Configuration Reference

Configuration Reference

LitterBox configuration is stored in config/config.yaml. This reference covers all available settings organized by section.

Application

Basic server settings:

application:
  name: "LitterBox"
  host: "127.0.0.1"
  port: 1337
  debug: false
  version: "4.1.0"

• host - Server bind address (0.0.0.0 for external access)
• port - Server port
• debug - Enable verbose logging
• name/version - Application metadata

Utils

File handling configuration:

utils:
  allowed_extensions: [exe, dll, bin, docx, xlsx, lnk, sys]
  max_file_size: 104857600  # 100MB
  upload_folder: "Uploads"
  result_folder: "Results"
  malapi_path: "Utils\\malapi.json"

• allowed_extensions - Permitted file types for upload
• max_file_size - Upload size limit in bytes
• upload_folder - Directory for uploaded samples
• result_folder - Directory for analysis results
• malapi_path - Windows API reference database

Analysis

Process Settings

analysis:
  process:
    init_wait_time: 5

• init_wait_time - Seconds to wait for process initialization

Doppelganger

doppelganger:
  db:
    path: "Utils\\DoppelgangerDB"
    blender: "Blender"
    fuzzyhash: "FuzzyHash"
    fuzzy_extensions: [exe, dll, bin]

• path - Database root directory
• blender - Blender module data subdirectory
• fuzzyhash - FuzzyHash module data subdirectory
• fuzzy_extensions - File types for fuzzy hash analysis

HolyGrail

holygrail:
  enabled: true
  tool_path: ".\\Scanners\\HolyGrail\\HolyGrail.exe"
  policies_path: ".\\Scanners\\HolyGrail\\Policies\\"
  command: "{tool_path} -d {file_path} -p {policies_path} -j -o {results_path}"
  results_path: ".\\Scanners\\HolyGrail\\Analysis\\"
  timeout: 120

• policies_path - Driver block policy files directory
• results_path - Analysis output directory

Static Analysis

YARA

static:
  yara:
    enabled: true
    tool_path: ".\\Scanners\\Yara\\yara64.exe"
    command: "{tool_path} -s -m {rules_path} {file_path}"
    rules_path: ".\\Scanners\\Yara\\rules\\LitterBox.yar"
    timeout: 120

• rules_path - YARA rules file location

CheckPlz

checkplz:
  enabled: true
  tool_path: ".\\Scanners\\CheckPlz\\CheckPlz.exe"
  command: "{tool_path} -m -r -f {file_path}"
  timeout: 120

Stringnalyzer

stringnalyzer:
  enabled: true
  tool_path: ".\\Scanners\\Stringnalyzer\\Stringnalyzer.exe"
  command: "{tool_path} --wide -f {file_path}"
  timeout: 120

Dynamic Analysis

YARA (Memory)

dynamic:
  yara:
    enabled: true
    tool_path: ".\\Scanners\\Yara\\yara64.exe"
    command: "{tool_path} -s -m {rules_path} {pid}"
    rules_path: ".\\Scanners\\Yara\\rules\\LitterBox.yar"
    timeout: 120

PE-Sieve

pe_sieve:
  enabled: true
  tool_path: ".\\Scanners\\PE-Sieve\\pe-sieve.exe"
  command: "{tool_path} /pid {pid} /threads /data 3 /iat 3 /obfusc 3 /shellc 3 /dir .\\Scanners\\PE-Sieve\\analysis"
  timeout: 120

Hollows Hunter

hollows_hunter:
  enabled: true
  tool_path: ".\\Scanners\\HollowsHunter\\hollows_hunter.exe"
  command: "{tool_path} /threads /data 3 /iat 3 /obfusc 3 /hooks /shellc 3 /json /jlvl 2 /quiet /ofilter 2"
  timeout: 600

Moneta

moneta:
  enabled: true
  tool_path: ".\\Scanners\\Moneta\\Moneta64.exe"
  command: "{tool_path} -m ioc -p {pid} --option from-base suppress-banner"
  timeout: 360

Patriot

patriot:
  enabled: true
  tool_path: ".\\Scanners\\Patriot\\Patriot.exe"
  command: "{tool_path} -p {pid}"
  timeout: 120

Hunt Sleeping Beacons

hsb:
  enabled: true
  tool_path: ".\\Scanners\\HuntSleepingBeacons\\Hunt-Sleeping-Beacons.exe"
  command: "{tool_path} -p {pid}"
  timeout: 360

RedEdr

rededr:
  enabled: true
  etw_wait_time: 15
  tool_path: ".\\Scanners\\RedEdr\\RedEdr.exe"
  command: "{tool_path} -e --trace {process_name}"
  timeout: 120

• etw_wait_time - Seconds to wait for ETW provider setup

Common Settings

All scanner tools share these settings:

• enabled - Enable/disable the scanner (true/false)
• tool_path - Path to scanner executable
• command - Command line template with placeholders
• timeout - Execution timeout in seconds

Command Placeholders

Template variables used in scanner commands:

• {tool_path} - Scanner executable path
• {file_path} - Target file path
• {pid} - Process ID for dynamic analysis
• {process_name} - Process name for ETW tracing
• {rules_path} - YARA rules file path
• {results_path} - Output directory path