feat: Added a basic C++ and MSVC detector yara signature

This commit is contained in:
WerWolv
2024-02-22 21:31:53 +01:00
parent daf007fae7
commit e28b72e356

View File

@@ -0,0 +1,25 @@
rule CppExecutable {
meta:
category = "Programming Language"
name = "C++"
strings:
$exception_windows = "_CxxThrowException" ascii fullword
$iostreams = "iostream" ascii
condition:
any of them
}
rule CppMSVC {
meta:
category = "Compiler"
name = "MSVC"
strings:
$iostreams_mangled_name = "$basic_iostream@DU" ascii
$std_namespace = "@@std@@" ascii
condition:
any of them and CppExecutable
}