vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add LdrCallEnclave in execute-shellcode-via-windows-callback-function.yml (#1076)

Browse source
This commit is contained in:
JJ 2025-09-10 03:21:58 +08:00 • committed by GitHub
parent 1a065e6dea
commit 277540ac24
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
load-code/shellcode/execute-shellcode-via-windows-callback-function.yml
View file

@ -20,6 +20,7 @@ rule:
- http://ropgadget.com/posts/abusing_win_functions.html
- https://github.com/aahmad097/AlternativeShellcodeExec/
- https://osandamalith.com/2021/04/01/executing-shellcode-via-callbacks/
- https://github.com/tlsbollei/Malware-Training/blob/main/Code%20Injection/LdrCallEnclave.cpp
examples:
- 10cd7afd580ee9c222b0a87ff241d306:0x10008BE0
- 268d61837aa248c1d49a973612a129ce:0x1000CEC0
@ -78,6 +79,7 @@ rule:
- api: EnumerateLoadedModules
- api: GrayString
- api: ImmEnumInputContext
- api: LdrCallEnclave
- api: LineDDA
- and:
- api: SymInitialize