CybOXProject / schemas

CybOX Schemas and Schema Development
42 stars 17 forks source link

Break Out PE Section Header Characteristics into Multiple Elements #304

Open ikiril01 opened 10 years ago

ikiril01 commented 10 years ago

In the PESectionHeaderType of the Windows Executable File Object, we use a single element for capturing the Characteristics. These can be reported as separate entries (e.g. IMAGE_FILE_RELOCS_STRIPPED), so we should consider allowing for the characterization of these broken out entries instead of forcing them to be glommed together in a single field.