cuckoosandbox / community

Repository of modules and signatures contributed by the community
323 stars 175 forks source link

Added safelist for the exploit_heapspray signature #489

Closed cccs-kevin closed 2 years ago

cccs-kevin commented 3 years ago

Based on thousands of samples submitted and analyzed, I found that benign Word and Excel files were raising this signature. Therefore converted signature to use a safelist and added Word and Excel file types.