From 708b06dd0a76f7c104c7c2cdaeff6486fc047b02 Mon Sep 17 00:00:00 2001 From: Ervin Ocampo <130457949+ejfocampo@users.noreply.github.com> Date: Wed, 19 Apr 2023 23:56:15 +0800 Subject: [PATCH] Add capa rule load-code/shellcode/execute-shellcode-via-windows-callback-function.yml (#744) * Add capa rule load-code/shellcode/execute-shellcode-via-callback-functions.yml * Update load-code/shellcode/execute-shellcode-via-callback-functions.yml Co-authored-by: Mike Hunhoff * Update load-code/shellcode/execute-shellcode-via-callback-functions.yml Co-authored-by: Mike Hunhoff * Update load-code/shellcode/execute-shellcode-via-callback-functions.yml Co-authored-by: Mike Hunhoff * Update execute-shellcode-via-callback-functions.yml Omitted A and W on WinAPI function names since capa handles this automatically. * Update execute-shellcode-via-callback-functions.yml Added EnumTimeFormats and deduplicated EnumSystemCodePages * Update and rename execute-shellcode-via-callback-functions.yml to execute-shellcode-via-windows-callback-function.yml Renamed file to execute-shellcode-via-windows-callback-function.yml and merged https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml * Delete execute-shellcode-via-enumuilanguages.yml Delete rule due to merge with execute-shellcode-via-windows-callback-function.yml --------- Co-authored-by: Mike Hunhoff --- .../execute-shellcode-via-enumuilanguages.yml | 18 -------- ...hellcode-via-windows-callback-function.yml | 42 +++++++++++++++++++ 2 files changed, 42 insertions(+), 18 deletions(-) delete mode 100644 load-code/shellcode/execute-shellcode-via-enumuilanguages.yml create mode 100644 load-code/shellcode/execute-shellcode-via-windows-callback-function.yml diff --git a/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml b/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml deleted file mode 100644 index d7c32ac0..00000000 --- a/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml +++ /dev/null @@ -1,18 +0,0 @@ -rule: - meta: - name: execute shellcode via EnumUILanguages - namespace: load-code/shellcode - authors: - - jakub.jozwiak@mandiant.com - scope: function - mbc: - - Defense Evasion::Hijack Execution Flow::Abuse Windows Function Calls [F0015.006] - references: - - http://ropgadget.com/posts/abusing_win_functions.html - - https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/EnumUILanguagesW/EnumUILanguagesW.cpp - examples: - - ffcf88ead82bdfc159376026f5a9a7da49e593497674bdb6fa7f7d03dd9398d9:0x140001000 - features: - - and: - - match: allocate RWX memory - - api: EnumUILanguages diff --git a/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml b/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml new file mode 100644 index 00000000..a95f9d2d --- /dev/null +++ b/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml @@ -0,0 +1,42 @@ +rule: + meta: + name: execute shellcode via Windows callback function + namespace: load-code/shellcode + authors: + - ervin.ocampo@mandiant.com + - jakub.jozwiak@mandiant.com + description: Detect usage of various WinAPI functions that accept callback functions as parameters in order to execute arbitrary shellcode + scope: function + att&ck: + - Defense Evasion::Reflective Code Loading [T1620] + mbc: + - Defense Evasion::Hijack Execution Flow::Abuse Windows Function Calls [F0015.006] + references: + - https://github.com/ChaitanyaHaritash/Callback_Shellcode_Injection + - https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html + - http://ropgadget.com/posts/abusing_win_functions.html + - https://github.com/aahmad097/AlternativeShellcodeExec/ + examples: + - 10cd7afd580ee9c222b0a87ff241d306:0x10008BE0 + - 268d61837aa248c1d49a973612a129ce:0x1000CEC0 + - 4a2992b4c7a1573bf7c74065e3bf5b0d:0x1000D050 + - 43db867967c71bd3aaba9a9a3084e7fa:0x140001000 + features: + - and: + - match: allocate RWX memory + - or: + - api: EnumDateFormats + - api: GrayString + - api: LineDDA + - api: EnumChildWindows + - api: EnumDesktops + - api: EnumDesktopWindows + - api: EnumSystemCodePages + - api: EnumSystemGeoID + - api: EnumSystemLanguageGroups + - api: EnumSystemLocales + - api: EnumThreadWindows + - api: EnumUILanguages + - api: EnumWindows + - api: EnumChildWindows + - api: EnumTimeFormats