Skip to content

Exceptions

Errors raised by qarbaal.

Classes:

QarbaalError

Bases: Exception

Base class for qarbaal errors.

InputTooLargeError 

InputTooLargeError(size: int, limit: int)

Bases: QarbaalError

Input exceeded the configured character limit in strict mode.

Attributes:

  • size –

    Length of the input that was rejected.

  • limit –

    Configured maximum, in characters.

size instance-attribute 

size = size

limit instance-attribute 

limit = limit

UnsupportedFormatError

Bases: QarbaalError

The file suffix is not a supported input format.

OptionalDependencyError

Bases: QarbaalError

An optional parser or adapter is not installed.

ParseError

Bases: QarbaalError

A file could not be parsed as the selected format.

Sieve regular expressions and the file-extension exclusion set.

The twelve original patterns follow the reference sieve, including order. Hashes are matched longest first so a longer digest is not also reported as a shorter one. Extra types use their own patterns and do not change those matches.

Classes:

  • PatternSpec –

    A caller-supplied indicator pattern for an existing :class:~qarbaal.types.IOCType.

Attributes:

FILE_EXT module-attribute 

FILE_EXT: frozenset[str] = frozenset('exe dll bat cmd ps1 vbs js jse wsf hta scr txt log md doc docx xls xlsx ppt pptx pdf rtf zip rar 7z tar gz bz2 jpg jpeg png gif bmp svg ico webp mp3 mp4 avi mov dat bin tmp sys ini cfg conf yml yaml json xml html htm css php asp aspx jsp py sh rb pl class jar war apk ipa db sqlite sql bak lnk iso img dmg msi cab reg pcap pcapng evtx dmp'.split())

SHA512_RE module-attribute 

SHA512_RE = re.compile('(?<![a-fA-F0-9])[a-fA-F0-9]{128}(?![a-fA-F0-9])', _ASCII)

SHA256_RE module-attribute 

SHA256_RE = re.compile('(?<![a-fA-F0-9])[a-fA-F0-9]{64}(?![a-fA-F0-9])', _ASCII)

SHA1_RE module-attribute 

SHA1_RE = re.compile('(?<![a-fA-F0-9])[a-fA-F0-9]{40}(?![a-fA-F0-9])', _ASCII)

MD5_RE module-attribute 

MD5_RE = re.compile('(?<![a-fA-F0-9])[a-fA-F0-9]{32}(?![a-fA-F0-9])', _ASCII)

URL_RE module-attribute 

URL_RE = re.compile('\\b(?:https?|ftp)://[^\\s"\'<>()\\[\\]{}]+', _ASCII | re.IGNORECASE)

IPV4_RE module-attribute 

IPV4_RE = re.compile('\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b', _ASCII)

IPV4_CIDR_RE module-attribute 

IPV4_CIDR_RE = re.compile('\\b(?:\\d{1,3}\\.){3}\\d{1,3}/(?:[0-9]|[12]\\d|3[0-2])\\b', _ASCII)

IPV6_RE module-attribute 

IPV6_RE = re.compile('\\b(?:[a-fA-F0-9]{1,4}:){2,7}(?::|[a-fA-F0-9]{1,4})\\b', _ASCII)

IPV6_TIME_RE module-attribute 

IPV6_TIME_RE = re.compile('(?:\\d{1,2}:){2,}\\d{1,2}', _ASCII)

IPV6_CIDR_RE module-attribute 

IPV6_CIDR_RE = re.compile('(?i)\\b(?:[a-f0-9]{1,4}:){2,7}(?::|[a-f0-9]{1,4})/(?:12[0-8]|1[01]\\d|\\d{1,2})\\b', _ASCII)

EMAIL_RE module-attribute 

EMAIL_RE = re.compile('\\b[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,24}\\b', _ASCII)

DOMAIN_RE module-attribute 

DOMAIN_RE = re.compile('\\b(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\\.)+[a-zA-Z]{2,24}\\b', _ASCII)

CVE_RE module-attribute 

CVE_RE = re.compile('\\bCVE-\\d{4}-\\d{4,7}\\b', _ASCII | re.IGNORECASE)

ATTACK_RE module-attribute 

ATTACK_RE = re.compile('\\bT1\\d{3}(?:\\.\\d{3})?\\b', _ASCII)

