Suricata file extraction

Help
1

Hi, I need to use the Suricata file extraction functionality but specifically the files with extension (.exe), is this possible.

I have tried using the following rule, but it ends up downloading any extension even with all the rules disabled:

alert http any any -> any any (msg:“File stored”; fileext:“exe”; filestore; sid:1; rev:1;)

2

Hi,

Make sure that file extraction is configured.

In suricata.yaml, ensure that enabled: yes – here’s a snippet
(this enables the current file store version).

 - file-store:
      version: 2
      enabled: yes
3

I have added: (version: 2) and the same thing keeps happening, all kinds of files are downloaded

4

Can you post the entire suricata.yaml or at least the full - file-store: block?

5

Make sure that you don’t have force-filestore set to yes. If you do, that will store every file – not just the one in the rule. You should see force-filestore: no in the - file-store section.

6

It was that, I thought “force-filestore” was to retry extraction in case of failure, and ended up enabling it without knowing. Thanks for everything Jeff_Lucovsky and vjulien !!!