diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml index 583c5f61..d5818e6d 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml @@ -14,11 +14,9 @@ rule: features: - and: - number: 0x7FFE02D4 = UserSharedData->KdDebuggerEnabled - - basic block: - - and: - - mnemonic: and - - number: 0x2 = KdDebuggerNotPresent - - basic block: - - and: - - mnemonic: and - - number: 0x1 = KdDebuggerEnabled + - instruction: + - mnemonic: and + - number: 0x2 = KdDebuggerNotPresent + - instruction: + - mnemonic: and + - number: 0x1 = KdDebuggerEnabled diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml index 400c9f5b..f87b45e2 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml @@ -17,12 +17,18 @@ rule: - and: - match: PEB access - or: - - or: - - offset/x32: 0x68 = PEB.NtGlobalFlag - - offset/x64: 0xBC = PEB.NtGlobalFlag - and: + - arch: i386 + - offset: 0x68 = PEB.NtGlobalFlag + - and: + - arch: amd64 + - offset: 0xBC = PEB.NtGlobalFlag + - instruction: + - arch: i386 - mnemonic: add - - or: - - number/x32: 0x68 = PEB.NtGlobalFlag - - number/x64: 0xBC = PEB.NtGlobalFlag + - offset: 0x68 = PEB.NtGlobalFlag + - instruction: + - arch: amd64 + - mnemonic: add + - offset: 0xBC = PEB.NtGlobalFlag - number: 0x70 = (FLG_HEAP_ENABLE_TAIL_CHECK | FLG_HEAP_ENABLE_FREE_CHECK | FLG_HEAP_VALIDATE_PARAMETERS) diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml index f3295602..7ebdbae8 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml @@ -12,12 +12,7 @@ rule: - al-khaser_x86.exe_:0x431020 features: - and: - - basic block: - - and: - - mnemonic: cmp - - or: - - number: 0xCC - - and: - - number: 0xCD - - number: 0x3 + - instruction: + - mnemonic: cmp + - number: 0xCC - match: contain loop diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml index e2e14a71..dc0c0e8f 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml @@ -26,9 +26,9 @@ rule: - mnemonic: popfq - or: - description: set trap flag - - and: + - instruction: - mnemonic: or - number: 0x100 - - and: + - instruction: - mnemonic: bts - number: 0x8 diff --git a/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml b/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml index b2d584ba..9b854950 100644 --- a/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml +++ b/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml @@ -14,14 +14,17 @@ rule: - 79abd17391adc6251ecdc58d13d76baf:0x10002385 features: - and: - - and: - - or: - - mnemonic: push = 'push 33h' - - mnemonic: mov = cover any mov ESP / EBP equivalents - - number: 0x33 = set up retf to push 0x33 to CS indicating 64-bit mode + - or: + - description: set up retf to push 0x33 to CS indicating 64-bit mode + - instruction: + - mnemonic: push + - number: 0x33 + - instruction: + - mnemonic: mov + - number: 0x33 - characteristic: call $+5 description: call $+5 pushes the current EIP onto the stack, +5 to jump past call insn bytes - - and: + - instruction: - mnemonic: add = 'add dword ptr[esp], 5' updates the return address to point after retf - number: 0x5 = length of add + retf insn bytes - mnemonic: retf = set EIP = [ESP] and CS = [ESP+4] diff --git a/anti-analysis/anti-forensic/patch-process-command-line.yml b/anti-analysis/anti-forensic/patch-process-command-line.yml index 599dd261..8e389f4a 100644 --- a/anti-analysis/anti-forensic/patch-process-command-line.yml +++ b/anti-analysis/anti-forensic/patch-process-command-line.yml @@ -29,10 +29,11 @@ rule: # call cs:VirtualProtect # test eax, eax - and: + - arch: amd64 - characteristic: gs access - - offset/x64: 0x60 = PEB - - offset/x64: 0x20 = PEB->ProcessParameters - - offset/x64: 0x70 = PEB->ProcessParameters->CommandLine + - offset: 0x60 = PEB + - offset: 0x20 = PEB->ProcessParameters + - offset: 0x70 = PEB->ProcessParameters->CommandLine - api: VirtualProtect - count(api(VirtualProtect)): 2 or more - and: @@ -42,8 +43,10 @@ rule: - api: ReadProcessMemory - or: - and: - - offset/x32: 0x10 = PEB->ProcessParameters - - offset/x32: 0x40 = PEB->ProcessParameters->CommandLine + - arch: i386 + - offset: 0x10 = PEB->ProcessParameters + - offset: 0x40 = PEB->ProcessParameters->CommandLine - and: - - offset/x64: 0x20 = PEB->ProcessParameters - - offset/x64: 0x70 = PEB->ProcessParameters->CommandLine + - arch: amd64 + - offset: 0x20 = PEB->ProcessParameters + - offset: 0x70 = PEB->ProcessParameters->CommandLine diff --git a/collection/credit-card/parse-credit-card-information.yml b/collection/credit-card/parse-credit-card-information.yml index 45d69791..1ab92ca5 100644 --- a/collection/credit-card/parse-credit-card-information.yml +++ b/collection/credit-card/parse-credit-card-information.yml @@ -11,50 +11,39 @@ rule: features: - and: - 4 or more: - - basic block: - - and: - - mnemonic: cmp - - number: 0x5E = '^' (Track 1 separator) - - basic block: - - and: - - mnemonic: cmp - - number: 0x3D = '=' (Track 2 separator) - - basic block: - - and: - - mnemonic: cmp - - number: 0x25 = '%' (Track 1 start sentinel) - - basic block: - - and: - - mnemonic: cmp - - number: 0x42 = 'B' (Format code) - - basic block: - - and: - - mnemonic: cmp - - number: 0x44 = 'D' (Format code) - - basic block: - - and: - - mnemonic: cmp - - number: 0x3F = '?' (Track 1 & 2 end sentinel) - - basic block: - - and: - - mnemonic: cmp - - number: 0x3B = ';' (Track 2 start sentinel) + - instruction: + - mnemonic: cmp + - number: 0x5E = '^' (Track 1 separator) + - instruction: + - mnemonic: cmp + - number: 0x3D = '=' (Track 2 separator) + - instruction: + - mnemonic: cmp + - number: 0x25 = '%' (Track 1 start sentinel) + - instruction: + - mnemonic: cmp + - number: 0x42 = 'B' (Format code) + - instruction: + - mnemonic: cmp + - number: 0x44 = 'D' (Format code) + - instruction: + - mnemonic: cmp + - number: 0x3F = '?' (Track 1 & 2 end sentinel) + - instruction: + - mnemonic: cmp + - number: 0x3B = ';' (Track 2 start sentinel) - not: - description: if a function also compares these non-hex characters it's most likely NOT parsing CC data - and: - - basic block: - - and: - - mnemonic: cmp - - number: 0x6D = 'm' - - basic block: - - and: - - mnemonic: cmp - - number: 0x6E = 'n' - - basic block: - - and: - - mnemonic: cmp - - number: 0x6F = 'o' - - basic block: - - and: - - mnemonic: cmp - - number: 0x70 = 'p' + - instruction: + - mnemonic: cmp + - number: 0x6D = 'm' + - instruction: + - mnemonic: cmp + - number: 0x6E = 'n' + - instruction: + - mnemonic: cmp + - number: 0x6F = 'o' + - instruction: + - mnemonic: cmp + - number: 0x70 = 'p' diff --git a/communication/http/client/check-http-status-code.yml b/communication/http/client/check-http-status-code.yml index 335b5200..492e6b40 100644 --- a/communication/http/client/check-http-status-code.yml +++ b/communication/http/client/check-http-status-code.yml @@ -17,7 +17,7 @@ rule: - optional: - api: atoi - api: wininet.HttpQueryInfo - - basic block: + - instruction: - and: - or: - mnemonic: cmp diff --git a/communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml b/communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml index f9d4d6f8..feb1ad72 100644 --- a/communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml +++ b/communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml @@ -23,8 +23,12 @@ rule: - number: 0x11D31F90 = WSAID_TRANSMITPACKETS guid part - number: 0xD9689DA0 = WSAID_TRANSMITPACKETS