|
|
|
@ -2,41 +2,41 @@
|
|
|
|
|
{% if SCAN_MACROS == 'True' %}
|
|
|
|
|
# local.d/external_services_group.conf
|
|
|
|
|
|
|
|
|
|
description = "Oletools content rules";
|
|
|
|
|
symbols = {
|
|
|
|
|
"OLETOOLS" {
|
|
|
|
|
weight = 1.0;
|
|
|
|
|
description = "OLETOOLS found a Macro";
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_MACRO_FOUND" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_AUTOEXEC" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_FLAG" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_VBASTOMP" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_A" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_W" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_X" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
}
|
|
|
|
|
description = "Oletools content rules";
|
|
|
|
|
symbols = {
|
|
|
|
|
"OLETOOLS" {
|
|
|
|
|
weight = 1.0;
|
|
|
|
|
description = "OLETOOLS found a Macro";
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_MACRO_FOUND" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_AUTOEXEC" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_FLAG" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_VBASTOMP" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_A" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_W" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
"OLETOOLS_X" {
|
|
|
|
|
weight = 0.0;
|
|
|
|
|
one_shot = true;
|
|
|
|
|
},
|
|
|
|
|
}
|
|
|
|
|
{% endif %}
|
|
|
|
|
.include(try=true,priority=1,duplicate=merge) "/overrides/external_services_group.conf"
|
|
|
|
|