Merge pull request #346 from CybercentreCanada/id_vbs

Adding strong indicators for vbs
CybercentreCanada · Sep 2, 2021 · 13d8132 · 13d8132
2 parents a7ab80d + f244beb
commit 13d8132
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/assemblyline/common/identify.py b/assemblyline/common/identify.py
@@ -30,6 +30,8 @@
         re.compile(rb'(^|\n)ExecuteGlobal'),
         re.compile(rb'(^|\n)REM[ \t]+'),
         re.compile(rb'(ubound|lbound)\('),
+        re.compile(rb'CreateObject\('),
+        re.compile(rb'Set[ \t]*\w+[ \t]*=[ \t]*'),
     ],
     'code/javascript': [
         re.compile(rb'function([ \t]*|[ \t]+[\w]+[ \t]*)\([\w \t,]*\)[ \t]*{'),