mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
1759205930
This signature is relevant for process dumps on Windows that could be extracted by various tools. The unencrypted transmission of the dump of a critical system process (for example, lsass.exe) via network would be detected by this rule. |
||
|---|---|---|
| .. | ||
| magic | ||
| __load__.zeek | ||
| main.zeek | ||
| README | ||
The file analysis framework provides an interface for driving the analysis of files, possibly independent of any network protocol over which they're transported.