Skip to content

Commit

Permalink
vverbose: don't show examples in output
Browse files Browse the repository at this point in the history
closes #970
  • Loading branch information
williballenthin authored and mr-tz committed Apr 7, 2022
1 parent 86fa5f3 commit 7ee3cce
Showing 1 changed file with 7 additions and 1 deletion.
8 changes: 7 additions & 1 deletion capa/render/vverbose.py
Original file line number Diff line number Diff line change
Expand Up @@ -196,7 +196,6 @@ def render_rules(ostream, doc):
author michael.hunhoff@mandiant.com
scope function
mbc Anti-Behavioral Analysis::Detect Debugger::OutputDebugString
examples Practical Malware Analysis Lab 16-02.exe_:0x401020
function @ 0x10004706
and:
api: kernel32.SetLastError @ 0x100047C2
Expand Down Expand Up @@ -234,6 +233,13 @@ def render_rules(ostream, doc):
if key == "name" or key not in rule["meta"]:
continue

if key == "examples":
# I can't think of a reason that an analyst would pivot to the concrete example
# directly from the capa output.
# the more likely flow is to review the rule and go from there.
# so, don't make the output messy by showing the examples.
continue

v = rule["meta"][key]
if not v:
continue
Expand Down

0 comments on commit 7ee3cce

Please sign in to comment.