You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
65 lines
2.5 KiB
Plaintext
65 lines
2.5 KiB
Plaintext
{% if SCAN_MACROS == 'True' %}
|
|
oletools {
|
|
# default olefy settings
|
|
servers = "{{ OLETOOLS_ADDRESS }}"
|
|
|
|
# needs to be set explicitly for Rspamd < 1.9.5
|
|
scan_mime_parts = true;
|
|
extended = true;
|
|
max_size = 3145728;
|
|
timeout = 20.0;
|
|
retransmits = 1;
|
|
|
|
patterns {
|
|
OLETOOLS_MACRO_FOUND= '^.....M..$';
|
|
OLETOOLS_AUTOEXEC = '^A....M..$';
|
|
OLETOOLS_FLAG = '^.....MS.$';
|
|
OLETOOLS_VBASTOMP = '^VBA Stomping$';
|
|
# see https://github.com/decalage2/oletools/blob/master/oletools/mraptor.py
|
|
OLETOOLS_A = '(?i)\b(?:Auto(?:Exec|_?Open|_?Close|Exit|New)|Document(?:_?Open|_Close|_?BeforeClose|Change|_New)|NewDocument|Workbook(?:_Open|_Activate|_Close|_BeforeClose)|\w+_(?:Painted|Painting|GotFocus|LostFocus|MouseHover|Layout|Click|Change|Resize|BeforeNavigate2|BeforeScriptExecute|DocumentComplete|DownloadBegin|DownloadComplete|FileDownload|NavigateComplete2|NavigateError|ProgressChange|PropertyChange|SetSecureLockIcon|StatusTextChange|TitleChange|MouseMove|MouseEnter|MouseLeave|OnConnecting))\b|Auto_Ope\b';
|
|
OLETOOLS_W = '(?i)\b(?:FileCopy|CopyFile|Kill|CreateTextFile|VirtualAlloc|RtlMoveMemory|URLDownloadToFileA?|AltStartupPath|WriteProcessMemory|ADODB\.Stream|WriteText|SaveToFile|SaveAs|SaveAsRTF|FileSaveAs|MkDir|RmDir|SaveSetting|SetAttr)\b|(?:\bOpen\b[^\n]+\b(?:Write|Append|Binary|Output|Random)\b)';
|
|
OLETOOLS_X = '(?i)\b(?:Shell|CreateObject|GetObject|SendKeys|RUN|CALL|MacScript|FollowHyperlink|CreateThread|ShellExecuteA?|ExecuteExcel4Macro|EXEC|REGISTER|SetTimer)\b|(?:\bDeclare\b[^\n]+\bLib\b)';
|
|
}
|
|
|
|
# mime-part regex matching in content-type or filename
|
|
mime_parts_filter_regex {
|
|
#UNKNOWN = "application\/octet-stream";
|
|
DOC2 = "application\/msword";
|
|
DOC3 = "application\/vnd\.ms-word.*";
|
|
XLS = "application\/vnd\.ms-excel.*";
|
|
PPT = "application\/vnd\.ms-powerpoint.*";
|
|
GENERIC = "application\/vnd\.openxmlformats-officedocument.*";
|
|
}
|
|
# mime-part filename extension matching (no regex)
|
|
mime_parts_filter_ext {
|
|
doc = "doc";
|
|
dot = "dot";
|
|
docx = "docx";
|
|
dotx = "dotx";
|
|
docm = "docm";
|
|
dotm = "dotm";
|
|
xls = "xls";
|
|
xlt = "xlt";
|
|
xla = "xla";
|
|
xlsx = "xlsx";
|
|
xltx = "xltx";
|
|
xlsm = "xlsm";
|
|
xltm = "xltm";
|
|
xlam = "xlam";
|
|
xlsb = "xlsb";
|
|
ppt = "ppt";
|
|
pot = "pot";
|
|
pps = "pps";
|
|
ppa = "ppa";
|
|
pptx = "pptx";
|
|
potx = "potx";
|
|
ppsx = "ppsx";
|
|
ppam = "ppam";
|
|
pptm = "pptm";
|
|
potm = "potm";
|
|
ppsm = "ppsm";
|
|
slk = "slk";
|
|
}
|
|
}
|
|
{% endif %}
|