Add rule for Microsoft Linker detection

Introduced a new YARA rule 'Linker__Microsoft_Linker' that triggers when the Rich signature is present, leveraging the existing IsRichSignPresent rule.
This commit is contained in:
DosX 2025-11-02 22:02:00 +03:00
commit 3f1898623e

View file

@ -29,6 +29,11 @@ private rule IsRichSignPresent {
condition: for any i in (0x40..0x400) : (@rich_pe == i)
}
rule Linker__Microsoft_Linker {
condition:
IsRichSignPresent
}
rule Compiler__NET_Native__debug {
condition:
IsPE and