rule:
meta:
name: contain a thread local storage (.tls) section in .NET
namespace: executable/pe/section/tls
authors:
- michael.hunhoff@mandiant.com
description: .NET file contains uncommon TLS section
scopes:
static: file
dynamic: file
references:
- https://washi.dev/blog/posts/entry-points/
features:
- and:
- match: contain a thread local storage (.tls) section
- format: dotnet
last edited: 2023-11-24 10:34:28