mirror of
https://github.com/mandiant/capa-rules.git
synced 2026-10-11 21:39:59 +00:00
fix: escape + and / in Base64 string regex, add URL-safe variant
This commit is contained in:
@@ -13,8 +13,13 @@ rule:
|
||||
- Data::Encode Data::Base64 [C0026.001]
|
||||
- Data::Check String [C0019]
|
||||
examples:
|
||||
- B766CC43D649D30E9F27AFF8F7EE7DE0
|
||||
- BFB9B5391A13D0AFD787E87AB90F14F5
|
||||
- 074072B261FC27B65C72671F13510C05
|
||||
- 5DB2D2BE20D59AA0BE6709A6850F1775
|
||||
features:
|
||||
- string: /ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
|
||||
- or:
|
||||
- string: /ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\+\//
|
||||
description: standard Base64 alphabet
|
||||
- string: /ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_/
|
||||
description: URL-safe Base64 alphabet
|
||||
|
||||
Reference in New Issue
Block a user