mirror of
https://github.com/horsicq/Detect-It-Easy.git
synced 2026-06-24 01:54:08 +00:00
Add rule for Microsoft Linker detection
Introduced a new YARA rule 'Linker__Microsoft_Linker' that triggers when the Rich signature is present, leveraging the existing IsRichSignPresent rule.
This commit is contained in:
parent
cb912f6efe
commit
3f1898623e
1 changed files with 5 additions and 0 deletions
|
|
@ -29,6 +29,11 @@ private rule IsRichSignPresent {
|
|||
condition: for any i in (0x40..0x400) : (@rich_pe == i)
|
||||
}
|
||||
|
||||
rule Linker__Microsoft_Linker {
|
||||
condition:
|
||||
IsRichSignPresent
|
||||
}
|
||||
|
||||
rule Compiler__NET_Native__debug {
|
||||
condition:
|
||||
IsPE and
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue