vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

removing ntdll requirement from function features exported by both ntdll and ntoskrnl

Browse source
This commit is contained in:
Michael Hunhoff 2021-02-16 18:28:05 -07:00
parent 3d9b4159f3
commit 750e164a41
10 changed files with 19 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

2
load-code/pe/access-pe-header.yml
View file

@ -10,5 +10,5 @@ rule:
- 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x1400018E0
features:
- or:
- api: ntdll.RtlImageNtHeader
- api: RtlImageNtHeader
- api: ntdll.RtlImageNtHeaderEx