service_manifest.yml

name: ELF
version: $SERVICE_TAG
description: This service analyzes executable Linux files and provides metadata about the file.

# Regex defining the types of files the service accepts and rejects
accepts: executable/linux
rejects: empty|metadata/.*

# At which stage the service should run (one of FILTER, EXTRACT, CORE, SECONDARY, POST, REVIEW)
# NOTE: Stages are executed in the order defined in the list
stage: CORE
# Which category the service is part of (one of Antivirus, Dynamic Analysis, External, Extraction, Filtering, Internet Connected, Networking, Static Analysis)
category: Static Analysis

# Does the service require access to the file to perform its task
# If set to false, the service will only have access to the file metadata (e.g. Hashes, size, type, ...)
file_required: true
# Maximum execution time the service has before it's considered to be timed out
timeout: 60

# is the service enabled by default
enabled: true
privileged: true

heuristics:
  - description: This file looks like an ELF file but fails to load
    filetype: "executable/linux"
    heur_id: 1
    name: Invalid ELF look-alike
    score: 100

  # Supported by https://github.com/viper-framework/viper-modules/blob/00ee6cd2b2ad4ed278279ca9e383e48bc23a2555/elf.py#L447
  # Supported by https://github.com/viper-framework/viper-modules/blob/00ee6cd2b2ad4ed278279ca9e383e48bc23a2555/lief.py#L363
  - description: >-
      This ELF contains at least one section with entropy > 7.5, which
      may indicate packed or encrypted code.
    filetype: "executable/linux"
    heur_id: 2
    name: High section entropy
    score: 100

  - description: Sample contains only a LOAD segment without any section mappings
    filetype: "executable/linux/.*"
    heur_id: 3
    name: LOAD without section mappings
    score: 100

  # Inspired by https://github.com/viper-framework/viper-modules/blob/00ee6cd2b2ad4ed278279ca9e383e48bc23a2555/lief.py#L401
  - description: Lief could not find a dynamic library
    filetype: "executable/linux/.*"
    heur_id: 4
    name: No dynamic library found
    score: 100

  # Inspired by https://github.com/viper-framework/viper-modules/blob/00ee6cd2b2ad4ed278279ca9e383e48bc23a2555/lief.py#L1538
  - description: Lief could not find a dynamic entry
    filetype: "executable/linux/.*"
    heur_id: 5
    name: No dynamic entry found
    score: 100

  # Inspired by https://github.com/viper-framework/viper-modules/blob/00ee6cd2b2ad4ed278279ca9e383e48bc23a2555/lief.py#L1549
  - description: Lief could not find a dynamic symbol
    filetype: "executable/linux/.*"
    heur_id: 6
    name: No dynamic symbol found
    score: 100

  # Inspired by https://github.com/viper-framework/viper-modules/blob/00ee6cd2b2ad4ed278279ca9e383e48bc23a2555/lief.py#L1075
  - description: Lief could not find any relocations
    filetype: "executable/linux/.*"
    heur_id: 7
    name: No relocation found
    score: 100

  # Inspired by https://github.com/viper-framework/viper-modules/blob/00ee6cd2b2ad4ed278279ca9e383e48bc23a2555/lief.py#L426
  - description: Lief could not find any symbols
    filetype: "executable/linux/.*"
    heur_id: 8
    name: No symbol found
    score: 100

docker_config:
  image: ${REGISTRY}cccs/assemblyline-service-elf:$SERVICE_TAG
  cpu_cores: 1.0
  ram_mb: 1024