From aca06cec1ffbb3a092118e15a92152c51b14b408 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Wed, 3 Apr 2019 14:05:39 +0200 Subject: [PATCH] chg: [lnk] new LNK object (Windows Shortcut) --- README.md | 1 + objects/lnk/definition.json | 279 ++++++++++++++++++++++++++++++++++++ 2 files changed, 280 insertions(+) create mode 100644 objects/lnk/definition.json diff --git a/README.md b/README.md index f1cf85f..57b2491 100644 --- a/README.md +++ b/README.md @@ -101,6 +101,7 @@ for a specific attribute. An optional **to_ids** boolean field to disable the ID * [objects/ip-port](objects/ip-port/definition.json) - An IP address and a port seen as a tuple (or as a triple) in a specific time frame. * [objects/ja3](objects/ja3/definition.json) - A ja3 object which describes an SSL client fingerprint in an easy to produce and shareable way. * [objects/legal-entity](objects/legal-entity/definition.json) - Object describing a legal entity, such as an organisation. +* [objects/lnk](objects/lnk/definition.json) - Object describing a Windows LNK (Windows Shortcut) file. * [objects/macho](objects/macho/definition.json) - Object describing a Mach object file format. * [objects/macho-section](objects/macho-section/definition.json) - Object describing a section of a Mach object file format. * [objects/mactime-timeline-analysis](objects/mactime-timeline-analysis/definition.json) - Mactime template, used in forensic investigations to describe the timeline of a file activity. diff --git a/objects/lnk/definition.json b/objects/lnk/definition.json new file mode 100644 index 0000000..83eca79 --- /dev/null +++ b/objects/lnk/definition.json @@ -0,0 +1,279 @@ +{ + "requiredOneOf": [ + "filename", + "ssdeep", + "md5", + "sha1", + "sha224", + "sha256", + "sha384", + "sha512", + "sha512/224", + "sha512/256" + ], + "attributes": { + "md5": { + "description": "[Insecure] MD5 hash (128 bits)", + "ui-priority": 1, + "misp-attribute": "md5", + "recommended": false + }, + "sha1": { + "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", + "ui-priority": 1, + "misp-attribute": "sha1", + "recommended": false + }, + "sha224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "ui-priority": 0, + "misp-attribute": "sha224", + "recommended": false + }, + "sha256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "ui-priority": 1, + "misp-attribute": "sha256" + }, + "sha384": { + "description": "Secure Hash Algorithm 2 (384 bits)", + "ui-priority": 0, + "misp-attribute": "sha384", + "recommended": false + }, + "sha512": { + "description": "Secure Hash Algorithm 2 (512 bits)", + "ui-priority": 1, + "misp-attribute": "sha512" + }, + "sha512/224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "ui-priority": 0, + "misp-attribute": "sha512/224", + "recommended": false + }, + "sha512/256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "ui-priority": 0, + "misp-attribute": "sha512/256", + "recommended": false + }, + "ssdeep": { + "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", + "ui-priority": 0, + "misp-attribute": "ssdeep" + }, + "size-in-bytes": { + "description": "Size of the LNK file, in bytes", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "size-in-bytes" + }, + "entropy": { + "description": "Entropy of the whole file", + "disable_correlation": true, + "ui-priority": 1, + "misp-attribute": "float" + }, + "pattern-in-file": { + "description": "Pattern that can be found in the file", + "categories": [ + "Artifacts dropped", + "Payload installation", + "External analysis" + ], + "ui-priority": 1, + "misp-attribute": "pattern-in-file", + "multiple": true + }, + "text": { + "description": "Free text value to attach to the file", + "disable_correlation": true, + "ui-priority": 1, + "misp-attribute": "text", + "recommended": false + }, + "malware-sample": { + "description": "The LNK file itself (binary)", + "ui-priority": 1, + "misp-attribute": "malware-sample" + }, + "filename": { + "description": "Filename on disk", + "disable_correlation": true, + "multiple": true, + "categories": [ + "Payload delivery", + "Artifacts dropped", + "Payload installation", + "External analysis" + ], + "ui-priority": 1, + "misp-attribute": "filename" + }, + "path": { + "description": "Path of the LNK filename complete or partial", + "disable_correlation": true, + "multiple": true, + "ui-priority": 0, + "misp-attribute": "text" + }, + "fullpath": { + "description": "Complete path of the LNK filename including the filename", + "multiple": true, + "ui-priority": 0, + "misp-attribute": "text" + }, + "tlsh": { + "description": "Fuzzy hash by Trend Micro: Locality Sensitive Hash", + "ui-priority": 0, + "misp-attribute": "tlsh" + }, + "state": { + "misp-attribute": "text", + "ui-priority": 0, + "description": "State of the LNK file", + "multiple": true, + "disable_correlation": true, + "values_list": [ + "Malicious", + "Harmless", + "Trusted" + ] + }, + "lnk-creation-time": { + "description": "Creation time of the LNK", + "categories": [ + "Other" + ], + "ui-priority": 0, + "misp-attribute": "datetime", + "disable_correlation": true + }, + "lnk-modification-time": { + "description": "Modification time of the LNK", + "categories": [ + "Other" + ], + "ui-priority": 0, + "misp-attribute": "datetime", + "disable_correlation": true + }, + "lnk-access-time": { + "description": "Access time of the LNK", + "categories": [ + "Other" + ], + "ui-priority": 0, + "misp-attribute": "datetime", + "disable_correlation": true + }, + "lnk-file-size": { + "description": "Size of the target file, in bytes", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "size-in-bytes" + }, + "lnk-icon-index": { + "description": "Icon index", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "text" + }, + "lnk-show-window-value": { + "description": "Show Window value", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "text" + }, + "lnk-hot-key-value": { + "description": "Hot Key value", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "text" + }, + "lnk-file-attribute-flags": { + "description": "File attribute flags", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "text" + }, + "lnk-drive-type": { + "description": "Drive type", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "text" + }, + "lnk-drive-serial-number": { + "description": "Drive serial number", + "ui-priority": 0, + "misp-attribute": "text" + }, + "lnk-volume-label": { + "description": "Volume label", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "text" + }, + "lnk-local-path": { + "description": "Local path", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "text" + }, + "lnk-description": { + "description": "LNK description", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "text" + }, + "lnk-relative-path": { + "description": "Relative path", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "text" + }, + "lnk-working-directory": { + "description": "LNK working path", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "text" + }, + "lnk-command-line-arguments": { + "description": "LNK command line arguments", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "text" + }, + "machine-identifier": { + "description": "Machine identifier", + "ui-priority": 0, + "misp-attribute": "text" + }, + "droid-volume-identifier": { + "description": "Droid volume identifier", + "ui-priority": 0, + "misp-attribute": "text" + }, + "droid-file-identifier": { + "description": "Droid file identifier (UUIDv1 where MAC can be extracted)", + "ui-priority": 0, + "misp-attribute": "text" + }, + "birth-droid-volume-identifier": { + "description": "Droid volume identifier", + "ui-priority": 0, + "misp-attribute": "text" + }, + "birth-droid-file-identifier": { + "description": "Birth droid volume identifier (UUIDv1 where MAC can be extracted)", + "ui-priority": 0, + "misp-attribute": "text" + } + }, + "version": 1, + "description": "LNK object describing a Windows LNK binary file (aka Windows shortcut)", + "meta-category": "file", + "uuid": "ad13533e-1853-4da0-a111-33a7ce7e6c09", + "name": "lnk" +}