+
the type of message extracted from the forensic-evidence. ['SMS', 'MMS', 'Instant Message (IM)', 'Voice Message']
+An Object Template to gather information from evidential or interesting exchange of messages identified during a digital forensic investigation..
+| + + | ++tsk-chats is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
message-type |
+text |
+
+ the type of message extracted from the forensic-evidence. ['SMS', 'MMS', 'Instant Message (IM)', 'Voice Message'] + |
+
+ + |
+
+ + |
+
datetime-sent |
+datetime |
+
+ date and the time when the message was sent. + |
+
+ + |
+
+ + |
+
datetime-received |
+datetime |
+
+ date and time when the message was received. + |
+
+ + |
+
+ + |
+
Source |
+text |
+
+ Source of the message.(Contact details) + |
+
+ + |
+
+ + |
+
destination |
+text |
+
+ Destination of the message.(Contact details) + |
+
+ + |
+
+ + |
+
app-used |
+text |
+
+ Application used to send the message. + |
+
+ + |
+
+ + |
+
subject |
+text |
+
+ Subject of the message if any. + |
+
+ + |
+
+ + |
+
message |
+text |
+
+ Message exchanged. + |
+
+ + |
+
+ + |
+
attachments |
+link |
+
+ External references + |
+
+ + |
+
+ + |
+
additional-comments |
+text |
+
+ Comments. + |
+
+ + |
+
+ + |
+
An Object Template to add evidential bookmarks identified during a digital forensic investigation..
+| + + | ++tsk-web-bookmark is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
URL |
+link |
+
+ The URL saved as bookmark. + |
+
+ + |
+
+ + |
+
datetime-bookmarked |
+datetime |
+
+ date and time when the URL was added to favorites. + |
+
+ + |
+
+ + |
+
name |
+text |
+
+ Book mark name. + |
+
+ + |
+
+ + |
+
title |
+text |
+
+ Title of the web page + |
+
+ + |
+
+ + |
+
browser |
+text |
+
+ Browser used to access the URL. ['IE', 'Safari', 'Chrome', 'Firefox', 'Opera mini', 'Chromium'] + |
+
+ + |
+
+ + |
+
domain-name |
+text |
+
+ Domain of the URL. + |
+
+ + |
+
+ + |
+
domain-ip |
+ip-src |
+
+ IP of the URL domain. + |
+
+ + |
+
+ + |
+
additional-comments |
+text |
+
+ Comments. + |
+
+ + |
+
+ + |
+
An TSK-Autopsy Object Template to represent cookies identified during a forensic investigation..
+| + + | ++tsk-web-cookie is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
URL |
+link |
+
+ The website URL that created the cookie. + |
+
+ + |
+
+ + |
+
datetime-created |
+datetime |
+
+ date and time when the cookie was created. + |
+
+ + |
+
+ + |
+
name |
+text |
+
+ Name of the cookie + |
+
+ + |
+
+ + |
+
value |
+text |
+
+ Value assigned to the cookie. + |
+
+ + |
+
+ + |
+
browser |
+text |
+
+ Browser on which the cookie was created. ['IE', 'Safari', 'Chrome', 'Firefox', 'Opera mini', 'Chromium'] + |
+
+ + |
+
+ + |
+
domain-name |
+text |
+
+ Domain of the URL that created the cookie. + |
+
+ + |
+
+ + |
+
domain-ip |
+ip-src |
+
+ IP of the domain that created the URL. + |
+
+ + |
+
+ + |
+
additional-comments |
+text |
+
+ Comments. + |
+
+ + |
+
+ + |
+
An Object Template to add web-downloads.
+| + + | ++tsk-web-downloads is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
url |
+url |
+
+ The URL used to download the file. + |
+
+ + |
+
+ + |
+
datetime-accessed |
+datetime |
+
+ date and time when the file was downloaded. + |
+
+ + |
+
+ + |
+
name |
+text |
+
+ Name of the file downloaded. + |
+
+ + |
+
+ + |
+
path-downloadedTo |
+text |
+
+ Location the file was downloaded to. + |
+
+ + |
+
+ + |
+
pathID |
+text |
+
+ Id of the attribute file where the information is gathered from. + |
+
+ + |
+
+ + |
+
attachment |
+attachment |
+
+ The downloaded file itself. + |
+
+ + |
+
+ + |
+
additional-comments |
+text |
+
+ Comments. + |
+
+ + |
+
+ + |
+
An Object Template to share web history information.
