service_manifest.yml

name: Oletools
version: $SERVICE_TAG
description: >-
  This service extracts metadata, network information and reports anomalies in
  Microsoft OLE and XML documents using the Python library py-oletools by Philippe
  Lagadec - http://www.decalage.info.

accepts: document/office/.*|document/odt/.*|document/installer/windows
rejects: empty|metadata/.*|document/office/email|document/office/onenote

stage: CORE
category: Static Analysis

file_required: true
timeout: 60
disable_cache: false

enabled: true
is_external: false
licence_count: 0
privileged: true

uses_temp_submission_data: true

config:
  macro_score_max_file_size: 5242880 # 5 * 1024**2
  macro_score_min_alert: 0.6
  metadata_size_to_extract: 500
  ioc_pattern_safelist: []
  ioc_exact_safelist: []

heuristics:
  - heur_id: 1
    name: External Relationship
    score: 0
    max_score: 1000
    signature_score_map:
      external_relationship_ip: 500
      link_to_executable: 500
      mhtml_link: 100
      mshta: 500
      msdt_exploit: 500
      unc_path: 0
      # relationship types
      attachedtemplate: 500
      externallink: 500
      externallinkpath: 0
      externalreference: 500
      frame: 500
      hyperlink: 0
      officedocument: 500
      oleobject: 500
      package: 500
      slideupdateurl: 500
      slidemaster: 500
      slide: 500
      slideupdateinfo: 500
      subdocument: 500
      worksheet: 500
    filetype: document/office
    description: >-
      XML relationship with external link as the target.
      Many relationship types can be used to link to malicious files.

  - heur_id: 2
    name: Multi-embedded documents
    score: 0
    filetype: document/office
    description: >-
      File contains both old OLE format and new ODF format. This can be
      used to obfuscate malicious content.

  - heur_id: 3
    name: Too Large
    score: 0
    filetype: document/office
    description: >-
      File contains parts which are too large to be scanned.

  - heur_id: 4
    name: VBA Stomping
    score: 100
    filetype: document/office
    description: The VBA source code and P-code are different, this may have been used to hide malicious code.

  - heur_id: 5
    name: Flash content in OLE
    score: 10
    filetype: document/office/ole
    description: Flash object detected in OLE stream.

  - heur_id: 6
    name: Hex content in OLE
    score: 500
    filetype: document/office/ole
    description: Found large chunk of VBA hex notation in OLE.

  - heur_id: 7
    name: IOC in XML
    score: 1
    max_score: 100
    filetype: document/office/.*|document/odt/.*
    description: IOC content discovered in compressed XML.

  - heur_id: 8
    name: B64 in XML
    score: 0
    filetype: document/office
    description: Base64 content discovered in compressed XML.

  - heur_id: 9
    name: IOC in OLE
    score: 1
    max_score: 100
    filetype: document/(office|installer/windows)
    description: IOC content discovered in OLE Object.

  - heur_id: 10
    name: B64 in OLE
    score: 0
    filetype: document/(office|installer/windows)
    description: Base64 content discovered in OLE Object.

  - heur_id: 13
    name: Linked Object
    score: 10
    filetype: document/office
    description: Link object in RTF.
    signature_score_map:
      malicious_link_object: 1000

  - heur_id: 14
    name: Suspicious Unknown Object
    score: 1000
    filetype: document/office
    description: Malicious properties discovered in embedded object(s) of unknown type.

  - heur_id: 15
    name: DDE Link Extracted
    score: 50
    filetype: document/office
    description: DDE link object extracted.

  - heur_id: 16
    name: Suspicious DDE Link
    score: 1000
    filetype: document/office
    description: Suspicious properties discovered in DDE link object.

  - heur_id: 17
    name: Large Metadata Extracted
    score: 0
    signature_score_map:
      hexadecimal: 0
      shellcode: 1000
    filetype: document/office
    description: Large metadata content extracted for analysis.

  - heur_id: 18
    name: Thumbnail Extracted
    score: 0
    filetype: document/office
    description: Embedded thumbnail from OLE metadata extracted.

  - heur_id: 19
    name: Large malformed OLE Object Extracted
    score: 0
    filetype: document/office
    description: Large malformed OLE object extracted from sample.

  - heur_id: 20
    name: Packed or obfuscated macro
    score: 100
    filetype: document/office
    description: Macro may be packed or obfuscated.

  - heur_id: 21
    name: RTF Embedded Object
    score: 10
    filetype: document/office
    description: RTF Embedded Object.
    signature_score_map:
      malicious_embedded_object: 1000

  - heur_id: 22
    name: Compressed macros found
    score: 100
    filetype: document/office
    description: Compressed macros found.

