From f2e8195d505cb0a87a6e87f95d394df5e1acbed7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Fri, 3 May 2019 11:18:58 +0200 Subject: [PATCH] new: Add offset, virtual_address and virtual_size to the pe section object Related to https://github.com/MISP/PyMISP/issues/388 --- objects/pe-section/definition.json | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/objects/pe-section/definition.json b/objects/pe-section/definition.json index 3d1d792..2ef4c3c 100644 --- a/objects/pe-section/definition.json +++ b/objects/pe-section/definition.json @@ -88,6 +88,24 @@ "ui-priority": 1, "misp-attribute": "size-in-bytes" }, + "offset": { + "description": "Section’s offset", + "disable_correlation": true, + "ui-priority": 1, + "misp-attribute": "hex" + }, + "virtual_address": { + "description": "Section’s virtual address", + "disable_correlation": true, + "ui-priority": 1, + "misp-attribute": "hex" + }, + "virtual_size": { + "description": "Section’s virtual size", + "disable_correlation": true, + "ui-priority": 1, + "misp-attribute": "size-in-bytes" + }, "text": { "description": "Free text value to attach to the section", "disable_correlation": true, @@ -106,7 +124,7 @@ "misp-attribute": "text" } }, - "version": 2, + "version": 3, "description": "Object describing a section of a Portable Executable", "meta-category": "file", "uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",