vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #1001 from mandiant/fix/fn/inject-apc

Browse source
This commit is contained in:
Moritz 2025-02-21 13:15:39 +01:00 • committed by GitHub
commit 33ccbf2a64
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
host-interaction/process/inject/inject-apc.yml
View file

@ -4,6 +4,7 @@ rule:
namespace: host-interaction/process/inject
authors:
- william.ballenthin@mandiant.com
- mehunhoff@google.com
scopes:
static: function
dynamic: span of calls
@ -19,7 +20,10 @@ rule:
- api: kernel32.MapViewOfFile
- or:
- api: kernel32.QueueUserAPC
- api: kernel32.KeInsertQueueApc
- api: ntdll.NtQueueApcThread
- api: ntdll.NtQueueApcThreadEx
- api: ntdll.NtQueueApcThreadEx2
- optional:
- or:
- number: 0x1fffff = THREAD_ALL_ACCESS