def test_registry_hive(self):
hive_string = "HKLM"
normalized_hive_string = "HKEY_LOCAL_MACHINE"
registry_key_obj = WinRegistryKey()
registry_key_obj.hive = hive_string
normalize_object_properties(registry_key_obj)
self.assertEqual(registry_key_obj.hive.value, normalized_hive_string)
def test_registry_hive(self):
hive_string = "HKLM"
normalized_hive_string = "HKEY_LOCAL_MACHINE"
registry_key_obj = WinRegistryKey()
registry_key_obj.hive = hive_string
normalize_object_properties(registry_key_obj)
self.assertEqual(registry_key_obj.hive.value, normalized_hive_string)
def test_registry_value_data(self):
file_path_string = "C:"
normalized_file_path_string = "%SystemDrive%"
registry_key_obj = WinRegistryKey()
registry_key_obj.values = RegistryValues()
registry_value = RegistryValue()
registry_value.data = file_path_string
registry_key_obj.values.append(registry_value)
normalize_object_properties(registry_key_obj)
self.assertEqual(registry_key_obj.values[0].data.value, normalized_file_path_string)
def test_registry_value_data(self):
file_path_string = "C:"
normalized_file_path_string = "%SystemDrive%"
registry_key_obj = WinRegistryKey()
registry_key_obj.values = RegistryValues()
registry_value = RegistryValue()
registry_value.data = file_path_string
registry_key_obj.values.append(registry_value)
normalize_object_properties(registry_key_obj)
self.assertEqual(registry_key_obj.values[0].data.value,
normalized_file_path_string)
def add_registry_observable(self, mode, value):
if (mode, value) in self.__regkeys:
return
self.__regkeys.add((mode, value))
# FIXME value is not parse properly
_key = '\\'.join(value.split('\\')[3:])
hive = value.split('\\')[2]
reg_object = WinRegistryKey.from_dict({'key': _key, 'hive': hive})
reg_observable = Observable(reg_object)
reg_observable.title = "Malware Artifact - Registry"
reg_observable.description = "Registry access derived from sandboxed malware sample."
reg_observable.short_description = "Registry access from malware."
self.reg_indicator.add_observable(reg_observable)
def _set_search_items_from_win_registry_key_object(patterns, prop):
u'''
extract and set search key/value items from Cybox binding WindowsRegistryKey Object
'''
if prop is None or type(prop) != WindowsRegistryKeyObjectType:
return
# translate cybox.bindings object to cybox.objects object
obj = WinRegistryKey.from_obj(prop)
# Win Registry Key
if obj.key is not None:
keyname = unicode(obj.key)
if keyname[0] == '[' and keyname[len(keyname) - 1] == ']':
for key in keyname[1:len(keyname) - 2].split(','):
if obj.hive is not None:
key = u"%s\\%s" % (obj.hive, key)
_add_search_item(patterns, u"RegistryKey", key)
else:
key = keyname
if obj.hive is not None:
key = u"%s\\%s" % (obj.hive, key)
_add_search_item(patterns, u"RegistryKey", key)
# Win Registry Value
if obj.values is not None:
for value in obj.values:
if value is not None:
if value.data is not None:
value_data = unicode(value.data)
if value_data[0] == '[' and value_data[len(value_data) -
1] == ']':
_add_search_item(
patterns, u"RegistryValue",
value_data[1:len(value_data) - 2].split(','))
else:
_add_search_item(patterns, u"RegistryValue",
value_data)
def print_match(self, fpath, page, name, match):
# Resolve all hashes to single HASH reference to avoid repetition
if name == 'MD5' or name == 'SHA1' or name == 'SHA256':
name = 'HASH'
if name in ind_dict:
indicator = ind_dict[name]
add_ind_list.append(name)
indicator.title = fpath
#===========
# Add new object handlers here:
if name == 'IP':
new_obj = Address(address_value=match,
category=Address.CAT_IPV4)
elif name == 'HASH':
new_obj = File()
new_obj.add_hash(Hash(match))
elif name == 'URL':
new_obj = URI(type_=URI.TYPE_URL, value=match)
elif name == 'Host':
new_obj = URI(type_=URI.TYPE_DOMAIN, value=match)
elif name == 'Email':
new_obj = Address(
address_value=match, category=Address.CAT_EMAIL
) ## Not sure if this is right - should this be using the email_message_object?
