Implementation of new Observables / Observable Extensions

oasis-tcs / cti-stix2

OASIS CTI TC: Provides issue tracking and wiki pages for the STIX 2.x Work Products

https://github.com/oasis-tcs/cti-stix2

Other

24 stars 9 forks source link

Closed securitiz closed 3 years ago

securitiz commented 3 years ago

I'd like to (re)introduce the idea of adding several types of observables, some of which have already been brought up in other issues (#46 , #45 )

ISP
- technically an organization, any way to distinguish Org vs ISP in relation to an IP? maybe a boolean property
Windows Scheduled Task
Windows Events
Windows File Mapping
Windows Pipe
Windows Class
Windows Window Name

Have any of these been discussed and shot down? If so, can someone point me to the reasoning and proposed workaround?

rpiazza commented 3 years ago

Hi @securitiz,

Please add a comment on #45 and #46.

On the other hand, you could use the extension facility (see spec section 7.3) to implement these as "new-sco"s.