Help wanted - passing payload extracted by Yara dispatcher to Yara worker about stoq-plugins-public HOT 2 CLOSED

@mlaferrera it's awesome, it works as expected! I dropped calling Yara worker for payloads passed from every plugin, instead now smtp is calling Yara dispatcher, and if it's archive, decompress (thanks for change) calling Yara worker. By the way, extracted payload was already archived by archiver before the change you made.

from stoq-plugins-public.

Hi @aleksf -- Great question and it gave me the idea to add two new options to the decompress plugin. You can now set always_dispatch (identical to the smtp plugin) and archive_extracted to the configuration for decompress. You'll need to upgrade your decompress plugin with the below command. Once done, just add the new configuration options and you should be all set.

stoq install --github --upgrade stoq:decompress

Optionally, you can also leverage your yara dispatcher to see payloads to the yara worker. Just write a yara dispatcher signature that sends all, or specific (i.e., pe files), payloads to yara worker.

from stoq-plugins-public.