id: Extract Indicators From File - Generic v2 version: -1 name: Extract Indicators From File - Generic v2 description: |- This playbook extracts indicators from a file. Supported file types: - CSV - PDF - TXT - HTM, HTML - DOC, DOCX - PPT - PPTX - RTF - XLS - XLSX - XML - XLSM - DOCM - PPTM - DOTM - XLSB - DOT - PPSM - PNG - JPG/JPEG - GIF (when Image OCR is enabled). In addition, the playbook supports QR codes. The playbook does not support encrypted / password-protected files such as XLSB. Such files will be skipped. starttaskid: "0" tasks: "0": id: "0" taskid: 19112ab0-6176-49fc-83c5-b0d3b14eafe7 type: start task: id: 19112ab0-6176-49fc-83c5-b0d3b14eafe7 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "1" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 915, "y": -10 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "1": id: "1" taskid: 27e3a138-4521-475e-ab6e-d2fa5278a561 type: condition task: id: 27e3a138-4521-475e-ab6e-d2fa5278a561 version: -1 name: Is there a file? description: | Checks if there is a file in the playbook input. type: condition iscommand: false brand: "" nexttasks: '#default#': - "10" "yes": - "4" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: inputs.File accessor: EntryID iscontext: true continueonerrortype: "" view: |- { "position": { "x": 915, "y": 120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "3": id: "3" taskid: 463760b9-550a-4dea-8a06-42354107dc49 type: title task: id: 463760b9-550a-4dea-8a06-42354107dc49 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 915, "y": 1826 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "4": id: "4" taskid: 832f6312-844f-43ce-8c6b-ce6e3feb0ada type: title task: id: 832f6312-844f-43ce-8c6b-ce6e3feb0ada version: -1 name: Extract Indicators From Files type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "5" - "7" - "9" - "15" - "20" - "21" - "23" - "26" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 915, "y": 295 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: 615974ba-0088-4aed-92bf-80613b251d49 type: condition task: id: 615974ba-0088-4aed-92bf-80613b251d49 version: -1 name: Is there a text-based file? description: Checks if there is a text-based file in context. Skips MSG and EML files. type: condition iscommand: false brand: "" nexttasks: '#default#': - "10" "yes": - "6" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: inputs.File filters: - - operator: containsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: ASCII text ignorecase: true - operator: containsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: Rich Text Format - operator: containsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: UTF-8 Unicode text - operator: containsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: JSON data ignorecase: true - operator: containsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: CSV text ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: csv ignorecase: true - - operator: notContainsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: news or mail - - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: eml - - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: msg - - operator: notContainsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: Composite Document File V2 Document, No summary info - - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: text/rtf ignorecase: true - - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: rtf ignorecase: true - - operator: notContainsGeneral left: value: simple: inputs.File.Info iscontext: true right: value: simple: xml ignorecase: true - - operator: notContainsGeneral left: value: simple: inputs.File.Type iscontext: true right: value: simple: text/rtf ignorecase: true - - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: message/rfc822 - - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: p7m accessor: EntryID transformers: - operator: uniq iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 112.5, "y": 460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: f2241e90-214f-4661-a5ea-0cc6769773bc type: regular task: id: f2241e90-214f-4661-a5ea-0cc6769773bc version: -1 name: Extract indicators from text-based file description: Extracts indicators from text-based files. scriptName: ExtractIndicatorsFromTextFile type: regular iscommand: false brand: "" nexttasks: '#none#': - "19" scriptarguments: entryID: complex: root: inputs.File filters: - - operator: containsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: ASCII text ignorecase: true - operator: containsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: Rich Text Format - operator: containsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: UTF-8 Unicode - operator: containsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: JSON data ignorecase: true - operator: containsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: CSV text ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: csv ignorecase: true - - operator: notContainsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: news - operator: notContainsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: mail - - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: eml - - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: msg - - operator: notContainsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: Composite Document File V2 Document, No summary info - - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: text/rtf ignorecase: true - - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: rtf ignorecase: true - - operator: notContainsGeneral left: value: simple: inputs.File.Info iscontext: true right: value: simple: xml ignorecase: true - - operator: notContainsGeneral left: value: simple: inputs.File.Type iscontext: true right: value: simple: text/rtf ignorecase: true - - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: message/rfc822 accessor: EntryID transformers: - operator: uniq reputationcalc: 2 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 112.5, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: fe9aa9e7-8981-4594-b9a4-b7a4225a12fa type: condition task: id: fe9aa9e7-8981-4594-b9a4-b7a4225a12fa version: -1 name: Is there a PDF file? description: Checks if there is a PDF file in context. type: condition iscommand: false brand: "" nexttasks: '#default#': - "10" "yes": - "29" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: inputs.File filters: - - operator: containsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: pdf ignorecase: true - - operator: containsString left: value: simple: inputs.File.Info iscontext: true right: value: simple: pdf ignorecase: true accessor: EntryID transformers: - operator: uniq iscontext: true right: value: {} ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 1320, "y": 460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "9": id: "9" taskid: b61b2d2d-526f-4d64-8bcc-46a45a3da866 type: condition task: id: b61b2d2d-526f-4d64-8bcc-46a45a3da866 version: -1 name: Is there a Word file? description: Checks if there is a Word file (DOC, DOCX) in context. type: condition iscommand: false brand: "" nexttasks: '#default#': - "10" "yes": - "11" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: inputs.File filters: - - operator: containsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: Composite Document File V2 Document - operator: containsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: Microsoft Word - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: docx ignorecase: true - operator: containsString left: value: simple: inputs.File.Info iscontext: true right: value: simple: CDFV2 - - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: msg ignorecase: true - - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: eml ignorecase: true - - operator: isNotExists left: value: simple: inputs.File.Extension iscontext: true - operator: isNotEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: xls ignorecase: true - - operator: isNotExists left: value: simple: inputs.File.Extension iscontext: true - operator: isNotEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: xlsx ignorecase: true - - operator: isNotExists left: value: simple: inputs.File.Type iscontext: true - operator: notContainsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: Excel ignorecase: true - - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: ppt ignorecase: true - - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: pptx ignorecase: true - - operator: isNotExists left: value: simple: inputs.File.Extension iscontext: true - operator: isNotEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: xlsb - - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: xlsb - - operator: isNotExists left: value: simple: inputs.File.Extension iscontext: true - operator: isNotEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: xlsm - - operator: isNotExists left: value: simple: inputs.File.Extension iscontext: true - operator: isNotEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: docm - - operator: isNotExists left: value: simple: inputs.File.Extension iscontext: true - operator: isNotEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: oft ignorecase: true - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: oft ignorecase: true - - operator: notContainsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: Encrypted accessor: EntryID transformers: - operator: uniq iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 510, "y": 460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "10": id: "10" taskid: 3e880c19-d946-4cca-8dd4-fabe023b5f27 type: title task: id: 3e880c19-d946-4cca-8dd4-fabe023b5f27 version: -1 name: No File To Parse type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "19" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -975, "y": 735 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: cce17910-c4c9-4c71-862c-9a55cbeca170 type: regular task: id: cce17910-c4c9-4c71-862c-9a55cbeca170 version: -1 name: Extract indicators from Word file description: Extracts indicators from word files (DOC, DOCX). scriptName: ExtractIndicatorsFromWordFile type: regular iscommand: false brand: "" nexttasks: '#none#': - "19" scriptarguments: entryID: complex: root: inputs.File filters: - - operator: containsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: Composite Document File V2 Document - operator: containsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: Microsoft Word - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: docx ignorecase: true - operator: containsString left: value: simple: inputs.File.Info iscontext: true right: value: simple: CDFV2 ignorecase: true - - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: msg ignorecase: true - - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: eml ignorecase: true - - operator: isNotExists left: value: simple: inputs.File.Extension iscontext: true - operator: isNotEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: xls ignorecase: true - - operator: isNotExists left: value: simple: inputs.File.Extension iscontext: true - operator: isNotEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: xlsx ignorecase: true - - operator: isNotExists left: value: simple: inputs.File.Type iscontext: true - operator: notContainsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: Excel ignorecase: true - - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: ppt ignorecase: true - - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: pptx - - operator: isNotExists left: value: simple: inputs.File.Extension iscontext: true - operator: isNotEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: xlsm - - operator: isNotExists left: value: simple: inputs.File.Extension iscontext: true - operator: isNotEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: oft ignorecase: true - operator: isNotEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: oft ignorecase: true - - operator: notContainsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: Encrypted - - operator: isNotExists left: value: simple: inputs.File.Extension iscontext: true - operator: isNotEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: xlsb - - operator: isNotExists left: value: simple: inputs.File.Extension iscontext: true - operator: isNotEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: docm accessor: EntryID transformers: - operator: uniq reputationcalc: 2 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 510, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "13": id: "13" taskid: 13a4204e-43c3-4c7d-8331-5048057a0ab2 type: condition task: id: 13a4204e-43c3-4c7d-8331-5048057a0ab2 version: -1 name: Is Image OCR enabled? description: Checks whether there is an active instance of the Image OCR integration. enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "19" "yes": - "14" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: brand iscontext: true right: value: simple: Image OCR iscontext: true continueonerrortype: "" view: |- { "position": { "x": 2809, "y": 718 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: 5fe1445f-0d84-48e8-84b5-265e777b594f type: regular task: id: 5fe1445f-0d84-48e8-84b5-265e777b594f version: -1 name: Extract text from images description: Extracts text from PNG, JPEG, and GIF image files, and uses auto-extract to get reputation for indicators. script: '|||image-ocr-extract-text' type: regular iscommand: true brand: "" nexttasks: '#none#': - "19" scriptarguments: entryid: complex: root: inputs.File filters: - - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: image/png ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: image/jpg ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: image/jpeg ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: image/gif ignorecase: true accessor: EntryID transformers: - operator: uniq reputationcalc: 2 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2778, "y": 1099 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "15": id: "15" taskid: a7ba5b59-d995-4fcd-8454-668c7047028c type: condition task: id: a7ba5b59-d995-4fcd-8454-668c7047028c version: -1 name: Is there another supported document type? description: |- Checks if one of the following file types exists: - PPT - PPTX - RTF - XLS - XLSX - XML type: condition iscommand: false brand: "" nexttasks: '#default#': - "10" "yes": - "16" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: inputs.File filters: - - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: ppt ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: pptx ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: rtf ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: xls ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: xlsx ignorecase: true - operator: containsGeneral left: value: simple: inputs.File.Info iscontext: true right: value: simple: xml ignorecase: true - operator: containsGeneral left: value: simple: inputs.File.Info iscontext: true right: value: simple: vnd.ms-powerpoint ignorecase: true - operator: containsGeneral left: value: simple: inputs.File.Info iscontext: true right: value: simple: vnd.ms-excel ignorecase: true - operator: containsGeneral left: value: simple: inputs.File.Info iscontext: true right: value: simple: text/rtf ignorecase: true - - operator: isNotExists left: value: simple: inputs.File.Extension iscontext: true - operator: isNotEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: