williballenthin · January 4, 2023 08:23
diff --git a/DotnetStartupHook.yar b/DotnetStartupHook.yar
 import "dotnet"

 rule DotnetStartupHook { 
  meta:
    description = "might be a .NET startup hook module"
    author = "William Ballenthin <[email protected]>"
  strings:
     $a1 = "StartupHook"
     $a2 = "Initialize"
  condition: 
    uint16(0) == 0x5A4D 
    and dotnet.is_dotnet
    and all of them
 }
	import "dotnet"

	rule DotnetStartupHook {
	meta:
	description = "might be a .NET startup hook module"
	author = "William Ballenthin <[email protected]>"
	strings:
	$a1 = "StartupHook"
	$a2 = "Initialize"
	condition:
	uint16(0) == 0x5A4D
	and dotnet.is_dotnet
	and all of them
	}