elif name == 'Registry':
new_obj = WinRegistryKey(values=match)
#===========
new_obs = Observable(new_obj)
new_obs.title = "Page Ref: " + str(page)
indicator.add_observable(new_obs)
def createDynamicIndicators(stix_package, dynamicindicators):
filescreated = False
processesstarted = False
regkeyscreated = False
mutexescreated = False
hostscontacted = False
hasdynamicindicators = False
# Here we are just testing to see if the report had any
# of the various dynamic indicator types so we know whether
# or not to process them at all
if len(dynamicindicators['droppedfiles']) > 0:
filescreated = True
hasdynamicindicators = True
if len(dynamicindicators['processes']) > 0:
processesstarted = True
hasdynamicindicators = True
if len(dynamicindicators['regkeys']) > 0:
regkeyscreated = True
hasdynamicindicators = True
if len(dynamicindicators['mutexes']) > 0:
mutexescreated = True
hasdynamicindicators = True
if len(dynamicindicators['hosts']) > 0:
hostscontacted = True
hasdynamicindicators = True
if not hasdynamicindicators:
return
if filescreated:
createdfilesind = Indicator()
for createdfile in dynamicindicators['droppedfiles']:
createdfilename = File()
createdfilename.file_name = createdfile[0]
createdfilename.size_in_bytes = createdfile[1]
createdfilename.md5 = createdfile[2]
createdfilename.sha1 = createdfile[3]
createdfilename.sha256 = createdfile[4]
createdfilesind.add_observable(Observable(createdfilename))
stix_package.add_indicator(createdfilesind)
if processesstarted:
procindicator = Indicator()
for process in dynamicindicators['processes']:
# Process name
processname = process[0]
# Process pid
processpid = process[1]
# Process parent pid
processparentpid = process[2]
proc = Process()
proc.name = processname
proc.pid = processpid
proc.parent_pid = processparentpid
procindicator.add_observable(Observable(proc))
stix_package.add_indicator(procindicator)
if regkeyscreated:
regindicator = Indicator()
keypath = WinRegistryKey()
for regkey in dynamicindicators['regkeys']:
keypath = WinRegistryKey()
keypath.key = regkey
regindicator.add_observable(Observable(keypath))
stix_package.add_indicator(regindicator)
if not mutexescreated:
mutexind = Indicator()
for mutex in dynamicindicators['mutexes']:
winhandle = WinHandle()
winhandle.name = mutex
winmutex = WinMutex()
winmutex.handle = winhandle
mutexind.add_observable(Observable(winmutex))
stix_package.add_indicator(mutexind)
if hostscontacted:
networkconnectionind = Indicator()
for host in dynamicindicators['hosts']:
networkconnection = NetworkConnection()
socketaddress = SocketAddress()
socketaddress.ip_address = host
networkconnection.destination_socket_address = socketaddress
networkconnectionind.add_observable(Observable(networkconnection))
stix_package.add_indicator(networkconnectionind)
return
def make_cybox_object(type_, name=None, value=None):
"""
Converts type_, name, and value to a CybOX object instance.
:param type_: The object type.
:type type_: str
:param name: The object name.
:type name: str
:param value: The object value.
:type value: str
:returns: CybOX object
"""
if type_ == "Account":
acct = Account()
acct.description = value
return acct
elif type_ == "Address":
return Address(category=name, address_value=value)
elif type_ == "Email Message":
e = EmailMessage()
e.raw_body = value
return e
elif type_ == "API":
api = API()
api.description = value
return api
elif type_ == "Artifact":
if name == "Data Region":
atype = Artifact.TYPE_GENERIC
elif name == 'FileSystem Fragment':
atype = Artifact.TYPE_FILE_SYSTEM
elif name == 'Memory Region':
atype = Artifact.TYPE_MEMORY
else:
raise UnsupportedCybOXObjectTypeError(type_, name)
return Artifact(value, atype)
elif type_ == "Code":
obj = Code()
obj.code_segment = value
obj.type = name
return obj
elif type_ == "Disk":
disk = Disk()
disk.disk_name = type_
disk.type = name
return disk
elif type_ == "Disk Partition":
disk = DiskPartition()
disk.device_name = type_
disk.type = name
return disk
elif type_ == "DNS Query":
r = URI()
r.value = value
dq = DNSQuestion()
dq.qname = r
d = DNSQuery()
d.question = dq
return d
elif type_ == "DNS Record":
# DNS Record indicators in CRITs are just a free form text box, there
# is no good way to map them into the attributes of a DNSRecord cybox
# object. So just stuff it in the description until someone tells me
# otherwise.
d = StructuredText(value=value)
dr = DNSRecord()
dr.description = d
return dr
elif type_ == "GUI Dialogbox":
obj = GUIDialogbox()
obj.box_text = value
return obj
elif type_ == "GUI Window":
obj = GUIWindow()
obj.window_display_name = value
return obj
elif type_ == "HTTP Request Header Fields" and name and name == "User-Agent":
# TODO/NOTE: HTTPRequestHeaderFields has a ton of fields for info.
# we should revisit this as UI is reworked or CybOX is improved.
obj = HTTPRequestHeaderFields()
obj.user_agent = value
return obj
elif type_ == "Library":
obj = Library()
obj.name = value
obj.type = name
return obj
elif type_ == "Memory":
obj = Memory()
obj.memory_source = value
return obj
elif type_ == "Mutex":
m = Mutex()
m.named = True
m.name = String(value)
return m
elif type_ == "Network Connection":
obj = NetworkConnection()
obj.layer7_protocol = value
return obj
elif type_ == "Pipe":
p = Pipe()
p.named = True
p.name = String(value)
return p
elif type_ == "Port":
p = Port()
try:
p.port_value = PositiveInteger(value)
except ValueError: # XXX: Raise a better exception...
raise UnsupportedCybOXObjectTypeError(type_, name)
return p
elif type_ == "Process":
p = Process()
p.name = String(value)
return p
elif type_ == "String":
c = Custom()
c.custom_name = "crits:String"
c.description = ("This is a generic string used as the value of an "
"Indicator or Object within CRITs.")
c.custom_properties = CustomProperties()
p1 = Property()
p1.name = "value"
p1.description = "Generic String"
p1.value = value
c.custom_properties.append(p1)
return c
elif type_ == "System":
s = System()
s.hostname = String(value)
return s
elif type_ == "URI":
r = URI()
r.type_ = name
r.value = value
return r
elif type_ == "User Account":
obj = UserAccount()
obj.username = value
return obj
elif type_ == "Volume":
obj = Volume()
obj.name = value
return obj
elif type_ == "Win Driver":
w = WinDriver()
w.driver_name = String(value)
return w
elif type_ == "Win Event Log":
obj = WinEventLog()
obj.log = value
return obj
elif type_ == "Win Event":
w = WinEvent()
w.name = String(value)
return w
elif type_ == "Win Handle":
obj = WinHandle()
obj.type_ = name
obj.object_address = value
return obj
elif type_ == "Win Kernel Hook":
obj = WinKernelHook()
obj.description = value
return obj
elif type_ == "Win Mailslot":
obj = WinMailslot()
obj.name = value
return obj
elif type_ == "Win Network Share":
obj = WinNetworkShare()
obj.local_path = value
return obj
elif type_ == "Win Process":
obj = WinProcess()
obj.window_title = value
return obj
elif type_ == "Win Registry Key":
obj = WinRegistryKey()
obj.key = value
return obj
elif type_ == "Win Service":
obj = WinService()
obj.service_name = value
return obj
elif type_ == "Win System":
obj = WinSystem()
obj.product_name = value
return obj
elif type_ == "Win Task":
obj = WinTask()
obj.name = value
return obj
elif type_ == "Win User Account":
obj = WinUser()
obj.security_id = value
return obj
elif type_ == "Win Volume":
obj = WinVolume()
obj.drive_letter = value
return obj
elif type_ == "X509 Certificate":
obj = X509Certificate()
obj.raw_certificate = value
return obj
"""
The following are types that are listed in the 'Indicator Type' box of
the 'New Indicator' dialog in CRITs. These types, unlike those handled
above, cannot be written to or read from CybOX at this point.
The reason for the type being omitted is written as a comment inline.
This can (and should) be revisited as new versions of CybOX are released.
NOTE: You will have to update the corresponding make_crits_object function
with handling for the reverse direction.
In the mean time, these types will raise unsupported errors.
