Skip to content

Commit 1bf9f93

Browse files
theobarraguetheobarrague
authored
Merge branch 'main' into main
2 parents 159be29 + 4e011f2 commit 1bf9f93

10 files changed

Lines changed: 194 additions & 12 deletions

File tree

‎objects/authenticode-signerinfo/definition.json‎

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,20 @@
55
"misp-attribute": "text",
66
"ui-priority": 0
77
},
8+
"digest-base64": {
9+
"description": "Signature created by the signing certificate’s private key",
10+
"disable_correlation": true,
11+
"misp-attribute": "text",
12+
"ui-priority": 0
13+
},
814
"digest_algorithm": {
9-
"description": "Digest algorithm",
15+
"description": "Algorithm used to hash the file.",
16+
"disable_correlation": true,
17+
"misp-attribute": "text",
18+
"ui-priority": 0
19+
},
20+
"encryption_algorithm": {
21+
"description": "Algorithm used to encrypt the digest",
1022
"disable_correlation": true,
1123
"misp-attribute": "text",
1224
"ui-priority": 0
@@ -22,6 +34,12 @@
2234
"misp-attribute": "text",
2335
"ui-priority": 0
2436
},
37+
"serial-number": {
38+
"description": "Serial number of the certificate",
39+
"disable_correlation": true,
40+
"misp-attribute": "text",
41+
"ui-priority": 0
42+
},
2543
"signature_algorithm": {
2644
"description": "Signature algorithm",
2745
"disable_correlation": true,
@@ -55,8 +73,9 @@
5573
"name": "authenticode-signerinfo",
5674
"requiredOneOf": [
5775
"url",
58-
"program-name"
76+
"program-name",
77+
"issuer"
5978
],
6079
"uuid": "965cb0aa-baf1-4cc6-9070-68f5c1698c1e",
61-
"version": 1
80+
"version": 2
6281
}

‎objects/pe/definition.json‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
{
22
"attributes": {
3+
"authentihash": {
4+
"description": "Authenticode executable signature hash (sha256)",
5+
"misp-attribute": "authentihash",
6+
"ui-priority": 1
7+
},
38
"company-name": {
49
"description": "CompanyName in the resources",
510
"disable_correlation": true,
@@ -131,5 +136,5 @@
131136
"impfuzzy"
132137
],
133138
"uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
134-
"version": 6
139+
"version": 7
135140
}

‎objects/regexp/definition.json‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,8 @@
1919
"PCRE",
2020
"PCRE2",
2121
"POSIX BRE",
22-
"POSIX ERE"
22+
"POSIX ERE",
23+
"FCRE (Farsight Compatible Regular Expressions)"
2324
]
2425
},
2526
"type": {
@@ -51,5 +52,5 @@
5152
"regexp"
5253
],
5354
"uuid": "ceffad66-71e5-4e20-9370-1b3fb694c648",
54-
"version": 4
55+
"version": 5
5556
}

‎objects/report/definition.json‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,12 @@
99
"misp-attribute": "text",
1010
"ui-priority": 1
1111
},
12+
"link": {
13+
"description": "Link to the report mentioned",
14+
"misp-attribute": "link",
15+
"multiple": true,
16+
"ui-priority": 100
17+
},
1218
"report-file(s)": {
1319
"description": "Attachment(s) that is related to the report",
1420
"misp-attribute": "attachment",
@@ -30,8 +36,9 @@
3036
"meta-category": "misc",
3137
"name": "report",
3238
"required": [
33-
"summary"
39+
"summary",
40+
"link"
3441
],
3542
"uuid": "70a68471-df22-4e3f-aa1a-5a3be19f82df",
36-
"version": 1
43+
"version": 2
3744
}

‎objects/splunk/definition.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@
4646
"description": "Search / Correlation search",
4747
"disable_correlation": true,
4848
"misp-attribute": "text",
49+
"multiple": true,
4950
"ui-priority": 0
5051
}
5152
},
@@ -56,5 +57,5 @@
5657
"search"
5758
],
5859
"uuid": "fd9b7bf8-df7b-4df9-bcd8-28591edcaab8",
59-
"version": 1
60+
"version": 2
6061
}

‎objects/telegram-account/definition.json‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"attributes": {
3+
"first_name": {
4+
"description": "First name",
5+
"misp-attribute": "text",
6+
"ui-priority": 1
7+
},
8+
"id": {
9+
"description": "Telegram user identifier",
10+
"misp-attribute": "text",
11+
"ui-priority": 1
12+
},
13+
"last_name": {
14+
"description": "Last name",
15+
"misp-attribute": "text",
16+
"ui-priority": 1
17+
},
18+
"phone": {
19+
"description": "Phone associated with the telegram user",
20+
"misp-attribute": "text",
21+
"multiple": true,
22+
"ui-priority": 1
23+
},
24+
"username": {
25+
"description": "Telegram username",
26+
"misp-attribute": "text",
27+
"ui-priority": 1
28+
},
29+
"verified": {
30+
"description": "Verified",
31+
"misp-attribute": "text",
32+
"ui-priority": 1
33+
}
34+
},
35+
"description": "Information related to a telegram account",
36+
"meta-category": "misc",
37+
"name": "telegram-account",
38+
"requiredOneOf": [
39+
"id",
40+
"phone",
41+
"username"
42+
],
43+
"uuid": "06f02ecf-5afb-42c5-9cb0-b362e222f52c",
44+
"version": 2
45+
}

