executable/pe

implement COM DLL

rule:
  meta:
    name: implement COM DLL
    namespace: executable/pe
    authors:
      - moritz.raabe@mandiant.com
    scopes:
      static: file
      dynamic: file
    references:
      - https://learn.microsoft.com/en-us/windows/win32/api/combaseapi/nf-combaseapi-dllgetclassobject
  features:
    - and:
      - export: DllGetClassObject
      - optional:
        - export: DllRegisterServer

last edited: 2023-11-24 10:35:05