service_manifest.yml

name: URLCreator
version: $SERVICE_TAG
description: This Assemblyline service creates URI files for URIs that were extracted by other services with an associated score that is high enough, or if the URI fits a certain set of criteria.

# Regex defining the types of files the service accepts and rejects
accepts: .*
rejects: empty|metadata/.*|uri/.*

# At which stage the service should run (one of FILTER, EXTRACT, CORE, SECONDARY, POST, REVIEW)
# NOTE: Stages are executed in the order defined in the list
stage: POST
# Which category the service is part of (one of Antivirus, Dynamic Analysis, External, Extraction, Filtering, Internet Connected, Networking, Static Analysis)
category: Static Analysis

# Does the service require access to the file to perform its task
# If set to false, the service will only have access to the file metadata (e.g. Hashes, size, type, ...)
file_required: false
# Maximum execution time the service has before it's considered to be timed out
timeout: 60

# is the service enabled by default
enabled: true
uses_tag_scores: true
uses_metadata: true
uses_temp_submission_data: true
privileged: true

submission_params:
  - default: 300
    name: minimum_maliciousness
    value: 300
    type: int

config:
  minimum_maliciousness_limit: 1

heuristics:
  - heur_id: 1
    name: IP-based URL Request
    score: 0
    filetype: .*
    description: Download using a server IP
    # Scoring needs to be evaluated
    signature_score_map:
      ipv4: 0
      ipv6: 0

  - heur_id: 2
    name: High Port Usage
    score: 0
    filetype: .*
    description: URI contains a host with a high port value
    signature_score_map:
      domain: 0
      ip: 0

  - heur_id: 3
    name: Discovery Tool in URI Path
    score: 0
    filetype: .*
    description: URI contains a native OS tool name, presumably used for reconnaissance
    signature_score_map:
      windows: 0
      linux: 0
      recon: 0

  - heur_id: 4
    name: Phishing
    score: 500
    filetype: .*
    description: This IOC seems to be phishing-related

docker_config:
  image: ${REGISTRY}cccs/assemblyline-service-urlcreator:$SERVICE_TAG
  cpu_cores: 0.5
  ram_mb: 512