+| + + | ++tsk-web-history is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
URL |
+link |
+
+ The URL accessed. + |
+
+ + |
+
+ + |
+
datetime-accessed |
+datetime |
+
+ date and the time when the URL was accessed. + |
+
+ + |
+
+ + |
+
referrer |
+text |
+
+ where the URL was referred from + |
+
+ + |
+
+ + |
+
title |
+text |
+
+ Title of the web page + |
+
+ + |
+
+ + |
+
domain-name |
+text |
+
+ Domain of the URL. + |
+
+ + |
+
+ + |
+
domain-ip |
+ip-src |
+
+ IP of the URL domain. + |
+
+ + |
+
+ + |
+
browser |
+text |
+
+ Browser used to access the URL. ['IE', 'Safari', 'Chrome', 'Firefox', 'Opera mini', 'Chromium'] + |
+
+ + |
+
+ + |
+
additional-comments |
+text |
+
+ Comments. + |
+
+ + |
+
+ + |
+
An Object Template to share web search query information.
+| + + | ++tsk-web-search-query is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
domain |
+link |
+
+ The domain of the search engine. ['Google', 'Yahoo', 'Bing', 'Alta Vista', 'MSN'] + |
+
+ + |
+
+ + |
+
text |
+text |
+
+ the search word or sentence. + |
+
+ + |
+
+ + |
+
datetime-searched |
+datetime |
+
+ date and time when the search was conducted. + |
+
+ + |
+
+ + |
+
browser |
+text |
+
+ Browser used. ['IE', 'Safari', 'Chrome', 'Firefox', 'Opera mini', 'Chromium'] + |
+
+ + |
+
+ + |
+
username |
+text |
+
+ User name or ID associated with the search. + |
+
+ + |
+
+ + |
+
additional-comments |
+text |
+
+ Comments. + |
+
+ + |
+
+ + |
+
protocol
text
Capture protocol (linktype name). ['LINKTYPE_NULL', 'LINKTYPE_ETHERNET']
+Capture protocol (linktype name). ['PER_PACKET', 'UNKNOWN', 'ETHERNET', 'TOKEN_RING', 'SLIP', 'PPP', 'FDDI', 'FDDI_BITSWAPPED', 'RAW_IP', 'ARCNET', 'ARCNET_LINUX', 'ATM_RFC1483', 'LINUX_ATM_CLIP', 'LAPB', 'ATM_PDUS', 'ATM_PDUS_UNTRUNCATED', 'NULL', 'ASCEND', 'ISDN', 'IP_OVER_FC', 'PPP_WITH_PHDR', 'IEEE_802_11', 'IEEE_802_11_PRISM', 'IEEE_802_11_WITH_RADIO', 'IEEE_802_11_RADIOTAP', 'IEEE_802_11_AVS', 'SLL', 'FRELAY', 'FRELAY_WITH_PHDR', 'CHDLC', 'CISCO_IOS', 'LOCALTALK', 'OLD_PFLOG', 'HHDLC', 'DOCSIS', 'COSINE', 'WFLEET_HDLC', 'SDLC', 'TZSP', 'ENC', 'PFLOG', 'CHDLC_WITH_PHDR', 'BLUETOOTH_H4', 'MTP2', 'MTP3', 'IRDA', 'USER0', 'USER1', 'USER2', 'USER3', 'USER4', 'USER5', 'USER6', 'USER7', 'USER8', 'USER9', 'USER10', 'USER11', 'USER12', 'USER13', 'USER14', 'USER15', 'SYMANTEC', 'APPLE_IP_OVER_IEEE1394', 'BACNET_MS_TP', 'NETTL_RAW_ICMP', 'NETTL_RAW_ICMPV6', 'GPRS_LLC', 'JUNIPER_ATM1', 'JUNIPER_ATM2', 'REDBACK', 'NETTL_RAW_IP', 'NETTL_ETHERNET', 'NETTL_TOKEN_RING', 'NETTL_FDDI', 'NETTL_UNKNOWN', 'MTP2_WITH_PHDR', 'JUNIPER_PPPOE', 'GCOM_TIE1', 'GCOM_SERIAL', 'NETTL_X25', 'K12', 'JUNIPER_MLPPP', 'JUNIPER_MLFR', 'JUNIPER_ETHER', 'JUNIPER_PPP', 'JUNIPER_FRELAY', 'JUNIPER_CHDLC', 'JUNIPER_GGSN', 'LINUX_LAPD', 'CATAPULT_DCT2000', 'BER', 'JUNIPER_VP', 'USB_FREEBSD', 'IEEE802_16_MAC_CPS', 'NETTL_RAW_TELNET', 'USB_LINUX', 'MPEG', 'PPI', 'ERF', 'BLUETOOTH_H4_WITH_PHDR', 'SITA', 'SCCP', 'BLUETOOTH_HCI', 'IPMB', 'IEEE802_15_4', 'X2E_XORAYA', 'FLEXRAY', 'LIN', 'MOST', 'CAN20B', 'LAYER1_EVENT', 'X2E_SERIAL', 'I2C', 'IEEE802_15_4_NONASK_PHY', 'TNEF', 'USB_LINUX_MMAPPED', 'GSM_UM', 'DPNSS', 'PACKETLOGGER', 'NSTRACE_1_0', 'NSTRACE_2_0', 'FIBRE_CHANNEL_FC2', 'FIBRE_CHANNEL_FC2_WITH_FRAME_DELIMS', 'JPEG_JFIF', 'IPNET', 'SOCKETCAN', 