fix: ignore false positive

Yamato-Security · Dec 3, 2024 · 3dc44c7 · 3dc44c7
1 parent 1328db1
commit 3dc44c7
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/src/timeline/extract_base64.rs b/src/timeline/extract_base64.rs
@@ -290,6 +290,9 @@ fn create_base64_extracted_record(
                 .replace(b64.base64_str().as_str(), "<Base64String>")
                 .to_string();
             let no_pad_original = BASE64_PAD.replace_all(original.as_str(), "<Base64String>");
+            if no_pad_original.contains("-<Base64String>") {
+                continue;
+            }
             let row = vec![
                 evtx.ts.to_string(),
                 evtx.computer.clone(),