This rule detects files compiled by the V8 Javascript engine.

INFO_V8_Javascript_Engine_Jul_11.yar

import "pe"

rule INFO_V8_Javascript_Engine_Jul_11 : INFO JS COMPILER { 
meta:
  description = "This rule detects files compiled by the V8 Javascript engine."
  author      = "@brkalbyrk7"
  date        = "2024-07-10"
  sharing     = "TLP:WHITE"
  tags        = "info,javascript,compiler"
  reference   = "https://github.com/v8/v8"
  os          = "multi"
  category    = "Info"
strings:
	$mlin1 = "_ZN2v88internal" wide ascii
 	$mlin2 = "_ZNK2v88internal" wide ascii
	$mlin3 = "_ZNSt8_Rb_tree" wide ascii
 	$mlin4 = "V8_TORQUH" wide ascii
 	$mlin5 = "_ZTVN2v88internal" wide ascii
	$mlin6 = "_ZN2v84base" wide ascii
 	condition: 
	uint16(0x02) == 0xC0DE or pe.exports(/internal@v8@@@/) or (2 of ( $mlin* ) )
}