Propose new attribute type "malware-configuration"...

[StefanKelm]

...as currently there's no distinct type within the Artifacts dropped category and, personally, I wouldn't use malware-sample here.

[adulau]

We had some discussions sometime ago especially for the use-case of Fidelis Security (barncat MISP). I was thinking of creating an object template with the following format:

field	misp-attribute-type	description
config	text	clear raw configuration of the malware
format	text	[JSON, YAML, INI, other]
encrypted	text	encrypted or encoded version of the configuration
first-seen	datetime	First time this configuration was seen
last-seen	datetime	Last time this configuration was seen

If this is fine for you, I'll do it.

[StefanKelm]

That's a great idea! Thank you.