Create SmartAssembly packer

techniques/SmartAssembly/README.md

@@ -0,0 +1,16 @@
+# *SmartAssembly*
+## Authorship information
+* Name: *Euler Neto*
+* Twitter: *https://twitter.com/netonightmare*
+* Website: *https://netoeuler.github.io*
+
+## Technique Information
+* Technique title: Smart Assembly
+* Technique category: Packers
+* Technique description: SmartAssembly is an obfuscator that helps protect the application against reverse-engineering or modification, by making it difficult for a third-party to access the source code.
+
+## Additional resources
+* https://www.red-gate.com/products/smartassembly/
+
+## Detection rules
+* `smart_assembly.yar`

techniques/SmartAssembly/smart_assembly.yar

@@ -0,0 +1,15 @@
+rule smart_assembly
+{
+  meta:
+    author = "Euler Neto"
+    description = "Rule to detect the utilization of the .NET packer SmartAssembly"
+    target_entity = "file"
+  strings:
+    $sig1 = "SmartAssembly.Attributes"
+    $sig2 = "Powered by SmartAssembly"
+    $s1 = "#Strings"
+  condition:
+    uint16(0) == 0x5a4d
+    and any of ($sig*)
+    and $s1
+}