"""
#elif type_ == "Device": # No CybOX API
#elif type_ == "DNS Cache": # No CybOX API
#elif type_ == "GUI": # revisit when CRITs supports width & height specification
#elif type_ == "HTTP Session": # No good mapping between CybOX/CRITs
#elif type_ == "Linux Package": # No CybOX API
#elif type_ == "Network Packet": # No good mapping between CybOX/CRITs
#elif type_ == "Network Route Entry": # No CybOX API
#elif type_ == "Network Route": # No CybOX API
#elif type_ == "Network Subnet": # No CybOX API
#elif type_ == "Semaphore": # No CybOX API
#elif type_ == "Socket": # No good mapping between CybOX/CRITs
#elif type_ == "UNIX File": # No CybOX API
#elif type_ == "UNIX Network Route Entry": # No CybOX API
#elif type_ == "UNIX Pipe": # No CybOX API
#elif type_ == "UNIX Process": # No CybOX API
#elif type_ == "UNIX User Account": # No CybOX API
#elif type_ == "UNIX Volume": # No CybOX API
#elif type_ == "User Session": # No CybOX API
#elif type_ == "Whois": # No good mapping between CybOX/CRITs
#elif type_ == "Win Computer Account": # No CybOX API
#elif type_ == "Win Critical Section": # No CybOX API
#elif type_ == "Win Executable File": # No good mapping between CybOX/CRITs
#elif type_ == "Win File": # No good mapping between CybOX/CRITs
#elif type_ == "Win Kernel": # No CybOX API
#elif type_ == "Win Mutex": # No good mapping between CybOX/CRITs
#elif type_ == "Win Network Route Entry": # No CybOX API
#elif type_ == "Win Pipe": # No good mapping between CybOX/CRITs
#elif type_ == "Win Prefetch": # No CybOX API
#elif type_ == "Win Semaphore": # No CybOX API
#elif type_ == "Win System Restore": # No CybOX API
#elif type_ == "Win Thread": # No good mapping between CybOX/CRITs
#elif type_ == "Win Waitable Timer": # No CybOX API
raise UnsupportedCybOXObjectTypeError(type_, name)
def create_object(self, ce1sus_object, event_permissions, user):
definition_name = ce1sus_object.definition.name
obj = Object()
identifier = 'ce1sus:Object-{0}'.format(ce1sus_object.uuid)
obj.id_ = identifier
# try to find automatic the object container
try:
clazz = get_class(
'cybox.objects.{0}_object'.format(definition_name.lower()),
definition_name)
instance = clazz()
if definition_name == 'Disk':
# TODO: check why this must be set stix bug?
setattr(instance, 'type_', None)
except ImportError:
if definition_name == 'WinEventLog':
instance = WinEventLog()
# TODO: check why this must be set stix bug?
setattr(instance, 'type_', None)
elif definition_name == 'UserAccount':
instance = UserAccount()
elif definition_name == 'WinService':
instance = WinService()
elif definition_name == 'WindowsRegistryKey':
instance = WinRegistryKey()
elif definition_name == 'NetworkConnection':
instance = NetworkConnection()
elif definition_name == 'WinVolume':
instance = WinVolume()
# TODO: check why this must be set stix bug?
setattr(instance, 'drive_type', None)
elif definition_name == 'WinKernelHook':
instance = WinKernelHook()
elif definition_name == 'WinDriver':
instance = WinDriver()
elif definition_name == 'DomainName':
instance = DomainName()
# TODO: try to map it manually
elif definition_name == 'email':
instance = EmailMessage()
else:
raise Ce1susStixMapperException(
'Required to map manually {0}'.format(definition_name))
obj.properties = instance
attributes = ce1sus_object.get_attributes_for_permissions(
event_permissions, user)
for attribute in attributes:
self.map_attribtue(instance, attribute)
rel_objects = ce1sus_object.get_related_objects_for_permissions(
event_permissions, user)
for rel_object in rel_objects:
ob = self.create_object(rel_object.object, event_permissions, user)
if ob:
rel_obj = self.create_related_object(rel_object,
event_permissions, user)
# cybox_rel_object = RelatedObject(properties=ob.properties, relationship=rel_object.relation)
obj.related_objects.append(rel_obj)
return obj
def make_cybox_object(type_, value=None):
"""
Converts type_, name, and value to a CybOX object instance.
:param type_: The object type.
:type type_: str
:param value: The object value.
