backend.yaml

version: 2024.04.22.01
logging_cfg: '/etc/strelka/logging.yaml'
limits:
  max_files: 5000
  time_to_live: 900
  max_depth: 15
  distribution: 600
  scanner: 150
coordinator:
  addr: 'coordinator:6379'
  db: 0
#  blocking_pop_time_sec: 5
tasting:
  mime_db: null
  yara_rules: '/etc/strelka/taste/'
caching:
  scanner: true
telemetry:
  traces:
    sampling: 1.0
# OTLP-gRPC
    exporter: otlp-grpc
    addr: jaeger:4317
# OTLP-HTTP
#    exporter: otlp-http
#    addr: http://jaeger:4318/v1/traces
# Jaeger Thrift Collector
#    exporter: jaeger-http-thrift
#    addr: http://jaeger:14268/api/traces
# Jaeger Thrift Agent
#    exporter: jaeger-udp-thrift
#    addr: jaeger:6831
scanners:
#  'ScanAntiword':
#    - positive:
#        flavors:
#          - 'application/msword'
#          - 'olecf_file'
#      priority: 5
#  'ScanBase64':
#    - positive:
#        flavors:
#          - 'base64'
#      priority: 5
  'ScanBase64PE':
    - positive:
        flavors:
          - 'base64_pe'
      priority: 5
  'ScanBatch':
    - positive:
        flavors:
          - 'text/x-msdos-batch'
          - 'batch_file'
      priority: 5
  'ScanBmpEof':
    - positive:
        flavors:
          - 'image/x-ms-bmp'
          - 'bmp_file'
      negative:
        source:
          - 'ScanTranscode'
      priority: 5
  'ScanBzip2':
    - positive:
        flavors:
          - 'application/x-bzip2'
          - 'bzip2_file'
      priority: 5
#  'ScanCcn':
#    - positive:
#        flavors:
#          - 'credit_cards'
#      priority: 5
  'ScanDonut':
    - positive:
        flavors:
          - 'hacktool_win_shellcode_donut'
      priority: 5
  'ScanDmg':
    - positive:
        flavors:
          - 'dmg_disk_image'
#          - 'dmg_encrypted_disk_image'
          - 'hfsplus_disk_image'
      priority: 5
  'ScanDocx':
    - positive:
        flavors:
          - 'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
          - "docx_file"
      priority: 5
      options:
        extract_text: False
#  'ScanElf':
#    - positive:
#        flavors:
#          - 'application/x-object'
#          - 'application/x-executable'
#          - 'application/x-sharedlib'
#          - 'application/x-coredump'
#          - 'elf_file'
#      priority: 5
  'ScanEmail':
    - positive:
        flavors:
          - 'application/vnd.ms-outlook'
          - 'message/rfc822'
          - 'email_file'
          - 'email_file_broad'
      priority: 5
      options:
        create_thumbnail: True
        thumbnail_header: False
        thumbnail_size: [ 500, 500 ]
  'ScanEncryptedDoc':
    - positive:
        flavors:
          - 'encrypted_word_document'
      priority: 5
      options:
        max_length: 5
        scanner_timeout: 150
        log_pws: True
        password_file: "/etc/strelka/passwords.dat"
        # brute_force: True
  'ScanEncryptedZip':
    - positive:
        flavors:
          - 'encrypted_zip'
      priority: 5
      options:
        max_length: 5
        scanner_timeout: 150
        log_pws: True
        password_file: '/etc/strelka/passwords.dat'
        # brute_force: True
  'ScanEntropy':
    - positive:
        flavors:
          - '*'
      priority: 5
  'ScanExiftool':
    - positive:
        flavors:
          - 'application/msword'
          - 'olecf_file'
          - 'application/vnd.ms-excel'
          - 'application/pdf'
          - 'pdf_file'
          - 'lnk_file'
          - 'image/gif'
          - 'gif_file'
          - 'image/jpeg'
          - 'jpeg_file'
          - 'image/png'
          - 'png_file'
          - 'image/tiff'
          - 'type_is_tiff'
          - 'image/x-ms-bmp'
          - 'bmp_file'
          - 'application/x-shockwave-flash'
          - 'fws_file'
          - 'image/webp'
          - 'image/avif'
          - 'image/heic'
          - 'image/heif'
          - "docx_file"
      priority: 5
  'ScanFooter':
    - positive:
        flavors:
          - '*'
      priority: 5
      options:
        length: 50
        encodings:
          - classic
          - backslash
#          - raw
#          - hex
  'ScanGif':
    - positive:
        flavors:
          - 'image/gif'
          - 'gif_file'
