vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-03 11:57:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #545 from mandiant/new/20222303

Browse source 
adding get-process-image-filename
This commit is contained in:
Mike Hunhoff 2022-03-23 11:48:38 -06:00 • committed by GitHub
commit 51de2eb818
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nursery/get-process-image-filename.yml Normal file
View file

@ -0,0 +1,13 @@
# generated using capa explorer for IDA Pro
rule:
meta:
name: get process image filename
namespace: host-interaction/process
author: michael.hunhoff@mandiant.com
scope: basic block
features:
- and:
- os: windows
- or:
- api: kernel32.K32GetProcessImageFileName
- api: kernel32.GetProcessImageFileName