Skip to content

Instantly share code, notes, and snippets.

@stvemillertime

stvemillertime/golang.yar

Created March 18, 2019 13:38
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save stvemillertime/8cb84d37d47d9ff70182ca2f6a711fcb to your computer and use it in GitHub Desktop.
Save stvemillertime/8cb84d37d47d9ff70182ca2f6a711fcb to your computer and use it in GitHub Desktop.
Download ZIP
Raw
golang.yar
rule methodology_golang_build_strings
{
meta:
author = "smiller"
version = "1.0"
date = "10/5/2038"
description = "Looks for PEs with a Golang build ID"
reference_hash = "94fa902d1473c35659d2396eccde596c"
strings:
$a01 = "go.buildid"
$a02 = "Go build ID:"
condition:
uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and 2 of them and filesize < 8MB
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment