2022-12-19 12:12:50 +01:00
|
|
|
{% if SCAN_MACROS == 'True' %}
|
2022-11-24 11:40:10 +01:00
|
|
|
# local.d/external_services_group.conf
|
|
|
|
|
|
|
|
description = "Oletools content rules";
|
|
|
|
symbols = {
|
|
|
|
"OLETOOLS" {
|
|
|
|
weight = 1.0;
|
|
|
|
description = "OLETOOLS found a Macro";
|
|
|
|
one_shot = true;
|
|
|
|
},
|
2022-11-24 12:25:41 +01:00
|
|
|
"OLETOOLS_MACRO_FOUND" {
|
|
|
|
weight = 0.0;
|
|
|
|
one_shot = true;
|
|
|
|
},
|
|
|
|
"OLETOOLS_AUTOEXEC" {
|
|
|
|
weight = 0.0;
|
|
|
|
one_shot = true;
|
|
|
|
},
|
2022-11-24 13:51:54 +01:00
|
|
|
"OLETOOLS_FLAG" {
|
2022-11-24 12:25:41 +01:00
|
|
|
weight = 0.0;
|
|
|
|
one_shot = true;
|
|
|
|
},
|
|
|
|
"OLETOOLS_VBASTOMP" {
|
|
|
|
weight = 0.0;
|
|
|
|
one_shot = true;
|
|
|
|
},
|
|
|
|
"OLETOOLS_A" {
|
|
|
|
weight = 0.0;
|
|
|
|
one_shot = true;
|
|
|
|
},
|
|
|
|
"OLETOOLS_W" {
|
|
|
|
weight = 0.0;
|
|
|
|
one_shot = true;
|
|
|
|
},
|
|
|
|
"OLETOOLS_X" {
|
|
|
|
weight = 0.0;
|
|
|
|
one_shot = true;
|
|
|
|
},
|
2022-11-24 11:40:10 +01:00
|
|
|
}
|
2022-12-19 12:12:50 +01:00
|
|
|
{% endif %}
|