Add 'internal_name' attribute to 'file' object. #1322
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
davemcatcisco
requested review from
floydtree,
pagbabian-splunk,
Aniak5,
mikeradka,
zschmerber and
jonrau-at-queryai
as code owners
davemcatcisco
added
non_breaking
mikeradka
reviewed
Jan 22, 2025
jonrau-at-queryai
previously approved these changes
Jan 22, 2025
mikeradka
approved these changes
Jan 22, 2025
floydtree
approved these changes
Jan 22, 2025
|
Thanks, all. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of changes:
This PR adds an
internal_nameto the dictionary and to thefileobject. This attribute is intended to capture the name of the file as identified within the file itself. This contrasts with the name by which the file is known on disk.Where available, the internal name is widely used by security practitioners and detection content because the on-disk file name is not reliable.
On the Windows OS, most PE files contain a
VERSIONINFOresource from which the internal name can be obtained.On macOS, binaries can optionally embed a copy of the application's Info.plist file which in turn contains the name of the executable (#NotAMacGuy).