misp-objects/objects/pe-section/definition.json

73 lines
1.5 KiB
JSON
Raw Normal View History

2017-03-12 23:06:39 +01:00
{
2017-07-03 12:18:25 +02:00
"requiredOneOf": [
"text",
"name",
"sha1",
"sha256",
"sha512"
],
2017-03-12 23:06:39 +01:00
"attributes": {
2017-07-03 12:18:25 +02:00
"characteristics": {
"sane_default": [
"read",
"write",
"executable"
],
"misp-usage-frequency": 0,
"misp-attribute": "text"
},
2017-03-12 23:06:39 +01:00
"name": {
2017-07-03 12:18:25 +02:00
"disable_correlation": true,
"sane_default": [
".rsrc",
".reloc",
".rdata",
".data",
".text"
],
2017-07-03 12:18:25 +02:00
"misp-usage-frequency": 1,
"misp-attribute": "text"
2017-03-12 23:06:39 +01:00
},
2017-07-03 12:18:25 +02:00
"size-in-bytes": {
"disable_correlation": true,
"misp-usage-frequency": 1,
"misp-attribute": "size-in-bytes"
2017-03-13 16:33:50 +01:00
},
2017-03-12 23:06:39 +01:00
"text": {
2017-07-03 12:18:25 +02:00
"disable_correlation": true,
"misp-usage-frequency": 1,
2017-07-03 12:18:25 +02:00
"misp-attribute": "text"
2017-03-12 23:06:39 +01:00
},
2017-07-03 12:18:25 +02:00
"md5": {
"misp-usage-frequency": 1,
2017-07-03 12:18:25 +02:00
"misp-attribute": "md5"
2017-03-12 23:06:39 +01:00
},
"entropy": {
2017-07-03 12:18:25 +02:00
"disable_correlation": true,
"misp-usage-frequency": 0,
2017-07-03 12:18:25 +02:00
"misp-attribute": "float"
2017-03-12 23:06:39 +01:00
},
2017-07-03 12:18:25 +02:00
"sha256": {
"misp-usage-frequency": 0,
"misp-attribute": "sha256"
2017-03-12 23:06:39 +01:00
},
"sha1": {
2017-07-03 12:18:25 +02:00
"misp-usage-frequency": 0,
"misp-attribute": "sha1"
2017-03-12 23:06:39 +01:00
},
2017-07-03 12:18:25 +02:00
"ssdeep": {
"misp-usage-frequency": 0,
"misp-attribute": "ssdeep"
2017-03-12 23:06:39 +01:00
},
"sha512": {
2017-07-03 12:18:25 +02:00
"misp-usage-frequency": 0,
"misp-attribute": "sha512"
2017-03-12 23:06:39 +01:00
}
},
2017-07-03 12:18:25 +02:00
"version": 1,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"name": "pe-section"
2017-03-12 23:06:39 +01:00
}