misp-objects/objects/file/definition.json

{
  "requiredOneOf": [
    "filename",
    "size-in-bytes",
    "authentihash",
    "ssdeep",
    "imphash",
    "pehash",
    "sha224",
    "sha384",
    "sha512",
    "sha512/224",
    "sha512/256",
    "tlsh",
    "md5",
    "sha1",
    "sha256",
    "pattern-in-file"
  ],
  "attributes": {
    "md5": {
      "misp-usage-frequency": 1,
      "misp-attribute": "md5"
    },
    "sha512/224": {
      "misp-usage-frequency": 0,
      "misp-attribute": "sha512/224"
    },
    "sha512": {
      "misp-usage-frequency": 0,
      "misp-attribute": "sha512"
    },
    "sha384": {
      "misp-usage-frequency": 0,
      "misp-attribute": "sha384"
    },
    "sha224": {
      "misp-usage-frequency": 0,
      "misp-attribute": "sha224"
    },
    "ssdeep": {
      "misp-usage-frequency": 0,
      "misp-attribute": "ssdeep"
    },
    "authentihash": {
      "misp-usage-frequency": 0,
      "misp-attribute": "authentihash"
    },
    "size-in-bytes": {
      "disable_correlation": true,
      "misp-usage-frequency": 0,
      "misp-attribute": "size-in-bytes"
    },
    "sha1": {
      "misp-usage-frequency": 1,
      "misp-attribute": "sha1"
    },
    "sha256": {
      "misp-usage-frequency": 1,
      "misp-attribute": "sha256"
    },
    "entropy": {
      "disable_correlation": true,
      "misp-usage-frequency": 1,
      "misp-attribute": "float"
    },
    "pattern-in-file": {
      "categories": [
        "Artifacts dropped",
        "Payload installation",
        "External analysis"
      ],
      "misp-usage-frequency": 1,
      "misp-attribute": "pattern-in-file"
    },
    "text": {
      "disable_correlation": true,
      "misp-usage-frequency": 1,
      "misp-attribute": "text"
    },
    "malware-sample": {
      "misp-usage-frequency": 1,
      "misp-attribute": "malware-sample"
    },
    "filename": {
      "categories": [
        "Payload delivery",
        "Artifacts dropped",
        "Payload installation",
        "External analysis"
      ],
      "misp-usage-frequency": 1,
      "misp-attribute": "filename"
    },
    "sha512/256": {
      "misp-usage-frequency": 0,
      "misp-attribute": "sha512/256"
    },
    "tlsh": {
      "misp-usage-frequency": 0,
      "misp-attribute": "tlsh"
    }
  },
  "version": 1,
  "description": "File object describing a file with meta-information",
  "meta-category": "file",
  "uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
  "name": "file"
}