Summary

referenece analysis tools strings (anti-analysis)

• the rules' regex : \ regex(\frida(.exe)?/?) hits so many false positives

Examples

the rule hits any sample that has the string "Friday" which is common string that got generated by many compilers.

Possible improvements

modify the regex to : (?i)(^|[^a-z0-9_])frida(.exe)?($|[^a-z0-9_])

Additional context