mirrors/Detect-It-Easy
2
0
Fork 0
mirror of https://github.com/horsicq/Detect-It-Easy.git synced 2026-06-24 01:54:08 +00:00
Code Issues Projects Releases Packages Wiki Activity

Add extra tokens to CI/build regex

Browse source 
Include additional common tokens (mgr, vds, word, runtime) in the build/CI server pattern inside isTokenObfuscated(). This prevents those tokens from being treated as obfuscated by the heuristic and reduces false positives when analyzing PE names.
This commit is contained in:
DosX 2026-05-11 21:57:26 +03:00
commit 45f0a4ca16
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
db/PE/__GenericHeuristicAnalysis_By_DosX.7.sg
View file

@ -3996,7 +3996,7 @@ function isTokenObfuscated(token) {
// Build/CI server patterns: buildbot, jenkins, gitlab-runner, etc.
// Contains common CI/build keywords with hyphens/underscores
if (token.match(/(?:krnl|buildbot|builder|jenkins|gitlab|runner|beta|alpha|client|relclient|steam|win(?:32|64|2)|x64|x86)/i)) return false;
if (token.match(/(?:krnl|mgr|vds|word|runtime|buildbot|builder|jenkins|gitlab|runner|beta|alpha|client|relclient|steam|win(?:32|64|2)|x64|x86)/i)) return false;
// === OBFUSCATION DETECTION ===