'IEEE_802_11_NETMON', 'IEEE802_15_4_NOFCS', 'RAW_IPFIX', 'RAW_IP4', 'RAW_IP6', 'LAPD', 'DVBCI', 'MUX27010', 'MIME', 'NETANALYZER', 'NETANALYZER_TRANSPARENT', 'IP_OVER_IB_SNOOP', 'MPEG_2_TS', 'PPP_ETHER', 'NFC_LLCP', 'NFLOG', 'V5_EF', 'BACNET_MS_TP_WITH_PHDR', 'IXVERIWAVE', 'SDH', 'DBUS', 'AX25_KISS', 'AX25', 'SCTP', 'INFINIBAND', 'JUNIPER_SVCS', 'USBPCAP', 'RTAC_SERIAL', 'BLUETOOTH_LE_LL', 'WIRESHARK_UPPER_PDU', 'STANAG_4607', 'STANAG_5066_D_PDU', 'NETLINK', 'BLUETOOTH_LINUX_MONITOR', 'BLUETOOTH_BREDR_BB', 'BLUETOOTH_LE_LL_WITH_PHDR', 'NSTRACE_3_0', 'LOGCAT', 'LOGCAT_BRIEF', 'LOGCAT_PROCESS', 'LOGCAT_TAG', 'LOGCAT_THREAD', 'LOGCAT_TIME', 'LOGCAT_THREADTIME', 'LOGCAT_LONG', 'PKTAP', 'EPON', 'IPMI_TRACE', 'LOOP', 'JSON', 'NSTRACE_3_5', 'ISO14443', 'GFP_T', 'GFP_F', 'IP_OVER_IB_PCAP', 'JUNIPER_VN', 'USB_DARWIN', 'LORATAP', '3MB_ETHERNET', 'VSOCK', 'NORDIC_BLE', 'NETMON_NET_NETEVENT', 'NETMON_HEADER', 'NETMON_NET_FILTER', 'NETMON_NETWORK_INFO_EX', 'MA_WFP_CAPTURE_V4', 'MA_WFP_CAPTURE_V6', 'MA_WFP_CAPTURE_2V4', 'MA_WFP_CAPTURE_2V6', 'MA_WFP_CAPTURE_AUTH_V4', 'MA_WFP_CAPTURE_AUTH_V6', 'JUNIPER_ST', 'ETHERNET_MPACKET', 'DOCSIS31_XRA31']
@@ -9700,6 +10573,332 @@ process is a MISP object available in JSON format at +
Event log object template to share information of the activities conducted on a system. .
+| + + | ++python-etvx-event-log is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
event-id |
+text |
+
+ A unique number which identifies the event. + |
+
+ + |
+
+ + |
+
name |
+text |
+
+ Name of the event. + |
+
+ + |
+
+ + |
+
event-channel |
+text |
+
+ Channel through which the event occurred ['Application', 'System', 'Security', 'Setup', 'other'] + |
+
+ + |
+
+ + |
+
event-type |
+text |
+
+ Event-type assigned to the event ['Admin', 'Operational', 'Audit', 'Analytic', 'Debug', 'other'] + |
+
+ + |
+
+ + |
+
source |
+text |
+
+ The source of the event log - application/software that logged the event. + |
+
+ + |
+
+ + |
+
event-date-time |
+datetime |
+
+ Date and time when the event was logged. + |
+
+ + |
+
+ + |
+
level |
+text |
+
+ Determines the event severity. ['Information', 'Warning', 'Error', 'Critical', 'Success Audit', 'Failure Audit'] + |
+
+ + |
+
+ + |
+
Computer |
+text |
+
+ Computer name on which the event occurred + |
+
+ + |
+
+ + |
+
User |
+text |
+
+ Name or the User ID the event is associated with. + |
+
+ + |
+
+ + |
+
Operational-code |
+text |
+
+ The opcode (numeric value or name) associated with the activity carried out by the event. + |
+
+ + |
+
+ + |
+
log |
+text |
+
+ Log file where the event was recorded. + |
+
+ + |
+
+ + |
+
task-category |
+text |
+
+ Activity by the event publisher + |
+
+ + |
+
+ + |
+
Keywords |
+text |
+
+ Tags used for the event for the purpose of filtering or searching. ['Network', 'Security', 'Resource not found', 'other'] + |
+
+ + |
+
+ + |
+
Processor-ID |
+text |
+
+ ID of the processor that processed the event. + |
+
+ + |
+
+ + |
+
Thread-ID |
+text |
+
+ Thread id that generated the event. + |
+
+ + |
+
+ + |
+
Session-ID |
+text |
+
+ Terminal server session ID. + |
+
+ + |
+
+ + |
+
Correlation-ID |
+text |
+
+ Unique activity identity which relates the event to a process. + |
+
+ + |
+
+ + |
+
Relative-Correlation-ID |
+text |
+
