mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
ee3e885712
- Plain text now identified with BOMs for UTF8,16,32 (even though 16 and 32 wouldn't get identified as plain text, oh-well) - X.509 certificates are now populating files.log with the mime type application/pkix-cert. - File signatures are split apart into file types to help group and organize signatures a bit better. - Normalized some FILE_ANALYSIS debug messages. - Improved Javascript detection. - Improved HTML detection. - Removed a bunch of bad signatures. - Merged a bunch of signatures that ultimately detected the same mime type. - Added detection for MS LNK files. - Added detection for cross-domain-policy XML files. - Added detection for SOAP envelopes.
34 lines
1.1 KiB
Standard ML
34 lines
1.1 KiB
Standard ML
|
|
# This signature is non-specific and terrible but after
|
|
# searching for a long time there doesn't seem to be a
|
|
# better option.
|
|
signature file-msword {
|
|
file-magic /^\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1/
|
|
file-mime "application/msword", 50
|
|
}
|
|
|
|
signature file-ooxml {
|
|
file-magic /^PK\x03\x04\x14\x00\x06\x00/
|
|
file-mime "application/vnd.openxmlformats-officedocument", 50
|
|
}
|
|
|
|
signature file-docx {
|
|
file-magic /^PK\x03\x04.{26}(\[Content_Types\]\.xml|_rels\x2f\.rels|word\x2f).*PK\x03\x04.{26}word\x2f/
|
|
file-mime "application/vnd.openxmlformats-officedocument.wordprocessingml.document", 80
|
|
}
|
|
|
|
signature file-xlsx {
|
|
file-magic /^PK\x03\x04.{26}(\[Content_Types\]\.xml|_rels\x2f\.rels|xl\2f).*PK\x03\x04.{26}xl\x2f/
|
|
file-mime "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", 80
|
|
}
|
|
|
|
signature file-pptx {
|
|
file-magic /^PK\x03\x04.{26}(\[Content_Types\]\.xml|_rels\x2f\.rels|ppt\x2f).*PK\x03\x04.{26}ppt\x2f/
|
|
file-mime "application/vnd.openxmlformats-officedocument.presentationml.presentation", 80
|
|
}
|
|
|
|
signature file-msaccess {
|
|
file-mime "application/x-msaccess", 180
|
|
file-magic /.{4}Standard (Jet|ACE) DB\x00/
|
|
}
|
|
|