Adding strong indicators for vbs

CybercentreCanada · Sep 2, 2021 · f244beb · f244beb
1 parent 3ca6722
commit f244beb
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/assemblyline/common/identify.py b/assemblyline/common/identify.py
@@ -30,6 +30,8 @@
         re.compile(rb'(^|\n)ExecuteGlobal'),
         re.compile(rb'(^|\n)REM[ \t]+'),
         re.compile(rb'(ubound|lbound)\('),
+        re.compile(rb'CreateObject\('),
+        re.compile(rb'Set[ \t]*\w+[ \t]*=[ \t]*'),
     ],
     'code/javascript': [
         re.compile(rb'function([ \t]*|[ \t]+[\w]+[ \t]*)\([\w \t,]*\)[ \t]*{'),