From 29fbeec36a6754f155261a9cf97ff7ffb3016b67 Mon Sep 17 00:00:00 2001 From: 0x534a <0x534a@mailbox.org> Date: Thu, 28 Jan 2021 15:28:53 +0100 Subject: [PATCH] Adjusts test file of hijack-thread-execution.yml, resolves conflict in inject-thread.yml and removes articles from rules --- .../process/inject/hijack-thread-execution.yml | 8 ++++---- .../process/inject/{inject-a-dll.yml => inject-dll.yml} | 4 ++-- .../process/inject/{inject-a-pe.yml => inject-pe.yml} | 4 ++-- .../inject/{inject-a-thread.yml => inject-thread.yml} | 4 ++-- .../process/inject/use-process-replacement.yml | 2 +- .../resume/{resume-a-thread.yml => resume-thread.yml} | 2 +- .../suspend/{suspend-a-thread.yml => suspend-thread.yml} | 2 +- lib/{open-a-process.yml => open-process.yml} | 2 +- lib/{open-a-thread.yml => open-thread.yml} | 2 +- 9 files changed, 15 insertions(+), 15 deletions(-) rename host-interaction/process/inject/{inject-a-dll.yml => inject-dll.yml} (95%) rename host-interaction/process/inject/{inject-a-pe.yml => inject-pe.yml} (93%) rename host-interaction/process/inject/{inject-a-thread.yml => inject-thread.yml} (91%) rename host-interaction/thread/resume/{resume-a-thread.yml => resume-thread.yml} (94%) rename host-interaction/thread/suspend/{suspend-a-thread.yml => suspend-thread.yml} (93%) rename lib/{open-a-process.yml => open-process.yml} (91%) rename lib/{open-a-thread.yml => open-thread.yml} (92%) diff --git a/host-interaction/process/inject/hijack-thread-execution.yml b/host-interaction/process/inject/hijack-thread-execution.yml index a319990e..bea57088 100644 --- a/host-interaction/process/inject/hijack-thread-execution.yml +++ b/host-interaction/process/inject/hijack-thread-execution.yml @@ -7,17 +7,17 @@ rule: att&ck: - Defense Evasion::Process Injection::Thread Execution Hijacking [T1055.003] examples: - - 787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:0x4044C7 + - 77d87e9937546aebc1595039d730352b15fab32c72a76913f04262c6802d098f:0x401000 features: - and: - optional: - or: - - match: open a thread + - match: open thread - match: create thread - - match: suspend a thread + - match: suspend thread - api: kernel32.GetThreadContext - match: allocate RWX memory - optional: - match: write process memory - api: kernel32.SetThreadContext - - match: resume a thread + - match: resume thread diff --git a/host-interaction/process/inject/inject-a-dll.yml b/host-interaction/process/inject/inject-dll.yml similarity index 95% rename from host-interaction/process/inject/inject-a-dll.yml rename to host-interaction/process/inject/inject-dll.yml index 9d6f8692..e8a9f6ae 100644 --- a/host-interaction/process/inject/inject-a-dll.yml +++ b/host-interaction/process/inject/inject-dll.yml @@ -1,6 +1,6 @@ rule: meta: - name: inject a dll + name: inject dll namespace: host-interaction/process/inject author: 0x534a@mailbox.org scope: function @@ -20,7 +20,7 @@ rule: - and: - optional: - or: - - match: open a process + - match: open process - match: create process - match: allocate RW memory - match: write process memory diff --git a/host-interaction/process/inject/inject-a-pe.yml b/host-interaction/process/inject/inject-pe.yml similarity index 93% rename from host-interaction/process/inject/inject-a-pe.yml rename to host-interaction/process/inject/inject-pe.yml index 19f26a3f..44a2703f 100644 --- a/host-interaction/process/inject/inject-a-pe.yml +++ b/host-interaction/process/inject/inject-pe.yml @@ -1,6 +1,6 @@ rule: meta: - name: inject a pe + name: inject pe namespace: host-interaction/process/inject author: 0x534a@mailbox.org scope: function @@ -15,7 +15,7 @@ rule: - characteristic: loop - optional: - or: - - match: open a process + - match: open process - match: create process - match: allocate RWX memory - basic block: diff --git a/host-interaction/process/inject/inject-a-thread.yml b/host-interaction/process/inject/inject-thread.yml similarity index 91% rename from host-interaction/process/inject/inject-a-thread.yml rename to host-interaction/process/inject/inject-thread.yml index f9855490..8ceea473 100644 --- a/host-interaction/process/inject/inject-a-thread.yml +++ b/host-interaction/process/inject/inject-thread.yml @@ -1,6 +1,6 @@ rule: meta: - name: inject a thread + name: inject thread namespace: host-interaction/process/inject author: - anamaria.martinezgom@fireeye.com @@ -18,6 +18,6 @@ rule: - match: create thread - optional: - or: - - match: open a process + - match: open process - match: create process - number: 0x3000 = MEM_COMMIT or MEM_RESERVE diff --git a/host-interaction/process/inject/use-process-replacement.yml b/host-interaction/process/inject/use-process-replacement.yml index 9d425fca..7e3cd74c 100644 --- a/host-interaction/process/inject/use-process-replacement.yml +++ b/host-interaction/process/inject/use-process-replacement.yml @@ -15,4 +15,4 @@ rule: - and: - match: create process suspended - match: write process memory - - match: resume a thread + - match: resume thread diff --git a/host-interaction/thread/resume/resume-a-thread.yml b/host-interaction/thread/resume/resume-thread.yml similarity index 94% rename from host-interaction/thread/resume/resume-a-thread.yml rename to host-interaction/thread/resume/resume-thread.yml index 9e157fdf..4f20a4f9 100644 --- a/host-interaction/thread/resume/resume-a-thread.yml +++ b/host-interaction/thread/resume/resume-thread.yml @@ -1,6 +1,6 @@ rule: meta: - name: resume a thread + name: resume thread namespace: host-interaction/thread/resume author: 0x534a@mailbox.org scope: basic block diff --git a/host-interaction/thread/suspend/suspend-a-thread.yml b/host-interaction/thread/suspend/suspend-thread.yml similarity index 93% rename from host-interaction/thread/suspend/suspend-a-thread.yml rename to host-interaction/thread/suspend/suspend-thread.yml index 6d30f19d..8cd7f708 100644 --- a/host-interaction/thread/suspend/suspend-a-thread.yml +++ b/host-interaction/thread/suspend/suspend-thread.yml @@ -1,6 +1,6 @@ rule: meta: - name: suspend a thread + name: suspend thread namespace: host-interaction/thread/suspend author: 0x534a@mailbox.org scope: basic block diff --git a/lib/open-a-process.yml b/lib/open-process.yml similarity index 91% rename from lib/open-a-process.yml rename to lib/open-process.yml index 93bc5e26..c0317dae 100644 --- a/lib/open-a-process.yml +++ b/lib/open-process.yml @@ -1,6 +1,6 @@ rule: meta: - name: open a process + name: open process author: 0x534a@mailbox.org lib: True scope: basic block diff --git a/lib/open-a-thread.yml b/lib/open-thread.yml similarity index 92% rename from lib/open-a-thread.yml rename to lib/open-thread.yml index 8f80563c..da13caa1 100644 --- a/lib/open-a-thread.yml +++ b/lib/open-thread.yml @@ -1,6 +1,6 @@ rule: meta: - name: open a thread + name: open thread author: 0x534a@mailbox.org lib: True scope: basic block