Skip to content

Conversation

@JakePeralta7
Copy link
Contributor

Added example and moved from nursery to host-interaction/user.

mandiant/capa-testfiles#293

P.S. There is no need for the *Ex or clause, right?

Renamed impersonate-user.yml from nursery to host-interaction/user and added an examples section with a sample hash.
Copy link
Collaborator

@mike-hunhoff mike-hunhoff left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, I've left a quick comment for you to address.

@mike-hunhoff
Copy link
Collaborator

Also @JakePeralta7 , lints are failing now:

INFO     lint: rule "impersonate user" does not match for sample     lint.py:409
         bf9a888e226d8396e84e042732daf32b8c1df8fd675eb128e8da3f0d776            
         8bea5                                                                  

 impersonate user
  FAIL: doesn't match on referenced example: Fix the rule logic or provide a 
different example

Removed optional and or conditions for GetUserName and DuplicateToken APIs
@JakePeralta7
Copy link
Contributor Author

Also @JakePeralta7 , lints are failing now:

INFO     lint: rule "impersonate user" does not match for sample     lint.py:409
         bf9a888e226d8396e84e042732daf32b8c1df8fd675eb128e8da3f0d776            
         8bea5                                                                  

 impersonate user
  FAIL: doesn't match on referenced example: Fix the rule logic or provide a 
different example

Yeah, that's because of the Ex

Copy link
Collaborator

@mike-hunhoff mike-hunhoff left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, LGTM 🚀

@mike-hunhoff mike-hunhoff merged commit 5d990ad into mandiant:master Sep 3, 2025
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants