Iterat0r comments

Repositories
Issues
Comments

Results 2 comments of


                                            Iterat0r

Rules engine prevents VirtualAlloc events propagation

Hi @rabbitstack ok, I'm going to check this out... thanks

Rules engine prevents VirtualAlloc events propagation

@rabbitstack, the filter you mentioned works, it would be like this in `controller_windows.go`/`NewController` : ``` if ktype == ktypes.VirtualAlloc && c.Yara.Enabled { c.Kstream.EnableMemKevents = true continue } ``` Another option...