From b444a585cac57432de09a6b128e6848fbf92d879 Mon Sep 17 00:00:00 2001
From: Mike Hunhoff <mike.hunhoff@gmail.com>
Date: Thu, 20 Feb 2025 15:08:04 -0700
Subject: [PATCH] additional APIs to remove FNs for inject apc

---
 host-interaction/process/inject/inject-apc.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/host-interaction/process/inject/inject-apc.yml b/host-interaction/process/inject/inject-apc.yml
index de507b38..db938c56 100644
--- a/host-interaction/process/inject/inject-apc.yml
+++ b/host-interaction/process/inject/inject-apc.yml
@@ -4,6 +4,7 @@ rule:
     namespace: host-interaction/process/inject
     authors:
       - william.ballenthin@mandiant.com
+      - mehunhoff@google.com
     scopes:
       static: function
       dynamic: span of calls
@@ -19,7 +20,10 @@ rule:
         - api: kernel32.MapViewOfFile
       - or:
         - api: kernel32.QueueUserAPC
+        - api: kernel32.KeInsertQueueApc
         - api: ntdll.NtQueueApcThread
+        - api: ntdll.NtQueueApcThreadEx
+        - api: ntdll.NtQueueApcThreadEx2
       - optional:
         - or:
           - number: 0x1fffff = THREAD_ALL_ACCESS