mirror of https://github.com/MISP/misp-objects
				
				
				
			add: [registry-key-value] New template to describe registry key values
- The `registry-key` object template includes already the `data`, `data-type` & `name` fields of a registry key value, but there is a limitation in the case of multiple registry key values - In order to describe multiple registry key values, instead of adding a simple `multiple` field to the related and above mentioned fields, it is better to use the `registry-key-value` template so we know which data, data type and name values are related to a given registry key value - It is then possible to have a reference between the registry key object and the related valuespull/387/head
							parent
							
								
									f579209884
								
							
						
					
					
						commit
						4b5faf196b
					
				|  | @ -315,6 +315,7 @@ for a specific attribute. An optional **to_ids** boolean field to disable the ID | |||
| - [objects/reddit-subreddit](https://github.com/MISP/misp-objects/blob/main/objects/reddit-subreddit/definition.json) - Public or private subreddit. | ||||
| - [objects/regexp](https://github.com/MISP/misp-objects/blob/main/objects/regexp/definition.json) - An object describing a regular expression (regex or regexp). The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a regular expression. | ||||
| - [objects/registry-key](https://github.com/MISP/misp-objects/blob/main/objects/registry-key/definition.json) - Registry key object describing a Windows registry key with value and last-modified timestamp. | ||||
| - [objects/registry-key-value](https://github.com/MISP/misp-objects/blob/main/objects/registry-key-value/definition.json) - Registry key value object describing a Windows registry key value with its data, data type and name, to be used when a registry key has multiple values | ||||
| - [objects/regripper-NTUser](https://github.com/MISP/misp-objects/blob/main/objects/regripper-NTUser/definition.json) - Regripper Object template designed to present user specific configuration details extracted from the NTUSER.dat hive. | ||||
| - [objects/regripper-sam-hive-single-user](https://github.com/MISP/misp-objects/blob/main/objects/regripper-sam-hive-single-user/definition.json) - Regripper Object template designed to present user profile details extracted from the SAM hive. | ||||
| - [objects/regripper-sam-hive-user-group](https://github.com/MISP/misp-objects/blob/main/objects/regripper-sam-hive-user-group/definition.json) - Regripper Object template designed to present group profile details extracted from the SAM hive. | ||||
|  |  | |||
|  | @ -0,0 +1,53 @@ | |||
| { | ||||
|   "attributes": { | ||||
|     "data": { | ||||
|       "categories": [ | ||||
|         "Persistence mechanism" | ||||
|       ], | ||||
|       "description": "Data stored in the registry key value", | ||||
|       "misp-attribute": "text", | ||||
|       "ui-priority": 1 | ||||
|     }, | ||||
|     "data-type": { | ||||
|       "categories": [ | ||||
|         "Persistence mechanism" | ||||
|       ], | ||||
|       "description": "Registry key value type", | ||||
|       "disable_correlation": true, | ||||
|       "misp-attribute": "text", | ||||
|       "sane_default": [ | ||||
|         "REG_NONE", | ||||
|         "REG_SZ", | ||||
|         "REG_EXPAND_SZ", | ||||
|         "REG_BINARY", | ||||
|         "REG_DWORD", | ||||
|         "REG_DWORD_LITTLE_ENDIAN", | ||||
|         "REG_DWORD_BIG_ENDIAN", | ||||
|         "REG_LINK", | ||||
|         "REG_MULTI_SZ", | ||||
|         "REG_RESOURCE_LIST", | ||||
|         "REG_FULL_RESOURCE_DESCRIPTOR", | ||||
|         "REG_RESOURCE_REQUIREMENTS_LIST", | ||||
|         "REG_QWORD", | ||||
|         "REG_QWORD_LITTLE_ENDIAN" | ||||
|       ], | ||||
|       "ui-priority": 0 | ||||
|     }, | ||||
|     "name": { | ||||
|       "categories": [ | ||||
|         "Persistence mechanism" | ||||
|       ], | ||||
|       "description": "Name of the registry key value", | ||||
|       "misp-attribute": "text", | ||||
|       "ui-priority": 1 | ||||
|     } | ||||
|   }, | ||||
|   "description": "Registry key value object describing a Windows registry key value, with its data, data type and name values. To be used when a registry key has multiple values.", | ||||
|   "meta-category": "file", | ||||
|   "name": "registry-key-value", | ||||
|   "requiredOneOf": [ | ||||
|     "data" | ||||
|   ], | ||||
|   "uuid": "4626a273-72c1-48d3-8595-ff48ea2277f7", | ||||
|   "version": 1 | ||||
| } | ||||
		Loading…
	
		Reference in New Issue
	
	 Christian Studer
						Christian Studer