File extraction with executables and archives

file_extract.bro

global ext_map: table[string] of string = {
    ["application/x-dosexec"] = "exe",
    ["application/zip"] = "zip",
    ["application/x-gtar"] = "gzip",
    ["application/x-rar-compressed"] = "rar",
    ["application/x-apple-diskimage"] = "dmg",
    ["application/x-7z-compressed"] = "tz",
    ["application/x-gzip"] = "gz",
    ["application/x-bzip2"] = "bz",
    ["application/x-lzma"] = "lzma",
    ["application/x-tar"] = "tar",
    ["application/x-cpio"] = "cpio",
    ["application/x-shar"] = "shar",
} &default ="";

event file_new(f: fa_file)
    {

    local ext = "";
    if ( f?$mime_type )
        ext = ext_map[f$mime_type];

    local fname = fmt("%s-%s.%s", f$source, f$id, ext);

    # Extract any outbound file
    for ( cx in f?$conns )
        if ( cx?$conn?$local_orig )
            Files::add_analyzer(f, Files::ANALYZER_EXTRACT, [$extract_filename=fname]);


    # Extract any inbound file that hits on interesting types
    if ( f?$mime_type !in ext_map )
        return;

    Files::add_analyzer(f, Files::ANALYZER_EXTRACT, [$extract_filename=fname]);


    }