A modular, recursive file scanning framework that extends Yara signatures to extract and analyze file objects for malware analysis and intelligence.
FSF (File Scanning Framework) is an open-source framework for recursive file analysis and intelligence extraction. It allows security analysts to use Yara signatures not just for detection, but to programmatically extract and analyze embedded file objects like malware configs, compressed archives, and document metadata. It solves the problem of manual, repetitive extraction tasks in static malware analysis.
Malware analysts, reverse engineers, and network defenders who need to automate file inspection, extract embedded threats, and enrich forensic data at scale.
Developers choose FSF because it transforms Yara from a detection tool into an actionable intelligence platform, enabling recursive extraction and modular analysis that scales for enterprise security operations.
File Scanning Framework
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Automatically extracts and scans embedded objects like ZIP files, UPX binaries, and Office macros, reducing manual effort as demonstrated by modules such as EXTRACT_ZIP and EXTRACT_UPX in the README's module table.
Allows analysts to codify observations into reusable Python modules triggered by Yara hits, with a built-in suite covering PE metadata, document parsing, and more, as detailed in the modules documentation.
Supports parallel processing and integration with tools like Bro for high-volume scanning, including examples for load balancing using external utilities like Balance, enabling enterprise-scale deployments.
Leverages jq filters to parse JSON output for custom detections and relationship analysis, with dedicated docs/jq_examples.md providing FSF-specific filtering techniques.
Requires separate configuration for server and client components, with dependency management on specific Linux distributions and detailed steps outlined in docs/INSTALL.md, making deployment non-trivial.
Heavily relies on proficiency in Yara for signatures and jq for post-processing, with the README directing users to external documentation, which can be a barrier for teams new to these tools.
Enforced MIN_DEPTH and TIMEOUT values restrict deep recursion and long-running module executions, potentially hindering analysis of complex or heavily nested files as admitted in the limitations section.