guid part - or: - - number/x64: 0x8 = 64-bit function ptr - - number/x32: 0x4 = 32-bit function ptr + - and: + - arch: i386 + - number: 0x4 = 32-bit function ptr + - and: + - arch: amd64 + - number: 0x8 = 64-bit function ptr - optional: - api: WSAIoctl - api: WSAGetLastError diff --git a/data-manipulation/checksum/adler32/compute-adler32-checksum.yml b/data-manipulation/checksum/adler32/compute-adler32-checksum.yml index 574a137c..74ccbc9c 100644 --- a/data-manipulation/checksum/adler32/compute-adler32-checksum.yml +++ b/data-manipulation/checksum/adler32/compute-adler32-checksum.yml @@ -14,16 +14,19 @@ rule: - and: - basic block: - and: + - instruction: + - mnemonic: shr + - operand[1].number: 0xF + - number: 0x80078071 - - number: 0xF - - mnemonic: shr - mnemonic: mul - mnemonic: imul + - or: - - and: - - number: 0xFFFF000F = -65521 + - instruction: - mnemonic: add - - and: + - number: 0xFFFF000F = -65521 + - instruction: - number: 0xFFF1 = 65521 - mnemonic: sub # Examples: @@ -43,8 +46,7 @@ rule: # shr edx, 0Fh ; edx = 0x2002 >> 0xF = 4 # imul eax, edx, 0FFF1h ; eax = 4 * 65521 (0xFFF1) = 262084 (3FFC4) # sub ebx, eax ; ebx = 0x3FFC9 - 0x3FFC4 = 5 - - basic block: - - and: - - mnemonic: shl - - number: 0x10 + - instruction: + - mnemonic: shl + - number: 0x10 - count(characteristic(tight loop)): 2 or more diff --git a/data-manipulation/checksum/crc32/hash-data-with-crc32.yml b/data-manipulation/checksum/crc32/hash-data-with-crc32.yml index 64c8fe95..cc2df47c 100644 --- a/data-manipulation/checksum/crc32/hash-data-with-crc32.yml +++ b/data-manipulation/checksum/crc32/hash-data-with-crc32.yml @@ -13,9 +13,10 @@ rule: features: - or: - and: - - mnemonic: shr + - instruction: + - mnemonic: shr + - number: 8 - number: 0xEDB88320 - - number: 8 - characteristic: nzxor - and: - number: 0x8320 diff --git a/data-manipulation/compression/decompress-data-using-aplib.yml b/data-manipulation/compression/decompress-data-using-aplib.yml index d23ae4ac..cd585d32 100644 --- a/data-manipulation/compression/decompress-data-using-aplib.yml +++ b/data-manipulation/compression/decompress-data-using-aplib.yml @@ -20,28 +20,24 @@ rule: - and: - description: aP_depack - match: contain loop - - basic block: + - instruction: - description: line 138, if (offs >= 32000) - - and: - - mnemonic: cmp - - number: 32000 - - basic block: + - mnemonic: cmp + - number: 32000 + - instruction: - description: line 144, if (offs < 128) - - and: - - mnemonic: cmp - - or: - - number: 127 - - number: 128 - - basic block: + - mnemonic: cmp + - or: + - number: 127 + - number: 128 + - instruction: - description: line 133, offs <<= 8; - - and: - - mnemonic: shl - - number: 8 - - basic block: + - mnemonic: shl + - number: 8 + - instruction: - description: line 96, offs >>= 1; - - and: - - mnemonic: shr - - number: 1 + - mnemonic: shr + - number: 1 - optional: - count(characteristic(calls from)): 2 or more description: calls aP_getbit and aP_getgamma diff --git a/data-manipulation/encryption/elliptic-curve/encrypt-data-using-curve25519.yml b/data-manipulation/encryption/elliptic-curve/encrypt-data-using-curve25519.yml index bc24b8e3..ec07ddd3 100644 --- a/data-manipulation/encryption/elliptic-curve/encrypt-data-using-curve25519.yml +++ b/data-manipulation/encryption/elliptic-curve/encrypt-data-using-curve25519.yml @@ -16,12 +16,12 @@ rule: # array[0] = 0xf8, # array[31] = array[31] & 0x3f | 0x40 - and: - - and: + - instruction: + - mnemonic: and - number: 0xf8 + - instruction: - mnemonic: and - - and: - number: 0x3f - - mnemonic: and - - and: - - number: 0x40 + - instruction: - mnemonic: or + - number: 0x40 diff --git