I recently imported some custom yara rules into the Malware Analysis
appliance. These particular rules had a large condition set that relied
on pe.imphash() so first off the .yara file has an import for pe, just
to be sure: import pe-------- A test o...
Perfect! Thank-you William. Might I recommend an update documentation of
the customHeaders() function on the mail_lua_options page.
https://community.rsa.com/docs/DOC-67106
William,I know this thread is a bit dated, but I'm in need of the same
"message-id" header being parsed into metadata. I have reviewed the
Parsers book and specifically the mail.lua file. I note in there that
parser is already attempting to tokenize ...
