diff --git a/objects/yabin/definition.json b/objects/yabin/definition.json new file mode 100644 index 0000000..c38331a --- /dev/null +++ b/objects/yabin/definition.json @@ -0,0 +1,42 @@ +{ + "name": "yabin", + "uuid": "35b4dd03-4fa9-4e0e-97d8-a2867b11c956", + "meta-category": "file", + "description": "yabin.py generates Yara rules from function prologs, for matching and hunting binaries. ref: https://github.com/AlienVault-OTX/yabin", + "version": 1, + "attributes": { + "yara": { + "misp-attribute": "yara", + "ui-priority": 0, + "disable_correlation": true, + "description": "Yara rule generated from -y." + }, + "yara-hunt": { + "misp-attribute": "yara", + "ui-priority": 0, + "disable_correlation": true, + "description": "Wide yara rule generated from -yh." + }, + "whitelist": { + "misp-attribute": "text", + "ui-priority": 0, + "disable_correlation": true, + "description": "Whitelist name used to generate the rules." + }, + "text": { + "misp-attribute": "text", + "ui-priority": 0, + "disable_correlation": true, + "description": "A description of Yara rule generated." + }, + "version": { + "misp-attribute": "url", + "ui-priority": 0, + "description": "yabin.py and regex.txt version used for the generation of the yara rules." + } + }, + "requiredOneOf": [ + "yara", + "yara-hunt" + ] +}