SIS CLI

Shape Guide — Campaign Hunting by Structure

sis corpus cluster fingerprints a file’s asset-graph shape — its containment structure reduced to formats only — so structurally-identical samples cluster under one key regardless of their bytes. It is the hunting surface: cluster a corpus by how a threat is packaged, not by content hashes that every sample changes.

Command shape

sis corpus cluster <input> [--glob PATTERN] [--format text|json]
  • A file → prints its shape fingerprint.
  • A directory → walks it (filtered by --glob, default *) and clusters files by shape.

The fingerprint

A canonical, deterministic, format-only containment string:

  • nesting is >, siblings are , (sorted, so sibling order never changes the key), a branch groups with (…).
  • polyglot / interpretation wrapper nodes are transparent (their children fold into the parent), so a live scan clusters with its own saved report.
flat PDF                         → pdf
a zip containing a PDF+PNG chain → zip>pdf>png
a zip with a PE and a PDF        → zip>(pdf,pe)
eml → zip → lnk → ps1            → eml>zip>lnk>ps1

Examples

sis corpus cluster sample.zip                          # zip>pdf>png
sis corpus cluster ./corpus --glob '*'                 # cluster the whole corpus
sis corpus cluster ./corpus --glob '*.docx' --format json

Directory output (--format json):

{
  "type": "shape_clusters",
  "total_files": 5,
  "distinct_shapes": 4,
  "clusters": [
    { "shape": "zip>pdf", "count": 2, "files": ["a.zip", "b.zip"] },
    { "shape": "eml>zip>lnk>ps1", "count": 1, "files": ["c.eml"] }
  ]
}

Two different-byte samples that package a threat the same way land in the same cluster — the campaign signal. The single-file shape is also available inside sis query <file> "shape".

  • sis docs asset-graph — the asset graph + asset-path selectors the shape is derived from
  • sis corpus correlate — correlate findings across analysed inputs