contain-an-embedded-pe-file.yml

rule:
  meta:
    name: contain an embedded PE file
    namespace: executable/subfile/pe
    author: moritz.raabe@fireeye.com
    scope: file
    mbc:
      - Execution::Install Additional Program [B0023]
    examples:
      - Practical Malware Analysis Lab 01-04.exe_:0x4060
  features:
    - count(characteristic(embedded pe)): 1 or more