vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-02 03:17:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Ghostly Hollowing process injection rule (#865)

Browse source 
* ghostly hollowing process injection rule

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
This commit is contained in:
sara-rn 2024-01-23 10:55:34 +01:00 • committed by GitHub
parent e09a22d9f3
commit 4f27bfe758
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 26 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

26
host-interaction/process/inject/process-ghostly-hollowing.yml Normal file
View file

@ -0,0 +1,26 @@
rule:
meta:
name: process ghostly hollowing
namespace: host-interaction/process/inject
authors:
- sara.rincon@mandiant.com
scopes:
static: function
dynamic: call
references:
- https://github.com/hasherezade/transacted_hollowing/tree/main#ghostly-hollowing
examples:
- 3b2eba4789bd4a799fe18476a4d1ce9f37ecc4c202eb406e06425c7e792904ff:0x140007aa0 # open_file
- 3b2eba4789bd4a799fe18476a4d1ce9f37ecc4c202eb406e06425c7e792904ff:0x140007840 # delete_pending_file
features:
- or:
- and:
- operand[1].number: 0xC0110000 = DELETE | SYNCHRONIZE | GENERIC_READ | GENERIC_WRITE
- operand[1].number: 0x20 = FILE_SUPERSEDE | FILE_SYNCHRONOUS_IO_NONALERT
- or:
- api: NtOpenFile
- string: "NtOpenFile"
- and:
- api: NtWriteFile
- api: NtSetInformationFile
- api: NtCreateSection