From 4026d60a48b80defc657417bfaa0a7cfab01fc58 Mon Sep 17 00:00:00 2001 From: JJ Date: Thu, 4 Sep 2025 00:08:36 +0800 Subject: [PATCH] Update enumerate-minifilter-drivers.yml (#1075) --- .../filter/enumerate-minifilter-drivers.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/host-interaction/filter/enumerate-minifilter-drivers.yml b/host-interaction/filter/enumerate-minifilter-drivers.yml index 4ae71965..6e90a405 100644 --- a/host-interaction/filter/enumerate-minifilter-drivers.yml +++ b/host-interaction/filter/enumerate-minifilter-drivers.yml @@ -4,15 +4,21 @@ rule: namespace: host-interaction/filter authors: - aseel.kayal@mandiant.com + - jakubjozwiak@google.com scopes: static: function dynamic: span of calls references: - https://posts.specterops.io/mimidrv-in-depth-4d273d19e148 - https://learn.microsoft.com/en-us/windows-hardware/drivers/ifs/filter-manager-concepts + - https://github.com/gentilkiwi/mimikatz/blob/2.2.0-20220919/mimikatz/modules/kuhl_m_misc.c#L944 examples: - 3E528207CA374123F63789195A4AEDDE:0x12F49 features: - - and: - - api: fltmgr.FltEnumerateFilters - - api: fltmgr.FltGetFilterInformation + - or: + - and: + - api: fltmgr.FltEnumerateFilters + - api: fltmgr.FltGetFilterInformation + - and: + - api: fltlib.FilterFindFirst + - api: fltlib.FilterFindNext