xlsb ignorecase: true - - operator: notContainsGeneral left: value: simple: inputs.File.Type iscontext: true right: value: simple: CDFV2 Encrypted ignorecase: true - - operator: isNotExists left: value: simple: inputs.File.Extension iscontext: true - operator: isNotEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: docx - - operator: isNotExists left: value: simple: inputs.File.Extension iscontext: true - operator: isNotEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: doc accessor: EntryID transformers: - operator: uniq iscontext: true ignorecase: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 1740, "y": 460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "16": id: "16" taskid: 80811529-61cb-4b0c-8000-e31cd312fdda type: regular task: id: 80811529-61cb-4b0c-8000-e31cd312fdda version: -1 name: Convert a document to PDF description: |- Converts the following formats to PDF format: - PPT - PPTX - RTF - XLS - XLSX - XML scriptName: ConvertFile type: regular iscommand: false brand: "" nexttasks: '#none#': - "32" scriptarguments: all_files: simple: "yes" entry_id: complex: root: inputs.File filters: - - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: ppt ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: pptx ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: rtf ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: xls ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: xlsx ignorecase: true - operator: containsGeneral left: value: simple: inputs.File.Info iscontext: true right: value: simple: xml ignorecase: true - operator: containsGeneral left: value: simple: inputs.File.Info iscontext: true right: value: simple: vnd.ms-powerpoint ignorecase: true - operator: containsGeneral left: value: simple: inputs.File.Info iscontext: true right: value: simple: vnd.ms-excel ignorecase: true - operator: containsGeneral left: value: simple: inputs.File.Info iscontext: true right: value: simple: text/rtf ignorecase: true - - operator: isNotExists left: value: simple: inputs.File.Extension iscontext: true - operator: isNotEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: xlsb ignorecase: true - - operator: isNotExists left: value: simple: inputs.File.Extension iscontext: true - operator: isNotEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: docx - - operator: isNotExists left: value: simple: inputs.File.Extension iscontext: true - operator: isNotEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: doc - - operator: notContainsGeneral left: value: simple: inputs.File.Type iscontext: true right: value: simple: CDFV2 Encrypted ignorecase: true accessor: EntryID transformers: - operator: uniq ignore-outputs: simple: "false" reputationcalc: 2 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1740, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "19": id: "19" taskid: 7f90c4cc-3035-4244-8785-360f594ddc62 type: regular task: id: 7f90c4cc-3035-4244-8785-360f594ddc62 version: -1 name: Set ExtractedURLsFromFiles description: |- Extracts URLs from files and stores them under the "ExtractedURLsFromFiles" key in the playbook output. Parent playbooks can use this key to indicate which URLs were extracted. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "3" scriptarguments: key: simple: ExtractedURLsFromFiles value: complex: root: URL accessor: Data transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 915, "y": 1690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "20": id: "20" taskid: 7ce286a8-d86f-42f4-8e36-426f4753740c type: playbook task: id: 7ce286a8-d86f-42f4-8e36-426f4753740c version: -1 name: Microsoft Office File Enrichment - Oletools description: |- Oletools is a tool for analyzing Microsoft OLE2 files, such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics, and debugging. This playbook will run run the "oleid" command on the files which are passed to to it as playbook inputs. In case any macros or external relationships were found, it will also run "olevba" and "oleobj" commands as well on the relevant files. oleid - Analyze OLE files to detect specific characteristics usually found in malicious files. oleobj - Extract embedded objects from OLE files. olevba - Extract and analyze VBA Macro source code from MS Office documents (OLE and OpenXML). playbookName: Microsoft Office File Enrichment - Oletools type: playbook iscommand: false brand: "" nexttasks: '#none#': - "19" scriptarguments: Decode: complex: root: inputs.Decode FileObject: complex: root: inputs.File filters: - - operator: isNotEmpty left: value: simple: inputs.File.EntryID iscontext: true separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": -730, "y": 460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "21": id: "21" taskid: 6515f21b-9e06-4b53-8b76-4ade7d43e829 type: condition task: id: 6515f21b-9e06-4b53-8b76-4ade7d43e829 version: -1 name: Is there an image file? description: |- Checks if the uploaded file is a valid image file. type: condition iscommand: false brand: "" nexttasks: '#default#': - "10" "yes": - "13" - "28" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.File filters: - - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: image/png ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: image/jpg ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: image/jpeg ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: image/gif ignorecase: true transformers: - operator: uniq iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 2397, "y": 460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "22": id: "22" taskid: 23e84751-1ddc-46b8-85dd-043b3252e940 type: regular task: id: 23e84751-1ddc-46b8-85dd-043b3252e940 version: -1 name: Extract indicators from docx file description: Extracts indicators from word files (DOC, DOCX). scriptName: ExtractIndicatorsFromWordFile type: regular iscommand: false brand: "" nexttasks: '#none#': - "19" scriptarguments: entryID: complex: root: inputs.File filters: - - operator: containsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: Zip archive data ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Type iscontext: true right: value: simple: Microsoft Excel 2007+ ignorecase: true - - operator: isEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: docx ignorecase: true accessor: EntryID transformers: - operator: uniq reputationcalc: 2 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 915, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "23": id: "23" taskid: 07993c36-28e2-46b3-8816-e580ba1ae505 type: condition task: id: 07993c36-28e2-46b3-8816-e580ba1ae505 version: -1 name: Is there a Word docx file? description: Checks if there is a Word file (DOC, DOCX) in context. type: condition iscommand: false brand: "" nexttasks: '#default#': - "10" "yes": - "22" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: inputs.File filters: - - operator: containsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: Zip archive data ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Type iscontext: true right: value: simple: Microsoft Excel 2007+ ignorecase: true - - operator: isEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: docx ignorecase: true accessor: EntryID transformers: - operator: uniq iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 915, "y": 460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "24": id: "24" taskid: e80f3f02-7c8b-4cde-8456-79145e049569 type: regular task: id: e80f3f02-7c8b-4cde-8456-79145e049569 version: -1 name: Extract Text from QR Code description: Extracts the text from a QR code. The output of this script includes the output of the script "extractIndicators" run on the text extracted from the QR code. scriptName: ReadQRCode type: regular iscommand: false brand: "" nexttasks: '#none#': - "19" scriptarguments: entry_id: complex: root: inputs.File filters: - - operator: containsGeneral left: value: simple: inputs.File.Info iscontext: true right: value: simple: image/png ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: image/jpeg - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: image/jpg accessor: EntryID transformers: - operator: append args: item: value: simple: InfoFile.EntryID iscontext: true - operator: uniq - operator: RemoveEmpty args: empty_values: {} remove_keys: value: simple: "true" reputationcalc: 2 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1606, "y": 1540 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "25": id: "25" taskid: 1c5f93e5-dd4c-46bf-8f76-ae594a83a90d type: regular task: id: 1c5f93e5-dd4c-46bf-8f76-ae594a83a90d version: -1 name: Convert PDF to Image description: Converts a PDF file to an image file. script: '|||rasterize-pdf' type: regular iscommand: true brand: "" nexttasks: '#none#': - "24" scriptarguments: EntryID: complex: root: ValidPDFEntryIDs transformers: - operator: AppendIfNotEmpty args: item: value: simple: AdditionalPDFs iscontext: true raw: {} - operator: uniq - operator: RemoveEmpty args: empty_values: {} remove_keys: value: simple: "true" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1606, "y": 1404 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "26": id: "26" taskid: 53db3653-4ebd-46c3-84e2-2a029bb9561c type: condition task: id: 53db3653-4ebd-46c3-84e2-2a029bb9561c version: -1 name: Is there a PPTX/XSLX file? description: Checks if there is a PowerPoint or Excel file (PPTX/XSLX) in context. type: condition iscommand: false brand: "" nexttasks: '#default#': - "10" "yes": - "27" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: inputs.File filters: - - operator: isEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: xlsx ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: pptx ignorecase: true - - operator: containsGeneral left: value: simple: inputs.File.Type iscontext: true right: value: simple: Zip archive data ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Type iscontext: true right: value: simple: Microsoft PowerPoint 2007+ ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Type iscontext: true right: value: simple: Microsoft Excel 2007+ ignorecase: true accessor: EntryID transformers: - operator: uniq iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": -300, "y": 460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: 629dd9a1-1eb5-42f1-8846-faf65be915f9 type: regular task: id: 629dd9a1-1eb5-42f1-8846-faf65be915f9 version: -1 name: Extract Hyper-Links from Office Files description: 'Extracts hyperlinks from Office files. Supported file types are: xlsx, docx, pptx.' scriptName: ExtractHyperlinksFromOfficeFiles type: regular iscommand: false brand: "" nexttasks: '#none#': - "19" scriptarguments: entry_id: complex: root: inputs.File filters: - - operator: isEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: xlsx ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Extension iscontext: true right: value: simple: pptx ignorecase: true - - operator: containsGeneral left: value: simple: inputs.File.Type iscontext: true right: value: simple: Zip archive data ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Type iscontext: true right: value: simple: Microsoft PowerPoint 2007+ ignorecase: true - operator: isEqualString left: value: simple: inputs.File.Type iscontext: true right: value: simple: Microsoft Excel 2007+ ignorecase: true accessor: EntryID transformers: - operator: uniq reputationcalc: 2 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -300, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "28": id: "28" taskid: 8cae1b0c-df86-4070-83bc-2108b2fb3281 type: condition task: id: 8cae1b0c-df86-4070-83bc-2108b2fb3281 version: -1 name: Does ReadQRCode support the image? description: Check if the image type is supported by the ReadQRCode script. type: condition iscommand: false brand: "" nexttasks: '#default#': - "19" "yes": - "24" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: image/png - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: image/jpeg - operator: isEqualString left: value: simple: inputs.File.Info iscontext: true right: value: simple: image/jpg continueonerrortype: "" view: |- { "position": { "x": 2398, "y": 860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: f3ab8c1c-f06f-4e23-8fb8-92d02cbee65a type: regular task: id: f3ab8c1c-f06f-4e23-8fb8-92d02cbee65a version: -1 name: Check validity of PDF files description: Returns wether a PDF is both valid and encrypted. scriptName: CheckPDFEncryptionAndValidity type: regular iscommand: false brand: "" nexttasks: '#none#': - "30" scriptarguments: EntryID: complex: root: inputs.File filters: - - operator: containsString left: value: simple: inputs.File.Type iscontext: true right: value: simple: pdf ignorecase: true - - operator: containsString left: value: simple: inputs.File.Info iscontext: true right: value: simple: pdf ignorecase: true accessor: EntryID transformers: - operator: uniq extend-context: simple: CheckedPDFs= ignore-outputs: simple: "true" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1320, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "30": id: "30" taskid: 544e230f-6df0-46c2-8d9d-e4535594f5b4 type: condition task: id: 544e230f-6df0-46c2-8d9d-e4535594f5b4 version: -1 name: Any readable PDF files? description: Checks if there are valid, non-encrypted PDFs. type: condition iscommand: false brand: "" nexttasks: '#default#': - "19" "yes": - "33" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: CheckedPDFs filters: - - operator: isTrue left: value: simple: CheckedPDFs.IsValid iscontext: true - - operator: isFalse left: value: simple: CheckedPDFs.IsEncrypted iscontext: true ignorecase: true accessor: EntryID transformers: - operator: uniq iscontext: true right: value: {} ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 1320, "y": 870 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "31": id: "31" taskid: 5ff6052a-4a53-49d0-8471-508a5e27af03 type: regular task: id: 5ff6052a-4a53-49d0-8471-508a5e27af03 version: -1 name: Extract indicators from PDF files description: Load a PDF file's content and metadata into context. scriptName: ReadPDFFileV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "25" scriptarguments: entryID: complex: root: ValidPDFEntryIDs transformers: - operator: AppendIfNotEmpty args: item: value: simple: AdditionalPDFs iscontext: true raw: {} - operator: uniq maxImages: complex: root: inputs.MaxImagesFromPDF reputationcalc: 2 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1606, "y": 1275 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "32": id: "32" taskid: 5b9ddd9d-143f-47fc-8cf8-0249889f1532 type: regular task: id: 5b9ddd9d-143f-47fc-8cf8-0249889f1532 version: -1 name: Save converted PDFs separately description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script" scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "34" scriptarguments: key: simple: AdditionalPDFs value: complex: root: File filters: - - operator: in left: value: simple: File.SHA256 iscontext: true right: value: simple: ConvertedFile.FileSHA256 iscontext: true accessor: EntryID transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1740, "y": 860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "33": id: "33" taskid: 82c30ea3-4fbc-42dc-852b-0bda54ef1315 type: regular task: id: 82c30ea3-4fbc-42dc-852b-0bda54ef1315 version: -1 name: Save valid PDFs separately description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script" scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "34" scriptarguments: key: simple: ValidPDFEntryIDs value: complex: root: CheckedPDFs filters: - - operator: isTrue left: value: simple: CheckedPDFs.IsValid iscontext: true - - operator: isFalse left: value: simple: CheckedPDFs.IsEncrypted iscontext: true accessor: EntryID transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1320, "y": 1013 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "34": id: "34" taskid: 54c92f03-3cc6-4742-b121-8694a35255b2 type: condition task: id: 54c92f03-3cc6-4742-b121-8694a35255b2 version: -1 name: Assert there are pdf files to extract from description: Checks whether there are any PDF files to process type: condition iscommand: false brand: "" nexttasks: '#default#': - "19" "yes": - "31" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: ValidPDFEntryIDs transformers: - operator: AppendIfNotEmpty args: item: value: simple: AdditionalPDFs iscontext: true raw: {} iscontext: true continueonerrortype: "" view: |- { "position": { "x": 1606, "y": 1149 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "13_19_#default#": 0.11, "15_10_#default#": 0.11, "15_16_yes": 0.38, "1_10_#default#": 0.17, "21_10_#default#": 0.1, "23_10_#default#": 0.14, "23_22_yes": 0.43, "28_24_yes": 0.88, "34_19_#default#": 0.42, "5_10_#default#": 0.33, "5_6_yes": 0.36, "7_10_#default#": 0.1, "9_10_#default#": 0.18, "9_11_yes": 0.35 }, "paper": { "dimensions": { "height": 1896, "width": 4165, "x": -975, "y": -10 } } } inputs: - key: File value: complex: root: File required: false description: The file to extract indicators from. playbookInputQuery: - key: "" value: {} required: false description: "" playbookInputQuery: query: "" queryEntity: indicators results: daterange: fromdate: 0001-01-01T00:00:00Z todate: 0001-01-01T00:00:00Z period: by: "" byto: "" byfrom: "" tovalue: fromvalue: field: "" fromdatelicenseval: 0001-01-01T00:00:00Z runFromLastJobTime: true - key: Decode value: simple: "False" required: false description: |- Available values: "True" or "False". Default is "False" When this is set to "True", in case a macro was found within the file (using oletools), it will output all the obfuscated strings with their decoded content (Hex, Base64, StrReverse, Dridex, VBA). playbookInputQuery: - key: MaxImagesFromPDF value: simple: "10" required: false description: |- The maximum number of images that can be extracted from a PDF file. We recommend setting a low number if you don't need all images extracted from PDF files. If no value is specified, a default of 20 will be used. playbookInputQuery: outputs: - contextPath: Domain.Name description: The extracted domains. type: string - contextPath: Account.Email.Address description: The extracted email addresses. type: string - contextPath: File.MD5 description: The extracted MD5 hash. type: string - contextPath: File.SHA1 description: The extracted SHA1 hash. type: string - contextPath: File.SHA256 description: The extracted SHA256 hash. type: string - contextPath: IP.Address description: The extracted IP addresses. type: string - contextPath: File.Text description: The text or images extracted from the PDF file. type: string - contextPath: File.Producer description: The PDF file producer. type: string - contextPath: File.Title description: The title of the PDF file. type: string - contextPath: File.xap description: The XAP of the PDF file. type: string - contextPath: File.Author description: The author of the file. type: string - contextPath: File.dc description: The DC of the file. type: string - contextPath: File.xapmm description: The XAPMM of the file. type: string - contextPath: File.ModDate description: The mod date of the file. type: string - contextPath: File.CreationDate description: The creation date of the file. type: string - contextPath: File.Pages description: The number of pages in the file. type: string - contextPath: URL.Data description: The list of URLs that were extracted from the file. type: string - contextPath: ExtractedURLsFromFiles description: The list of URLs that were extracted from the file. This output is a duplicate of the URL.Data output and it enables parent playbooks to identify the URLs generated by this playbook. type: String - contextPath: Oletools.Oleid.ole_command_result description: Indicator list from the oleid command. type: string - contextPath: Oletools.Oleid.file_name description: File name. type: string - contextPath: Oletools.Oleid.sha256 description: SHA256 hash. type: string - contextPath: Oletools.Oleid.ole_command_result.File_format description: Indicator file format. type: string - contextPath: Oletools.Oleid.ole_command_result.Container_format description: Indicator container format. type: string - contextPath: Oletools.Oleid.ole_command_result.Encrypted description: Indicator encrypted. type: string - contextPath: Oletools.Oleid.ole_command_result.VBA_Macros description: Indicator VBA macros. type: string - contextPath: Oletools.Oleid.ole_command_result.XLM_Macros description: Indicator XLM macros. type: string - contextPath: Oletools.Oleid.ole_command_result.External_Relationships description: Indicator external relationships. type: string - contextPath: Oletools.Oleid.ole_command_result.ObjectPool description: Indicator object pool. type: string - contextPath: Oletools.Oleid.ole_command_result.Flash_objects description: Indicator flash objects. type: string - contextPath: Oletools.Oleid.ole_command_result.File_format.Value description: Indicator file format value. type: string - contextPath: Oletools.Oleid.ole_command_result.File_format.Ole_Risk description: Indicator file format OLE risk. type: string - contextPath: Oletools.Oleid.ole_command_result.File_format.Description description: Indicator file format description. type: string - contextPath: Oletools.Oleid.ole_command_result.Container_format.Value description: Indicator container format value. type: string - contextPath: Oletools.Oleid.ole_command_result.Container_format.Ole_Risk description: Indicator container format OLE risk. type: string - contextPath: Oletools.Oleid.ole_command_result.Container_format.Description description: Indicator container format description. type: string - contextPath: Oletools.Oleid.ole_command_result.Encrypted.Value description: Indicator encrypted value. type: string - contextPath: Oletools.Oleid.ole_command_result.Encrypted.Ole_Risk description: Indicator encrypted OLE risk. type: string - contextPath: Oletools.Oleid.ole_command_result.Encrypted.Description description: Indicator encrypted description. type: string - contextPath: Oletools.Oleid.ole_command_result.VBA_Macros.Value description: Indicator VBA macros value. type: string - contextPath: Oletools.Oleid.ole_command_result.VBA_Macros.Ole_Risk description: Indicator VBA macros OLE risk. type: string - contextPath: Oletools.Oleid.ole_command_result.VBA_Macros.Description description: Indicator VBA macros description. type: string - contextPath: Oletools.Oleid.ole_command_result.XLM_Macros.Value description: Indicator XLM macros value. type: string - contextPath: Oletools.Oleid.ole_command_result.XLM_Macros.Ole_Risk description: Indicator XLM macros OLE risk. type: string - contextPath: Oletools.Oleid.ole_command_result.XLM_Macros.Description description: Indicator XLM macros description. type: string - contextPath: Oletools.Oleid.ole_command_result.External_Relationships.Value description: Indicator XLM macros value. type: string - contextPath: Oletools.Oleid.ole_command_result.External_Relationships.Ole_Risk description: Indicator XLM macros OLE risk. type: string - contextPath: Oletools.Oleid.ole_command_result.External_Relationships.Description description: Indicator XLM macros description. type: string - contextPath: Oletools.Oleid.ole_command_result.ObjectPool.Value description: Indicator object pool value. type: string - contextPath: Oletools.Oleid.ole_command_result.ObjectPool.Ole_Risk description: Indicator object pool OLE risk. type: string - contextPath: Oletools.Oleid.ole_command_result.ObjectPool.Description description: Indicator object pool description. type: string - contextPath: Oletools.Oleid.ole_command_result.Flash_objects.Value description: Indicator Flash objects value. type: string - contextPath: Oletools.Oleid.ole_command_result.Flash_objects.Ole_Risk description: Indicator Flash objects OLE risk. type: string - contextPath: Oletools.Oleid.ole_command_result.Flash_objects.Description description: Indicator Flash objects description. type: string - contextPath: Oletools.Oleobj.ole_command_result.hyperlinks description: List of hyperlinks. type: string - contextPath: Oletools.Oleobj.file_name description: File name. type: string - contextPath: Oletools.Oleobj.sha256 description: SHA256 hash. type: string - contextPath: Oletools.Olevba.file_name description: File name. type: string - contextPath: Oletools.Olevba.sha256 description: SHA256 hash. type: string - contextPath: Oletools.Olevba.ole_command_result.macro_analyze description: Macro analyze. type: string - contextPath: Oletools.Olevba.ole_command_result.macro_src_code description: Macro source code. type: string - contextPath: Oletools.Olevba.ole_command_result.macro_list description: Macro list. type: string - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: QRCodeReader description: The QR code reader primary key object. type: unknown - contextPath: QRCodeReader.Text description: The raw text extracted from the QR code image. type: String - contextPath: QRCodeReader.Domain description: The domains extracted from the QR code image if they are present. type: String - contextPath: QRCodeReader.URL description: The URLs extracted from the QR code image if they are present. type: String - contextPath: QRCodeReader.IP description: The IPs extracted from the QR code image if they are present. type: String - contextPath: ExtractedHyperLink description: Extracted hyperlinks from supported Office documents (xlsx,docx,pptx). type: unknown - contextPath: ExtractedHyperLink.URL description: The URL of the extracted hyperlink. type: String - contextPath: ExtractedHyperLink.FileName description: The Office file from which the hyperlinks are extracted. type: String tests: - Extract Indicators From File - Generic v2 - Test fromversion: 5.0.0 contentitemexportablefields: contentitemfields: {} system: true