a/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml b/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml index 1f88e88f..848eb6b3 100644 --- a/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml +++ b/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml @@ -17,36 +17,36 @@ rule: - e69a8eb94f65480980deaf1ff5a431a6:0x405D0D features: - and: - - and: + - instruction: + - mnemonic: shl - number: 0x0F = (v << (32 - 17)) from ROTR32(x, 17) in F2(x) - - mnemonic: shl - - and: + - instruction: + - mnemonic: shr - number: 0x11 = (v >> 17) from ROTR32(x, 17) in F2(x) - - mnemonic: shr - - and: + - instruction: + - mnemonic: shl - number: 0xD = (v << (32 - 19)) from ROTR32(x, 19) in F2(x) - - mnemonic: shl - - and: + - instruction: + - mnemonic: shr - number: 0x13 = (v >> 19) from ROTR32(x, 19) in F2(x) + - instruction: - mnemonic: shr - - and: - number: 0xA = (v >> 10) in F2(x) - - mnemonic: shr - - and: + - instruction: + - mnemonic: shl - number: 0x19 = (v << (32 - 7)) from ROTR32(x, 7) in F1(x) - - mnemonic: shl - - and: + - instruction: + - mnemonic: shr - number: 0x7 = (v >> 7) from ROTR32(x, 7) in F1(x) - - mnemonic: shr - - and: - - number: 0xE = (v << (32 - 18)) from ROTR32(x, 18) in F1(x) + - instruction: - mnemonic: shl - - and: + - number: 0xE = (v << (32 - 18)) from ROTR32(x, 18) in F1(x) + - instruction: + - mnemonic: shr - number: 0x12 = (v >> 18) from ROTR32(x, 18) in F1(X) + - instruction: - mnemonic: shr - - and: - number: 0x3 = (x >> 3) in F1(x) - - mnemonic: shr - count(mnemonic(shl)): 4 - count(mnemonic(shr)): 6 - count(mnemonic(or)): 4 diff --git a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml index 606d172d..e187e0a1 100644 --- a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml +++ b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml @@ -37,10 +37,10 @@ rule: - mnemonic: idiv - and: - description: optimized, writes DWORDs instead of bytes - - or: - - number: 0xFFFEFDFC + - instruction: - mnemonic: sub - - or: - - number: 0x03020100 + - number: 0xFFFEFDFC + - instruction: - mnemonic: add + - number: 0x03020100 - number: 0x4040404 diff --git a/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml b/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml index 1a065ac9..ed133464 100644 --- a/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml +++ b/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml @@ -21,9 +21,9 @@ rule: - bytes: 00 00 00 00 18 0F 40 CD 30 1E 80 33 28 11 C0 FE 60 3C A9 66 78 33 E9 AB 50 22 29 55 48 2D 69 98 C0 78 FB CC D8 77 BB 01 F0 66 7B FF E8 69 3B 32 A0 44 52 AA B8 4B 12 67 90 5A D2 99 88 55 92 54 29 F0 5F 31 31 FF 1F FC 19 EE DF 02 01 E1 9F CF 49 CC F6 57 51 C3 B6 9A 79 D2 76 64 61 DD 36 A9 E9 88 A4 FD F1 87 E4 30 D9 96 24 CE C1 99 64 03 89 B4 0D 9B 91 BB 4D 56 B9 AA 8D A8 A1 A5 CD 65 = mul_ia - bytes: 00 00 00 00 CD 40 0F 18 33 80 1E 30 FE C0 11 28 66 A9 3C 60 AB E9 33 78 55 29 22 50 98 69 2D 48 CC FB 78 C0 01 BB 77 D8 FF 7B 66 F0 32 3B 69 E8 AA 52 44 A0 67 12 4B B8 99 D2 5A 90 54 92 55 88 31 5F F0 29 FC 1F FF 31 02 DF EE 19 CF 9F E1 01 57 F6 CC 49 9A B6 C3 51 64 76 D2 79 A9 36 DD 61 FD A4 88 E9 30 E4 87 F1 CE 24 96 D9 03 64 99 C1 9B 0D B4 89 56 4D BB 91 A8 8D AA B9 65 CD A5 A1 = mul_ia_4byte_array_le - and: - - and: - - number: 7 + - instruction: - mnemonic: rol - - and: - - number: 0x54655307 + - number: 7 + - instruction: - mnemonic: imul + - number: 0x54655307 diff --git a/data-manipulation/hashing/djb2/hash-data-using-djb2.yml b/data-manipulation/hashing/djb2/hash-data-using-djb2.yml index 6afb7a0a..7f5997cb 100644 --- a/data-manipulation/hashing/djb2/hash-data-using-djb2.yml +++ b/data-manipulation/hashing/djb2/hash-data-using-djb2.yml @@ -13,13 +13,11 @@ rule: - 6be0ae5cb7c3155f70d608fc7670d2d9:0x41DD19 features: - and: - - basic block: - - and: - - description: hash = 5381 - - mnemonic: mov - - number: 5381 - - basic block: - - and: - - description: hash << 5 - - mnemonic: shl - - number: 5 + - instruction: + - description: hash = 5381 + - mnemonic: mov + - number: 5381 + - instruction: + - description: hash << 5 + - mnemonic: shl + - number: 5 diff --git a/data-manipulation/hashing/murmur/hash-data-using-murmur3.yml b/data-manipulation/hashing/murmur/hash-data-using-murmur3.yml index de4fb82e..d02c0ddf 100644 --- a/data-manipulation/hashing/murmur/hash-data-using-murmur3.yml +++ b/data-manipulation/hashing/murmur/hash-data-using-murmur3.yml @@ -33,20 +33,22 @@ rule: - and: - description: 'hash >> 16; hash >> 13; hash >> 16' - count(mnemonic(shr)): 3 - - number: 16 - - number: 13 + - instruction: + - mnemonic: shr + - number: 16 + - instruction: + - mnemonic: shr + - number: 13 - optional: - count(characteristic(nzxor)): 3 or more - and: # Group this two blocks under an `and` as on their own they are not # unique enough and would cause false positives - - basic block: - - and: - - description: k ROL r1 - - mnemonic: rol - - number: 15 = r1 - - basic block: - - and: - - description: hash ROL r2 - - mnemonic: rol - - number: 13 = r2 + - instruction: + - description: k ROL r1 + - mnemonic: rol + - number: 15 = r1 + - instruction: + - description: hash ROL r2 + - mnemonic: rol + - number: 13 = r2 diff --git a/host-interaction/file-system/exists/check-if-file-exists.yml b/host-interaction/file-system/exists/check-if-file-exists.yml index 416e765f..982669f6 100644 --- a/host-interaction/file-system/exists/check-if-file-exists.yml +++ b/host-interaction/file-system/exists/check-if-file-exists.yml @@ -13,11 +13,13 @@ rule: - basic block: - and: - api: kernel32.GetFileAttributes - - mnemonic: cmp - - number: 0xFFFFFFFF = INVALID_FILE_ATTRIBUTES + - instruction: + - mnemonic: cmp + - number: 0xFFFFFFFF = INVALID_FILE_ATTRIBUTES - basic block: - and: - api: kernel32.GetLastError - - mnemonic: cmp - - number: 2 = ERROR_FILE_NOT_FOUND + - instruction: + - mnemonic: cmp + - number: 2 = ERROR_FILE_NOT_FOUND - api: shlwapi.PathFileExists diff --git a/host-interaction/hardware/cpu/get-number-of-processors.yml b/host-interaction/hardware/cpu/get-number-of-processors.yml index 4b3895fd..75a7f7ee 100644 --- a/host-interaction/hardware/cpu/get-number-of-processors.yml +++ b/host-interaction/hardware/cpu/get-number-of-processors.yml @@ -7,12 +7,16 @@ rule: att&ck: - Discovery::System Information Discovery [T1082] references: - - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L113 + - https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiVM/Generic.cpp#L361 examples: - al-khaser_x86.exe_:0x432CB0 features: - and: - match: PEB access - or: - - number/x32: 0x64 - - number/x64: 0xB8 + - and: + - arch: i386 + - number: 0x64 = PEB->NumberOfProcessors + - and: + - arch: amd64 + - number: 0xB8 = PEB->NumberOfProcessors diff --git a/host-interaction/network/connectivity/check-internet-connectivity-via-wininet.yml b/host-interaction/network/connectivity/check-internet-connectivity-via-wininet.yml index 140c45b8..bb5c0493 100644 --- a/host-interaction/network/connectivity/check-internet-connectivity-via-wininet.yml +++ b/host-interaction/network/connectivity/check-internet-connectivity-via-wininet.yml @@ -17,8 +17,9 @@ rule: - api: wininet.InternetGetConnectedState - api: wininet.InternetCheckConnection - optional: - - mnemonic: cmp - - or: - - number: 0 = FALSE - - number: 1 = TRUE + - instruction: + - mnemonic: cmp + - or: + - number: 