first version of a yabin object

2017-09-06 16:04:37 +02:00 · 2017-09-06 16:04:37 +02:00 · 317fd559d6
parent 0c95f5e3cc
commit 317fd559d6
1 changed files with 42 additions and 0 deletions
--- a/objects/yabin/definition.json
+++ b/objects/yabin/definition.json
@ -0,0 +1,42 @@
+{
+  "name": "yabin",
+  "uuid": "35b4dd03-4fa9-4e0e-97d8-a2867b11c956",
+  "meta-category": "file",
+  "description": "yabin.py generates Yara rules from function prologs, for matching and hunting binaries. ref: https://github.com/AlienVault-OTX/yabin",
+  "version": 1,
+  "attributes": {
+    "yara": {
+      "misp-attribute": "yara",
+      "ui-priority": 0,
+      "disable_correlation": true,
+      "description": "Yara rule generated from -y."
+    },
+    "yara-hunt": {
+      "misp-attribute": "yara",
+      "ui-priority": 0,
+      "disable_correlation": true,
+      "description": "Wide yara rule generated from -yh."
+    },
+    "whitelist": {
+      "misp-attribute": "text",
+      "ui-priority": 0,
+      "disable_correlation": true,
+      "description": "Whitelist name used to generate the rules."
+    },
+    "text": {
+      "misp-attribute": "text",
+      "ui-priority": 0,
+      "disable_correlation": true,
+      "description": "A description of Yara rule generated."
+    },
+    "version": {
+      "misp-attribute": "url",
+      "ui-priority": 0,
+      "description": "yabin.py and regex.txt version used for the generation of the yara rules."
+    }
+  },
+  "requiredOneOf": [
+    "yara",
+    "yara-hunt"
+  ]
+}