File detection signature - ISO
"Darren S." <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAKVSOJVr4LLNbJSyFMDn-hdqmLhfVfBPyrHNO8=+j_s8UsdJ1w@mail.gmail.com> |
ISO files (ISO 9660 media images) - magic bytes 43 44 30 30 31 (CD001) at offset(s). Is this omitted intentionally for any reason (confidence or similar), or is it sensible to add a signature for this? Just noting delivery of malicious ISO files as malware containers over recent years. I notice recent libmagic having a couple of entries for this. How would an update or addition typically happen? https://github.com/zeek/zeek/tree/master/scripts/base/frameworks/files/magic -- Darren Spruell [email protected] _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek