rule:
meta:
name: use .NET library Newtonsoft.Json
namespace: data-manipulation/json
authors:
- "@johnk3r"
scopes:
static: file
dynamic: file
references:
- https://www.welivesecurity.com/2021/04/06/janeleiro-time-traveler-new-old-banking-trojan-brazil/
examples:
- 387f15043f0198fd3a637b0758c2b6dde9ead795c3ed70803426fc355731b173
features:
- and:
- match: compiled to the .NET platform
- string: "Newtonsoft.Json"
last edited: 2023-11-24 10:34:28