Add py2exe detection to DiE and YARA rules

Added a header comment to the Py2exe.1.sg rule file for clarity. Introduced a new YARA rule to detect py2exe-packed PE files by checking for the 'PyArg_ParseTuple' export.
This commit is contained in:
DosX 2025-10-01 23:55:58 +03:00
commit 9ae7963fa9
2 changed files with 10 additions and 0 deletions

View file

@ -1,3 +1,5 @@
// Detect It Easy: detection rule file
meta("packer", "py2exe");
function detect() {

View file

@ -133,6 +133,14 @@ rule Packer__SimplePack {
)
}
rule Packer__py2exe {
condition:
IsPE and
IsNative and
not IsDll and
pe.exports("PyArg_ParseTuple")
}
rule Protection__obfus_h {
condition:
IsPE and