Module

module

The Module object describes the load attributes of a module.

Attributes

CaptionNameTypeDescription
Base Addressbase_addressString

The memory address where the module was loaded.

FilefileFile[]

Entity:FILE
The module file object.

Function Namefunction_nameString

The entry-point function of the module. The system calls the entry-point function whenever a process or thread loads or unloads the module.

Load Typeload_typeString

The load type, normalized to the caption of the load_type_id value. In the case of 'Other', it is defined by the event source.

Load Type IDload_type_idInteger

The normalized identifier for how the module was loaded in memory.

  • 0: Unknown (UNKNOWN)
  • 1: Standard (STANDARD)
  • 2: Non Standard (NON_STANDARD)
  • 3: ShellCode (SHELLCODE)
  • 4: Mapped (MAPPED)
  • 5: NonStandard Backed (NONSTANDARD_BACKED)
  • 99: Other (OTHER)
Raw Dataraw_dataJSON

Group:context
The event data as received from the event source.

Record IDrecord_idString

Group:primary
Unique identifier for the object

Start Addressstart_addressString

The start address of the execution.

TypetypeString

The module type.

UnmappedunmappedUnmapped[]

Data from the source that was not mapped into the schema.

Relationships

Module shown in context

Inbound Relationships

These objects and events reference Module in their attributes:

Outbound Relationships

Module references the following objects and events in its attributes:

This page describes ocsf-1.4.0