      priority: 5
  'ScanGzip':
    - positive:
        flavors:
          - 'application/gzip'
          - 'application/x-gzip'
          - 'gzip_file'
      priority: 5
  'ScanHash':
    - positive:
        flavors:
          - '*'
      priority: 5
  'ScanHeader':
    - positive:
        flavors:
          - '*'
      priority: 5
      options:
        length: 50
        encodings:
          - classic
          - backslash
#          - raw
#          - hex
  'ScanHtml':
    - positive:
        flavors:
          - 'hta_file'
          - 'text/html'
          - 'html_file'
      priority: 5
      options:
        max_hyperlinks: 50
#  'ScanIni':
#    - positive:
#        filename: '(\.([Cc][Ff][Gg]|[Ii][Nn][Ii])|PROJECT)$'
#        flavors:
#          - 'ini_file'
#          - 'olecf_file'
#      priority: 5
  'ScanIso':
    - positive:
        flavors:
          - 'application/x-iso9660-image'
      priority: 5
      options:
        limit: 50
  'ScanIqy':
    - positive:
        flavors:
          - 'iqy_file'
      priority: 5
  'ScanJarManifest':
    - positive:
        flavors:
          - 'jar_manifest_file'
      priority: 5
      options:
        headers:
          - 'Manifest-Version'
          - 'Created-By'
  'ScanJavascript':
    - negative:
        flavors:
          - 'text/html'
          - 'html_file'
      positive:
        flavors:
          - 'javascript_file'
          - 'text/javascript'
      priority: 5
      options:
        beautify: True
        max_strings: 50
  'ScanJpeg':
    - positive:
        flavors:
          - 'image/jpeg'
          - 'jpeg_file'
      negative:
        source:
          - 'ScanTranscode'
      priority: 5
  'ScanJson':
    - positive:
        flavors:
          - 'application/json'
          - 'json_file'
      priority: 5
  'ScanJnlp':
    - positive:
        flavors:
          - "jnlp_file"
      priority: 5
  'ScanLibarchive':
    - positive:
        flavors:
          - 'application/vnd.ms-cab-compressed'
          - 'cab_file'
          - 'application/x-cpio'
          - 'cpio_file'
          - 'application/x-xar'
          - 'xar_file'
#          - 'arj_file'  # ARJ support missing from ScanLibarchive
          - 'application/x-debian-package'
          - 'debian_package_file'
      priority: 5
      options:
        limit: 1000
  'ScanLnk':
    - positive:
        flavors:
          - 'lnk_file'
      priority: 5
  'ScanLsb':
    - positive:
        flavors:
          - 'image/png'
          - 'png_file'
          - 'image/jpeg'
          - 'jpeg_file'
          - 'image/x-ms-bmp'
          - 'bmp_file'
          - 'image/webp'
      negative:
        source:
          - 'ScanTranscode'
      priority: 5
  'ScanLzma':
    - positive:
        flavors:
          - 'application/x-lzma'
          - 'lzma_file'
          - 'application/x-xz'
          - 'xz_file'
      priority: 5
  'ScanMacho':
    - positive:
        flavors:
          - 'application/x-mach-binary'
          - 'macho_file'
      priority: 5
      options:
        tmp_directory: '/dev/shm/'
  'ScanManifest':
    - positive:
        flavors:
          - 'browser_manifest'
      priority: 5
  'ScanMsi':
    - positive:
        flavors:
          - "image/vnd.fpx"
          - "application/vnd.ms-msi"
          - "application/x-msi"
      priority: 5
      options:
        tmp_directory: '/dev/shm/'
        keys:
          - 'Author'
          - 'Characters'
          - 'Company'
          - 'CreateDate'
          - 'LastModifiedBy'
          - 'Lines'
          - 'ModifyDate'
          - 'Pages'
          - 'Paragraphs'
          - 'RevisionNumber'
          - 'Software'
          - 'Template'
          - 'Title'
          - 'TotalEditTime'
          - 'Words'
#  'ScanNf':
#    - positive:
#        flavors:
#          - 'image/png'
#          - 'png_file'
#          - 'image/jpeg'
#          - 'jpeg_file'
#          - 'image/x-ms-bmp'
#          - 'bmp_file'
#          - 'image/webp'
#      negative:
#        source:
#          - 'ScanTranscode'
#      priority: 5
  'ScanOcr':
    - positive:
        flavors:
          - 'image/jpeg'
          - 'jpeg_file'
          - 'image/png'
