Add PE Header Information about hijacklibs

[wietze]

That's right, for that reason hunting for the DLLs is preferred. Nevertheless, you're right, you could hunt for the executables as well, based on other properties than filename/location. Would #13 meet your use case?

[Cyb3r-Monk]

Just hunting for the DLL(based on its expected location) created lots of false positives in my case. Looks like #13 meets my use case.

[mgreen27]

Just adding a +1: VersionInformation + Signiture details to reduce FPs.

Looking at some VQL automation. For example, hunt MFT for dllname > check path > check VersionInfoirmation > check signiture would be the methodology.

[wietze]

Supported via #31 and #36; closing this issue for now. Thanks for the suggestions.