linked-against-go-process-enumeration-library.yml

rule:
  meta:
    name: linked against Go process enumeration library
    namespace: host-interaction/process/list
    authors:
      - joakim@intezer.com
    description: Enumerating processes using a Go library
    scope: file
    att&ck:
      - Discovery::Process Discovery [T1057]
      - Discovery::Software Discovery [T1518]
    references:
      - https://pkg.go.dev/github.com/mitchellh/go-ps
  features:
    - and:
      - match: compiled with Go
      - or:
        - string: "github.com/mitchellh/go-ps.FindProcess"
        - string: "github.com/mitchellh/go-ps.Processes"