mirror of
https://github.com/mandiant/capa.git
synced 2026-01-18 07:36:37 -08:00
26 lines
860 B
Python
26 lines
860 B
Python
import termcolor
|
|
|
|
|
|
def bold(s):
|
|
"""draw attention to the given string"""
|
|
return termcolor.colored(s, 'blue')
|
|
|
|
|
|
def capability_rules(doc):
|
|
"""enumerate the rules in (namespace, name) order that are 'capability' rules (not lib/subscope/disposition/etc)."""
|
|
for rule in sorted(map(lambda rule: (rule['meta']['namespace'], rule['meta']['name'], rule), doc.values())):
|
|
if rule['meta'].get('lib'):
|
|
continue
|
|
if rule['meta'].get('capa/subscope'):
|
|
continue
|
|
if rule['meta'].get('maec/analysis-conclusion'):
|
|
continue
|
|
if rule['meta'].get('maec/analysis-conclusion-ov'):
|
|
continue
|
|
if rule['meta'].get('maec/malware-category'):
|
|
continue
|
|
if rule['meta'].get('maec/malware-category-ov'):
|
|
continue
|
|
|
|
yield rule
|