vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 10:58:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

removing ntdll requirement from function features exported by both ntdll and ntoskrnl

Browse source
This commit is contained in:
Michael Hunhoff 2021-02-16 18:28:05 -07:00
parent 3d9b4159f3
commit 750e164a41
10 changed files with 19 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

6
executable/resource/extract-resource-via-kernel32-functions.yml
View file

@ -15,7 +15,7 @@ rule:
- or:
- api: kernel32.LoadResource
- api: kernel32.LockResource
- api: ntdll.LdrAccessResource
- api: LdrAccessResource
- optional:
- match: contain a resource (.rsrc) section
- api: kernel32.GetModuleHandle
@ -23,8 +23,8 @@ rule:
- or:
- api: kernel32.FindResource
- api: kernel32.FindResourceEx
- api: ntdll.LdrFindResource_U
- api: ntdll.LdrFindResourceEx_U
- api: LdrFindResource_U
- api: LdrFindResourceEx_U
- api: kernel32.SizeofResource
- api: kernel32.FreeResource
- api: user32.LoadString

2
host-interaction/file-system/files/list/enumerate-files-via-ntdll-functions.yml
View file

@ -18,6 +18,6 @@ rule:
- api: ntdll.NtOpenDirectoryObject
- api: ntdll.NtQueryDirectoryObject
- optional:
- api: ntdll.RtlAllocateHeap
- api: RtlAllocateHeap
- match: contain loop
- characteristic: indirect call

4
host-interaction/file-system/write/write-file.yml
View file

@ -21,12 +21,12 @@ rule:
- and:
- number: 0x2 = FILE_WRITE_DATA
- or:
- api: ntdll.NtCreateFile
- api: NtCreateFile
- api: ZwCreateFile
- or:
- api: kernel32.WriteFile
- api: kernel32.WriteFileEx
- api: ntdll.NtWriteFile
- api: NtWriteFile
- api: ZwWriteFile
- api: _fwrite
- api: fwrite

4
host-interaction/os/info/get-system-information.yml
View file

@ -12,8 +12,8 @@ rule:
- or:
- api: kernel32.GetSystemInfo
- api: kernel32.GetNativeSystemInfo
- api: ntdll.NtQuerySystemInformation
- api: ntdll.NtQuerySystemInformationEx
- api: NtQuerySystemInformation
- api: NtQuerySystemInformationEx
- api: ntdll.RtlGetNativeSystemInformation
- api: ZwQuerySystemInformation
- api: ZwQuerySystemInformationEx

2
host-interaction/process/inject/inject-apc.yml
View file

@ -13,7 +13,7 @@ rule:
- or:
- match: write process memory
- api: kernel32.MapViewOfSection
- api: ntdll.NtMapViewOfSection
- api: NtMapViewOfSection
- api: ntdll.ZwMapViewOfSection
- api: kernel32.MapViewOfFile
- or:

2
host-interaction/process/list/enumerate-processes-via-ntquerysysteminformation.yml
View file

@ -12,4 +12,4 @@ rule:
features:
- and:
- number: 0x5 = SYSTEM_PROCESS_INFORMATION
- api: ntdll.NtQuerySystemInformation
- api: NtQuerySystemInformation

8
lib/allocate-memory.yml
View file

@ -17,7 +17,7 @@ rule:
- api: kernel32.VirtualAllocExNuma
- api: kernel32.VirtualProtect
- api: kernel32.VirtualProtectEx
- api: ntdll.NtAllocateVirtualMemory
- api: ntdll.ZwAllocateVirtualMemory
- api: ntdll.NtMapViewOfSection
- api: ntdll.ZwMapViewOfSection
- api: NtAllocateVirtualMemory
- api: ZwAllocateVirtualMemory
- api: NtMapViewOfSection
- api: ZwMapViewOfSection

4
lib/open-process.yml
View file

@ -9,5 +9,5 @@ rule:
features:
- or:
- api: kernel32.OpenProcess
- api: ntdll.NtOpenProcess
- api: ntdll.ZwOpenProcess
- api: NtOpenProcess
- api: ZwOpenProcess

4
lib/open-thread.yml
View file

@ -9,5 +9,5 @@ rule:
features:
- or:
- api: kernel32.OpenThread
- api: ntdll.NtOpenThread
- api: ntdll.ZwOpenThread
- api: NtOpenThread
- api: ZwOpenThread

2
load-code/pe/access-pe-header.yml
View file

@ -10,5 +10,5 @@ rule:
- 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x1400018E0
features:
- or:
- api: ntdll.RtlImageNtHeader
- api: RtlImageNtHeader
- api: ntdll.RtlImageNtHeaderEx