          - 'png_file'
          - 'image/tiff'
          - 'type_is_tiff'
          - 'image/x-ms-bmp'
          - 'bmp_file'
          - 'image/webp'
          - 'application/pdf'
          - 'pdf_file'
          - "image/gif"
          - "gif_file"
      priority: 5
      options:
        extract_text: False
        tmp_directory: "/dev/shm/"
        pdf_to_png: True
        remove_formatting: False
        split_words: True
        create_thumbnail: True
        thumbnail_size: [250, 250]
  'ScanOle':
    - positive:
        flavors:
          - 'application/CDFV2'
          - 'application/msword'
          - 'olecf_file'
      priority: 5
  'ScanOnenote':
    - positive:
        flavors:
          - 'application/onenote'
          - 'application/msonenote'
          - 'onenote_file'
      priority: 5
  'ScanPcap':
    - positive:
        flavors:
          - 'pcap_file'
          - 'pcapng_file'
      priority: 5
      options:
        scanner_timeout: 20
  'ScanPdf':
    - positive:
        flavors:
          - 'application/pdf'
          - 'pdf_file'
      priority: 5
      options:
        objects:
          - 'AA'
          - 'EmbeddedFiles'
          - 'JavaScript'
          - 'JS'
          - 'Launch'
          - 'Macrosheet'
          - 'MediaBox'
          - 'OpenAction'
          - 'URI'
          - 'XObject'
        max_objects: 250
  'ScanPe':
    - positive:
        flavors:
          - 'application/x-dosexec'
          - 'mz_file'
      priority: 5
      options:
        extract_overlay: False
  'ScanPgp':
    - positive:
        flavors:
          - 'application/pgp-keys'
          - 'text/PGP'
          - 'pgp_file'
      priority: 5
  'ScanPhp':
    - positive:
        flavors:
          - 'text/x-php'
          - 'php_file'
      priority: 5
  'ScanPkcs7':
    - positive:
        flavors:
          - 'pkcs7_file'
      priority: 5
      options:
        tmp_directory: '/dev/shm/'
  'ScanPlist':
    - positive:
        flavors:
          - 'bplist_file'
          - 'plist_file'
      priority: 5
      options:
        keys:
          - 'KeepAlive'
          - 'Label'
          - 'NetworkState'
          - 'Program'
          - 'ProgramArguments'
          - 'RunAtLoad'
          - 'StartInterval'
  'ScanPngEof':
    - positive:
        flavors:
          - 'image/png'
          - 'png_file'
      negative:
        source:
          - 'ScanTranscode'
      priority: 5
  'ScanPyinstaller':
    - positive:
        flavors:
          - "pyinstaller_file"
      priority: 5
  'ScanQr':
    - positive:
        flavors:
          - 'image/jpeg'
          - 'jpeg_file'
          - 'image/png'
          - 'png_file'
          - 'image/tiff'
          - 'type_is_tiff'
          - 'image/x-ms-bmp'
          - 'bmp_file'
          - 'image/webp'
      priority: 5
      options:
        support_inverted: True
  'ScanRar':
    - positive:
        flavors:
          - 'application/x-rar'
          - 'rar_file'
      priority: 5
      options:
        limit: 1000
        limit_metadata: True
        size_limit: 250000000
        crack_pws: False
        log_pws: True
        password_file: '/etc/strelka/passwords.dat'
  'ScanRpm':
    - positive:
        flavors:
          - 'application/x-rpm'
          - 'rpm_file'
      priority: 5
      options:
        tmp_directory: '/dev/shm/'
  'ScanRtf':
    - positive:
        flavors:
          - 'text/rtf'
          - 'rtf_file'
      priority: 5
      options:
        limit: 1000
#  'ScanSave':
#    - positive:
#        flavors:
#          - '*'
#      priority: 5
#      options:
#        compression: 'gzip'
#        encoding: 'base64'
  'ScanSevenZip':
    - positive:
        flavors:
          - 'application/x-7z-compressed'
          - '_7zip_file'
          - "image/vnd.fpx"
          - "application/vnd.ms-msi"
          - "application/x-msi"
      priority: 5
      options:
#        min_length: 1
#        max_length: 6
        scanner_timeout: 150
        crack_pws: True
        log_pws: True
#        brute_force: True
#  'ScanStrings':
#    - positive:
#        flavors:
#          - 'mz_file'
#    - negative:
#        flavors:
#          - 'base64'
#      priority: 5
  'ScanSwf':
