mandiant/stringsifter

What it solves

StringSifter is designed to speed up malware analysis by automatically ranking strings extracted from binaries. Instead of manually sifting through thousands of lines of output from tools like strings or FLOSS, analysts can focus on the most relevant strings for identifying the malware's functionality.

How it works

The tool uses a machine learning model based on Gradient Boosted Decision Trees (specifically LightGBM) with a learning-to-rank objective function. It was trained on strings from malware binaries in the EMBER dataset using weak supervision to generate labels. It can be processed via the command line using rank_strings, which accepts piped input from string extraction tools like flarestrings or FLOSS.

Who it’s for

It is primarily for malware analysts and reverse engineers who need to quickly identify high-value strings in binaries, memory dumps, or sandbox runs.

Highlights

• Integration with existing tools: Works seamlessly with flarestrings and FLOSS to process extracted strings.
• Batch processing: Supports processing multiple files in a folder via the --batch option.
• Flexible filtering: Allows users to limit output to the top-ranked strings or those meeting a minimum score threshold.
• Docker support: Provided as a container for easy deployment and consistent execution across platforms.