misp-objects/objects/pe/definition.json

109 lines
2.5 KiB
JSON
Raw Normal View History

2017-03-09 14:14:36 +01:00
{
"name": "pe",
"meta-category": "file",
"description": "Object describing a Portable Executable",
"version": 1,
"attributes": {
"imphash": {
"misp-attribute": "imphash",
"misp-usage-frequency": 0
},
"pehash": {
"misp-attribute": "pehash",
"misp-usage-frequency": 0
},
2017-03-15 11:30:54 +01:00
"impfuzzy": {
2017-03-15 11:19:08 +01:00
"misp-attribute": "impfuzzy",
"misp-usage-frequency": 0
2017-03-15 11:30:54 +01:00
},
2017-03-14 15:57:05 +01:00
"type": {
"misp-attribute": "text",
"misp-usage-frequency": 1,
"disable_correlation": true,
"sane_default": [
"exe",
"dll",
"driver",
"unknown"
]
},
2017-03-09 14:14:36 +01:00
"text": {
"misp-attribute": "text",
"misp-usage-frequency": 1,
"disable_correlation": true
2017-03-09 14:14:36 +01:00
},
2017-03-14 15:57:05 +01:00
"number-sections": {
"misp-attribute": "counter",
"misp-usage-frequency": 0,
"disable_correlation": true
},
2017-03-09 14:14:36 +01:00
"original-filename": {
"misp-attribute": "filename",
2017-03-09 14:14:36 +01:00
"misp-usage-frequency": 1
},
"internal-filename": {
"misp-attribute": "filename",
2017-03-09 14:14:36 +01:00
"misp-usage-frequency": 0
},
"compilation-timestamp": {
"misp-attribute": "datetime",
"misp-usage-frequency": 1
},
2017-03-12 23:06:39 +01:00
"entrypoint-section|position": {
2017-03-09 14:14:36 +01:00
"misp-attribute": "text",
"misp-usage-frequency": 0,
"disable_correlation": true
2017-03-09 14:14:36 +01:00
},
"entrypoint-address": {
"misp-attribute": "text",
"misp-usage-frequency": 0,
"disable_correlation": true
2017-03-09 14:14:36 +01:00
},
"file-description": {
"misp-attribute": "text",
"misp-usage-frequency": 0,
"disable_correlation": true
2017-03-09 14:14:36 +01:00
},
"file-version": {
"misp-attribute": "text",
"misp-usage-frequency": 0,
"disable_correlation": true
2017-03-09 14:14:36 +01:00
},
"lang-id": {
"misp-attribute": "text",
"misp-usage-frequency": 0,
"disable_correlation": true
2017-03-09 14:14:36 +01:00
},
"product-name": {
"misp-attribute": "text",
"misp-usage-frequency": 0,
"disable_correlation": true
2017-03-09 14:14:36 +01:00
},
"product-version": {
"misp-attribute": "text",
"misp-usage-frequency": 0,
"disable_correlation": true
2017-03-12 23:06:39 +01:00
},
"company-name": {
"misp-attribute": "text",
"misp-usage-frequency": 0,
"disable_correlation": true
2017-03-12 23:06:39 +01:00
},
"legal-copyright": {
"misp-attribute": "text",
"misp-usage-frequency": 0,
"disable_correlation": true
2017-03-12 23:06:39 +01:00
},
"pe-type": {
"misp-attribute": "text",
"misp-usage-frequency": 0,
"disable_correlation": true
2017-03-09 14:14:36 +01:00
}
},
"requiredOneOf": [
"text",
"original-filename",
"internal-filename"
]
}