From 876af5fa37f90c79331cb8515307a1ed233680ce Mon Sep 17 00:00:00 2001 From: William Ballenthin Date: Sun, 26 Feb 2023 21:14:13 +0100 Subject: [PATCH 1/4] add get http query uri ref #3 --- communication/http/get-http-query-uri.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 communication/http/get-http-query-uri.yml diff --git a/communication/http/get-http-query-uri.yml b/communication/http/get-http-query-uri.yml new file mode 100644 index 00000000..2a36c040 --- /dev/null +++ b/communication/http/get-http-query-uri.yml @@ -0,0 +1,15 @@ +rule: + meta: + name: get HTTP query URI + namespace: communication/http + authors: + - william.ballenthin@mandiant.com + scope: basic block + mbc: + - Communication::HTTP Communication [C0002] + examples: + - Practical Malware Analysis Lab 03-02.dll_:0x10004452 + features: + - and: + - api: wininet.HttpQueryInfo + - number: 0x13 = HTTP_QUERY_URI From 07f16e846d73b55a5b77a6742fbd6c1d0a218b7c Mon Sep 17 00:00:00 2001 From: Willi Ballenthin Date: Tue, 28 Feb 2023 09:09:53 +0100 Subject: [PATCH 2/4] Update communication/http/get-http-query-uri.yml --- communication/http/get-http-query-uri.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/communication/http/get-http-query-uri.yml b/communication/http/get-http-query-uri.yml index 2a36c040..7635a6e2 100644 --- a/communication/http/get-http-query-uri.yml +++ b/communication/http/get-http-query-uri.yml @@ -12,4 +12,4 @@ rule: features: - and: - api: wininet.HttpQueryInfo - - number: 0x13 = HTTP_QUERY_URI + - number: 0xD = HTTP_QUERY_URI From bd1aeefd2da90925b5ed3573321035ffcb7aded4 Mon Sep 17 00:00:00 2001 From: Willi Ballenthin Date: Tue, 28 Feb 2023 09:10:27 +0100 Subject: [PATCH 3/4] Update and rename get-http-query-uri.yml to get-http-request-uri.yml --- .../http/{get-http-query-uri.yml => get-http-request-uri.yml} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename communication/http/{get-http-query-uri.yml => get-http-request-uri.yml} (91%) diff --git a/communication/http/get-http-query-uri.yml b/communication/http/get-http-request-uri.yml similarity index 91% rename from communication/http/get-http-query-uri.yml rename to communication/http/get-http-request-uri.yml index 7635a6e2..0be35360 100644 --- a/communication/http/get-http-query-uri.yml +++ b/communication/http/get-http-request-uri.yml @@ -1,6 +1,6 @@ rule: meta: - name: get HTTP query URI + name: get HTTP request URI namespace: communication/http authors: - william.ballenthin@mandiant.com From ba2cc497f9d890541163aefcf73168819ff40b0f Mon Sep 17 00:00:00 2001 From: Willi Ballenthin Date: Tue, 28 Feb 2023 09:29:09 +0100 Subject: [PATCH 4/4] http request uri: move to nursery --- communication/http/client/check-http-status-code.yml | 1 + {communication/http => nursery}/get-http-request-uri.yml | 2 -- 2 files changed, 1 insertion(+), 2 deletions(-) rename {communication/http => nursery}/get-http-request-uri.yml (80%) diff --git a/communication/http/client/check-http-status-code.yml b/communication/http/client/check-http-status-code.yml index 4dea7272..c1d74ab2 100644 --- a/communication/http/client/check-http-status-code.yml +++ b/communication/http/client/check-http-status-code.yml @@ -9,6 +9,7 @@ rule: - Communication::HTTP Communication::Read Header [C0002.014] examples: - 54ac78733552a62d1d05ea4ba3fc604bb49fe000d7fc948da45335b726e64d75:0x10001a20 + - Practical Malware Analysis Lab 03-02.dll_:0x10004452 features: - and: - os: windows diff --git a/communication/http/get-http-request-uri.yml b/nursery/get-http-request-uri.yml similarity index 80% rename from communication/http/get-http-request-uri.yml rename to nursery/get-http-request-uri.yml index 0be35360..1be9fc1f 100644 --- a/communication/http/get-http-request-uri.yml +++ b/nursery/get-http-request-uri.yml @@ -7,8 +7,6 @@ rule: scope: basic block mbc: - Communication::HTTP Communication [C0002] - examples: - - Practical Malware Analysis Lab 03-02.dll_:0x10004452 features: - and: - api: wininet.HttpQueryInfo