File tree Expand file tree Collapse file tree 4 files changed +32
-0
lines changed
lib/src/modules/protos/vt Expand file tree Collapse file tree 4 files changed +32
-0
lines changed Original file line number Diff line number Diff line change @@ -172,6 +172,7 @@ enum FileType {
172172 ISOIMAGE = 800 ;
173173 SQUASHFS = 801 ;
174174 VHD = 802 ;
175+ VHDX = 803 ;
175176 APPLE = 1000 ;
176177 MACINTOSH = 1001 ;
177178 APPLESINGLE = 1002 ;
Original file line number Diff line number Diff line change @@ -218,6 +218,10 @@ message KeyValue {
218218}
219219
220220message HttpConversation {
221+ option (yara.message_options ) = {
222+ name : "Http"
223+ };
224+
221225 enum RequestMethod {
222226 option (yara.enum_options ) = {
223227 name : "Method"
@@ -254,6 +258,10 @@ message DnsLookup {
254258}
255259
256260message IpTraffic {
261+ option (yara.message_options ) = {
262+ name : "Net"
263+ };
264+
257265 enum TransportLayerProtocol {
258266 option (yara.enum_options ) = {
259267 name : "Protocol"
Original file line number Diff line number Diff line change @@ -17,6 +17,7 @@ option (yara.module_options) = {
1717 name : "vt"
1818 root_message : "vt.titan.LiveHuntData"
1919 rust_module : "vt"
20+ cargo_feature : "vt-module"
2021};
2122
2223message LiveHuntData {
Original file line number Diff line number Diff line change @@ -93,6 +93,10 @@ message PopularityRank {
9393}
9494
9595message EnrichedURL {
96+ option (yara.message_options ) = {
97+ name : "URL"
98+ };
99+
96100 int64 port = 3 ;
97101 repeated Tracker trackers = 4 ;
98102 map <string , string > response_headers = 5 ;
@@ -130,6 +134,10 @@ message EnrichedURL {
130134}
131135
132136message EnrichedIP {
137+ option (yara.message_options ) = {
138+ name : "IP"
139+ };
140+
133141 map <string , string > whois = 3 ;
134142 string whois_raw = 22 ;
135143 SSLCertificate https_certificate = 4 ;
@@ -170,6 +178,20 @@ message EnrichedIP {
170178}
171179
172180message EnrichedDomain {
181+ option (yara.message_options ) = {
182+ name : "Domain"
183+ };
184+
185+ enum Permutation {
186+ ALL = 0 [(yara.enum_value ) = { i64 : 65535 }];
187+ TYPO = 1 [(yara.enum_value ) = { i64 : 1 }];
188+ HOMOGLYPH = 2 [(yara.enum_value ) = { i64 : 2 }];
189+ HYPHENATION = 3 [(yara.enum_value ) = { i64 : 4 }];
190+ SUBDOMAIN = 4 [(yara.enum_value ) = { i64 : 8 }];
191+ TLD = 5 [(yara.enum_value ) = { i64 : 16 }];
192+ BITSQUATTING = 6 [(yara.enum_value ) = { i64 : 32 }];
193+ }
194+
173195 string raw = 18 ;
174196 string root = 27 ;
175197 map <string , string > whois = 3 ;
You can’t perform that action at this time.
0 commit comments