    - positive:
        flavors:
          - 'application/x-shockwave-flash'
          - 'fws_file'
          - 'cws_file'
          - 'zws_file'
      priority: 5
  'ScanTar':
    - positive:
        flavors:
          - 'application/x-tar'
          - 'tar_file'
      priority: 5
      options:
        limit: 1000
  'ScanTlsh':
    - positive:
        flavors:
          - '*'
      priority: 5
      options:
        location: '/etc/strelka/tlsh/'
        score: 30
  'ScanTnef':
    - positive:
        flavors:
          - 'application/vnd.ms-tnef'
          - 'tnef_file'
      priority: 5
  'ScanTranscode':
    - positive:
        flavors:
          - 'image/avif'
          - 'image/heic'
          - 'image/heif'
      options:
        output_format: jpeg  # "gif", "webp", "jpeg", "bmp", "png", "tiff"
  'ScanUdf':
    - positive:
        flavors:
          - 'udf_file'
      priority: 5
      options:
        limit: 50
  'ScanUpx':
    - positive:
        flavors:
          - 'upx_file'
      priority: 5
      options:
        tmp_directory: '/dev/shm/'
  'ScanUrl':
    - negative:
        flavors:
          - 'javascript_file'
      positive:
        flavors:
          - 'text/plain'
      priority: 5
  'ScanVb':
    - positive:
        flavors:
          - 'vb_file'
          - 'vbscript'
          - 'hta_file'
      priority: 5
  'ScanVba':
    - positive:
        flavors:
          - 'mhtml_file'
          - 'application/msword'
          - 'olecf_file'
          - 'wordml_file'
          - 'application/vnd.ms-office'
          - 'application/x-mspublisher'
      priority: 5
      options:
        analyze_macros: True
  'ScanVhd':
    - positive:
        flavors:
          - 'application/x-vhd'
          - 'vhd_file'
          - 'vhdx_file'
      priority: 5
      options:
        limit: 100
  'ScanVsto':
    - positive:
        flavors:
          - 'vsto_file'
      priority: 5
  'ScanX509':
    - positive:
        flavors:
          - 'x509_der_file'
      priority: 5
      options:
        type: 'der'
    - positive:
        flavors:
          - 'x509_pem_file'
      priority: 5
      options:
        type: 'pem'
  'ScanXl4ma':
    - positive:
        flavors:
          - 'excel4_file'
      priority: 5
  'ScanXml':
    - positive:
        flavors:
          - 'application/xml'
          - 'text/xml'
          - 'xml_file'
          - 'mso_file'
          - 'soap_file'
      priority: 5
      options:
        extract_tags:
          - "target"
          - "script"
          - "embeddedfile"
          - "cipherdata"
          - "data"
          - "signedinfo"
          - "encrypteddata"
        metadata_tags:
          - "type"
          - "description"
          - "maintainer"
  'ScanYara':
    - positive:
        flavors:
          - "*"
      priority: 5
      options:
        location: "/etc/strelka/yara/"
        compiled:
          enabled: True
          filename: "rules.compiled"
        category_key: "scope"
        categories:
          collection:
            show_meta: False
          detection:
            show_meta: True
          information:
            show_meta: False
        meta_fields:
          - "author"
          - "description"
          - "hash"
          - "intel"
        show_all_meta: False
        store_offset: True
        offset_meta_key: "StrelkaHexDump"
        offset_padding: 32
  'ScanZip':
    - positive:
        flavors:
          - 'application/java-archive'
          - 'application/zip'
          - 'zip_file'
          - 'application/vnd.openxmlformats-officedocument'
          - 'application/vnd.openxmlformats-officedocument.presentationml.presentation'
          - 'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
          - 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'
          - 'ooxml_file'
      priority: 5
      options:
        limit: 1000
        limit_metadata: True
        size_limit: 250000000
        crack_pws: False
        log_pws: True
        password_file: '/etc/strelka/passwords.dat'
  'ScanZlib':
    - positive:
        flavors:
          - 'application/zlib'
          - 'zlib_file'
      priority: 5