CAPE_Defendnot

rule CAPE_Defendnot : FILE
{
	meta:
		description = "Defendnot Payload"
		author = "kevoreilly"
		id = "415181b5-1d12-57d8-9849-07ed340ade54"
		date = "2026-09-22"
		modified = "2026-09-22"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/Defendnot.yar#L1-L15"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		hash = "b0870e105c7ad37fb0bdcb9305279b2943810d55300e8721eb64bdaa588cc84e"
		logic_hash = "77bdd1891d42947b254ffb0b274071e92e7fb7c62bdaa31793258a23a495e477"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Defendnot Payload"

	strings:
		$string1 = "defendnot"
		$string2 = "Got HRESULT={:#x} at\n{}:{}"
		$string3 = "init: {:#x}"
		$string4 = "AV Name can not be empty!"

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}