Checks if any command line call is equal to the deleted file, not only the first one

cuckoosandbox / community

Repository of modules and signatures contributed by the community

324 stars 175 forks source link

Checks if any command line call is equal to the deleted file, not only the first one #372

Open anna-g-arbeiter opened 6 years ago

anna-g-arbeiter commented 6 years ago

Currently the signature only checks if the first command_line entry of the report is equal to one of the deleted files. In case of more than one command line calls the position of the matching call in the report cannot be predicted, therefore it has to be checked if any of the calls is equal to one of the deleted files.

kevross33 commented 6 years ago

Hi,

Can you update it with the name change to deletes_executed and also in the signature description, classname etc. and I will close off my pull request. Thanks

https://github.com/cuckoosandbox/community/pull/333