vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""

Browse source 
This reverts commit d43a6ee544.
This commit is contained in:
Willi Ballenthin 2022-06-28 15:23:20 -06:00
parent d5c2709049
commit 57e1732f5c
No known key found for this signature in database
43 changed files with 398 additions and 341 deletions
Download patch file Download diff file Expand all files Collapse all files

7
load-code/shellcode/execute-shellcode-via-copyfile2.yml
View file

@ -21,8 +21,11 @@ rule:
# lea r9d, [rcx+40h] ; flProtect
# call cs:VirtualAlloc
- match: allocate memory
- mnemonic: lea
- offset: 0x40
- or:
- number: 0x40
- instruction:
- mnemonic: lea
- offset: 0x40
- api: CopyFile2
- api: DeleteFileW
- number: 0x00000001 = COPY_FILE_FAIL_IF_EXISTS