Common Information
| Type | Value |
|---|---|
| Value |
rule hunting_msix_appx {
strings:
$a00 = "AppxManifest.xml"
$a01 = "AppxBlockMap.xml"
$a03 = "AppxSignature.p7x"
condition:
uint16(0) == 0x4b50 and all of them
}
|
| Category | |
| Type | Yara Rule |
| Misp Type | |
| Description |