vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #516 from dzbeck/capa-3-mbc-updates

Browse source 
update mappings for mbc (part 7)
This commit is contained in:
Willi Ballenthin 2021-12-14 14:45:25 -07:00 • committed by GitHub
commit 26d216249f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
8 changed files with 17 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
load-code/shellcode/execute-shellcode-via-enumuilanguages.yml
View file

@ -4,6 +4,8 @@ rule:
namespace: load-code/shellcode
author: jakub.jozwiak@mandiant.com
scope: function
mbc:
- Defense Evasion::Hijack Execution Flow::Abuse Windows Function Calls [F0015.006]
references:
- http://ropgadget.com/posts/abusing_win_functions.html
- https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/EnumUILanguagesW/EnumUILanguagesW.cpp

2
load-code/shellcode/execute-shellcode-via-windows-fibers.yml
View file

@ -4,6 +4,8 @@ rule:
namespace: load-code/shellcode
author: jakub.jozwiak@mandiant.com
scope: function
mbc:
- Defense Evasion::Process Injection::Injection via Windows Fibers [E1055.m05]
references:
- https://www.ired.team/offensive-security/code-injection-process-injection/executing-shellcode-with-createfiber
- https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/FiberContextEdit/Source.cpp

3
load-code/shellcode/spawn-thread-to-rwx-shellcode.yml
View file

@ -4,6 +4,9 @@ rule:
namespace: load-code/shellcode
author: moritz.raabe@mandiant.com
scope: function
mbc:
- Memory::Allocate Memory [C0007]
- Process::Create Thread [C0038]
examples:
- Practical Malware Analysis Lab 19-02.exe_:0x401230
features: