diff --git a/assemblyline/common/identify.py b/assemblyline/common/identify.py index 051eec5aa..4b374037d 100644 --- a/assemblyline/common/identify.py +++ b/assemblyline/common/identify.py @@ -124,7 +124,9 @@ # Match one of the common Classes (case-insensitive) re.compile(rb'(?i)(-memberDefinition|-Name|-namespace|-passthru|-command|-TypeName)'), # Match one of the common Methods (case-insensitive) - re.compile(rb'(?i)(\.Get(String|Field|Type|Method)|FromBase64String)\(') + re.compile(rb'(?i)(\.Get(String|Field|Type|Method)|FromBase64String)\('), + # A .NET class that is commonly used in PowerShell + re.compile(rb'(?i)(System\.Net\.WebClient)'), ] } STRONG_SCORE = 15