PE import table
Neslog <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CALgfRGLR7=UW9zidSginmPjeoe-g9KipwKJ8uuvucRpzNv9jkw@mail.gmail.com> |
I'd like to generate an alert for Go binaries for Windows platforms. Looks
like there's a .symtab section and I'd like to pattern match in that
section. I'd like to do something like below.
event pe_section_header(f: fa_file, h: PE::SectionHeader)
if ( /symtab/ in h$name )
if ( /Go build ID/ in h$data ) #h$data not available yet?
Raise notice.
Has anyone done anything like this yet?
_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek