Registry Key
reg_key
The registry key object describes a Windows registry key. Defined by D3FEND d3f:WindowsRegistryKey.
Contents
Attributes
Caption | Name | Type | Is Array | Default | Description |
---|---|---|---|---|---|
System | is_system | Boolean | The indication of whether the object is part of the operating system. | ||
Modified Time | modified_time | Timestamp | The time when the registry key was last modified. | ||
Path | path | String | The full path to the registry key. | ||
Raw Data | raw_data | JSON | The event data as received from the event source. | ||
Record ID | record_id | String | Unique identifier for the object | ||
Security Descriptor | security_descriptor | String | The security descriptor of the registry key. | ||
Unmapped Data | unmapped | Unmapped | The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source. |
References
Context
JSON
{
"caption": "Registry Key",
"observable": 28,
"name": "reg_key",
"description": "The registry key object describes a Windows registry key. Defined by D3FEND <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:WindowsRegistryKey/'>d3f:WindowsRegistryKey</a>.",
"extends": "object",
"attributes": {
"is_system": {
"requirement": "optional",
"caption": "System",
"description": "The indication of whether the object is part of the operating system.",
"type": "boolean_t"
},
"modified_time": {
"description": "The time when the registry key was last modified.",
"requirement": "optional",
"caption": "Modified Time",
"type": "timestamp_t"
},
"path": {
"caption": "Path",
"description": "The full path to the registry key.",
"requirement": "required",
"type": "string_t"
},
"security_descriptor": {
"caption": "Security Descriptor",
"description": "The security descriptor of the registry key.",
"requirement": "optional",
"type": "string_t"
},
"raw_data": {
"group": "context",
"caption": "Raw Data",
"description": "The event data as received from the event source.",
"type": "json_t"
},
"record_id": {
"description": "Unique identifier for the object",
"group": "primary",
"requirement": "required",
"caption": "Record ID",
"type": "string_t"
},
"unmapped": {
"caption": "Unmapped Data",
"description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
"type": "unmapped",
"is_array": true
}
},
"extension": "windows"
}