Daniel Stinson-Diess shellcromancer

## zip_ext.yara
rule zip_with_ext
{
    meta:
        author = "@jaydinbas"
        description = "Only match zip files containing desired file extensions"

    strings:
        $file_sig = "PK\x03\x04"    //zip header sig
        $entry_sig = "PK\x01\x02"   //ZIPDIRENTRY sig

## 100_days_of_yara.yar
/*
Goals for #100DaysofYARA:

better understanding of bitwise operators
use math module beyond general entropy of a section / resource
position specific things beyond what PE module tells us
do some funky stuff with hashing


*/
	rule zip_with_ext
	{
	meta:
	author = "@jaydinbas"
	description = "Only match zip files containing desired file extensions"

	strings:
	$file_sig = "PK\x03\x04" //zip header sig
	$entry_sig = "PK\x01\x02" //ZIPDIRENTRY sig
	/*
	Goals for #100DaysofYARA:

	better understanding of bitwise operators
	use math module beyond general entropy of a section / resource
	position specific things beyond what PE module tells us
	do some funky stuff with hashing


	*/