+ Related activity ID which identity similar activities which occurred as a part of the event. + |
+
+ + |
+
+ + |
+
kernel-time |
+datetime |
+
+ Execution time of the kernel mode instruction. + |
+
+ + |
+
+ + |
+
user-time |
+datetime |
+
+ Date and time when the user instruction was executed. + |
+
+ + |
+
+ + |
+
Event-data |
+text |
+
+ Event data description. + |
+
+ + |
+
+ + |
+
comment |
+text |
+
+ Additional comments. + |
+
+ + |
+
+ + |
+
Regripper Object template designed to present user specific configuration details extracted from the NTUSER.dat hive..
+| + + | ++regripper-NTUser is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
key |
+text |
+
+ Registry key where the information is retrieved from. + |
+
+ + |
+
+ + |
+
key-last-write-time |
+datetime |
+
+ Date and time when the key was last updated. + |
+
+ + |
+
+ + |
+
logon-user-name |
+text |
+
+ Name assigned to the user profile. + |
+
+ + |
+
+ + |
+
recent-folders-accessed |
+text |
+
+ List of recent folders accessed by the user. + |
+
+ + |
+
+ + |
+
recent-files-accessed |
+text |
+
+ List of recent files accessed by the user. + |
+
+ + |
+
+ + |
+
typed-urls |
+text |
+
+ Urls typed by the user in internet explorer + |
+
+ + |
+
+ + |
+
applications-installed |
+text |
+
+ List of applications installed. + |
+
+ + |
+
+ + |
+
applications-run |
+text |
+
+ List of applications set to run on the system. + |
+
+ + |
+
+ + |
+
external-devices |
+text |
+
+ List of external devices connected to the system by the user. + |
+
+ + |
+
+ + |
+
user-init |
+text |
+
+ Applications or processes set to run when the user logs onto the windows system. + |
+
+ + |
+
+ + |
+
nukeOnDelete |
+boolean |
+
+ Determines if the Recycle bin option has been disabled. + |
+
+ + |
+
+ + |
+
network-connected-to |
+text |
+
+ List of networks the user connected the system to. + |
+
+ + |
+
+ + |
+
mount-points |
+text |
+
+ Details of the mount points created on the system. + |
+
+ + |
+
+ + |
+
comments |
+text |
+
+ Additional information related to the user profile + |
+
+ + |
+
+ + |
+
Regripper Object template designed to present user profile details extracted from the SAM hive..
+| + + | ++regripper-sam-hive-single-user is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
key |
+text |
+
+ Registry key where the information is retrieved from. + |
+
+ + |
+
+ + |
+
key-last-write-time |
+datetime |
+
+ Date and time when the key was last updated. + |
+
+ + |
+
+ + |
+
user-name |
+text |
+
+ User name assigned to the user profile. + |
+
+ + |
+
+ + |
+
full-user-name |
+text |
+
+ Full name assigned to the user profile. + |
+
+ + |
+
+ + |
+
last-login-time |
+datetime |
+
+ Date and time when the user last logged onto the system. + |
+
+ + |
+
+ + |
+
pwd-reset-time |
+datetime |
+
+ Date and time when the password was last reset. + |
+
+ + |
+
+ + |
+
pwd-fail-date |
+datetime |
+
+ Date and time when a password last failed for this user profile. + |
+
+ + |
+
+ + |
+
login-count |
+counter |
+
+ Number of times the user logged-in onto the system. + |
+
+ + |
+
+ + |
+
comments |
+text |
+
+ Full name assigned to the user profile. + |
+
+ + |
+
+ + |
+
Regripper Object template designed to present group profile details extracted from the SAM hive..
