Extract Indicators From File - Generic v2

This playbook extracts indicators from a file. Supported file types: - CSV - PDF - TXT - HTM, HTML - DOC, DOCX - PPT - PPTX - RTF - XLS - XLSX - XML - XLSM - DOCM - PPTM - DOTM - XLSB - DOT - PPSM - PNG - JPG/JPEG - GIF (when Image OCR is enabled). In addition, the playbook supports QR codes. The playbook does not support encrypted / password-protected files such as XLSB. Such files will be skipped.

Pack

CommonPlaybooks

Tasks

30

Inputs

• File — The file to extract indicators from.
• Decode — Available values: "True" or "False". Default is "False" When this is set to "True", in case a macro was found within the file (using oletools), it will output all the obfuscated strings with their decoded content (Hex, Base64, StrReverse, Dridex, VBA).
• MaxImagesFromPDF — The maximum number of images that can be extracted from a PDF file. We recommend setting a low number if you don't need all images extracted from PDF files. If no value is specified, a default of 20 will be used.

Outputs

• Domain.Name — The extracted domains.
• Account.Email.Address — The extracted email addresses.
• File.MD5 — The extracted MD5 hash.
• File.SHA1 — The extracted SHA1 hash.
• File.SHA256 — The extracted SHA256 hash.
• IP.Address — The extracted IP addresses.
• File.Text — The text or images extracted from the PDF file.
• File.Producer — The PDF file producer.
• File.Title — The title of the PDF file.
• File.xap — The XAP of the PDF file.
• File.Author — The author of the file.
• File.dc — The DC of the file.
• File.xapmm — The XAPMM of the file.
• File.ModDate — The mod date of the file.
• File.CreationDate — The creation date of the file.
• File.Pages — The number of pages in the file.
• URL.Data — The list of URLs that were extracted from the file.
• ExtractedURLsFromFiles — The list of URLs that were extracted from the file. This output is a duplicate of the URL.Data output and it enables parent playbooks to identify the URLs generated by this playbook.
• Oletools.Oleid.ole_command_result — Indicator list from the oleid command.
• Oletools.Oleid.file_name — File name.
• Oletools.Oleid.sha256 — SHA256 hash.
• Oletools.Oleid.ole_command_result.File_format — Indicator file format.
• Oletools.Oleid.ole_command_result.Container_format — Indicator container format.
• Oletools.Oleid.ole_command_result.Encrypted — Indicator encrypted.
• Oletools.Oleid.ole_command_result.VBA_Macros — Indicator VBA macros.
• Oletools.Oleid.ole_command_result.XLM_Macros — Indicator XLM macros.
• Oletools.Oleid.ole_command_result.External_Relationships — Indicator external relationships.
• Oletools.Oleid.ole_command_result.ObjectPool — Indicator object pool.
• Oletools.Oleid.ole_command_result.Flash_objects — Indicator flash objects.
• Oletools.Oleid.ole_command_result.File_format.Value — Indicator file format value.
• Oletools.Oleid.ole_command_result.File_format.Ole_Risk — Indicator file format OLE risk.
• Oletools.Oleid.ole_command_result.File_format.Description — Indicator file format description.
• Oletools.Oleid.ole_command_result.Container_format.Value — Indicator container format value.
• Oletools.Oleid.ole_command_result.Container_format.Ole_Risk — Indicator container format OLE risk.
• Oletools.Oleid.ole_command_result.Container_format.Description — Indicator container format description.
• Oletools.Oleid.ole_command_result.Encrypted.Value — Indicator encrypted value.
• Oletools.Oleid.ole_command_result.Encrypted.Ole_Risk — Indicator encrypted OLE risk.
• Oletools.Oleid.ole_command_result.Encrypted.Description — Indicator encrypted description.
• Oletools.Oleid.ole_command_result.VBA_Macros.Value — Indicator VBA macros value.
• Oletools.Oleid.ole_command_result.VBA_Macros.Ole_Risk — Indicator VBA macros OLE risk.
• Oletools.Oleid.ole_command_result.VBA_Macros.Description — Indicator VBA macros description.
• Oletools.Oleid.ole_command_result.XLM_Macros.Value — Indicator XLM macros value.
• Oletools.Oleid.ole_command_result.XLM_Macros.Ole_Risk — Indicator XLM macros OLE risk.
• Oletools.Oleid.ole_command_result.XLM_Macros.Description — Indicator XLM macros description.
• Oletools.Oleid.ole_command_result.External_Relationships.Value — Indicator XLM macros value.
• Oletools.Oleid.ole_command_result.External_Relationships.Ole_Risk — Indicator XLM macros OLE risk.
• Oletools.Oleid.ole_command_result.External_Relationships.Description — Indicator XLM macros description.
• Oletools.Oleid.ole_command_result.ObjectPool.Value — Indicator object pool value.
• Oletools.Oleid.ole_command_result.ObjectPool.Ole_Risk — Indicator object pool OLE risk.
• Oletools.Oleid.ole_command_result.ObjectPool.Description — Indicator object pool description.
• Oletools.Oleid.ole_command_result.Flash_objects.Value — Indicator Flash objects value.
• Oletools.Oleid.ole_command_result.Flash_objects.Ole_Risk — Indicator Flash objects OLE risk.
• Oletools.Oleid.ole_command_result.Flash_objects.Description — Indicator Flash objects description.
• Oletools.Oleobj.ole_command_result.hyperlinks — List of hyperlinks.
• Oletools.Oleobj.file_name — File name.
• Oletools.Oleobj.sha256 — SHA256 hash.
• Oletools.Olevba.file_name — File name.
• Oletools.Olevba.sha256 — SHA256 hash.
• Oletools.Olevba.ole_command_result.macro_analyze — Macro analyze.
• Oletools.Olevba.ole_command_result.macro_src_code — Macro source code.
• Oletools.Olevba.ole_command_result.macro_list — Macro list.
• DBotScore.Indicator — The indicator that was tested.
• DBotScore.Type — The indicator type.
• DBotScore.Vendor — The vendor used to calculate the score.
• DBotScore.Score — The actual score.
• QRCodeReader — The QR code reader primary key object.
• QRCodeReader.Text — The raw text extracted from the QR code image.
• QRCodeReader.Domain — The domains extracted from the QR code image if they are present.
• QRCodeReader.URL — The URLs extracted from the QR code image if they are present.
• QRCodeReader.IP — The IPs extracted from the QR code image if they are present.
• ExtractedHyperLink — Extracted hyperlinks from supported Office documents (xlsx,docx,pptx).
• ExtractedHyperLink.URL — The URL of the extracted hyperlink.
• ExtractedHyperLink.FileName — The Office file from which the hyperlinks are extracted.

Commands used

• image-ocr-extract-text
• rasterize-pdf