:type value: str
:returns: CybOX object
"""
if type_ == IndicatorTypes.USER_ID:
acct = Account()
acct.description = value
return acct
elif type_ in IPTypes.values():
if type_ == IPTypes.IPV4_ADDRESS:
name = 'ipv4-addr'
elif type_ == IPTypes.IPV6_ADDRESS:
name = 'ipv6-addr'
elif type_ == IPTypes.IPV4_SUBNET:
name = 'ipv4-net'
elif type_ == IPTypes.IPV6_SUBNET:
name = 'ipv6-net'
return Address(category=name, address_value=value)
elif type_ == IndicatorTypes.API_KEY:
api = API()
api.description = value
return api
elif type_ == IndicatorTypes.DOMAIN:
obj = DomainName()
obj.value = value
elif type_ == IndicatorTypes.USER_AGENT:
obj = HTTPRequestHeaderFields()
obj.user_agent = value
return obj
elif type_ == IndicatorTypes.MUTEX:
m = Mutex()
m.named = True
m.name = String(value)
return m
elif type_ in (IndicatorTypes.SOURCE_PORT,
IndicatorTypes.DEST_PORT):
p = Port()
try:
p.port_value = PositiveInteger(value)
except ValueError: # XXX: Raise a better exception...
raise UnsupportedCybOXObjectTypeError(type_, name)
return p
elif type_ == IndicatorTypes.PROCESS_NAME:
p = Process()
p.name = String(value)
return p
elif type_ == IndicatorTypes.URI:
r = URI()
r.type_ = 'URL'
r.value = value
return r
elif type_ in (IndicatorTypes.REGISTRY_KEY,
IndicatorTypes.REG_KEY_CREATED,
IndicatorTypes.REG_KEY_DELETED,
IndicatorTypes.REG_KEY_ENUMERATED,
IndicatorTypes.REG_KEY_MONITORED,
IndicatorTypes.REG_KEY_OPENED):
obj = WinRegistryKey()
obj.key = value
return obj
"""
The following are types that are listed in the 'Indicator Type' box of
the 'New Indicator' dialog in CRITs. These types, unlike those handled
above, cannot be written to or read from CybOX at this point.
The reason for the type being omitted is written as a comment inline.
This can (and should) be revisited as new versions of CybOX are released.
NOTE: You will have to update the corresponding make_crits_object function
with handling for the reverse direction.
In the mean time, these types will raise unsupported errors.
"""
#elif type_ == "Device": # No CybOX API
#elif type_ == "DNS Cache": # No CybOX API
#elif type_ == "GUI": # revisit when CRITs supports width & height specification
#elif type_ == "HTTP Session": # No good mapping between CybOX/CRITs
#elif type_ == "Linux Package": # No CybOX API
#elif type_ == "Network Packet": # No good mapping between CybOX/CRITs
#elif type_ == "Network Route Entry": # No CybOX API
#elif type_ == "Network Route": # No CybOX API
#elif type_ == "Network Subnet": # No CybOX API
#elif type_ == "Semaphore": # No CybOX API
#elif type_ == "Socket": # No good mapping between CybOX/CRITs
#elif type_ == "UNIX File": # No CybOX API
#elif type_ == "UNIX Network Route Entry": # No CybOX API
#elif type_ == "UNIX Pipe": # No CybOX API
#elif type_ == "UNIX Process": # No CybOX API
#elif type_ == "UNIX User Account": # No CybOX API
#elif type_ == "UNIX Volume": # No CybOX API
#elif type_ == "User Session": # No CybOX API
#elif type_ == "Whois": # No good mapping between CybOX/CRITs
#elif type_ == "Win Computer Account": # No CybOX API
#elif type_ == "Win Critical Section": # No CybOX API
#elif type_ == "Win Executable File": # No good mapping between CybOX/CRITs
#elif type_ == "Win File": # No good mapping between CybOX/CRITs
#elif type_ == "Win Kernel": # No CybOX API
#elif type_ == "Win Mutex": # No good mapping between CybOX/CRITs
#elif type_ == "Win Network Route Entry": # No CybOX API
#elif type_ == "Win Pipe": # No good mapping between CybOX/CRITs
#elif type_ == "Win Prefetch": # No CybOX API
#elif type_ == "Win Semaphore": # No CybOX API
#elif type_ == "Win System Restore": # No CybOX API
#elif type_ == "Win Thread": # No good mapping between CybOX/CRITs
#elif type_ == "Win Waitable Timer": # No CybOX API
raise UnsupportedCybOXObjectTypeError(type_, name)
