vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update enumerate-minifilter-drivers.yml (#1075)

Browse source
This commit is contained in:
JJ 2025-09-04 00:08:36 +08:00 • committed by GitHub
parent 19d48abd05
commit 4026d60a48
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 9 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
host-interaction/filter/enumerate-minifilter-drivers.yml
View file

@ -4,15 +4,21 @@ rule:
namespace: host-interaction/filter
authors:
- aseel.kayal@mandiant.com
- jakubjozwiak@google.com
scopes:
static: function
dynamic: span of calls
references:
- https://posts.specterops.io/mimidrv-in-depth-4d273d19e148
- https://learn.microsoft.com/en-us/windows-hardware/drivers/ifs/filter-manager-concepts
- https://github.com/gentilkiwi/mimikatz/blob/2.2.0-20220919/mimikatz/modules/kuhl_m_misc.c#L944
examples:
- 3E528207CA374123F63789195A4AEDDE:0x12F49
features:
- and:
- api: fltmgr.FltEnumerateFilters
- api: fltmgr.FltGetFilterInformation
- or:
- and:
- api: fltmgr.FltEnumerateFilters
- api: fltmgr.FltGetFilterInformation
- and:
- api: fltlib.FilterFindFirst
- api: fltlib.FilterFindNext