vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

add load-code/pe/rebuild-import-table.yml

Browse source 
Identify rebuilding of import table, used in reflective-dll-injection.
References:
- https://0x00sec.org/t/reflective-dll-injection/3080
- https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection
This commit is contained in:
Ana Maria Martinez Gomez 2021-03-23 17:29:10 +01:00
parent 02915b3ade
commit 684f817111
No known key found for this signature in database
GPG key ID: 708FEFF2737E9788
1 changed files with 27 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

27
load-code/pe/rebuild-import-table.yml Normal file
View file

@ -0,0 +1,27 @@
rule:
meta:
name: rebuild import table
namespace: load-code/pe
author: "@Ana06"
scope: function
references:
- https://0x00sec.org/t/reflective-dll-injection/3080
- https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection
examples:
- E4C33AC3638EEF68311F8AC0D72483C7:0x401510
features:
- and:
- offset: 0x7C = IMAGE_NT_HEADERS.OptionalHeader.DataDirectory.Size
- offset: 0x78 = IMAGE_NT_HEADERS.OptionalHeader.DataDirectory.VirtualAddress
- basic block:
- and:
- offset: 0xC = IMAGE_IMPORT_DESCRIPTOR.Name
- api: LoadLibraryA
- offset: 0x10 = IMAGE_IMPORT_DESCRIPTOR.FirstThunk
- api: GetProcAddress
- optional: # Optional as may only support import by ordinal or import by name
- or:
- number/x32: 0x80000000 = IMAGE_SNAP_BY_ORDINAL32
- number/x64: 0x8000000000000000 = IMAGE_SNAP_BY_ORDINAL64
- number: 0xFFFF = IMAGE_ORDINAL
- number: 0x2 = thunk->u1.AddressOfData