From 0d83ae971cb96c3ef49b5aba2c2c5aade90061b8 Mon Sep 17 00:00:00 2001 From: Zander Work Date: Sat, 23 Oct 2021 03:40:55 -0400 Subject: [PATCH] Add glibc memfrob rule --- .../encrypt-data-using-memfrob-from-glibc.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml diff --git a/data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml b/data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml new file mode 100644 index 00000000..5c0fb7ab --- /dev/null +++ b/data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml @@ -0,0 +1,15 @@ +rule: + meta: + name: encrypt data using memfrob from glibc + namespace: data-manipulation/encryption + author: zander.work@mandiant.com + scope: function + att&ck: + - Defense Evasion::Obfuscated Files or Information [T1027] + mbc: + - Defense Evasion::Obfuscated Files or Information::Encryption [E1027.m04] + - Cryptography::Encrypt Data [C0027] + examples: + - 055da8e6ccfe5a9380231ea04b850e18:0x1189 + features: + - api: memfrob