-
Notifications
You must be signed in to change notification settings - Fork 5
/
Copy pathservice_manifest.yml
120 lines (101 loc) · 3.24 KB
/
service_manifest.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
name: FrankenStrings
version: $SERVICE_TAG
description: This service performs file and IOC extractions using pattern matching, simple encoding decoder and script deobfuscators.
# Regex defining the types of files the service accepts and rejects
accepts: .*
rejects: empty|metadata/.*|document/(email|office/email)|uri/.*
# At which stage the service should run (one of FILTER, EXTRACT, CORE, SECONDARY, POST, REVIEW)
# NOTE: Stages are executed in the order defined in the list
stage: CORE
# Which category the service is part of (one of Antivirus, Dynamic Analysis, External, Extraction, Filtering, Internet Connected, Networking, Static Analysis)
category: Static Analysis
# Does the service require access to the file to perform its task
# If set to false, the service will only have access to the file metadata (e.g. Hashes, size, type, ...)
file_required: true
# Maximum execution time the service has before it's considered to be timed out
timeout: 300
# is the service enabled by default
enabled: true
privileged: true
config:
st_max_size: 0
bb_max_size: 85000
add_multidecoder_output_as_supplementary: false
submission_params:
- name: max_file_size
type: int
value: 3000000
default: 3000000
- name: max_string_length
type: int
value: 5000
default: 5000
heuristics:
- heur_id: 1
name: Base64_Decoded
score: 10
filetype: ".*"
description: Base64-like strings discovered and decoded.
- heur_id: 2
name: XOR_decoded
score: 500
filetype: ".*"
description: XOR'd IOC content found and decoded.
- heur_id: 3
name: Embedded_PE
score: 100
signature_score_map:
reversed: 500
filetype: ".*"
description: Embedded PE extracted.
- heur_id: 4
name: Unicode_decoded
score: 10
filetype: ".*"
description: Unicode-like data found and decoded in non-exectuable file.
- heur_id: 5
name: Unicode_file_extracted
score: 100
filetype: ".*"
description: Long section of unicode-like data found and extracted in non-executable file.
- heur_id: 6
name: IOC_unicode_decoded
score: 500
filetype: ".*"
description: IOC(s) found in unicode encoded data in non-executable file.
- heur_id: 7
name: ASCIIhex_file_decoded
score: 50
filetype: ".*"
description: Possible ASCII hex encoded file decoded in non-executable file.
- heur_id: 8
name: ASCIIhex_strings_decoded
score: 100
filetype: ".*"
description:
ASCII hex-like strings found and decoded in a non-document, non-executable file.
-
- heur_id: 9
name: ASCIIhex_xor_string
score: 500
filetype: ".*"
description: Possible ASCII hex-like string with additional xor encoding found.
- heur_id: 10
name: ASCIIhex_strings_decoded_doc
score: 10
filetype: "document/.*"
description: ASCII hex-like strings found and decoded in a document file
- heur_id: 11
name: Base64_PE
score: 500
filetype: ".*"
description: Base64 decoded PE file
- heur_id: 12
name: URLANDEXIT Usage in Video
score: 500
filetype: "video/asf"
description: A URL was embedded into the stream of a video via URLANDEXIT
docker_config:
image: ${REGISTRY}cccs/assemblyline-service-frankenstrings:$SERVICE_TAG
cpu_cores: 1.0
ram_mb: 3072