ScanIqy

Strelka scanner for extracting URLs from IQY (Excel Web Query Internet Inquire) files.

IQY files are typically used to import data into Excel from the web. They often contain URLs that specify the data source. This scanner aims to extract these URLs and process them for IOCs.

The following is a typical format of an IQY file: WEB 1 [URL] [optional parameters]

Reference for IQY file format: https://learn.microsoft.com/en-us/office/vba/api/excel.querytable

Source code in strelka/src/python/strelka/scanners/scan_iqy.py

class ScanIqy(strelka.Scanner):
    """
    Strelka scanner for extracting URLs from IQY (Excel Web Query Internet Inquire) files.

    IQY files are typically used to import data into Excel from the web. They often contain URLs
    that specify the data source. This scanner aims to extract these URLs and process them for IOCs.

    The following is a typical format of an IQY file:
    WEB
    1
    [URL]
    [optional parameters]

    Reference for IQY file format: https://learn.microsoft.com/en-us/office/vba/api/excel.querytable
    """

    def scan(self, data, file, options, expire_at):
        """
        Processes the provided IQY data to extract URLs.

        Attempts to decode the data and applies a regex pattern to identify and extract URLs.
        Extracted URLs are added to the scanner's IOC list.

        Args:
            data (bytes): Data associated with the IQY file to be scanned.
            file (strelka.File): File object associated with the data.
            options (dict): Options to be applied during the scan.
            expire_at (int): Expiration timestamp for extracted files.
        """
        try:
            # Compile regex pattern for URL detection
            address_pattern = re.compile(
                r"\b(?:http|https|ftp|ftps|file|smb)://\S+|"
                r"\\{2}\w+\\(?:[\w$]+\\)*[\w$]+",
                re.IGNORECASE,
            )

            # Attempt to decode the data
            try:
                decoded_data = data.decode("utf-8")
            except UnicodeDecodeError:
                decoded_data = data.decode("latin-1")

            # Extract addresses from the data
            addresses = set(
                match.group().strip()
                for line in decoded_data.splitlines()
                if (match := address_pattern.search(line))
            )

            # Add extracted URLs to the scanner's IOC list
            if addresses:
                self.event["address_found"] = True
                self.add_iocs(list(addresses))
            else:
                self.event["address_found"] = False

        except UnicodeDecodeError as e:
            self.flags.append(f"Unicode decoding error: {e}")
        except Exception as e:
            self.flags.append(f"Unexpected exception: {e}")

scan(data, file, options, expire_at)

Processes the provided IQY data to extract URLs.

Attempts to decode the data and applies a regex pattern to identify and extract URLs. Extracted URLs are added to the scanner's IOC list.

Parameters:

Name	Type	Description	Default
data	bytes	Data associated with the IQY file to be scanned.	required
file	File	File object associated with the data.	required
options	dict	Options to be applied during the scan.	required
expire_at	int	Expiration timestamp for extracted files.	required

Source code in strelka/src/python/strelka/scanners/scan_iqy.py

def scan(self, data, file, options, expire_at):
    """
    Processes the provided IQY data to extract URLs.

    Attempts to decode the data and applies a regex pattern to identify and extract URLs.
    Extracted URLs are added to the scanner's IOC list.

    Args:
        data (bytes): Data associated with the IQY file to be scanned.
        file (strelka.File): File object associated with the data.
        options (dict): Options to be applied during the scan.
        expire_at (int): Expiration timestamp for extracted files.
    """
    try:
        # Compile regex pattern for URL detection
        address_pattern = re.compile(
            r"\b(?:http|https|ftp|ftps|file|smb)://\S+|"
            r"\\{2}\w+\\(?:[\w$]+\\)*[\w$]+",
            re.IGNORECASE,
        )

        # Attempt to decode the data
        try:
            decoded_data = data.decode("utf-8")
        except UnicodeDecodeError:
            decoded_data = data.decode("latin-1")

        # Extract addresses from the data
        addresses = set(
            match.group().strip()
            for line in decoded_data.splitlines()
            if (match := address_pattern.search(line))
        )

        # Add extracted URLs to the scanner's IOC list
        if addresses:
            self.event["address_found"] = True
            self.add_iocs(list(addresses))
        else:
            self.event["address_found"] = False

    except UnicodeDecodeError as e:
        self.flags.append(f"Unicode decoding error: {e}")
    except Exception as e:
        self.flags.append(f"Unexpected exception: {e}")

Features

The features of this scanner are detailed below. These features represent the capabilities and the type of analysis the scanner can perform. This may include support for Indicators of Compromise (IOC), the ability to emit files for further analysis, and the presence of extended documentation for complex analysis techniques.

Feature	Support
IOC Support
Emit Files
Extended Docs
Malware Scanner
Image Thumbnails

Tastes

Strelka's file distribution system assigns scanners to files based on 'flavors' and 'tastes'. Flavors describe the type of file, typically determined by MIME types from libmagic, matches from YARA rules, or characteristics of parent files. Tastes are the criteria used within Strelka to determine which scanners are applied to which files, with positive and negative tastes defining files to be included or excluded respectively.

Source Filetype	Include / Exclude
iqy_file

Scanner Fields

This section provides a list of fields that are extracted from the files processed by this scanner. These fields include the data elements that the scanner extracts from each file, representing the analytical results produced by the scanner. If the test file is missing or cannot be parsed, this section will not contain any data.

Field Name	Field Type
address_found	bool
elapsed	str
flags	list
iocs	list
iocs.ioc	str
iocs.ioc_type	str
iocs.scanner	str

Sample Event

Below is a sample event generated by this scanner, demonstrating the kind of output that can be expected when it processes a file. This sample is derived from a mock scan event configured in the scanner's test file. If no test file is available, this section will not display a sample event.

    test_scan_event = {
        "elapsed": 0.001,
        "flags": [],
        "address_found": True,
        "iocs": [
            {
                "ioc": "github.com",
                "ioc_type": "domain",
                "scanner": "ScanIqy",
            },
            {
                "ioc": "https://github.com/target/strelka/blob/master/docs/index.html",
                "ioc_type": "url",
                "scanner": "ScanIqy",
            },
        ],
    }