public sealed class SuspiciousFlagsRule : IValidationRule
{
public string RuleName => nameof(SuspiciousFlagsRule);
public ValidationSeverity Severity => ValidationSeverity.Warning;
public Task<ValidationResult> ValidateAsync(PeImageInfo peInfo, CancellationToken cancellationToken)
{
var suspicious = false;
foreach (var section in peInfo.Sections)
{
if ((section.Characteristics & 0x02000000) != 0 && (section.Characteristics & 0x20000000) == 0)
{
suspicious = true;
break;
}
}
return Task.FromResult(new ValidationResult(RuleName, Severity, !suspicious, suspicious ? "Suspicious section flags detected." : "No suspicious flags detected."));
}
}