mirror of
https://github.com/zeek/zeek.git
synced 2025-10-16 21:48:21 +00:00
New file types sigs from Keith Lehigh.
This commit is contained in:
parent
6487446f27
commit
645ec39f4b
3 changed files with 112 additions and 2 deletions
|
@ -1,8 +1,14 @@
|
|||
|
||||
# Web Open Font Format 2
|
||||
signature file-woff2 {
|
||||
file-mime "application/font-woff2", 70
|
||||
file-magic /^wOF2/
|
||||
}
|
||||
|
||||
# Web Open Font Format
|
||||
signature file-woff {
|
||||
file-magic /^wOFF/
|
||||
file-mime "application/font-woff", 70
|
||||
file-magic /^wOFF/
|
||||
}
|
||||
|
||||
# TrueType font
|
||||
|
|
|
@ -292,6 +292,104 @@ signature file-skp {
|
|||
file-mime "application/skp", 100
|
||||
}
|
||||
|
||||
# Microsoft DirectDraw Surface
|
||||
signature file-msdds {
|
||||
file-mime "application/x-ms-dds", 100
|
||||
file-magic /^DDS/
|
||||
}
|
||||
|
||||
# bsdiff output
|
||||
signature file-bsdiff {
|
||||
file-mime "application/bsdiff", 100
|
||||
file-magic /^BSDIFF/
|
||||
}
|
||||
|
||||
# AV Update binary diffs (mostly kaspersky)
|
||||
# inferred from traffic analysis
|
||||
signature file-binarydiff {
|
||||
file-mime "application/bindiff", 100
|
||||
file-magic /^DIFF/
|
||||
}
|
||||
|
||||
# Kaspersky Database
|
||||
# inferred from traffic analysis
|
||||
signature file-kaspdb {
|
||||
file-mime "application/x-kaspavdb", 100
|
||||
file-magic /^KLZF/
|
||||
}
|
||||
|
||||
# Kaspersky AV Database diff
|
||||
# inferred from traffic analysis
|
||||
signature file-kaspdbdif {
|
||||
file-mime "application/x-kaspavupdate", 100
|
||||
file-magic /^KLD2/
|
||||
}
|
||||
|
||||
# MSSQL Backups
|
||||
signature file-mssqlbak {
|
||||
file-mime "application/mssql-bak", 100
|
||||
file-magic /^MSSQLBAK/
|
||||
}
|
||||
|
||||
# Microsoft Tape Format
|
||||
# MSSQL transaction log
|
||||
signature file-ms-tf {
|
||||
file-mime "application/mtf", 100
|
||||
file-magic /^TAPE/
|
||||
}
|
||||
|
||||
# Binary property list (Apple)
|
||||
signature file-bplist {
|
||||
file-mime "application/bplist", 100
|
||||
file-magic /^bplist0?/
|
||||
}
|
||||
|
||||
# Microsoft Compiled HTML Help File
|
||||
signature file-mshelp {
|
||||
file-mime "application/mshelp", 100
|
||||
file-magic /^ITSF/
|
||||
}
|
||||
|
||||
# Blizzard game file MPQ Format
|
||||
signature file-mpqgame {
|
||||
file-mime "application/x-game-mpq", 100
|
||||
file-magic /^MPQ\x1a/
|
||||
}
|
||||
|
||||
# Blizzard CASC Format game file
|
||||
signature file-blizgame {
|
||||
file-mime "application/x-blizgame", 100
|
||||
file-magic /^BLTE/
|
||||
}
|
||||
|
||||
# iOS Mapkit tiles
|
||||
# inferred from traffic analysis
|
||||
signature file-mapkit-tile {
|
||||
file-mime "application/map-tile", 100
|
||||
file-magic /^VMP4/
|
||||
}
|
||||
|
||||
# Google Chrome Extension file
|
||||
signature file-chrome-extension {
|
||||
file-mime "application/chrome-ext", 100
|
||||
file-magic /^Cr24/
|
||||
}
|
||||
|
||||
# Google Chrome Extension Update Delta
|
||||
# not 100% sure about this identification
|
||||
# this may be google chrome updates, not extensions
|
||||
signature file-chrome-extension-update {
|
||||
file-mime "application/chrome-ext-upd", 70
|
||||
file-magic /^CrOD/
|
||||
}
|
||||
|
||||
# Microsoft Message Queueing
|
||||
# .net related
|
||||
signature file-msqm {
|
||||
file-mime "application/msqm", 100
|
||||
file-magic /^MSQM/
|
||||
}
|
||||
|
||||
signature file-elf-object {
|
||||
file-mime "application/x-object", 50
|
||||
file-magic /\x7fELF[\x01\x02](\x01.{10}\x01\x00|\x02.{10}\x00\x01)/
|
||||
|
@ -315,4 +413,4 @@ signature file-elf-coredump {
|
|||
signature file-vim-tmp {
|
||||
file-mime "application/x-vim-tmp", 100
|
||||
file-magic /^b0VIM/
|
||||
}
|
||||
}
|
||||
|
|
|
@ -164,3 +164,9 @@ signature file-award-bios-logo {
|
|||
file-mime "image/x-award-bioslogo", 50
|
||||
file-magic /^\x11[\x06\x09]/
|
||||
}
|
||||
|
||||
# WebP, lossy image format from Google
|
||||
signature file-webp {
|
||||
file-mime "image/webp", 70
|
||||
file-magic /^RIFF.{4}WEBP/
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue