mquery
mquery copied to clipboard
Add a support for `pe` module
Feature Category
- [ ] Correctness
- [ ] User Interface / User Experience
- [ ] Performance
- [x] Other (please explain)
Describe the problem
Reported by a user: It's some organisations it's very common to use a pe module in Yara rules. Having a (limited) support for it would be great.
Describe the solution you'd like
This rule should be optimised by the backend:
import "pe"
rule single_section
{
condition:
pe.number_of_sections == 1
}
Describe alternatives you've considered
Teach users not to use pe or other auxiliary modules in their yara rules. It worked for all places I've worked at, but this makes life of researchers a bit more difficult.