You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
|
|
|
|
{% if SCAN_MACROS == 'True' %}
|
|
|
|
|
# local.d/external_services_group.conf
|
|
|
|
|
|
|
|
|
|
description = "Oletools content rules";
|
|
|
|
|
symbols = {
|
|
|
|
|
"OLETOOLS" {
|
|
|
|
|
weight = 1.0;
|
|
|
|
|
description = "OLETOOLS found a Macro";
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_MACRO_FOUND" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_AUTOEXEC" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_FLAG" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_VBASTOMP" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_A" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_W" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_X" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
}
|
|
|
|
|
{% endif %}
|