0 = FALSE + - number: 1 = TRUE - api: wininet.InternetAttemptConnect diff --git a/host-interaction/os/version/check-os-version.yml b/host-interaction/os/version/check-os-version.yml index d2c9f829..5c298c6f 100644 --- a/host-interaction/os/version/check-os-version.yml +++ b/host-interaction/os/version/check-os-version.yml @@ -19,24 +19,35 @@ rule: - api: GetVersionEx - api: VerifyVersionInfo - api: VerSetConditionMask - - mnemonic: cmp - or: - and: - - number: 5 = Windows 2000 + - instruction: + - mnemonic: cmp + - number: 5 = Windows 2000 - optional: - - or: - - number: 0 - - number: 1 = Windows XP - - number: 2 = Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2 + - instruction: + - mnemonic: cmp + - or: + - number: 0 + - number: 1 = Windows XP + - number: 2 = Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2 - and: - - number: 6 = Windows Vista / Windows Server 2008 + - instruction: + - mnemonic: cmp + - number: 6 = Windows Vista / Windows Server 2008 - optional: - - or: - - number: 0 - - number: 1 = Windows Server 2008 R2 / Windows 7 - - number: 2 = Windows Server 2012 / Windows 8 - - number: 3 = Windows Server 2012 R2 / Windows 8.1 + - instruction: + - mnemonic: cmp + - or: + - number: 0 + - number: 1 = Windows Server 2008 R2 / Windows 7 + - number: 2 = Windows Server 2012 / Windows 8 + - number: 3 = Windows Server 2012 R2 / Windows 8.1 - and: - - number: 10 = Windows Server 2016 / Windows Server 2019 / Windows 10 + - instruction: + - mnemonic: cmp + - number: 10 = Windows Server 2016 / Windows Server 2019 / Windows 10 - optional: - - number: 0 + - instruction: + - mnemonic: cmp + - number: 0 diff --git a/host-interaction/process/create/create-a-process-with-modified-io-handles-and-window.yml b/host-interaction/process/create/create-a-process-with-modified-io-handles-and-window.yml index 6fd47a1f..6740f1eb 100644 --- a/host-interaction/process/create/create-a-process-with-modified-io-handles-and-window.yml +++ b/host-interaction/process/create/create-a-process-with-modified-io-handles-and-window.yml @@ -23,8 +23,12 @@ rule: # STARTF_USESTDHANDLES indicates the hStdInput, hStdOutput, and hStdError members contain additional information # STARTF_USESHOWWINDOW indicates the wShowWindow member contains additional information - or: - - number/x32: 0x44 = StartupInfo.cb (size) - - number/x64: 0x68 = StartupInfo.cb (size) + - and: + - arch: i386 + - number: 0x44 = StartupInfo.cb (size) + - and: + - arch: amd64 + - number: 0x68 = StartupInfo.cb (size) # STARTUPINFOEX size values not currently supported by this rule. - optional: - api: kernel32.GetStartupInfo diff --git a/host-interaction/process/get-process-heap-flags.yml b/host-interaction/process/get-process-heap-flags.yml index 1ecc43d6..9460ba2d 100644 --- a/host-interaction/process/get-process-heap-flags.yml +++ b/host-interaction/process/get-process-heap-flags.yml @@ -7,7 +7,7 @@ rule: att&ck: - Discovery::Process Discovery [T1057] references: - - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/ProcessHeap_Flags.cpp + - https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiDebug/ProcessHeap_Flags.cpp#L13 examples: - al-khaser_x86.exe_:0x425470 features: @@ -15,12 +15,14 @@ rule: - match: PEB access - or: - and: - - number/x32: 0x18 = offset process heap + - arch: i386 + - number: 0x18 = PEB->ProcessHeap - or: - - number/x32: 0x40 = offset heap flags >= Vista - - number/x32: 0xC = offset heap flags < Vista + - number: 0x40 = ProcessHeap->HeapFlags >= Vista + - number: 0xC = ProcessHeap->HeapFlags < Vista - and: - - number/x64: 0x30 = offset process heap + - arch: amd64 + - number: 0x30 = PEB->ProcessHeap - or: - - number/x64: 0x70 = offset heap flags >= Vista - - number/x64: 0x14 = offset heap flags < Vista + - number: 0x70 = ProcessHeap->HeapFlags >= Vista + - number: 0x14 = ProcessHeap->HeapFlags < Vista diff --git a/host-interaction/process/get-process-heap-force-flags.yml b/host-interaction/process/get-process-heap-force-flags.yml index 7de5c80c..3274460e 100644 --- a/host-interaction/process/get-process-heap-force-flags.yml +++ b/host-interaction/process/get-process-heap-force-flags.yml @@ -7,7 +7,7 @@ rule: att&ck: - Discovery::Process Discovery [T1057] references: - - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/ProcessHeap_ForceFlags.cpp + - https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiDebug/ProcessHeap_ForceFlags.cpp#L14 examples: - al-khaser_x86.exe_:0x425470 features: @@ -15,12 +15,14 @@ rule: - match: PEB access - or: - and: - - number/x32: 0x18 = offset process heap + - arch: i386 + - number: 0x18 = PEB->ProcessHeap - or: - - number/x32: 0x44 = offset force flags >= Vista - - number/x32: 0x10 = offset force flags < Vista + - number: 0x44 = ProcessHeap->ForceFlags >= Vista + - number: 0x10 = ProcessHeap->ForceFlags < Vista - and: - - number/x64: 0x30 = offset process heap + - arch: amd64 + - number: 0x30 = PEB->ProcessHeap - or: - - number/x64: 0x74 = offset force flags >= Vista - - number/x64: 0x18 = offset force flags < Vista + - number: 0x74 = ProcessHeap->ForceFlags >= Vista + - number: 0x18 = ProcessHeap->ForceFlags < Vista diff --git a/host-interaction/process/terminate/terminate-process-via-fastfail.yml b/host-interaction/process/terminate/terminate-process-via-fastfail.yml index e657d0e9..f5d8bca8 100644 --- a/host-interaction/process/terminate/terminate-process-via-fastfail.yml +++ b/host-interaction/process/terminate/terminate-process-via-fastfail.yml @@ -3,7 +3,7 @@ rule: name: terminate process via fastfail namespace: host-interaction/process/terminate author: "@_re_fox" - scope: basic block + scope: instruction mbc: - Process::Terminate Process [C0018] references: diff --git a/host-interaction/recycle-bin/empty-recycle-bin-quietly.yml b/host-interaction/recycle-bin/empty-recycle-bin-quietly.yml index c6ff1480..6f241168 100644 --- a/host-interaction/recycle-bin/empty-recycle-bin-quietly.yml +++ b/host-interaction/recycle-bin/empty-recycle-bin-quietly.yml @@ -13,9 +13,11 @@ rule: features: - and: - api: SHEmptyRecycleBin - - or: - - and: - - mnemonic: lea - - offset: 7 = SHERB_NOSOUND|SHERB_NOPROGRESSUI|SHERB_NOCONFIRMATION - - description: accounts for argument loaded via LEA (lea r8d, [rdx+7]) - - number: 7 = SHERB_NOSOUND|SHERB_NOPROGRESSUI|SHERB_NOCONFIRMATION + - instruction: + - or: + - and: + - mnemonic: cmp + - number: 7 = SHERB_NOSOUND|SHERB_NOPROGRESSUI|SHERB_NOCONFIRMATION + - and: + - mnemonic: lea + - offset: 7 = SHERB_NOSOUND|SHERB_NOPROGRESSUI|SHERB_NOCONFIRMATION diff --git a/lib/calculate-modulo-256-via-x86-assembly.yml b/lib/calculate-modulo-256-via-x86-assembly.yml index f46a471d..eebf14f8 100644 --- a/lib/calculate-modulo-256-via-x86-assembly.yml +++ b/lib/calculate-modulo-256-via-x86-assembly.yml @@ -3,7 +3,7 @@ rule: name: calculate modulo 256 via x86 assembly author: moritz.raabe@mandiant.com lib: true - scope: basic block + scope: instruction mbc: - Data::Modulo [C0058] examples: diff --git a/lib/peb-access.yml b/lib/peb-access.yml index 05da2d0a..deb04828 100644 --- a/lib/peb-access.yml +++ b/lib/peb-access.yml @@ -15,22 +15,31 @@ rule: - characteristic: peb access - and: # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp#L41 + - arch: i386 - characteristic: fs access - or: - - offset/x32: 0x30 - - and: - - number/x32: 0x30 + # in 