The example report from Mandiant specifies hashes as follows:
"pattern": "[file:hashes.md5 = '001dd76872d80801692ff942308c64e6']"
According to Section 10.7 of the specification, the common hashing algorithms need to be uppercase.
Some security products do not recognize file:hashes.md5 as an MD5 hash and will ignore the pattern or even crash.
It would be a good idea to replace the first example on the webpage with one that follows the specification exactly.
The example report from Mandiant specifies hashes as follows:
According to Section 10.7 of the specification, the common hashing algorithms need to be uppercase.
Some security products do not recognize
file:hashes.md5as an MD5 hash and will ignore the pattern or even crash.It would be a good idea to replace the first example on the webpage with one that follows the specification exactly.