+| + + | ++regripper-sam-hive-user-group is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
key |
+text |
+
+ Registry key where the information is retrieved from. + |
+
+ + |
+
+ + |
+
key-last-write-time |
+datetime |
+
+ Date and time when the key was last updated. + |
+
+ + |
+
+ + |
+
group-name |
+text |
+
+ Name assigned to the profile. + |
+
+ + |
+
+ + |
+
full-name |
+text |
+
+ Full name assigned to the profile. + |
+
+ + |
+
+ + |
+
last-write-date-time |
+datetime |
+
+ Date and time when the group key was updated. + |
+
+ + |
+
+ + |
+
group-comment |
+text |
+
+ Any group comment added. + |
+
+ + |
+
+ + |
+
group-users |
+text |
+
+ Users belonging to the group + |
+
+ + |
+
+ + |
+
Regripper Object template designed to gather information of the browser helper objects installed on the system..
+| + + | ++regripper-software-hive-BHO is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
key |
+text |
+
+ Software hive key where the information is retrieved from. + |
+
+ + |
+
+ + |
+
last-write-time |
+datetime |
+
+ Date and time when the key was last updated. + |
+
+ + |
+
+ + |
+
BHO-name |
+text |
+
+ Name of the browser helper object. + |
+
+ + |
+
+ + |
+
BHO-key-last-write-time |
+datetime |
+
+ Date and time when the BHO key was last updated. + |
+
+ + |
+
+ + |
+
class |
+text |
+
+ Class to which the BHO belongs to. + |
+
+ + |
+
+ + |
+
module |
+text |
+
+ DLL module the BHO belongs to. + |
+
+ + |
+
+ + |
+
comments |
+text |
+
+ Additional comments. + |
+
+ + |
+
+ + |
+
references |
+link |
+
+ References to the BHO. + |
+
+ + |
+
+ + |
+
Regripper Object template designed to gather information of the DLL files installed on the system..
+| + + | ++regripper-software-hive-appInit-DLLS is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
key |
+text |
+
+ Software hive key where the information is retrieved from. + |
+
+ + |
+
+ + |
+
last-write-time |
+datetime |
+
+ Date and time when the key was last updated. + |
+
+ + |
+
+ + |
+
DLL-name |
+text |
+
+ Name of the DLL file. + |
+
+ + |
+
+ + |
+
DLL-path |
+text |
+
+ Path where the DLL file is stored. + |
+
+ + |
+
+ + |
+
DLL-last-write-time |
+datetime |
+
+ Date and time when the DLL file was last updated. + |
+
+ + |
+
+ + |
+
comments |
+text |
+
+ Additional comments. + |
+
+ + |
+
+ + |
+
references |
+link |
+
+ References to the DLL file. + |
+
+ + |
+
+ + |
+
Regripper Object template designed to gather information of the application paths..
+| + + | ++regripper-software-hive-application-paths is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
key |
+text |
+
+ Software hive key where the information is retrieved from. + |
+
+ + |
+
+ + |
+
last-write-time |
+datetime |
+
+ Date and time when the key was last updated. + |
+
+ + |
+
+ + |
+
executable-file-name |
+text |
+
+ Name of the executable file. + |
+
+ + |
+
+ + |
+
path |
+text |
+
+ Path of the executable file. + |
+
+ + |
+
+ + |
+
comments |
+text |
+
+ Additional comments. + |
+
+ + |
+
+ + |
+
references |
+link |
+
+ References to the application installed. + |
+
+ + |
+
+ + |
+
Regripper Object template designed to gather information of the applications installed on the system..
+| + + | ++regripper-software-hive-applications-installed is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
key |
+text |
+
+ Software hive key where the information is retrieved from. + |
+
+ + |
+
+ + |
+
key-path |
+text |
+
+ Path of the key. + |
+
+ + |
+
+ + |
+
last-write-time |
+datetime |
+
+ Date and time when the key was last updated. + |
+
+ + |
+
+ + |
+
app-name |
+text |
+
+ Name of the application. + |
+
+ + |
+
+ + |
+
app-last-write-time |
+datetime |
+
+ Date and time when the application key was last updated. + |
+
+ + |
+
+ + |
+
version |
+text |
+
+ Version of the application. + |
+
+ + |
+
+ + |
+
comments |
+text |
+
+ Additional comments. + |
+
+ + |
+
+ + |
+
references |
+link |
+
+ References to the application installed. + |
+
+ + |
+
+ + |
+
Regripper Object template designed to gather information of the shell commands executed on the system..