  - heur_id: 23
    name: Suspicious javascript string
    score: 250
    filetype: document/(office|installer/windows)
    description: Suspicious javascript string found in the stream

  - heur_id: 24
    name: Suspicious executable string
    score: 500
    filetype: document/office
    description: Suspicious executable string found in the stream

  - heur_id: 25
    name: Suspicious string found
    score: 50
    filetype: document/(office|installer/windows)
    description: Suspicious string found in the stream

  - heur_id: 26
    name: ActiveMime Document(s) in multipart/related
    score: 500
    filetype: document/office
    description: ActiveMime Document(s) in multipart/related

  - heur_id: 27
    name: Found network indicator(s) within macros
    score: 50
    max_score: 500
    filetype: document/office
    description: Found network indicator(s) within macros

  - heur_id: 28
    name: Error parsing ExOleObjStg stream
    score: 50
    filetype: document/office
    description: Error parsing ExOleObjStg stream

  - heur_id: 29
    name: Ole10Native stream
    score: 0
    signature_score_map:
      embedded_pe_file: 1000
    filetype: document/office
    description: Data embedded in a OLE file using the Ole10Native stream structure

  - heur_id: 30
    name: Suspicious strings or functions
    score: 50
    max_score: 100
    signature_score_map:
      base64_strings: 0
      call: 0
      create: 0
      hex_strings: 0
      lib: 0
      open: 0
      output: 0
      run: 0
      system: 0
      windows: 0
    filetype: document/office
    description: Suspicious strings or functions

  - heur_id: 32
    name: Autoexecution strings
    score: 50
    max_score: 100
    filetype: document/office
    description: Autoexecution strings

  - heur_id: 33
    name: VBA Macro
    score: 0
    filetype: ".*"
    description: Contains Embedded VBA Macro(s)

  - heur_id: 34
    name: OleID Indicator Found
    score: 10
    filetype: document/(office|installer/windows)|document/odt/.*
    description: OleID indicator object found

  - heur_id: 40
    name: Root[0] Does Not Exist
    score: 50
    filetype: ".*"
    description: Root[0] does not exist

  - heur_id: 41
    name: Invalid CompObj type
    score: 50
    filetype: ".*"
    description: Check if the name is CompObj and the type of the file is not stream type.

  - heur_id: 42
    name: Missing Field
    score: 50
    filetype: ".*"
    description: >-
      This is caused when an error is thrown when Hachoir lib could not
      get a field from the file. This file is either corrupted, patched or
      exploiting a vulnerability.

  - heur_id: 43
    name: Cannot Find Property of Type
    score: 50
    filetype: ".*"
    description: >-
      This is caused when a parser error is thrown when Hachoir lib could
      not parse a property from the file. This file is either corrupted,
      patched or exploiting a vulnerability.

  - heur_id: 44
    name: Overflowing Field
    score: 50
    filetype: ".*"
    description: >-
      This is caused when a parser error is thrown when Hachoir lib could
      not read a field from the file since it it overflowing. This file is
      either corrupted, patched or exploiting a vulnerability.

  - heur_id: 45
    name: Could not Access Field
    score: 50
    filetype: ".*"
    description: >-
      This is caused when a parser error is thrown when Hachoir lib could
      not access a field from the file. This file is either corrupted,
      patched or exploiting a vulnerability.

  - heur_id: 46
    name: FAT Chain - Loop
    score: 50
    filetype: ".*"
    description: >-
      This is caused when a parser error is thrown when Hachoir lib found
      a loop when navigating through the file. It should be either BFAT or
      SFAT. This file is either corrupted, patched or exploiting a
      vulnerability.

  - heur_id: 47
    name: SFAT Invalid Block Index
    score: 50
    filetype: ".*"
    description: >-
      This is caused when a parser error is thrown when Hachoir lib finds
      an invalid block index in the file. This file is either corrupted,
      patched or exploiting a vulnerability.

  - heur_id: 48
    name: OLE2 - Invalid endian value
    score: 50
    filetype: ".*"
    description: >-
      The stream endian field is not valid.  This file is either
      corrupted, patched or exploiting a vulnerability.

  - heur_id: 49
    name: Failure to Parse Whole File
    score: 10
    filetype: ".*"
    description: The Hachoir lib wasn't able to parse the whole file for some unknown reason.

  - heur_id: 50
    name: Suspicious properties
    score: 100
    filetype: ".*"
    description: Found properties with different IDs than storage, stream and root.

  - heur_id: 51
    name: Excel 4.0 Macro sheet
    score: 250
    filetype: ".*"
    description: Excel 4.0 macro sheets are depricated and can be used for detection avoidance.

  - heur_id: 52
    name: Known malicious CLSID
    score: 500
    filetype: ".*"
    description: CLSID that has been flagged as malicious

docker_config:
  image: ${REGISTRY}cccs/assemblyline-service-oletools:$SERVICE_TAG
  cpu_cores: 1
  ram_mb: 4096