misp-objects/objects/pe-section/definition.json

72 lines
1.4 KiB
JSON

{
"name": "pe-section",
"meta-category": "file",
"description": "Object describing a section of a Portable Executable",
"version": 1,
"attributes": {
"name": {
"misp-attribute": "text",
"misp-usage-frequency": 1,
"sane_default": [
".rsrc",
".reloc",
".rdata",
".data",
".text"
],
"disable_correlation": true
},
"characteristics":{
"misp-attributes": "text",
"sane_default":[
"read",
"write",
"executable"
]
}
,
"text": {
"misp-attribute": "text",
"misp-usage-frequency": 1,
"disable_correlation": true
},
"size-in-bytes": {
"misp-attribute": "size-in-bytes",
"misp-usage-frequency": 1,
"disable_correlation": true
},
"entropy": {
"misp-attribute": "float",
"misp-usage-frequency": 0,
"disable_correlation": true
},
"md5": {
"misp-attribute": "md5",
"misp-usage-frequency": 1
},
"sha1": {
"misp-attribute": "sha1",
"misp-usage-frequency": 0
},
"sha256": {
"misp-attribute": "sha256",
"misp-usage-frequency": 0
},
"sha512": {
"misp-attribute": "sha512",
"misp-usage-frequency": 0
},
"ssdeep": {
"misp-attribute": "ssdeep",
"misp-usage-frequency": 0
}
},
"requiredOneOf": [
"text",
"name",
"sha1",
"sha256",
"sha512"
]
}