vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 10:58:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

merge duplicate rules

Browse source
This commit is contained in:
Moritz Raabe 2021-03-22 18:34:51 +01:00
parent a6ec668690
commit 6c9f83dd7f
3 changed files with 20 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

15
executable/pe/run-as-a-service.yml
View file

@ -1,15 +0,0 @@
rule:
meta:
name: run as a service
namespace: executable/pe
author: moritz.raabe@fireeye.com
scope: file
mbc:
- Anti-Behavioral Analysis::Execution Guardrails::Runs as Service [E1480.m07]
examples:
- Practical Malware Analysis Lab 03-02.dll_
features:
- or:
- export: ServiceMain
- import: RegisterServiceCtrlHandler
- import: RegisterServiceCtrlHandlerEx