Adding comment to the examples if detected by api or string
changing of:
string: "advapi32.dll" to string: /advapi32/i: .dll is not needed and could be appended by the OS, and the string as argument is used in a case-insensitive way
deletion of line 21: it is covered by the regex string
https://github.com/mandiant/capa-rules/blame/b9c2bc120e21154fd7e3e1d8b7150f8de92b1a50/data-manipulation/prng/generate-random-numbers-via-rtlgenrandom.yml
Dear Willi,
fantastic rule; thank you for insipiration. What do you think about these changes?
string: "advapi32.dll"
tostring: /advapi32/i
:.dll
is not needed and could be appended by the OS, and the string as argument is used in a case-insensitive wayIt is only an idea and I hope you like it. :)
Kind regards, Richard