misp-objects/objects/registry-key/definition.json

102 lines
2.5 KiB
JSON
Raw Normal View History

2016-12-07 16:39:31 +01:00
{
2017-02-13 11:18:42 +01:00
"attributes": {
"data": {
2017-02-13 11:18:42 +01:00
"categories": [
"Persistence mechanism"
2017-07-03 12:19:04 +02:00
],
"description": "Data stored in the registry key",
"misp-attribute": "text",
"ui-priority": 1
2017-02-13 11:18:42 +01:00
},
2017-07-03 12:19:04 +02:00
"data-type": {
2017-02-13 11:18:42 +01:00
"categories": [
"Persistence mechanism"
2017-07-03 12:19:04 +02:00
],
"description": "Registry value type",
"disable_correlation": true,
"misp-attribute": "text",
2017-08-29 18:36:46 +02:00
"sane_default": [
"REG_NONE",
"REG_SZ",
"REG_EXPAND_SZ",
"REG_BINARY",
"REG_DWORD",
"REG_DWORD_LITTLE_ENDIAN",
"REG_DWORD_BIG_ENDIAN",
"REG_LINK",
"REG_MULTI_SZ",
"REG_RESOURCE_LIST",
"REG_FULL_RESOURCE_DESCRIPTOR",
"REG_RESOURCE_REQUIREMENTS_LIST",
"REG_QWORD",
"REG_QWORD_LITTLE_ENDIAN"
],
"ui-priority": 0
2017-02-13 11:18:42 +01:00
},
"hive": {
2017-02-13 11:18:42 +01:00
"categories": [
"Persistence mechanism"
2017-07-03 12:19:04 +02:00
],
"description": "Hive used to store the registry key (file on disk)",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 1
2017-07-03 12:19:04 +02:00
},
"key": {
2017-02-13 11:18:42 +01:00
"categories": [
"Persistence mechanism"
2017-07-03 12:19:04 +02:00
],
2017-08-29 18:36:46 +02:00
"description": "Full key path",
"misp-attribute": "regkey",
"ui-priority": 1
},
"last-modified": {
2017-02-13 11:18:42 +01:00
"categories": [
"Other"
2017-07-03 12:19:04 +02:00
],
"description": "Last time the registry key has been modified",
"misp-attribute": "datetime",
"ui-priority": 0
2017-02-13 11:18:42 +01:00
},
"name": {
2017-02-13 11:18:42 +01:00
"categories": [
2017-07-03 12:19:04 +02:00
"Persistence mechanism"
],
"description": "Name of the registry key",
"misp-attribute": "text",
"ui-priority": 1
2018-01-18 13:49:03 +01:00
},
"root-keys": {
"description": "Root key of the Windows registry (extracted from the key)",
"disable_correlation": true,
"misp-attribute": "text",
2018-01-18 13:49:03 +01:00
"sane_default": [
"HKCC",
"HKCR",
"HKCU",
"HKDD",
"HKEY_CLASSES_ROOT",
"HKEY_CURRENT_CONFIG",
"HKEY_CURRENT_USER",
"HKEY_DYN_DATA",
"HKEY_LOCAL_MACHINE",
"HKEY_PERFORMANCE_DATA",
"HKEY_USERS",
"HKLM",
"HKPD",
"HKU"
],
"ui-priority": 0
2017-02-13 11:18:42 +01:00
}
},
2017-07-03 12:19:04 +02:00
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
"meta-category": "file",
"name": "registry-key",
"requiredOneOf": [
"key",
"name",
"data"
],
2017-07-03 12:19:04 +02:00
"uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
"version": 4
}