added match of prior matching rule 'link function at runtime on Windo…

…ws' and rearranged the features section
mandiant · Sep 15, 2023 · 55f5496 · 55f5496
1 parent bc8d5b7
commit 55f5496
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/nursery/encrypt-data-using-rc4-via-systemfunction032.yml b/nursery/encrypt-data-using-rc4-via-systemfunction032.yml
@@ -19,7 +19,8 @@ rule:
     - or:
       - api: SystemFunction032
       - and:
+        - match: link function at runtime on Windows
+        - string: "SystemFunction032"
         - or:
           - string: /advapi32/i
           - string: /cryptsp/i
-        - string: "SystemFunction032"