+| + + | ++regripper-software-hive-command-shell is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
key |
+text |
+
+ Software hive key where the information is retrieved from. + |
+
+ + |
+
+ + |
+
last-write-time |
+datetime |
+
+ Date and time when the key was last updated. + |
+
+ + |
+
+ + |
+
shell |
+text |
+
+ Type of shell used to execute the command. ['exe', 'cmd', 'bat', 'hta', 'pif', 'Other'] + |
+
+ + |
+
+ + |
+
shell-path |
+text |
+
+ Path of the shell. + |
+
+ + |
+
+ + |
+
command |
+text |
+
+ Command executed. + |
+
+ + |
+
+ + |
+
comments |
+text |
+
+ Additional comments. + |
+
+ + |
+
+ + |
+
Regripper Object template designed to gather general windows information extracted from the software-hive..
+| + + | ++regripper-software-hive-windows-general-info is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
win-cv-path |
+text |
+
+ key where the windows information is retrieved from + |
+
+ + |
+
+ + |
+
last-write-time |
+datetime |
+
+ Date and time when the key was last updated. + |
+
+ + |
+
+ + |
+
RegisteredOrganization |
+text |
+
+ Name of the registered organization. + |
+
+ + |
+
+ + |
+
RegisteredOwner |
+text |
+
+ Name of the registered owner. + |
+
+ + |
+
+ + |
+
CurrentVersion |
+text |
+
+ Current version of windows + |
+
+ + |
+
+ + |
+
CurrentBuild |
+text |
+
+ Build number of the windows OS. + |
+
+ + |
+
+ + |
+
SoftwareType |
+text |
+
+ Software type of windows. ['System', 'Application', 'other'] + |
+
+ + |
+
+ + |
+
InstallationType |
+text |
+
+ Type of windows installation. + |
+
+ + |
+
+ + |
+
InstallDate |
+datetime |
+
+ Date when windows was installed. + |
+
+ + |
+
+ + |
+
SystemRoot |
+text |
+
+ Root directory. + |
+
+ + |
+
+ + |
+
PathName |
+text |
+
+ Path to the root directory. + |
+
+ + |
+
+ + |
+
EditionID |
+text |
+
+ Windows edition. + |
+
+ + |
+
+ + |
+
ProductName |
+text |
+
+ Name of the windows version. + |
+
+ + |
+
+ + |
+
ProductID |
+text |
+
+ ID of the product version. + |
+
+ + |
+
+ + |
+
CSDVersion |
+text |
+
+ Version of the service pack installed. + |
+
+ + |
+
+ + |
+
CurrentBuildType |
+text |
+
+ Current build type of the OS. + |
+
+ + |
+
+ + |
+
BuildLab |
+text |
+
+ Windows BuildLab string. + |
+
+ + |
+
+ + |
+
BuildGUID |
+text |
+
+ Build ID. + |
+
+ + |
+
+ + |
+
BuildLabEx |
+text |
+
+ Windows BuildLabEx string. + |
+
+ + |
+
+ + |
+
comment |
+comment |
+
+ Additional comments. + |
+
+ + |
+
+ + |
+
Regripper Object template designed to gather information of the applications set to run on the system..
+| + + | ++regripper-software-hive-software-run is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
key |
+text |
+
+ Software hive key where the information is retrieved from. ['Run', 'RunOnce', 'Runservices', 'Terminal', 'Other'] + |
+
+ + |
+
+ + |
+
key-path |
+text |
+
+ Path of the key. + |
+
+ + |
+
+ + |
+
last-write-time |
+datetime |
+
+ Date and time when the key was last updated. + |
+
+ + |
+
+ + |
+
application-name |
+text |
+
+ Name of the application run. + |
+
+ + |
+
+ + |
+
application-path |
+text |
+
+ Path where the application is installed. + |
+
+ + |
+
+ + |
+
comments |
+text |
+
+ Additional comments. + |
+
+ + |
+
+ + |
+
references |
+link |
+
+ References to the applications. + |
+
+ + |
+
+ + |
+
Regripper Object template designed to gather user profile information when the user logs onto the system, gathered from the software hive..
