fibratus
fibratus copied to clipboard
Compute PE imphash
Since we're gathering imported symbols via PE parsing, we could compute the import hash, most commonly referred to imphash.
We could simply adapt the pefile-go imphash logic to an existing code in fibratus by creating a new pkg/pe/imphash.go source file.
It would be valuable to provide a config flag by which users could control the imphash calculation. Capture file marshaling logic needs adjustments in order to support the new Imphash field in PE metadata. Similarly, we should register a new filter field to allow building filter expressions such as pe.imphash = '2c26ec4a570a502ed3e8484295581989'.