Merge pull request #25 from Gurummang/develop

buubb · web-flow · commit 0aebb51c6620 · 2024-10-18T19:55:13.000+09:00
fix: add missing_certificate
diff --git a/rules/exe/executable/ransomware/suspicious_pe.yar b/rules/exe/executable/ransomware/suspicious_pe.yar
@@ -24,6 +24,17 @@ rule EntryPointZero
         pe.entry_point == 0x0
 }
 
+rule missing_certificate
+{
+    meta:
+        atk_type= "missing_certificate"
+        description = "Detects PE files that do not have a digital signature"
+    condition:
+        uint16(0) == 0x5A4D and         
+        pe.is_pe and                     
+        pe.number_of_signatures == 0    
+}
+
 rule SectionSizeGreaterThanImageSize
 {
     meta:
