Files
codeql/csharp/ql/campaigns/Solorigate/src/NumberOfKnownHashesAboveThreshold.qhelp
Andrew Eisenberg 50ee4ab330 Solorigate: Extract to separate qlpack
Extracts solorigate to separate qlpacks in preparation for
publishing them to the registry.
2021-12-16 16:09:20 -08:00

13 lines
528 B
XML

<!DOCTYPE qhelp PUBLIC
"-//Semmle//qhelp//EN"
"qhelp.dtd">
<qhelp>
<overview>
<p>This query detects literals that look like Solorigate Hash values used in the Solorigate code.</p>
<p>This query detects when the code includes at least 5 of the Hash literals used in the Solorigate tampered code</p>
<p>Please notice that by themselves these literals are not malign, but several of the values together would be less likely to be coincidental.</p>
</overview>
<include src="Solorigate.inc.qhelp" />
</qhelp>