From cf1459567418c2babcddf51abd8f25b0037d151f Mon Sep 17 00:00:00 2001 From: Vatsal Jagani Date: Tue, 14 Mar 2023 18:38:43 +0530 Subject: [PATCH] Made ransomware notes lookup case insensitive. --- dist/escu/default/transforms.conf | 2 ++ lookups/ransomware_notes_lookup.yml | 1 + 2 files changed, 3 insertions(+) diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 275cd4aa12..caa558fcb9 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -338,6 +338,7 @@ case_sensitive_match = false # description = A list of file extensions that are associated with ransomware match_type = WILDCARD(Extensions) min_matches = 1 +case_sensitive_match = false [ransomware_notes_lookup] filename = ransomware_notes.csv @@ -345,6 +346,7 @@ default_match = false # description = A list of file names that are ransomware note files match_type = WILDCARD(ransomware_notes) min_matches = 1 +case_sensitive_match = false [remote_access_software] filename = remote_access_software.csv diff --git a/lookups/ransomware_notes_lookup.yml b/lookups/ransomware_notes_lookup.yml index c32a61f558..09528ba84e 100644 --- a/lookups/ransomware_notes_lookup.yml +++ b/lookups/ransomware_notes_lookup.yml @@ -4,3 +4,4 @@ filename: ransomware_notes.csv match_type: WILDCARD(ransomware_notes) min_matches: 1 name: ransomware_notes_lookup +case_sensitive_match: 'false'