add: [registry-key-value] New template to describe registry key values

- The `registry-key` object template includes
  already the `data`, `data-type` & `name` fields
  of a registry key value, but there is a
  limitation in the case of multiple registry key
  values
- In order to describe multiple registry key
  values, instead of adding a simple `multiple`
  field to the related and above mentioned fields,
  it is better to use the `registry-key-value`
  template so we know which data, data type and
  name values are related to a given registry key
  value
- It is then possible to have a reference between
  the registry key object and the related values
pull/387/head
Christian Studer 2023-03-01 20:50:30 +01:00
parent f579209884
commit 4b5faf196b
No known key found for this signature in database
GPG Key ID: 6BBED1B63A6D639F
2 changed files with 54 additions and 0 deletions

View File

@ -315,6 +315,7 @@ for a specific attribute. An optional **to_ids** boolean field to disable the ID
- [objects/reddit-subreddit](https://github.com/MISP/misp-objects/blob/main/objects/reddit-subreddit/definition.json) - Public or private subreddit.
- [objects/regexp](https://github.com/MISP/misp-objects/blob/main/objects/regexp/definition.json) - An object describing a regular expression (regex or regexp). The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a regular expression.
- [objects/registry-key](https://github.com/MISP/misp-objects/blob/main/objects/registry-key/definition.json) - Registry key object describing a Windows registry key with value and last-modified timestamp.
- [objects/registry-key-value](https://github.com/MISP/misp-objects/blob/main/objects/registry-key-value/definition.json) - Registry key value object describing a Windows registry key value with its data, data type and name, to be used when a registry key has multiple values
- [objects/regripper-NTUser](https://github.com/MISP/misp-objects/blob/main/objects/regripper-NTUser/definition.json) - Regripper Object template designed to present user specific configuration details extracted from the NTUSER.dat hive.
- [objects/regripper-sam-hive-single-user](https://github.com/MISP/misp-objects/blob/main/objects/regripper-sam-hive-single-user/definition.json) - Regripper Object template designed to present user profile details extracted from the SAM hive.
- [objects/regripper-sam-hive-user-group](https://github.com/MISP/misp-objects/blob/main/objects/regripper-sam-hive-user-group/definition.json) - Regripper Object template designed to present group profile details extracted from the SAM hive.

View File

@ -0,0 +1,53 @@
{
"attributes": {
"data": {
"categories": [
"Persistence mechanism"
],
"description": "Data stored in the registry key value",
"misp-attribute": "text",
"ui-priority": 1
},
"data-type": {
"categories": [
"Persistence mechanism"
],
"description": "Registry key value type",
"disable_correlation": true,
"misp-attribute": "text",
"sane_default": [
"REG_NONE",
"REG_SZ",
"REG_EXPAND_SZ",
"REG_BINARY",
"REG_DWORD",
"REG_DWORD_LITTLE_ENDIAN",
"REG_DWORD_BIG_ENDIAN",
"REG_LINK",
"REG_MULTI_SZ",
"REG_RESOURCE_LIST",
"REG_FULL_RESOURCE_DESCRIPTOR",
"REG_RESOURCE_REQUIREMENTS_LIST",
"REG_QWORD",
"REG_QWORD_LITTLE_ENDIAN"
],
"ui-priority": 0
},
"name": {
"categories": [
"Persistence mechanism"
],
"description": "Name of the registry key value",
"misp-attribute": "text",
"ui-priority": 1
}
},
"description": "Registry key value object describing a Windows registry key value, with its data, data type and name values. To be used when a registry key has multiple values.",
"meta-category": "file",
"name": "registry-key-value",
"requiredOneOf": [
"data"
],
"uuid": "4626a273-72c1-48d3-8595-ff48ea2277f7",
"version": 1
}