‎objects/url/definition.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535
"ip": {
3636
"description": "Better type when the host is an IP.",
3737
"misp-attribute": "ip-dst",
38+
"multiple": true,
3839
"ui-priority": 0
3940
},
4041
"last-seen": {
@@ -105,5 +106,5 @@
105106
"resource_path"
106107
],
107108
"uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
108-
"version": 8
109+
"version": 9
109110
}

‎objects/virustotal-report/definition.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
"External analysis"
66
],
77
"description": "Comment related to this hash",
8+
"disable_correlation": true,
89
"misp-attribute": "text",
910
"multiple": true,
1011
"ui-priority": 2
@@ -32,6 +33,7 @@
3233
"Other"
3334
],
3435
"description": "First Submission",
36+
"disable_correlation": true,
3537
"misp-attribute": "datetime",
3638
"ui-priority": 0
3739
},
@@ -40,6 +42,7 @@
4042
"Other"
4143
],
4244
"description": "Last Submission",
45+
"disable_correlation": true,
4346
"misp-attribute": "datetime",
4447
"ui-priority": 0
4548
},
@@ -48,6 +51,7 @@
4851
"External analysis"
4952
],
5053
"description": "Permalink Reference",
54+
"disable_correlation": true,
5155
"misp-attribute": "link",
5256
"ui-priority": 2
5357
}
@@ -59,5 +63,5 @@
5963
"permalink"
6064
],
6165
"uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
62-
"version": 3
66+
"version": 4
6367
}

‎objects/windows-service/definition.json‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
{
2+
"attributes": {
3+
"comment": {
4+
"description": "Additional comments.",
5+
"disable_correlation": true,
6+
"misp-attribute": "text",
7+
"ui-priority": 0
8+
},
9+
"display": {
10+
"description": "Display name/information of the service.",
11+
"misp-attribute": "windows-service-displayname",
12+
"ui-priority": 0
13+
},
14+
"group": {
15+
"description": "Group to which the system/driver belong to.",
16+
"disable_correlation": true,
17+
"misp-attribute": "text",
18+
"sane_default": [
19+
"Base",
20+
"Boot Bus Extender",
21+
"Boot File System",
22+
"Cryptography",
23+
"Extended base",
24+
"Event Log",
25+
"Filter",
26+
"FSFilter Bottom",
27+
"FSFilter Infrastructure",
28+
"File System",
29+
"FSFilter Virtualization",
30+
"Keyboard Port",
31+
"Network",
32+
"NDIS",
33+
"Parallel arbitrator",
34+
"Pointer Port",
35+
"PnP Filter",
36+
"ProfSvc_Group",
37+
"PNP_TDI",
38+
"SCSI Miniport",
39+
"SCSI CDROM Class",
40+
"System Bus Extender",
41+
"Video Save",
42+
"other"
43+
],
44+
"ui-priority": 0
45+
},
46+
"image-path": {
47+
"description": "Path of the service/drive",
48+
"misp-attribute": "text",
49+
"ui-priority": 0
50+
},
51+
"name": {
52+
"description": "name of the service",
53+
"misp-attribute": "windows-service-name",
54+
"ui-priority": 0
55+
},
56+
"start": {
57+
"description": "When the service/driver starts or executes.",
58+
"disable_correlation": true,
59+
"misp-attribute": "text",
60+
"sane_default": [
61+
"Boot start",
62+
"System start",
63+
"Auto start",
64+
"Manual",
65+
"Disabled"
66+
],
67+
"ui-priority": 0
68+
},
69+
"type": {
70+
"description": "Service/driver type.",
71+
"disable_correlation": true,
72+
"misp-attribute": "text",
73+
"sane_default": [
74+
"Kernel driver",
75+
"File system driver",
76+
"Own process",
77+
"Share process",
78+
"Interactive",
79+
"Other"
80+
],
81+
"ui-priority": 0
82+
}
83+
},
84+
"description": "Windows service and detailed about a service running a Windows operating system",
85+
"meta-category": "misc",
86+
"name": "windows-service",
87+
"required": [
88+
"name"
89+
],
90+
"uuid": "7598cc63-7ba3-4d0a-91c0-b875c6013035",
91+
"version": 1
92+
}

‎relationships/definition.json‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1042,6 +1042,13 @@
10421042
],
10431043
"name": "extends"
10441044
},
1045+
{
1046+
"description": "Reprensents an object which writes towards another object or attribute",
1047+
"format": [
1048+
"misp"
1049+
],
1050+
"name": "writes"
1051+
},
10451052
{
10461053
"description": "Represents the semantic link of an asn object being ranked with a bgp-ranking object",
10471054
"format": [
@@ -1143,5 +1150,5 @@
11431150
"name": "doxed-by"
11441151
}
11451152
],
1146-
"version": 21
1153+
"version": 22
11471154
}

0 commit comments

Comments
 (0)