Add a new module for OOXML
Hi team,
This is my first PR to any open-source project so do apologise if I get something wrong :)
I would like to request a new module for OOXML files which are part of the PKZIP specification. The module focuses on parsing the metadata properties of OOXML files and does not attempt to extract each file entity within the ZIP archive. Have used this PKZIP specification to construct the module https://users.cs.jmu.edu/buchhofp/forensics/formats/pkzip.html
I have built this module with limited knowledge of C and have tested it using the YARA tests function against a malicious document. The inspiration behind this is that various threat actors use such modern documents which follow the OOXML format during the initial phase of the intrusions.
The following have been added:
- A ooxml.md file to document and provide brief explanation of the module and its use.
- A ooxml.h which is the header file for the ooxml.c
- A ooxml.c under the modules/ooxml path which is the core module file
I have the supporting files that I can share as well such as modification to existing files (makefile.am, module_list, configure.ac) as well as new files (sample YARA ruleset, test-suite.log after running the make check and others)
Please let me know what is required from my end, I am super thrilled for this to be added as an official YARA module which will be huge for the 100DaysofYARA challenge and beyond, cheers
合并状态:未合并 关闭于 2026-02-10 3 条评论