MISP
/
misp-objects
mirror of https://github.com/MISP/misp-objects
2
0
Fork 0
Code Issues Releases Wiki Activity

Update attributes os r2graphity object

pull/17/head
Raphaël Vinot 2017-03-21 16:46:41 +01:00
parent 2f74b709d4
commit d7a1f85100
1 changed files with 27 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
objects/r2graphity/definition.json
View File

@ -77,23 +77,47 @@
"disable_correlation": true,
"description": "Ratio: amount of referenced strings per kilobyte of code section"
},
"get-proc": {
"get-proc-address": {
"misp-attribute": "counter",
"misp-usage-frequency": 0,
"disable_correlation": true,
"description": "Amount of calls to GetProcAddress"
},
"memory-allocations": {
"misp-attribute": "counter",
"misp-usage-frequency": 0,
"disable_correlation": true,
"description": "Amount of memory allocations"
},
"create-thread": {
"misp-attribute": "counter",
"misp-usage-frequency": 0,
"disable_correlation": true,
"description": "Amount of calls to CreateThread"
},
"memory-allocations": {
"shortest-path-to-create-thread": {
"misp-attribute": "counter",
"misp-usage-frequency": 0,
"disable_correlation": true,
"description": "Amount of memory allocations"
"description": "Shortest path to the first time the binary calls CreateThread"
},
"callbacks": {
"misp-attribute": "counter",
"misp-usage-frequency": 0,
"disable_correlation": true,
"description": "Amount of callbacks (functions started as thread)"
},
"callback-average": {
"misp-attribute": "counter",
"misp-usage-frequency": 0,
"disable_correlation": true,
"description": "Average size of a callback"
},
"callback-largest": {
"misp-attribute": "counter",
"misp-usage-frequency": 0,
"disable_correlation": true,
"description": "Largest callback"
},
"gml": {
"misp-attribute": "attachment",