Merge branch 'master' into rules52-21

mandiant · May 26, 2023 · 0bf564e · 0bf564e
2 parents 3a4bcbe + 11b9f29
commit 0bf564e
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 2 deletions.
diff --git a/README.md b/README.md
@@ -1,7 +1,7 @@
 # capa rules
 
 [![Rule linter status](https://github.com/mandiant/capa-rules/workflows/CI/badge.svg)](https://github.com/mandiant/capa-rules/actions?query=workflow%3A%22CI%22)
-[![Number of rules](https://img.shields.io/badge/rules-797-blue.svg)](rules)
+[![Number of rules](https://img.shields.io/badge/rules-796-blue.svg)](rules)
 [![License](https://img.shields.io/badge/license-Apache--2.0-green.svg)](LICENSE.txt)
 
 This is the standard collection of rules for [capa](https://github.com/mandiant/capa) - the tool to automatically identify capabilities of programs.

diff --git a/executable/resource/extract-resource-via-kernel32-functions.yml b/executable/resource/extract-resource-via-kernel32-functions.yml
@@ -18,7 +18,6 @@ rule:
           - api: kernel32.LockResource
           - api: LdrAccessResource
         - optional:
-          - section: .rsrc
           - api: kernel32.GetModuleHandle
           # may occur in parent function, see 0664B09A86EC2DF7DFE01A93E184A1FA23DF66EA82CAB39000944E418EC1F7B2
           - or: