vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #514 from jtothej/shellcode-via-copyfile2

Browse source 
Adding execute-shellcode-via-copyfile2.yml
This commit is contained in:
Willi Ballenthin 2021-12-14 14:51:17 -07:00 • committed by GitHub
commit 7b91f0ceee
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 28 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

28
load-code/shellcode/execute-shellcode-via-copyfile2.yml Normal file
View file

@ -0,0 +1,28 @@
rule:
meta:
name: execute shellcode via CopyFile2
namespace: load-code/shellcode
author: jakub.jozwiak@mandiant.com
scope: function
references:
- https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/CopyFile2/CopyFile2.cpp
examples:
- c2bb17c12975ea61ff43a71afd9c3ff111d018af161859abae0bdb0b3dae98f9:0x140001010
features:
- and:
- or:
- match: allocate RWX memory
- basic block:
- and:
# xor ecx, ecx ; lpAddress
# mov edx, 31Fh ; dwSize
# mov r8d, 1000h ; flAllocationType
# lea r9d, [rcx+40h] ; flProtect
# call cs:VirtualAlloc
- match: allocate memory
- mnemonic: lea
- offset: 0x40
- api: CopyFile2
- api: DeleteFileW
- number: 0x00000001 = COPY_FILE_FAIL_IF_EXISTS
- number: 0x20 = sizeof(COPYFILE2_EXTENDED_PARAMETERS)