BFI - Creating Custom Signature of File Path

[cstoneba]

I’d like to create a custom signature in BFI where the file name = blah.sh and the path contains “/test”. Do I need to use an Extended signature?

Would it be like this?

<Variable name="IS_INSTALLED" export="true">
  <Compare type="string" relation="ne">
    <VectorToScalar>
      <Vector filter="/test*">
        <FindFilePathEx name="blah.sh"/>
      </Vector>
    </VectorToScalar>
    <ValueOf value="" />
  </Compare>
</Variable>

[ssakunala]

The signature will detect the instance but will not report the discovery path. If discovery path is needed, then the following should help:

<MultipleInstance>
	<Iterator export="true" name="INSTALL_PATH">
		<Vector filter="*test*">
			<FindFilePathEx name="blah.sh"/>
		</Vector>
	</Iterator>
	<Instance>
		<Variable name="IS_INSTALLED">
			<FileExists absolutePath="$(INSTALL_PATH)blah.sh"/>
		</Variable>
		<Condition withVariable="IS_INSTALLED">
			<Action do="SKIP" onValue="false"/>
		</Condition>
	</Instance>
</MultipleInstance>