microsoft autorun parser #37
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The output dictionary was declared globally, causing the parser to return the same results over and over again as long as it ran in the same Celery process.
Fix prefetch file parser
Add the letter 'z' to the allowed letters.
Add parsers for Exchange logs and IIS logs
Add AutoParser
…-fix Greatly improve get_by_status performance
Create __init__.py for the parser AutoParser
Unlike zipfile, tarfile's extractall does not check if a member is going to be written outside of the specified destination path, so it needs to be checked manually.
Improve api checks
Fix redis Dockerfile
…ersal Fix path traversal vulnerability when extracting tar files
v 2.3.5
* Fix a bug with the timestamp will not be identified if it doesn't have `T`. (ex. `2024-09-10 21:41:41` will not be parsed but `2024-09-10T21:41:41` will be parsed correctly) * Added additional `Fennec` parsers and modified some parsers that will not recognize the `important fields`
timestamp bug fix & Fennec parser modification
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hi, I'm studying how to built a Kuiper parser for Microsoft Autoruns, is possible to find a good explanation of the advantage of analyzing Autoruns details here https://trustedsignal.blogspot.com/2012/02/finding-evil-automating-autoruns.html. Has anyone tried this before? Thank