karton-classifier 2.0.0

File type classifier for Karton framework

Classifier karton service

File type classifier for the Karton framework.

Entrypoint for samples. Classifies type of samples labeled as kind: raw, which makes them available for subsystems that receive samples with specific type only (e.g. raw => runnable:win32:exe)

Author: CERT.pl

Maintainers: psrok1, msm, nazywam

Consumes:

{
    "type": "sample",
    "kind": "raw"
    "payload": {
        "magic":  "output from 'file' command",
        "sample": <Resource>
    }
} 

Produces:

{
    "type":      "sample",
    "stage":     "recognized",
    "kind":      "runnable"  # Executable format default for OS platform
              || "document"  # Office document
              || "archive"   # Archive containing samples (zip, e-mails)
              || "dump"      # Dump from sandbox
              || "script",   # Script (js/vbs/bat...)
              || "misc",     # No platform or extension
    "platform":  "win32" 
              || "win64" 
              || "linux" 
              || "android",
              || "macos",
              || "freebsd",
              || "netbsd",
              || "openbsd",
              || "solaris",
    "extension": "*",        # Expected file extension
    "mime": "*",        # Expected file mimetype
    ... (other fields are derived from incoming task)
}

Warning the output mime field is not deterministic across libmagic versions and can change depending on the version you're using. We don't recommend creating consumers that listen on it directly.

Usage

First of all, make sure you have setup the core system: https://github.com/CERT-Polska/karton

Then install karton-classifier from PyPi:

$ pip install karton-classifier

$ karton-classifier