bytes to com

mandiant · Dec 16, 2023 · 3d2d0f0 · 3d2d0f0
1 parent 8a07f65
commit 3d2d0f0
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/host-interaction/hardware/enumerate-devices-by-category.yml b/host-interaction/hardware/enumerate-devices-by-category.yml
@@ -15,10 +15,10 @@ rule:
   features:
     - and:
       - and:
-        - bytes: 10 5D BE 62 EB 60 D0 11 BD 3B 00 A0 C9 11 CE 86 = SystemDeviceEnum
-        - bytes: 22 08 84 29 84 5B D0 11 BD 3B 00 A0 C9 11 CE 86 = ICreateDevEnum
+        - com/class: SystemDeviceEnum  # 10 5D BE 62 EB 60 D0 11 BD 3B 00 A0 C9 11 CE 86 = SystemDeviceEnum
+        - com/interface: ICreateDevEnum  # 22 08 84 29 84 5B D0 11 BD 3B 00 A0 C9 11 CE 86 = ICreateDevEnum
         - offset: 0xC = ICreateDevEnumVtbl.CreateClassEnumerator
       - optional:
         - description: class identifier (CLSID) of the device category
-        - bytes: 10 B3 0B 86 01 5D D0 11 BD 3B 00 A0 C9 11 CE 86 = CVidCapClassManager
-        - bytes: 62 A7 D9 33 C8 90 D0 11 BD 43 00 A0 C9 11 CE 86 = CWaveinClassManager
+        - com/class: CVidCapClassManager  # 10 B3 0B 86 01 5D D0 11 BD 3B 00 A0 C9 11 CE 86 = CVidCapClassManager
+        - com/class: CWaveinClassManager  # 62 A7 D9 33 C8 90 D0 11 BD 43 00 A0 C9 11 CE 86 = CWaveinClassManager