vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update rebuild-import-table.yml

Browse source 
Resolve comment
This commit is contained in:
Ryan Xu 2021-11-12 08:56:54 -06:00 • committed by GitHub
parent 6a02bdae83
commit 33cdd98446
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
load-code/pe/rebuild-import-table.yml
View file

@ -5,7 +5,7 @@ rule:
author: "@Ana06"
scope: function
mbc:
- Data::Code::Rebuild Import Table [C0062.004]
- Defense Evasion::Hijack Execution Flow::Import Address Table (IAT) Hooking [F0005.m03]
references:
- https://0x00sec.org/t/reflective-dll-injection/3080
- https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection