MISP
/
misp-objects
mirror of https://github.com/MISP/misp-objects
2
0
Fork 0
Code Issues Releases Wiki Activity

add: registry-hive object describing a Windows registry hive including key, subkey and 

value (and associated data if any)
pull/69/merge
Alexandre Dulaunoy 2018-01-18 12:54:01 +01:00
parent 90475bcf9c
commit 94cfc57e16
No known key found for this signature in database
GPG Key ID: 09E2CD4944E6CBCD
1 changed files with 77 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

77
objects/registry-hive/definition.json Normal file
View File

@ -0,0 +1,77 @@
{
"requiredOneOf": [
"text",
"key",
"value",
"data"
],
"attributes": {
"key": {
"description": "Key of the registry hive",
"misp-attribute": "text",
"ui-priority": 0
},
"value": {
"description": "Value of the registry hive",
"misp-attribute": "text",
"ui-priority": 0
},
"data-type": {
"sane_default": [
"REG_NONE",
"REG_SZ",
"REG_EXPAND_SZ",
"REG_BINARY",
"REG_DWORD",
"REG_DWORD_BIG_ENDIAN",
"REG_LINK",
"REG_MULTI_SZ",
"REG_RESOURCE_LIST",
"REG_FULL_RESOURCE_DESCRIPTOR",
"REG_RESOURCE_REQUIREMENTS_LIST",
"REG_QWORD"
],
"description": "Type of the data in the registry hive",
"misp-attribute": "text",
"ui-priority": 0
},
"data": {
"ui-priority": 0,
"description": "Data in the registry hive",
"misp-attribute": "text"
},
"root-keys": {
"description": "Root key of the Windows registry (extracted from the key)",
"sane_default": [
"HKCC",
"HKCR",
"HKCU",
"HKDD",
"HKEY_CLASSES_ROOT",
"HKEY_CURRENT_CONFIG",
"HKEY_CURRENT_USER",
"HKEY_DYN_DATA",
"HKEY_LOCAL_MACHINE",
"HKEY_PERFORMANCE_DATA",
"HKEY_USERS",
"HKLM",
"HKPD",
"HKU"
],
"ui-priority": 0,
"misp-attribute": "text",
"disable_correlation": true
},
"text": {
"description": "Free text value to attach to the registry hive",
"disable_correlation": true,
"ui-priority": 1,
"misp-attribute": "text"
}
},
"version": 1,
"description": "Object describing a Windows registry hive including key, subkey and value (and associated data if any)",
"meta-category": "file",
"uuid": "9640285f-f9b9-4bab-92d0-353f97543655",
"name": "registry-hive"
}