vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add glibc memfrob rule

Browse source
This commit is contained in:
Zander Work 2021-10-23 03:40:55 -04:00
parent b68b28b9ff
commit 0d83ae971c
1 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

15
data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml Normal file
View file

@ -0,0 +1,15 @@
rule:
meta:
name: encrypt data using memfrob from glibc
namespace: data-manipulation/encryption
author: zander.work@mandiant.com
scope: function
att&ck:
- Defense Evasion::Obfuscated Files or Information [T1027]
mbc:
- Defense Evasion::Obfuscated Files or Information::Encryption [E1027.m04]
- Cryptography::Encrypt Data [C0027]
examples:
- 055da8e6ccfe5a9380231ea04b850e18:0x1189
features:
- api: memfrob