Project

General

Profile

Actions
Copy link

Feature #7846

open

rules/transform: add gunzip transform

Added by James Emery-Callcott 5 months ago. Updated 8 days ago.

Status:
New
Priority:
Normal
Assignee:
OISF Dev
Target version:
TBD
Effort:
Difficulty:
Label:

Description

We've seen many use cases in which we would love the ability to utilise some sort of gzip keyword/transformation to allow us to match content within that decompressed buffer. This should function similarly to how base64 keywords work.

A recent example saw a HTTP POST request with a base64 string parameter value. Once decoded, that base64 string contained a gzip compressed data blob which ended up being a malicious executable. Unfortunately, due to this limitation, we were only able to use base64 keywords and then write a signature on the gzip header.

This new feature would allow us to write signatures 1 layer deeper and to identify and differentiate between malicious and benign depending on what is found in that final layer.

ex.

gzip_decompress:relative; gzip_data; content:"blah";

Actions
Copy link
 #1

Updated by Stuart DC 5 months ago

preferably, adding gzip decompression (gunzip) to the transformations would allow us to not only call transform any given buffer but also enable detection writers to transform carved buffers via pcrexform.

Actions
Copy link
 #2

Updated by Victor Julien 8 days ago

  • Subject changed from add the ability to manually call gzip decompress on any buffer and use it with other keywords and transformations to rules/transform: add gunzip transform
Actions
Copy link
 #3

Updated by Victor Julien 8 days ago

I think this should be a regular transform and not use the old base64 pattern with base64_decode; base64_data;

Since decompression comes with some problems, we should be careful about imposing limits.

There should be global hard limits for max decompressed size, possibly also for the input to output ratio.

Then the rule should be able to specify the same settings. The rule limits may not exceed the global limits.

e.g.

# specify limits in the rule
file.data; gzip_decompress: max-size 1MiB, max-ratio 10; content:"MZ";
# use global limits
file.data; gzip_decompress; content:"MZ";

Other options that might make sense are around how many bytes to consider for decompression on the input size.

Actions
Copy link

Also available in: Atom PDF