{% if SCAN_MACROS == 'True' %}
# local.d/external_services_group.conf
description = "Oletools content rules";
symbols = {
"OLETOOLS" {
weight = 1.0;
description = "OLETOOLS found a Macro";
one_shot = true;
},
"OLETOOLS_MACRO_FOUND" {
weight = 0.0;
"OLETOOLS_AUTOEXEC" {
"OLETOOLS_FLAG" {
"OLETOOLS_VBASTOMP" {
"OLETOOLS_A" {
"OLETOOLS_W" {
"OLETOOLS_X" {
}
{% endif %}