Windows Registry Key STIX observable node

[lparker31]

I think there should be changes to the Windows Registry Key. For instance, this is how I would put in a Windows Registry Key; however, this gives an error.

Oftentimes, reports just have the location of the registry key (in this example, HKEY_CURRENT_USER\Control Panel\Desktop) and not any of the value information.

The way to put in a Registry Key and not get an error is to do this:

However, this looks like you haven’t put in anything for the Registry Key in the overall flow (you have to click in to the Registry Key node then expand the Values section to actually see the registry key). My suggestion – don’t require the “Value” section to have any data to be a correct flow (to not throw an error), just the “Key” section, especially since many reports may not include information on the Values, just to modify registry key.