mirror of
https://github.com/mandiant/capa-rules
synced 2026-06-08 15:41:20 +00:00
Yacine Elhamer
19 lines
710 B
YAML
19 lines
710 B
YAML
rule:
|
|
meta:
|
|
name: reference Base58 string
|
|
namespace: data-manipulation/encoding/base58
|
|
authors:
|
|
- william.ballenthin@mandiant.com
|
|
description: Similar to Base64, but modified to avoid both non-alphanumeric characters (+ and /) and letters that might look ambiguous when printed (0, I, O, and l). Base58 is used to represent bitcoin addresses.
|
|
scopes:
|
|
static: file
|
|
dynamic: file
|
|
att&ck:
|
|
- Defense Evasion::Obfuscated Files or Information [T1027]
|
|
mbc:
|
|
- Data::Encode Data [C0026]
|
|
references:
|
|
- https://en.wikipedia.org/wiki/Binary-to-text_encoding#Base58
|
|
features:
|
|
- string: /123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz/
|