+| + + | ++regripper-software-hive-userprofile-winlogon is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
user-profile-key-path |
+text |
+
+ key where the user-profile information is retrieved from. + |
+
+ + |
+
+ + |
+
user-profile-key-last-write-time |
+datetime |
+
+ Date and time when the key was last updated. + |
+
+ + |
+
+ + |
+
user-profile-path |
+text |
+
+ Path of the user profile on the system + |
+
+ + |
+
+ + |
+
SID |
+text |
+
+ Security identifier assigned to the user profile. + |
+
+ + |
+
+ + |
+
user-profile-last-write-time |
+datetime |
+
+ Date and time when the user profile was last updated. + |
+
+ + |
+
+ + |
+
winlogon-key-path |
+text |
+
+ winlogon key referred in order to retrieve default user information + |
+
+ + |
+
+ + |
+
winlogon-key-last-write-time |
+datetime |
+
+ Date and time when the winlogon key was last updated. + |
+
+ + |
+
+ + |
+
DefaultUserName |
+text |
+
+ user-name of the default user. + |
+
+ + |
+
+ + |
+
Shell |
+text |
+
+ Shell set to run when the user logs onto the system. + |
+
+ + |
+
+ + |
+
UserInit |
+text |
+
+ Applications and files set to run when the user logs onto the system (User logon activity). + |
+
+ + |
+
+ + |
+
Legal-notice-caption |
+text |
+
+ Message title set to display when the user logs-in. + |
+
+ + |
+
+ + |
+
Legal-notice-text |
+text |
+
+ Message set to display when the user logs-in. + |
+
+ + |
+
+ + |
+
PreCreateKnownFolders |
+text |
+
+ create known folders key + |
+
+ + |
+
+ + |
+
ReportBootOk |
+boolean |
+
+ Flag to check if the reboot was successful. + |
+
+ + |
+
+ + |
+
AutoRestartShell |
+boolean |
+
+ Value of the flag set to auto restart the shell if it crashes or shuts down automatically. + |
+
+ + |
+
+ + |
+
PasswordExpiryWarining |
+counter |
+
+ Number of times the password expiry warning appeared. + |
+
+ + |
+
+ + |
+
PowerdownAfterShutDown |
+boolean |
+
+ Flag value- if the system is set to power down after it is shutdown. + |
+
+ + |
+
+ + |
+
ShutdownWithoutLogon |
+boolean |
+
+ Value of the flag set to enable shutdown without requiring a user to login. + |
+
+ + |
+
+ + |
+
WinStationsDisabled |
+boolean |
+
+ Flag value set to enable/disable logons to the system. + |
+
+ + |
+
+ + |
+
DisableCAD |
+boolean |
+
+ Flag to determine if user login is enabled by pressing Ctrl+ALT+Delete. + |
+
+ + |
+
+ + |
+
AutoAdminLogon |
+boolean |
+
+ Flag value to determine if autologon is enabled for a user without entering the password. + |
+
+ + |
+
+ + |
+
CachedLogonCount |
+counter |
+
+ Number of times the user has logged into the system. + |
+
+ + |
+
+ + |
+
ShutdownFlags |
+counter |
+
+ Number of times shutdown is initiated from a process when the user is logged-in. + |
+
+ + |
+
+ + |
+
Comments |
+text |
+
+ Additional comments. + |
+
+ + |
+
+ + |
+
Regripper Object template designed to present firewall configuration information extracted from the system-hive..
+| + + | ++regripper-system-hive-firewall-configuration is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
profile |
+text |
+
+ Firewall Profile type ['Domain Profile', 'Standard Profile', 'Network Profile', 'Public Profile', 'Private Profile', 'other'] + |
+
+ + |
+
+ + |
+
last-write-time |
+datetime |
+
+ Date and time when the firewall profile policy was last updated. + |
+
+ + |
+
+ + |
+
enbled-firewall |
+boolean |
+
+ Boolean flag to determine if the firewall is enabled. + |
+
+ + |
+
+ + |
+
disable-notification |
+boolean |
+
+ Boolean flag to determine if firewall notifications are enabled. + |
+
+ + |
+
+ + |
+
comment |
+text |
+
+ Additional comments. + |
+
+ + |
+
+ + |
+
Regripper Object template designed to present general system properties extracted from the system-hive..
+| + + | ++regripper-system-hive-general-configuration is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
computer-name |
+text |
+
+ name of the computer under analysis + |
+
+ + |
+
+ + |
+
last-write-time |
+datetime |
+
+ Date and time when the key was last updated. + |
+
+ + |
+
+ + |
+
shutdown-time |
+datetime |
+
+ Date and time when the system was shutdown. + |
+
+ + |
+
+ + |
+
timezone-last-write-time |
+datetime |
+
+ Date and time when the timezone key was last updated. + |
+
+ + |
+
+ + |
+
timezone-bias |
+text |
+
+ Offset in minutes from UTC. Offset added to the local time to get a UTC value. + |
+
+ + |
+
+ + |
+
timezone-standard-name |
+text |
+
+ Timezone standard name used during non-daylight saving months. + |
+
+ + |
+
+ + |
+
timezone-standard-date |
+datetime |
+
+ Standard date - non daylight saving months + |
+
+ + |
+
+ + |
+
timezone-standard-bias |
+text |
+
+ value in minutes to be added to the value of timezone-bias to generate the bias used during standard time. + |
+
+ + |
+
+ + |
+
timezone-daylight-name |
+text |
+
+ Timezone name used during daylight saving months. + |
+
+ + |
+
+ + |
+
timezone-daylight-date |
+datetime |
+
+ Daylight date - daylight saving months + |
+
+ + |
+
+ + |
+
timezone-daylight-bias |
+text |
+
+ value in minutes to be added to the value of timezone-bias to generate the bias used during daylight time. + |
+
+ + |
+
+ + |
+
fDenyTSConnections: |
+boolean |
+
+ Specifies whether remote connections are enabled or disabled on the system. + |
+
+ + |
+
+ + |
+
comment |
++ |
+ Additional comments. + |
+
+ + |
+
+ + |
+
Regripper object template designed to gather network information from the system-hive..
