Documentation uses [win-registry-key vs windows-registry-key in examples

oasis-tcs / cti-stix2

OASIS CTI TC: Provides issue tracking and wiki pages for the STIX 2.x Work Products

https://github.com/oasis-tcs/cti-stix2

Other

24 stars 9 forks source link

Open jasonparallel opened 3 years ago

jasonparallel commented 3 years ago

([file:hashes.'SHA-256' = '13987239847...'] AND [win-registry-key:key = 'hkey']) WITHIN 120 SECONDS

should be

([file:hashes.'SHA-256' = '13987239847...'] AND [windows-registry-key:key = 'hkey']) WITHIN 120 SECONDS

clenk commented 3 years ago

Looks like this is from Section 9.5.1 Observation Expression Qualifiers, in the table entry for a WITHIN x SECONDS.

ejratl commented 3 years ago

Great catch!