REGISTRY_RE module-attribute 

REGISTRY_RE = re.compile('\\b(?:HKEY_LOCAL_MACHINE|HKEY_CURRENT_USER|HKEY_CLASSES_ROOT|HKEY_USERS|HKEY_CURRENT_CONFIG|HKLM|HKCU|HKCR|HKU|HKCC)\\\\[^\\s"\'<>|*?]+', _ASCII | re.IGNORECASE)

WALLET_RE module-attribute 

WALLET_RE = re.compile('\\b(?:bc1[a-z0-9]{25,62}|[13][a-km-zA-HJ-NP-Z1-9]{25,34})\\b', _ASCII)

MAC_RE module-attribute 

MAC_RE = re.compile('(?<![0-9A-Fa-f:-])(?:[0-9A-Fa-f]{2}(?::[0-9A-Fa-f]{2}){5}|[0-9A-Fa-f]{2}(?:-[0-9A-Fa-f]{2}){5})(?![0-9A-Fa-f:-])', _ASCII)

ASN_RE module-attribute 

ASN_RE = re.compile('\\bAS[1-9]\\d{0,9}\\b', _ASCII)

JA3S_RE module-attribute 

JA3S_RE = re.compile('\\bJA3S\\s*[:=]\\s*([a-fA-F0-9]{32})\\b', _ASCII | re.IGNORECASE)

JA3_RE module-attribute 

JA3_RE = re.compile('\\bJA3\\s*[:=]\\s*([a-fA-F0-9]{32})\\b', _ASCII | re.IGNORECASE)

JARM_RE module-attribute 

JARM_RE = re.compile('\\bJARM\\s*[:=]\\s*([a-fA-F0-9]{62})\\b', _ASCII | re.IGNORECASE)

MUTEX_RE module-attribute 

MUTEX_RE = re.compile('\\b(?:Global|Local)\\\\[A-Za-z0-9_.:-]{4,120}\\b', _ASCII | re.IGNORECASE)

WINDOWS_PATH_RE module-attribute 

WINDOWS_PATH_RE = re.compile('(?i)\\b[A-Za-z]:\\\\(?:[^\\\\/:*?"<>|\\r\\n]+\\\\)+[^\\\\/:*?"<>|\\r\\n]+', _ASCII)

UNC_PATH_RE module-attribute 

UNC_PATH_RE = re.compile('\\\\\\\\[^\\\\/:*?"<>|\\r\\n]+\\\\[^\\\\/:*?"<>|\\r\\n]+\\\\[^\\\\/:*?"<>|\\r\\n]+', _ASCII)

UNIX_PATH_RE module-attribute 

UNIX_PATH_RE = re.compile('(?<![A-Za-z0-9])/(?:[A-Za-z0-9._-]{1,64}/){2,}[A-Za-z0-9._-]{1,128}', _ASCII)

USER_AGENT_RE module-attribute 

USER_AGENT_RE = re.compile('\\bUser-Agent\\s*:\\s*([^\\r\\n]{6,400})', _ASCII | re.IGNORECASE)

IPV4_HOST_RE module-attribute 

IPV4_HOST_RE = re.compile('\\d{1,3}(?:\\.\\d{1,3}){3}')

TRAILING_URL_PUNCT_RE module-attribute 

TRAILING_URL_PUNCT_RE = re.compile('[.,;:!?)]+$')

MAX_TOKEN_LENGTH module-attribute 

MAX_TOKEN_LENGTH = 4096

PatternSpec dataclass 

PatternSpec(type: IOCType, regex: str, flags: int = 0, folds: str = 'preserve')

A caller-supplied indicator pattern for an existing :class:~qarbaal.types.IOCType.

Attributes:

  • type (IOCType) –

    Indicator type stored on matches.

  • regex (str) –

    Regular expression. Group 1 is the value when present; otherwise the whole match.

  • flags (int) –

    Extra :mod:re flags. re.ASCII is not added for you.

  • folds (str) –

    lower, upper, or preserve.

Methods:

  • compile –

    Compile the pattern, or raise ValueError when it is invalid.

type instance-attribute 

type: IOCType

regex instance-attribute 

regex: str

flags class-attribute instance-attribute 

flags: int = 0

folds class-attribute instance-attribute 

folds: str = 'preserve'

compile 

compile() -> Pattern[str]

Compile the pattern, or raise ValueError when it is invalid.