Import analyzer plugin rule suggestions vol. 2 about manalyze HOT 3 CLOSED

Thanks for these! I'll add them very soon as well.

from manalyze.

• According to the MSDN, LoadDriver is only available in Windows Mobile. As such, I'm not sure it should be included.
• I have also tried to use LoadTypeLib to load a library such as kernel32, but was unable to do so - I'm assuming it can only be used to load .tlb libraries.
• To the best of my knowledge, the WMI isn't accessed with direct WMI* calls but through COM requests instead. Are there specific WMI functions that you know about? In any case, thinking about the WMI gave me the idea to add all the well known namespaces (i.e. ROOT\CIMV2) to the suspicious strings plugin, so thanks for that!

I'm pushing the commit adding the rest of the suggestions in a minute, let me know if you consider that this issue can be closed.

from manalyze.

Yeah, that's fine with me.

from manalyze.