mirror of https://github.com/MISP/misp-objects
104 lines
2.3 KiB
JSON
104 lines
2.3 KiB
JSON
{
|
|
"name": "elf-section",
|
|
"uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
"meta-category": "file",
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
"version": 1,
|
|
"attributes": {
|
|
"sh_name": {
|
|
"misp-attribute": "text",
|
|
"misp-usage-frequency": 1,
|
|
"disable_correlation": true
|
|
},
|
|
"sh_type": {
|
|
"misp-attribute": "text",
|
|
"misp-usage-frequency": 0,
|
|
"sane_default": [
|
|
"SHT_NULL",
|
|
"SHT_PROGBITS",
|
|
"SHT_SYMTAB",
|
|
"SHT_STRTAB",
|
|
"SHT_RELA",
|
|
"SHT_HASH",
|
|
"SHT_DYNAMIC",
|
|
"SHT_NOTE",
|
|
"SHT_NOBITS",
|
|
"SHT_REL",
|
|
"SHT_SHLIB",
|
|
"SHT_DYNSYM",
|
|
"SHT_INIT_ARRAY",
|
|
"SHT_FINI_ARRAY",
|
|
"SHT_PREINIT_ARRAY",
|
|
"SHT_GROUP",
|
|
"SHT_SYMTAB_SHNDX",
|
|
"SHT_NUM",
|
|
"SHT_LOOS"
|
|
]
|
|
},
|
|
"sh_flags": {
|
|
"misp-attribute": "text",
|
|
"misp-usage-frequency": 0,
|
|
"sane_default": [
|
|
"W (write)",
|
|
"A (alloc)",
|
|
"X (execute)",
|
|
"M (merge)",
|
|
"S (strings)",
|
|
"I (info)",
|
|
"L (link order)",
|
|
"O (extra OS processing required)",
|
|
"G (group)",
|
|
"T (TLS)",
|
|
"C (compressed)",
|
|
"x (unknown)",
|
|
"o (OS specific)",
|
|
"E (exclude)",
|
|
"l (large)",
|
|
"p (processor specific)"
|
|
]
|
|
},
|
|
"text": {
|
|
"misp-attribute": "text",
|
|
"misp-usage-frequency": 1,
|
|
"disable_correlation": true
|
|
},
|
|
"sh_size": {
|
|
"misp-attribute": "size-in-bytes",
|
|
"misp-usage-frequency": 1,
|
|
"disable_correlation": true
|
|
},
|
|
"entropy": {
|
|
"misp-attribute": "float",
|
|
"misp-usage-frequency": 0,
|
|
"disable_correlation": true
|
|
},
|
|
"md5": {
|
|
"misp-attribute": "md5",
|
|
"misp-usage-frequency": 1
|
|
},
|
|
"sha1": {
|
|
"misp-attribute": "sha1",
|
|
"misp-usage-frequency": 0
|
|
},
|
|
"sha256": {
|
|
"misp-attribute": "sha256",
|
|
"misp-usage-frequency": 0
|
|
},
|
|
"sha512": {
|
|
"misp-attribute": "sha512",
|
|
"misp-usage-frequency": 0
|
|
},
|
|
"ssdeep": {
|
|
"misp-attribute": "ssdeep",
|
|
"misp-usage-frequency": 0
|
|
}
|
|
},
|
|
"requiredOneOf": [
|
|
"text",
|
|
"name",
|
|
"sha1",
|
|
"sha256",
|
|
"sha512"
|
|
]
|
|
}
|