feat: Added a basic C++ and MSVC detector yara signature

This commit is contained in:
WerWolv 2024-02-22 21:31:53 +01:00
parent daf007fae7
commit e28b72e356
1 changed files with 25 additions and 0 deletions

View File

@ -0,0 +1,25 @@
rule CppExecutable {
meta:
category = "Programming Language"
name = "C++"
strings:
$exception_windows = "_CxxThrowException" ascii fullword
$iostreams = "iostream" ascii
condition:
any of them
}
rule CppMSVC {
meta:
category = "Compiler"
name = "MSVC"
strings:
$iostreams_mangled_name = "$basic_iostream@DU" ascii
$std_namespace = "@@std@@" ascii
condition:
any of them and CppExecutable
}