+| + + | ++regripper-system-hive-network-information. is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
network-key |
+text |
+
+ Registry key assigned to the network + |
+
+ + |
+
+ + |
+
network-key-last-write-time |
+datetime |
+
+ Date and time when the network key was last updated. + |
+
+ + |
+
+ + |
+
network-key-path |
+text |
+
+ Path of the key where the information is retrieved from. + |
+
+ + |
+
+ + |
+
TCPIP-key |
+text |
+
+ TCPIP key + |
+
+ + |
+
+ + |
+
TCPIP-key-last-write-time |
+datetime |
+
+ Datetime when the key was last updated. + |
+
+ + |
+
+ + |
+
DHCP-domain |
+text |
+
+ Name of the DHCP domain service + |
+
+ + |
+
+ + |
+
DHCP-IP-address |
+ip-dst |
+
+ DHCP service - IP address + |
+
+ + |
+
+ + |
+
DHCP-subnet-mask |
+ip-dst |
+
+ DHCP subnet mask - IP address. + |
+
+ + |
+
+ + |
+
DHCP-name-server |
+ip-dst |
+
+ DHCP Name server - IP address. + |
+
+ + |
+
+ + |
+
DHCP-server |
+ip-dst |
+
+ DHCP server - IP address. + |
+
+ + |
+
+ + |
+
interface-GUID |
+text |
+
+ GUID value assigned to the interface. + |
+
+ + |
+
+ + |
+
interface-last-write-time |
+datetime |
+
+ Last date and time when the interface key was updated. + |
+
+ + |
+
+ + |
+
interface-name |
+text |
+
+ Name of the interface. + |
+
+ + |
+
+ + |
+
interface-PnpInstanceID |
+text |
+
+ Plug and Play instance ID assigned to the interface. + |
+
+ + |
+
+ + |
+
interface-MediaSubType |
+text |
+
+ + |
+
+ + |
+
+ + |
+
interface-IPcheckingEnabled |
+boolean |
+
+ + |
+
+ + |
+
+ + |
+
additional-comments |
+text |
+
+ Comments. + |
+
+ + |
+
+ + |
+
Regripper Object template designed to gather information regarding the services/drivers from the system-hive..
+| + + | ++regripper-system-hive-services-drivers is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
name |
+text |
+
+ name of the key + |
+
+ + |
+
+ + |
+
last-write-time |
+datetime |
+
+ Date and time when the key was last updated. + |
+
+ + |
+
+ + |
+
display |
+text |
+
+ Display name/information of the service or the driver. + |
+
+ + |
+
+ + |
+
image-path |
+text |
+
+ Path of the service/drive + |
+
+ + |
+
+ + |
+
type |
+text |
+
+ Service/driver type. ['Kernel driver', 'File system driver', 'Own process', 'Share process', 'Interactive', 'Other'] + |
+
+ + |
+
+ + |
+
start |
+text |
+
+ When the service/driver starts or executes. ['Boot start', 'System start', 'Auto start', 'Manual', 'Disabled'] + |
+
+ + |
+
+ + |
+
group |
+text |
+
+ Group to which the system/driver belong to. ['Base', 'Boot Bus Extender', 'Boot File System', 'Cryptography', 'Extended base', 'Event Log', 'Filter', 'FSFilter Bottom', 'FSFilter Infrastructure', 'File System', 'FSFilter Virtualization', 'Keyboard Port', 'Network', 'NDIS', 'Parallel arbitrator', 'Pointer Port', 'PnP Filter', 'ProfSvc_Group', 'PNP_TDI', 'SCSI Miniport', 'SCSI CDROM Class', 'System Bus Extender', 'Video Save', 'other'] + |
+
+ + |
+
+ + |
+
comment |
++ |
+ Additional comments. + |
+
+ + |
+
+ + |
+
+
sandbox-file
+attachment
File related to sandbox run
++
+
sandbox-type
text