service_manifest.yml

name: MetaPeek
version: $SERVICE_TAG
description: This Assemblyline service checks the metadata of the submitted file to look for anomalies (name, extension, etc).

# Regex defining the types of files the service accepts and rejects
accepts: .*
rejects: empty|metadata/.*|uri/.*

# At which stage the service should run (one of FILTER, EXTRACT, CORE, SECONDARY, POST, REVIEW)
# NOTE: Stages are executed in the order defined in the list
stage: SECONDARY
# Which category the service is part of (one of Antivirus, Dynamic Analysis, External, Extraction, Filtering, Internet Connected, Networking, Static Analysis)
category: Static Analysis

# Does the service require access to the file to perform its task
# If set to false, the service will only have access to the file metadata (e.g. Hashes, size, type, ...)
file_required: false
# Maximum execution time the service has before it's considered to be timed out
timeout: 60

# is the service enabled by default
enabled: true
privileged: true
disable_cache: true

heuristics:
  - heur_id: 1
    name: Too Many Whitespaces
    score: 500
    filetype: '.*'
    description: File name has too many whitespaces, possibly masking its actual extension.

  - heur_id: 2
    name: Double File Extension
    score: 500
    filetype: '.*'
    description: File name has two extensions.

  - heur_id: 3
    name: Hidden Launchable File Extension
    score: 500
    filetype: '.*'
    description: Launchable file extension is hidden using a Unicode bidirectional control.

  - heur_id: 4
    name: Empty Filename
    score: 500
    filetype: '.*'
    description: File name is empty or all whitespaces.

  - heur_id: 5
    name: Phishing character in html file name
    score: 500
    filetype: 'code/html'
    description: >-
      Some characters are used to make the file name prettier to increase the chances of clicks, like a 🎶 for a fake voicemail message.

docker_config:
  image: ${REGISTRY}cccs/assemblyline-service-metapeek:$SERVICE_TAG
  cpu_cores: 0.4
  ram_mb: 2048