mwcollect.conf

# mwcollectd dist config, see man (5) mwcollect.conf and comments for help
# $Id: mwcollect.conf 292 2006-02-02 19:08:30Z oxff $

# the pretty basics required to run a senseful standard sensor
%loadModule("log-file.so", "log-file.conf");
%loadModule("net-posix.so", "empty.conf");

# additional loggers
#%loadModule("log-irc.so", "log-irc.conf");
#%loadModule("log-prelude.so", "log-prelude.conf");
#%loadModule("log-syslog.so", "log-syslog.conf");

# vulnerability modules
%loadModule("vuln-ms04-11.so", "vuln-ms04-11.conf");
%loadModule("vuln-ms05-39.so", "vuln-ms05-39.conf");
%loadModule("vuln-ms03-26.so", "vuln-ms03-26.conf");
%loadModule("vuln-ms05-51.so", "vuln-ms05-51.conf");

# shell emulation modules
%loadModule("shell-transfer.so", "empty.conf");
%loadModule("shell-basic.so", "empty.conf");

# download handlers
%loadModule("download-tftp.so", "empty.conf");
%loadModule("download-curl.so", "download-curl.conf");

# submitters
%loadModule("submit-localfile.so", "submit-localfile.conf");
# %loadModule("submit-gotek.so", "submit-gotek.conf");

# pure shellcode parsers
%loadModule("scparse-misc.so", "empty.conf");


# daemon configuration
{
        shellcode-directory = "./data/shellcodes/";     # write unknown shellcodes here
                                                        # set to `(none)' to disable (this is also the default)
                                                        
        store-shellcodes = "0";                         # store ALL shellcodes, including succesfully parsed ones
                                                        # set to `1' to activate, defaults to 0 which only saves
                                                        # unparsable ones
                                                        
        bind-address = "0.0.0.0";                       # connections to another addresses are ignored
                                                        # defaults to 0.0.0.0 which means accept all sources
                                                        
        connection-timeout = "300";                     # specifies after which time all connections time out (in seconds)
                                                        # defaults to 0 which means no timeout
                                                        # don't set this to a low value, it's just the last chance
                                                        
        download-blocking = "600";                      # an URL will not be tried to fetch twice within this timespan
                                                        # defaults to 600 seconds
        download-alerts = "1";                          # downloads will emit classful alert message if set to 1,
                                                        # this defaults to 1
}

submit-localfile.conf

#mwcollect3 submit-localfile example config

{
        # uncomment the following line to enable chown functionality
        # chown
        {
                # if mwcollect is not configured to drop privilegues at startup
                # it might be a good idea to chown & chmod collected binaries
                # after storing them in the local filesystem
                #
                # comment out the block to deactivate chown
                
                user = "mwcollectd";    # defaults to mwcollectd
                group = "mwcollectd";   # defaults to nogroup
        }
        
        chmod = "0640";                 # defaults to 0600
        
        directory = "./data/binaries/"; # where to store collected malware
                                        # defaults to `./data/binaries/'
        
        md5sum = "1";                   # perform md5 hashing on file's content and use as filename
                                        # otherwise a random 16 character string prefixed with `r' to
                                        # distinguish from md5sum's is used as filename
                                        # defaults to 1
                                        
        # there is no more requirement for symlink attack filename extension with random strings
        # since the module tests for existance of a symlink before actually opening the file
}