service_manifest.yml

name: Badlist
version: $SERVICE_TAG
description: >
  ALv4 Badlist service

  This service will check the file hashes against Assemblyline's internal badlist infrastructure and mark
  files as bad accordingly.

accepts: .*
rejects: empty|metadata/.*

stage: REVIEW
category: Static Analysis

uses_tags: true
file_required: false
timeout: 10
disable_cache: false
privileged: true

enabled: true

heuristics:
  - heur_id: 1
    name: Badlisted File
    score: 1000
    filetype: "*"
    description: This file is found in the list of know bad files
    max_score: 1000
  - heur_id: 2
    name: Badlisted IOC
    score: 1000
    filetype: "*"
    description: This Indicator Of Compromise is found in the list of know bad IOCs
    max_score: 1000
  - heur_id: 3
    name: Badlisted Similar File
    score: 500
    filetype: "*"
    description: This file is similar to a file found in the list of know bad files

config:
  cache_timeout_seconds: 1800
  lookup_md5: false
  lookup_sha1: false
  lookup_sha256: true
  lookup_ssdeep: false
  lookup_tlsh: true
  lookup_ip: false
  lookup_domain: false
  lookup_url: false

docker_config:
  image: ${REGISTRY}cccs/assemblyline-service-badlist:$SERVICE_TAG
  cpu_cores: 0.4
  ram_mb: 256

dependencies:
  updates:
    container:
      allow_internet_access: true
      command: ["python", "-m", "badlist.update_server"]
      image: ${REGISTRY}cccs/assemblyline-service-badlist:$SERVICE_TAG
      ports: ["5003"]
      cpu_cores: 2
      ram_mb: 4096
    run_as_core: True

update_config:
  generates_signatures: false
  sources:
    - name: malpedia
      uri: https://malpedia.caad.fkie.fraunhofer.de/api/list/families?format=json
      pattern: .*\/families
      configuration:
        type: malware_family_list
        format: list
    - name: malpedia_attribution
      uri: https://malpedia.caad.fkie.fraunhofer.de/api/list/actors?format=json
      pattern: .*\/actors
      configuration:
        type: attribution_list
        format: list
    - name: phishunt
      uri: https://phishunt.io/feed.txt
      pattern: .*\/feed\.txt
      configuration:
        type: blocklist
        format: csv
        uri: 0
    - name: urlhaus
      uri: https://urlhaus.abuse.ch/downloads/csv
      pattern: .*\/csv\.txt$
      configuration:
        type: blocklist
        format: csv
        uri: 2
        malware_family: 6
        reference: 7
        start: 9
      update_interval: 300 # Every 5 minutes
    - name: blackbook
      uri: https://github.com/stamparm/blackbook.git
      pattern: .*\.csv$
      configuration:
        type: blocklist
        format: csv
        domain: 0
        malware_family: 1
        start: 1
    - name: feodotracker
      uri: https://feodotracker.abuse.ch/downloads/ipblocklist.json
      pattern: .*ipblocklist\.json
      configuration:
        type: blocklist
        format: json
        ip: ip_address
        domain: hostname
        malware_family: malware
      update_interval: 300 # Every 5 minutes
    - name: threatfox
      uri: https://threatfox.abuse.ch/export/csv/recent
      pattern: .*\/recent
      configuration:
        type: blocklist
        format: csv
        dtl: 30
        start: 9
        ip: 2
        domain: 2
        uri: 2
        sha1: 2
        sha256: 2
        md5: 2
        malware_family: 5
        reference: 10
      update_interval: 300 # Every 5 minutes
    - name: "threatview.io_C2_Hunt_Feed"
      uri: https://threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt
      pattern: .*\.txt
      configuration:
        type: blocklist
        format: csv
        start: 3
        ip: 0
        domain: 2
        reference: 5
        default_attribution:
          family: ["COBALT STRIKE"]
      update_interval: 86400 # Daily
    - name: "threatview.io_IP_Blocklist"
      uri: https://threatview.io/Downloads/IP-High-Confidence-Feed.txt
      pattern: .*\.txt
      configuration:
        type: blocklist
        format: csv
        ip: 0
      update_interval: 86400 # Daily
    - name: "threatview.io_Domain_Blocklist"
      uri: https://threatview.io/Downloads/DOMAIN-High-Confidence-Feed.txt
      pattern: .*\.txt
      configuration:
        type: blocklist
        format: csv
        domain: 0
      update_interval: 86400 # Daily
    - name: "threatview.io_MD5_Hash_Blocklist"
      uri: https://threatview.io/Downloads/MD5-HASH-ALL.txt
      pattern: .*\.txt
      configuration:
        type: blocklist
        format: csv
        md5: 0
      update_interval: 86400 # Daily
    - name: "threatview.io_URL_Blocklist"
      uri: https://threatview.io/Downloads/URL-High-Confidence-Feed.txt
      pattern: .*\.txt
      configuration:
        type: blocklist
        format: csv
        uri: 0
      update_interval: 86400 # Daily
    - name: "threatview.io_SHA_Hash_Blocklist"
      uri: https://threatview.io/Downloads/SHA-HASH-FEED.txt
      pattern: .*\.txt
      configuration:
        type: blocklist
        format: csv
        sha1: 0
      update_interval: 86400 # Daily

  update_interval_seconds: 900 # Every 15 minutes
  wait_for_update: false