Skip to content

Instantly share code, notes, and snippets.

@sooshie

sooshie/extract_pe.bro

Created June 25, 2019 15:06
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save sooshie/c782817bc84fec995cae307a447f870a to your computer and use it in GitHub Desktop.
Save sooshie/c782817bc84fec995cae307a447f870a to your computer and use it in GitHub Desktop.
Download ZIP
Extract PE files in Bro/Zeek 2.6.1
Raw
extract_pe.bro
event file_sniff(f: fa_file, meta: fa_metadata)
{
if ( ! meta?$mime_type ) return;
if ( meta$mime_type == "application/x-dosexec" )
{
local fname = fmt("%s-%s.%s", f$source, f$id, "._xe");
Files::add_analyzer(f, Files::ANALYZER_EXTRACT, [$extract_filename=fname]);
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment