mirror of
https://github.com/mandiant/capa-rules.git
synced 2026-10-12 02:18:39 +00:00
rules: detect ps2exe binaries compiled with current MainApp/MainModule naming (#1168)
* rules: detect ps2exe binaries compiled with current MainApp/MainModule naming * rules: add capa-testfiles example for current ps2exe naming variant * rules: add @shreethaar to authors
This commit is contained in:
@@ -5,6 +5,7 @@ rule:
|
||||
authors:
|
||||
- "@_re_fox"
|
||||
- [email protected]
|
||||
- "@shreethaar"
|
||||
scopes:
|
||||
static: file
|
||||
dynamic: file
|
||||
@@ -14,6 +15,7 @@ rule:
|
||||
examples:
|
||||
- 8775ed26068788279726e08ff9665aab
|
||||
- 805f79e57e4ce24b95a04541e4ea55dd2ce9ba314ab2c43491328204bc25d017
|
||||
- 9df11356c5ac61d2aa7b5425e6322fc016b0ed5790dacb201396500b3eee03f7
|
||||
features:
|
||||
- and:
|
||||
- match: compiled to the .NET platform
|
||||
@@ -25,3 +27,7 @@ rule:
|
||||
- and:
|
||||
- string: "If you spzzcify thzz -zzxtract option you nzzed to add a filzz for zzxtraction in this way"
|
||||
- string: " -zzxtract:\"<filzznamzz>\""
|
||||
- and:
|
||||
- string: "ModuleNameSpace"
|
||||
- string: "MainAppInterface"
|
||||
- string: "ConsoleColorProxy"
|
||||
|
||||
Reference in New Issue
Block a user