Update generate-random-numbers-via-rtlgenrandom.yml (#828)

mandiant · Oct 9, 2023 · e454699 · e454699
1 parent 5e1ae79
commit e454699
Showing 1 changed file with 8 additions and 4 deletions.
diff --git a/data-manipulation/prng/generate-random-numbers-via-rtlgenrandom.yml b/data-manipulation/prng/generate-random-numbers-via-rtlgenrandom.yml
@@ -4,19 +4,23 @@ rule:
     namespace: data-manipulation/prng
     authors:
       - [email protected]
+      - [email protected]
     scope: function
     mbc:
       - Cryptography::Generate Pseudo-random Sequence::Use API [C0021.003]
+    references:
+      - https://doxygen.reactos.org/df/d13/sysfunc_8c_source.html
+      - https://blog.gentilkiwi.com/tag/systemfunction036
     examples:
-      - b7841b9d5dc1f511a93cc7576672ec0c:0x10002B80
-      - 0a0882b8da225406cc838991b5f67d11:0x416F35
+      - b7841b9d5dc1f511a93cc7576672ec0c:0x10002B80 # api
+      - 0a0882b8da225406cc838991b5f67d11:0x416F35 # string
   features:
     - or:
       - api: SystemFunction036
       - and:
         - match: link function at runtime on Windows
         - string: "SystemFunction036"
         - optional:
-          - string: "advapi32.dll"
-          - string: "Advapi32.dll"
+          - string: /advapi32/i
+          - string: /cryptsp/i
           - characteristic: indirect call