misp-objects/objects/elf/definition.json

260 lines
4.9 KiB
JSON

{
"requiredOneOf": [
"text",
"entrypoint-address"
],
"attributes": {
"entrypoint-address": {
"description": "Address of the entry point",
"disable_correlation": true,
"ui-priority": 0,
"misp-attribute": "text"
},
"type": {
"description": "Type of ELF",
"sane_default": [
"CORE",
"DYNAMIC",
"EXECUTABLE",
"HIPROC",
"LOPROC",
"NONE",
"RELOCATABLE"
],
"ui-priority": 0,
"misp-attribute": "text",
"disable_correlation": true
},
"number-sections": {
"description": "Number of sections",
"disable_correlation": true,
"ui-priority": 0,
"misp-attribute": "counter"
},
"arch": {
"description": "Architecture of the ELF file",
"sane_default": [
"None",
"M32",
"SPARC",
"i386",
"ARCH_68K",
"ARCH_88K",
"IAMCU",
"ARCH_860",
"MIPS",
"S370",
"MIPS_RS3_LE",
"PARISC",
"VPP500",
"SPARC32PLUS",
"ARCH_960",
"PPC",
"PPC64",
"S390",
"SPU",
"V800",
"FR20",
"RH32",
"RCE",
"ARM",
"ALPHA",
"SH",
"SPARCV9",
"TRICORE",
"ARC",
"H8_300",
"H8_300H",
"H8S",
"H8_500",
"IA_64",
"MIPS_X",
"COLDFIRE",
"ARCH_68HC12",
"MMA",
"PCP",
"NCPU",
"NDR1",
"STARCORE",
"ME16",
"ST100",
"TINYJ",
"x86_64",
"PDSP",
"PDP10",
"PDP11",
"FX66",
"ST9PLUS",
"ST7",
"ARCH_68HC16",
"ARCH_68HC11",
"ARCH_68HC08",
"ARCH_68HC05",
"SVX",
"ST19",
"VAX",
"CRIS",
"JAVELIN",
"FIREPATH",
"ZSP",
"MMIX",
"HUANY",
"PRISM",
"AVR",
"FR30",
"D10V",
"D30V",
"V850",
"M32R",
"MN10300",
"MN10200",
"PJ",
"OPENRISC",
"ARC_COMPACT",
"XTENSA",
"VIDEOCORE",
"TMM_GPP",
"NS32K",
"TPC",
"SNP1K",
"ST200",
"IP2K",
"MAX",
"CR",
"F2MC16",
"MSP430",
"BLACKFIN",
"SE_C33",
"SEP",
"ARCA",
"UNICORE",
"EXCESS",
"DXP",
"ALTERA_NIOS2",
"CRX",
"XGATE",
"C166",
"M16C",
"DSPIC30F",
"CE",
"M32C",
"TSK3000",
"RS08",
"SHARC",
"ECOG2",
"SCORE7",
"DSP24",
"VIDEOCORE3",
"LATTICEMICO32",
"SE_C17",
"TI_C6000",
"TI_C2000",
"TI_C5500",
"MMDSP_PLUS",
"CYPRESS_M8C",
"R32C",
"TRIMEDIA",
"HEXAGON",
"ARCH_8051",
"STXP7X",
"NDS32",
"ECOG1",
"ECOG1X",
"MAXQ30",
"XIMO16",
"MANIK",
"CRAYNV2",
"RX",
"METAG",
"MCST_ELBRUS",
"ECOG16",
"CR16",
"ETPU",
"SLE9X",
"L10M",
"K10M",
"AARCH64",
"AVR32",
"STM8",
"TILE64",
"TILEPRO",
"CUDA",
"TILEGX",
"CLOUDSHIELD",
"COREA_1ST",
"COREA_2ND",
"ARC_COMPACT2",
"OPEN8",
"RL78",
"VIDEOCORE5",
"ARCH_78KOR",
"ARCH_56800EX",
"BA1",
"BA2",
"XCORE",
"MCHP_PIC",
"INTEL205",
"INTEL206",
"INTEL207",
"INTEL208",
"INTEL209",
"KM32",
"KMX32",
"KMX16",
"KMX8",
"KVARC",
"CDP",
"COGE",
"COOL",
"NORC",
"CSR_KALIMBA",
"AMDGPU"
],
"ui-priority": 0,
"misp-attribute": "text",
"disable_correlation": true
},
"os_abi": {
"description": "Header operating system application binary interface (ABI)",
"sane_default": [
"AIX",
"ARM",
"AROS",
"C6000_ELFABI",
"C6000_LINUX",
"CLOUDABI",
"FENIXOS",
"FREEBSD",
"GNU",
"HPUX",
"HURD",
"IRIX",
"MODESTO",
"NETBSD",
"NSK",
"OPENBSD",
"OPENVMS",
"SOLARIS",
"STANDALONE",
"SYSTEMV",
"TRU64"
],
"ui-priority": 0,
"misp-attribute": "text",
"disable_correlation": true
},
"text": {
"description": "Free text value to attach to the ELF",
"disable_correlation": true,
"ui-priority": 1,
"misp-attribute": "text",
"recommended": false
}
},
"version": 5,
"description": "Object describing a Executable and Linkable Format",
"meta-category": "file",
"uuid": "fa6534ae-ad74-4ce0-8f23-15a66c82c7fa",
"name": "elf"
}