunTime' : 'most_recent_run_time' , #NEWLINE# 'TaskItem/Name' : 'name' , #NEWLINE# 'TaskItem/NextRunTime' : 'next_run_time' , #NEWLINE# 'TaskItem/Parameters' : 'parameters' , #NEWLINE# 'TaskItem/WorkItemData' : 'work_item_data' , #NEWLINE# 'TaskItem/WorkingDirectory' : 'working_directory' , #NEWLINE# 'TaskItem/Flag' : 'flags' , #NEWLINE# 'TaskItem/Priority' : 'priority' , #NEWLINE# 'TaskItem/Status' : 'status' , #NEWLINE# #UNINDENT# } #NEWLINE# icom_attrmap = { #NEWLINE# #INDENT# 'TaskItem/ActionList/Action/COMClassId' : 'com_class_id' , #NEWLINE# 'TaskItem/ActionList/Action/COMData' : 'com_data' , #NEWLINE# #UNINDENT# } #NEWLINE# iexecaction_attrmap = { #NEWLINE# #INDENT# 'TaskItem/ActionList/Action/ExecArguments' : 'exec_arguments' , #NEWLINE# 'TaskItem/ActionList/Action/ExecProgramPath' : 'exec_program_path' , #NEWLINE# 'TaskItem/ActionList/Action/ExecWorkingDirectory' : 'exec_working_directory' , #NEWLINE# #UNINDENT# } #NEWLINE# ishowmessage_attrmap = { #NEWLINE# #INDENT# 'TaskItem/ActionList/Action/ShowMessageBody' : 'show_message_body' , #NEWLINE# 'TaskItem/ActionList/Action/ShowMessageTitle' : 'show_message_title' , #NEWLINE# #UNINDENT# } #NEWLINE# trigger_attrmap = { #NEWLINE# #INDENT# 'TaskItem/TriggerList/Trigger/TriggerBegin' : 'trigger_begin' , #NEWLINE# 'TaskItem/TriggerList/Trigger/TriggerDelay' : 'trigger_delay' , #NEWLINE# 'TaskItem/TriggerList/Trigger/TriggerEnd' : 'trigger_end' , #NEWLINE# 'TaskItem/TriggerList/Trigger/TriggerFrequency' : 'trigger_frequency' , #NEWLINE# 'TaskItem/TriggerList/Trigger/TriggerMaxRunTime' : 'trigger_max_run_time' , #NEWLINE# 'TaskItem/TriggerList/Trigger/TriggerSessionChangeType' : 'trigger_session_change_type' , #NEWLINE# #UNINDENT# } #NEWLINE# email_map = { #NEWLINE# #INDENT# 'TaskItem/ActionList/Action/EmailBCC' : 'Email/BCC' , #NEWLINE# 'TaskItem/ActionList/Action/EmailBody' : 'Email/Body' , #NEWLINE# 'TaskItem/ActionList/Action/EmailCC' : 'Email/CC' , #NEWLINE# 'TaskItem/ActionList/Action/EmailSubject' : 'Email/Subject' , #NEWLINE# 'TaskItem/ActionList/Action/EmailFrom' : 'Email/From' , #NEWLINE# 'TaskItem/ActionList/Action/EmailTo' : 'Email/To' , #NEWLINE# 'TaskItem/ActionList/Action/EmailReplyTo' : 'Email/ReplyTo' , #NEWLINE# 'TaskItem/ActionList/Action/EmailServer' : 'Email/EmailServer' , #NEWLINE# #UNINDENT# } #NEWLINE# task = WinTask ( ) #NEWLINE# action = TaskAction ( ) #NEWLINE# actions = TaskActionList ( action ) #NEWLINE# trigger = Trigger ( ) #NEWLINE# triggers = TriggerList ( trigger ) #NEWLINE# if ( search_string in attrmap ) : #NEWLINE# #INDENT# set_field ( task , attrmap [ search_string ] , content_string , condition ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# if ( search_string in icom_attrmap ) : #NEWLINE# #INDENT# handler = IComHandlerAction ( ) #NEWLINE# set_field ( handler , icom_attrmap [ search_string ] , content_string , condition ) #NEWLINE# action . icomhandleraction = handler #NEWLINE# task . action_list = actions #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# if ( search_string in email_map ) : #NEWLINE# #INDENT# email = create_email_obj ( email_map [ search_string ] , content_string , condition ) #NEWLINE# action . iemailaction = email #NEWLINE# task . action_list = actions #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# if ( search_string in iexecaction_attrmap ) : #NEWLINE# #INDENT# execaction = IExecAction ( ) #NEWLINE# set_field ( execaction , iexecaction_attrmap [ search_string ] , content_string , condition ) #NEWLINE# action . iexecaction = execaction #NEWLINE# task . action_list = actions #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# if ( search_string in ishowmessage_attrmap ) : #NEWLINE# #INDENT# ishowmessage = IShowMessageAction ( ) #NEWLINE# set_field ( ishowmessage , handler [ search_string ] , content_string , condition ) #NEWLINE# action . ishowmessageaction = ( ishowmessage , ) #NEWLINE# task . action_list = actions #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# if ( search_string in trigger_attrmap ) : #NEWLINE# #INDENT# set_field ( trigger , trigger_attrmap [ search_string ] , content_string , condition ) #NEWLINE# task . trigger_list = triggers #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# if ( search_string == 'TaskItem/ActionList/Action/ActionType' ) : #NEWLINE# #INDENT# set_field ( action , 'action_type' , content_string , condition ) #NEWLINE# task . action_list = actions #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# return None #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# #UNINDENT# #UNINDENT# #UNINDENT# #UNINDENT# return Object ( task )