From f4ed1e05fca200d6c7c77d0f6d9dcb8b94c1e87b Mon Sep 17 00:00:00 2001
From: Arne Welzel <arne.welzel@corelight.com>
Date: Mon, 26 Feb 2024 20:59:01 +0100
Subject: [PATCH] signatures/iso-9660: Add \x01 suffix to CD001

As discussed with Tim, that should make it a bit more robust against
false positives.
---
 scripts/policy/frameworks/signatures/iso-9660.sig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/policy/frameworks/signatures/iso-9660.sig b/scripts/policy/frameworks/signatures/iso-9660.sig
index b6389721da..b4878a87eb 100644
--- a/scripts/policy/frameworks/signatures/iso-9660.sig
+++ b/scripts/policy/frameworks/signatures/iso-9660.sig
@@ -6,5 +6,5 @@
 # results in major performance degradation.
 signature file-iso9660 {
         file-mime "application/x-iso9660-image", 99
-        file-magic /.*CD001/
+        file-magic /.*CD001\x01/
 }