ScanXl4ma

Strelka scanner for extracting Excel 4 cell contents and IOCs.

This scanner uses the xl4ma analyzer to extract data from Excel files. It attempts to decode Excel 4 cell contents and extract any potential IOCs. Extracted data is added to the scanner's event, and IOCs are processed using the scanner's IOC processing capabilities.

Attributes inherited from strelka.Scanner: - name (str): Name of the scanner class. - key (str): Metadata key used to identify scanner metadata in scan results. - event (dict): Dictionary containing the result of the scan. - flags (list): List of flags raised during scanning. - iocs (list): List of IOCs extracted during scanning.

Source code in strelka/src/python/strelka/scanners/scan_xl4ma.py

class ScanXl4ma(strelka.Scanner):
    """
    Strelka scanner for extracting Excel 4 cell contents and IOCs.

    This scanner uses the xl4ma analyzer to extract data from Excel files.
    It attempts to decode Excel 4 cell contents and extract any potential IOCs.
    Extracted data is added to the scanner's event, and IOCs are processed
    using the scanner's IOC processing capabilities.

    Attributes inherited from strelka.Scanner:
        - name (str): Name of the scanner class.
        - key (str): Metadata key used to identify scanner metadata in scan results.
        - event (dict): Dictionary containing the result of the scan.
        - flags (list): List of flags raised during scanning.
        - iocs (list): List of IOCs extracted during scanning.
    """

    def scan(self, data, file, options, expire_at):
        """
        Overrideable scan method from strelka.Scanner.

        Processes the provided data using the xl4ma analyzer and extracts
        relevant information and IOCs.

        Args:
            data (bytes): Data associated with the file to be scanned.
            file (strelka.File): File object associated with the data.
            options (dict): Options to be applied during the scan.
            expire_at (int): Expiration timestamp for extracted files.
        """
        # Attempt to process Excel data using the xl4ma analyzer
        try:
            # Process Excel data and store the results
            results = analyzer.process_data(data=data, filename=file.name)

            # Check if decoding and IOCs are present in the results
            if "decoded" in results:
                self.event["decoded"] = results["decoded"]
            if "iocs" in results:
                self.event["iocs"] = results["iocs"]
                self.add_iocs(results["iocs"])
        except strelka.ScannerTimeout:
            # Propagate the timeout exception
            raise
        except Exception as e:
            # Append exception message to flags for diagnostic purposes
            self.flags.append(f"xl4ma_processing_exception: {str(e)}")

scan(data, file, options, expire_at)

Overrideable scan method from strelka.Scanner.

Processes the provided data using the xl4ma analyzer and extracts relevant information and IOCs.

Parameters:

Name	Type	Description	Default
data	bytes	Data associated with the file to be scanned.	required
file	File	File object associated with the data.	required
options	dict	Options to be applied during the scan.	required
expire_at	int	Expiration timestamp for extracted files.	required

Source code in strelka/src/python/strelka/scanners/scan_xl4ma.py

def scan(self, data, file, options, expire_at):
    """
    Overrideable scan method from strelka.Scanner.

    Processes the provided data using the xl4ma analyzer and extracts
    relevant information and IOCs.

    Args:
        data (bytes): Data associated with the file to be scanned.
        file (strelka.File): File object associated with the data.
        options (dict): Options to be applied during the scan.
        expire_at (int): Expiration timestamp for extracted files.
    """
    # Attempt to process Excel data using the xl4ma analyzer
    try:
        # Process Excel data and store the results
        results = analyzer.process_data(data=data, filename=file.name)

        # Check if decoding and IOCs are present in the results
        if "decoded" in results:
            self.event["decoded"] = results["decoded"]
        if "iocs" in results:
            self.event["iocs"] = results["iocs"]
            self.add_iocs(results["iocs"])
    except strelka.ScannerTimeout:
        # Propagate the timeout exception
        raise
    except Exception as e:
        # Append exception message to flags for diagnostic purposes
        self.flags.append(f"xl4ma_processing_exception: {str(e)}")

Features

The features of this scanner are detailed below. These features represent the capabilities and the type of analysis the scanner can perform. This may include support for Indicators of Compromise (IOC), the ability to emit files for further analysis, and the presence of extended documentation for complex analysis techniques.

Feature	Support
IOC Support
Emit Files
Extended Docs
Malware Scanner
Image Thumbnails

Tastes

Strelka's file distribution system assigns scanners to files based on 'flavors' and 'tastes'. Flavors describe the type of file, typically determined by MIME types from libmagic, matches from YARA rules, or characteristics of parent files. Tastes are the criteria used within Strelka to determine which scanners are applied to which files, with positive and negative tastes defining files to be included or excluded respectively.

Source Filetype	Include / Exclude
excel4_file

Scanner Fields

This section provides a list of fields that are extracted from the files processed by this scanner. These fields include the data elements that the scanner extracts from each file, representing the analytical results produced by the scanner. If the test file is missing or cannot be parsed, this section will not contain any data.

Field Name	Field Type
decoded	str
elapsed	str
flags	list
iocs	list
iocs.ioc	str
iocs.ioc_type	str
iocs.scanner	str

Sample Event

Below is a sample event generated by this scanner, demonstrating the kind of output that can be expected when it processes a file. This sample is derived from a mock scan event configured in the scanner's test file. If no test file is available, this section will not display a sample event.

    test_scan_event = {
        "elapsed": 0.001,
        "flags": [],
        "decoded": unordered(
            [
                "3",
                "user",
                "clean.xls",
                "None",
                "https://www.example.com/path/to/resource",
            ]
        ),
        "iocs": [
            {"ioc": "www.example.com", "ioc_type": "domain", "scanner": "ScanXl4ma"},
            {
                "ioc": "https://www.example.com/path/to/resource",
                "ioc_type": "url",
                "scanner": "ScanXl4ma",
            },
        ],
    }