admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update format.md

Browse Source
This commit is contained in:
Aayush Goel
2023-08-25 22:07:36 +05:30
parent 9f163b0cee
commit cdfb01762b
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/format.md
+3 -3
View File
@@ -512,19 +512,19 @@ Example:
- com/interface: IWebBrowser2 #bytes: 61 16 0C D3 AF CD D0 11 8A 3E 00 C0 4F C9 E2 6E = IID_IWebBrowser2
```
Rule parsers will translate the above rule to its bytes and string representation using the COM name by fetching the GUIDs from the COM database.
Rule parsers will translate the above rule to its `bytes` and `string` representation by fetching the GUIDs from the COM database using the COM name.
Translated Representation:
```yaml
- or:
- bytes : 01 DF 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 = InternetExplorer as bytes
- string : "0002DF01-0000-0000-C000-000000000046"
description: InternetExplorer as guid string
- bytes : 01 DF 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 = InternetExplorer as bytes
- or:
- bytes: 61 16 0C D3 AF CD D0 11 8A 3E 00 C0 4F C9 E2 6E = IWebBrowser2 as bytes
- string: "D30C1661-CDAF-11D0-8A3E-00C04FC9E26E"
description: IWebBrowser2 as guid string
- bytes: 61 16 0C D3 AF CD D0 11 8A 3E 00 C0 4F C9 E2 6E = IWebBrowser2 as bytes
```
Note: I added the description field for the bytes entries in the translated representation to match the provided example where the comments are included. This helps to maintain consistency in the documentation.