def main():
stix_package = STIXPackage()
malware_instance = MalwareInstance()
malware_instance.add_name("plugin1.exe")
#not really remote access but am not sure what else to put
malware_instance.add_type("Remote Access Trojan")
ttp = TTP(title="Install+plugin1.exe")
ttp.behavior = Behavior()
ttp.behavior.add_malware_instance(malware_instance)
#observable 1 Install+plugin1.exe
file_object = File()
file_object.file_name = "Install+plugin1.exe"
file_object.add_hash(
Hash("164ecfc36893ee368a3c4cb2fd500b58262f1b87de1e68df74390db0b5445915"
))
file_object.hashes[0].simple_hash_value.condition = "Equals"
#observable 2 plugin1.exe
#http://cybox.readthedocs.io/en/stable/examples.html#creating-observables
file_plugin1 = File()
file_plugin1.file_name = "plugin1.exe"
file_plugin1.file_path = "C:\\Users\\Default\\AppData\\Local\\temp\plugin1"
file_plugin1.add_hash(
Hash("ae768b62f5fef4dd604e1b736bdbc3ed30417ef4f67bff74bb57f779d794d6df"
))
file_plugin1.hashes[0].simple_hash_value.condition = "Equals"
#observable 3 registry key
#http://cybox.readthedocs.io/en/stable/api/coverage.html
registry_object = WinRegistryKey()
registry_object.name = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Google Ultron Updater"
#observable 4 network traffic
#http://stixproject.github.io/documentation/idioms/malware-hash/
#I couldn't figure out how to correctly indicate the source, dest or protocol
addr = Address(address_value="192.168.52.219", category=Address.CAT_IPV4)
#indicator 1 Install+plugin1.exe
indicator = Indicator(title="File hash for Install+plugin.exe")
indicator.add_indicator_type("File Hash Watchlist")
indicator.add_observable(file_object)
indicator.add_indicated_ttp(TTP(idref=ttp.id_))
#indicator 2 plugin1.exe
indicator2 = Indicator(title="File hash for plugin1.exe")
indicator2.add_indicator_type("File Hash Watchlist")
indicator2.add_observable(file_plugin1)
indicator2.add_indicated_ttp(TTP(idref=ttp.id_))
#indicator3 registry key
indicator3 = Indicator(title="Registry entry for Install+plugin.exe")
indicator3.add_indicator_type("Malware Artifacts")
indicator3.add_observable(registry_object)
indicator3.add_indicated_ttp(TTP(idref=ttp.id_))
#indicator4 network traffic
indicator4 = Indicator(title="Network Traffic for plugine1.exe")
indicator.add_indicator_type("IP Watchlist")
indicator4.add_observable(Observable(addr))
indicator4.add_indicated_ttp(TTP(idref=ttp.id_))
stix_package.add_indicator(indicator)
stix_package.add_indicator(indicator2)
stix_package.add_indicator(indicator3)
stix_package.add_indicator(indicator4)
stix_package.add_ttp(ttp)
print(stix_package.to_xml(encoding=None))
observables_doc.add(WinService.from_dict({"service_name": "Service Name",
"display_name": "Service Display name",
"startup_type": "Service type",
"service_status": "Status",
"service_dll": "Somedll.dll",
"started_as": "Start",
"group_name": "Group name",
"startup_command_line": "Commandline"}))
observables_doc.add(WinRegistryKey.from_dict({"hive": "SYSTEM",
"key": "some\\registry\\key",
"number_values": 2,
"values": [{"name": "Something",
"datatype": "REG_DWORD", #or whatever it is...
"data": "Something else"},
{"name": "Another",
"datatype": "REG_BINARY", #or whatever it is...
"data": base64.b64encode("\x90\x90\x90")}], #binary stuff must be normalized, base64 is the usual
"number_subkeys": 1,
# subkeys have the same members as keys:
"subkeys": [{"key": "SubkeyName", "number_values": 1,
"values": [{"name": "SubkeyVal", "datatype": "REG_DWORD", "data": "Subkey val data"}]}]
}))
observables_doc.add(Mutex.from_dict({"name": "Some_MUTEX!!!"}))
# we can also specify conditions:
proc = Process.from_dict({"name": "anotherProcess.exe",
"pid": 102,
"parent_pid": 10,
"image_info": {"command_line": "anotherProcess.exe /c blahblah.bat"}})
proc.name.condition = "Equals"
