misp-objects/objects/elf-section/definition.json

{
  "name": "elf-section",
  "meta-category": "file",
  "description": "Object describing a section of an Executable and Linkable Format",
  "version": 1,
  "attributes": {
    "sh_name": {
      "misp-attribute": "text",
      "misp-usage-frequency": 1,
      "disable_correlation": true
    },
    "sh_type":{
      "misp-attribute": "text",
      "misp-usage-frequency": 0,
      "sane_default": [
        "SHT_NULL",
        "SHT_PROGBITS",
        "SHT_SYMTAB",
        "SHT_STRTAB",
        "SHT_RELA",
        "SHT_HASH",
        "SHT_DYNAMIC",
        "SHT_NOTE",
        "SHT_NOBITS",
        "SHT_REL",
        "SHT_SHLIB",
        "SHT_DYNSYM",
        "SHT_INIT_ARRAY",
        "SHT_FINI_ARRAY",
        "SHT_PREINIT_ARRAY",
        "SHT_GROUP",
        "SHT_SYMTAB_SHNDX",
        "SHT_NUM",
        "SHT_LOOS"
      ]

    }
    ,
    "sh_flags": {
      "misp-attribute": "text",
      "misp-usage-frequency": 0,
      "sane_default": [
        "W (write)",
        "A (alloc)",
        "X (execute)",
        "M (merge)",
        "S (strings)",
        "I (info)",
        "L (link order)",
        "O (extra OS processing required)",
        "G (group)",
        "T (TLS)",
        "C (compressed)",
        "x (unknown)",
        "o (OS specific)",
        "E (exclude)",
        "l (large)",
        "p (processor specific)"
      ]
    },
    "text": {
      "misp-attribute": "text",
      "misp-usage-frequency": 1,
      "disable_correlation": true
    },
    "sh_size": {
      "misp-attribute": "size-in-bytes",
      "misp-usage-frequency": 1,
      "disable_correlation": true
    },
    "entropy": {
      "misp-attribute": "float",
      "misp-usage-frequency": 0,
      "disable_correlation": true
    },
    "md5": {
      "misp-attribute": "md5",
      "misp-usage-frequency": 1
    },
    "sha1": {
      "misp-attribute": "sha1",
      "misp-usage-frequency": 0
    },
    "sha256": {
      "misp-attribute": "sha256",
      "misp-usage-frequency": 0
    },
    "sha512": {
      "misp-attribute": "sha512",
      "misp-usage-frequency": 0
    },
    "ssdeep": {
      "misp-attribute": "ssdeep",
      "misp-usage-frequency": 0
    }
  },
  "requiredOneOf": [
    "text",
    "name",
    "sha1",
    "sha256",
    "sha512"
  ]
}