diff --git a/assemblyline/common/identify.py b/assemblyline/common/identify.py index 0ff95b9d8..2ba5df2b3 100644 --- a/assemblyline/common/identify.py +++ b/assemblyline/common/identify.py @@ -142,6 +142,7 @@ rb'Math\.(round|pow|sin|cos)\(', rb'(isNaN|isFinite|parseInt|parseFloat)\(', b'WSH', + rb'(document|window)\[' ], 'code/jscript': [rb'new[ \t]+ActiveXObject\(', rb'Scripting\.Dictionary'], 'code/pdfjs': [rb'xfa\.((resolve|create)Node|datasets|form)', rb'\.oneOfChild'], diff --git a/test/test_identify.py b/test/test_identify.py index bc5dc6614..8f6560b12 100644 --- a/test/test_identify.py +++ b/test/test_identify.py @@ -350,6 +350,8 @@ def test_strong_indicators(code_snippet, code_types): (b"parseInt(", ["code/javascript"]), (b"parseFloat(", ["code/javascript"]), (b"WSH", ["code/javascript", "code/vbs"]), + (b"document[", ["code/javascript"]), + (b"window[", ["code/javascript"]), # JScript (b"new ActiveXObject(", ["code/jscript"]), (b"new\tActiveXObject(", ["code/jscript"]),