Additional Syntax Opportunities

[infosec-intern]

Modules

Probably something along the lines of support.class or support.function according to this textmate documentation

Off the top of my head, there are a few parts that need matching:

• Module name (pe, elf, cuckoo, etc.)
• Constants (pe.DLL)
• Functions (pe.imports(''))
• Arrays/Dictionaries (pe.version_info[''])

And any of the entries that need strings (e.g. dictionaries) should mark those as string.quoted.double just like regular strings

Rule Tags

Should be pretty straightforward - any words after a colon (:) on the same line as a rule

rule Test : Foo Bar Baz