# Zeek - Usecase based File Extraction

**URL:** <https://community.zeek.org/t/zeek-usecase-based-file-extraction/5835>\
**Category:** Zeek\
**Created:** [September 12, 2019, 7:40pm UTC](https://community.zeek.org/t/zeek-usecase-based-file-extraction/5835 "2019-09-12T19:40:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Uton\_Cyr](https://avatars.discourse-cdn.com/v4/letter/u/f6c823/32.png) [@Uton\_Cyr](https://community.zeek.org/u/Uton_Cyr)\
**Post date:** [September 12, 2019, 7:40pm UTC](https://community.zeek.org/t/zeek-usecase-based-file-extraction/5835/1 "2019-09-12T19:40:12Z")

</div>

Hi all,

I’ve recently been working on file carving/extraction based on a few usecases.

Namely:  
During a match with the Intel Framework on a FILE\_HASH, I want to extract the file.  
During a match with the Intel Framework on a DOMAIN and ADDR, I want to extract the file.

_See code **below**._

Yet everytime I’ll get the error message:  
**Analyzer Files::ANALYZER\_EXTRACT not added successfully to file …**

This occurs when you try to extract from the event: file\_hash.  
However, within events such as file\_new and file\_sniff, files can be extracted.  
I’d like to hand over the hash within the event of file\_hash to Intel::Seen($indicator=hash)

A few questions:

- Is it possible to extract a file during an Intel::match event?
- If yes, how would I go about this?
- Is there a simple way to hand over the hash, originating tx\_host and domain to the Intel framework and extract a file after a match?

Looking forward to your reply.

Kind regards,  
Bart

{CODE}

@load base/frameworks/intel  
@load base/files/extract

##Redefine to path desired.  
global path = “/home/zintern/EXTRACTED/temp/”;

##Redefine to desired IoC .dat file  
redef Intel::read\_files += {fmt(“%s/otx.dat”, @DIR)};

## When a new file is seen:

event file\_new(f: fa\_file)  
{  
Files::add\_analyzer(f, Files::ANALYZER\_MD5);  
Files::add\_analyzer(f, Files::ANALYZER\_SHA1);  
Files::add\_analyzer(f, Files::ANALYZER\_SHA256);  
}

## When a file\_hash has been seen

event file\_hash(f: fa\_file, kind: string, hash: string)  
{  
local seen = Intel::Seen($indicator=hash,  
$indicator\_type=Intel::FILE\_HASH,  
$f=f,  
$where=Files::IN\_HASH);

Intel::seen(seen);  
}

## When a match has been found between the seen traffic and the otx.dat file indicators.

event Intel::match(s: Intel::Seen, items:set[Intel::Item])  
{  
if(s$indicator\_type == Intel::FILE\_HASH)  
{  
local fname = fmt(“%s%s-%s”, path, s$f$source, s$f$id);  
Files::add\_analyzer(s$f, Files::ANALYZER\_EXTRACT,[$extract\_filename = fname]);  
}

}

---

<div class="post-metadata">

**Author:** ![Jan](https://avatars.discourse-cdn.com/v4/letter/j/ce7236/32.png) [@Jan](https://community.zeek.org/u/Jan)\
**Post date:** [September 13, 2019, 3:54pm UTC](https://community.zeek.org/t/zeek-usecase-based-file-extraction/5835/2 "2019-09-13T15:54:59Z")

</div>

Hi Bart,

> A few questions:  
> - Is it possible to extract a file during an Intel::match event?  
> ...

usually the match is too late to attach the file analyzer that handles extraction. Furthermore, in a cluster setup its triggered on the manager. The simplest way to get files for intel hits is to extract all files and just preserve the ones that triggered a hit (for the poor man's approach see [https://github.com/J-Gras/intel-extensions/blob/master/scripts/preserve\_files.bro](https://github.com/J-Gras/intel-extensions/blob/master/scripts/preserve_files.bro)).

Jan

---

<div class="post-metadata">

**Author:** ![Uton\_Cyr](https://avatars.discourse-cdn.com/v4/letter/u/f6c823/32.png) [@Uton\_Cyr](https://community.zeek.org/u/Uton_Cyr)\
**Post date:** [September 14, 2019, 3:36pm UTC](https://community.zeek.org/t/zeek-usecase-based-file-extraction/5835/3 "2019-09-14T15:36:38Z")

</div>

Hi Jan,

Thank you for the clarification!  
I should’ve known a file cannot be extracted “after” the hash of the file has been calculated.  
To calculate the hash of a file in the first place you’d need to analyse the file in its entirety.  
Meaning after the hash has been analysed of the file it’s likely at the END bit of the data stream.

The partial solution to extract first and verify later might be overkill on a network where thousands of files are downloaded.  
Restricting it to particular data protocols such as HTTP ‘only’ will have less of an impact on the computational load.  
I’ll have to try your suggested method, thank you for the link!

I was wondering if the usecase of extracting after getting an intel hit on INTEL::DOMAIN and INTEL::ADDR might still work.  
My assumption here is that the time between the event file\_new and intel::match might be small enough to not make a difference.  
As long as the function Intel::seen is called immediately during a file\_new event (this might cause some dataloss).

I have a one more questions if you or anyone has time:

- I’d like to compare the tx\_hosts seen of a file with the INTEL::ADDR, how would I go about this? (since tx\_hosts is a set (still learning bro)).

Kind regards,  
Bart

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/zeek-usecase-based-file-extraction/5835/4 "2022-05-06T15:46:45Z")

</div>