vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 10:58:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

update match rule name

Browse source
This commit is contained in:
mr-tz 2023-10-11 11:20:23 +02:00
parent 5f223ea5ce
commit 66f58dffa0
9 changed files with 10 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

2
host-interaction/process/inject/allocate-user-process-rwx-memory.yml
View file

@ -12,7 +12,7 @@ rule:
features:
- and:
- match: attach user process memory
- match: allocate RWX memory
- match: allocate or change RWX memory
- number: 0xFFFFFFFF = NtCurrentProcess()
- optional:
- match: find process by PID

2
host-interaction/process/inject/hijack-thread-execution.yml
View file

@ -20,7 +20,7 @@ rule:
- match: suspend thread
- api: kernel32.GetThreadContext
- optional:
- match: allocate RWX memory
- match: allocate or change RWX memory
- match: write process memory
- api: kernel32.SetThreadContext
- match: resume thread

2
host-interaction/process/inject/inject-dll.yml
View file

@ -23,7 +23,7 @@ rule:
- or:
- match: open process
- match: host-interaction/process/create
- match: allocate RW memory
- match: allocate or change RW memory
- match: write process memory
- and:
- or:

2
host-interaction/process/inject/inject-pe.yml
View file

@ -19,7 +19,7 @@ rule:
- or:
- match: open process
- match: host-interaction/process/create
- match: allocate RWX memory
- match: allocate or change RWX memory
- basic block:
- description: virtual address offset calculation
- and:

4
host-interaction/process/inject/inject-thread.yml
View file

@ -15,8 +15,8 @@ rule:
features:
- and:
- or:
- match: allocate RWX memory
- match: allocate RW memory
- match: allocate or change RWX memory
- match: allocate or change RW memory
- match: write process memory
- match: create thread
- optional:

2
load-code/shellcode/execute-shellcode-via-createthreadpoolwait.yml
View file

@ -11,7 +11,7 @@ rule:
- a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf:0x10001010
features:
- and:
- match: allocate RWX memory
- match: allocate or change RWX memory
- api: CreateEvent
- api: CreateThreadpoolWait
- api: SetThreadpoolWait

2
load-code/shellcode/execute-shellcode-via-windows-callback-function.yml
View file

@ -23,7 +23,7 @@ rule:
- 43db867967c71bd3aaba9a9a3084e7fa:0x140001000
features:
- and:
- match: allocate RWX memory
- match: allocate or change RWX memory
- or:
- api: EnumDateFormats
- api: GrayString

2
load-code/shellcode/execute-shellcode-via-windows-fibers.yml
View file

@ -14,7 +14,7 @@ rule:
- f03bdb9fa52f7b61ef03141fefff1498ad2612740b1fdbf6941f1c5af5eee70a:0x4026E0
features:
- and:
- match: allocate RWX memory
- match: allocate or change RWX memory
- api: ConvertThreadToFiber
- api: CreateFiber
- api: SwitchToFiber

2
load-code/shellcode/spawn-thread-to-rwx-shellcode.yml
View file

@ -12,5 +12,5 @@ rule:
- Practical Malware Analysis Lab 19-02.exe_:0x401230
features:
- and:
- match: allocate RWX memory
- match: allocate or change RWX memory
- match: create thread