mirror of
https://github.com/mandiant/capa.git
synced 2025-12-22 23:26:21 -08:00
add thread scope
This commit is contained in:
@@ -145,12 +145,25 @@ def test_ruleset():
|
||||
"""
|
||||
)
|
||||
),
|
||||
capa.rules.Rule.from_yaml(
|
||||
textwrap.dedent(
|
||||
"""
|
||||
rule:
|
||||
meta:
|
||||
name: thread rule
|
||||
scope: thread
|
||||
features:
|
||||
- api: RegDeleteKey
|
||||
"""
|
||||
)
|
||||
),
|
||||
]
|
||||
)
|
||||
assert len(rules.file_rules) == 1
|
||||
assert len(rules.function_rules) == 1
|
||||
assert len(rules.basic_block_rules) == 1
|
||||
assert len(rules.process_rules) == 1
|
||||
assert len(rules.thread_rules) == 1
|
||||
|
||||
|
||||
def test_match_across_scopes_file_function(z9324d_extractor):
|
||||
|
||||
Reference in New Issue
Block a user