vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

add identify system language via API

Browse source 
closes #481
This commit is contained in:
William Ballenthin 2021-10-22 13:27:01 -06:00
parent e13beb6c0e
commit 4bfc6621d3
2 changed files with 17 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
host-interaction/hardware/keyboard/layout/get-keyboard-layout.yml → host-interaction/hardware/keyboard/get-keyboard-layout.yml
View file

@ -1,11 +1,11 @@
rule:
meta:
name: get keyboard layout
namespace: host-interaction/hardware/keyboard/layout
namespace: host-interaction/hardware/keyboard
author: michael.hunhoff@mandiant.com
scope: function
att&ck:
- Discovery::System Information Discovery [T1082]
- Discovery::System Location Discovery::System Language Discovery [T1614.001]
examples:
- 6F99A2C8944CB02FF28C6F9CED59B161:0x4193C0
- C91887D861D9BD4A5872249B641BC9F9:0x4015FD

15
targeting/language/identify-system-language-via-api.yml Normal file
View file

@ -0,0 +1,15 @@
rule:
meta:
name: identify system language via API
namespace: targeting/language
author: william.ballenthin@mandiant.com
scope: function
att&ck:
- Discovery::System Location Discovery::System Language Discovery [T1614.001]
examples:
- 9b7ccaa2ae6a5b96e3110ebcbc4311f6:0x10001F96
features:
- or:
- api: GetUserDefaultUILanguage
- api: GetSystemDefaultUILanguage
- api: GetUserDefaultLangID