0f5d5d07c6533bc6d991836ce79daaa1 + # then we have: + # + # xor edx, edx + # mov edx, fs:[edx+30h] + - offset: 0x30 + - instruction: + # in the case of CallObfuscator, gs:[rax] - mnemonic: add + - number: 0x30 - and: + - arch: amd64 - characteristic: gs access - or: - - offset/x64: 0x60 - - and: - - number/x64: 0x60 + - offset: 0x60 + - instruction: - mnemonic: add + - number: 0x60 - and: # WoW64 PEB address is fetched via the WoW64 Thread Environment Block (TEB) at FS:[0x18]-0x2000 # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp#L45 - characteristic: fs access - - mnemonic: sub - - number: 0x2000 + - instruction: + - mnemonic: sub + - number: 0x2000 diff --git a/lib/validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml b/lib/validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml index 2afeb98f..21dfb5f4 100644 --- a/lib/validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml +++ b/lib/validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml @@ -40,16 +40,15 @@ rule: - number: 0xfffffffd - number: 0xfffffffe - number: 0xffffffff - - basic block: - - or: - - and: - - description: Conversion of chr to int (SUB 0x30) - - number: 0x30 - - mnemonic: sub - - and: - - description: Conversion of chr to int (LEA REG,[REG+ -0x30]) - - mnemonic: lea - - offset: -0x30 + - or: + - instruction: + - description: Conversion of chr to int (SUB 0x30) + - number: 0x30 + - mnemonic: sub + - instruction: + - description: Conversion of chr to int (LEA REG,[REG+ -0x30]) + - mnemonic: lea + - offset: -0x30 - basic block: - or: - and: diff --git a/lib/validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml b/lib/validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml index 2d0fed45..08ffae5e 100644 --- a/lib/validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml +++ b/lib/validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml @@ -16,29 +16,27 @@ rule: - basic block: - and: - or: - - mnemonic: add - - and: + - instruction: - mnemonic: shl - number: 0x1 - - and: + - instruction: - mnemonic: imul - number: 0x2 - - mnemonic: cmp - - number: 0x9 - - description: Digital Root check number*2 < 0x9 - - and: - - basic block: - - and: + - instruction: - mnemonic: cmp - number: 0x9 - - description: Compare number to 0x9 for Digital Root + - description: Digital Root check number*2 < 0x9 + - and: + - instruction: + - mnemonic: cmp + - number: 0x9 + - description: Compare number to 0x9 for Digital Root - basic block: - or: - - mnemonic: add - - and: + - instruction: - mnemonic: imul - number: 0x2 - - and: + - instruction: - mnemonic: shl - number: 0x1 - description: 2*Number for Digital Root diff --git a/linking/runtime-linking/access-peb-ldr_data.yml b/linking/runtime-linking/access-peb-ldr_data.yml index 19ef6806..812e5d07 100644 --- a/linking/runtime-linking/access-peb-ldr_data.yml +++ b/linking/runtime-linking/access-peb-ldr_data.yml @@ -13,47 +13,33 @@ rule: - 3FDFB2D522E7DEECAAAF2F87420F7E75:0x4117B7 features: - or: - - description: x32 - and: - - description: resolve the PEB - - or: - - match: PEB access + - arch: i386 + - description: x32 + + - match: PEB access # x86 Windows uses fs:0 to access the TIB which contains SEH information at offset 0 # checking for fs:0 and a (possibly unrelated) number or offset often results in false positives - - offset/x32: 0x0C = PEB.LDR_DATA + - offset: 0x0C = PEB.LDR_DATA - or: - description: resolve a module list - - offset/x32: 0x0C = PEB.LDR_DATA.InLoadOrderModuleList - - offset/x32: 0x14 = PEB.LDR_DATA.InMemoryOrderModuleList - - offset/x32: 0x1C = PEB.LDR_DATA.InInitializationOrderModuleList + - offset: 0x0C = PEB.LDR_DATA.InLoadOrderModuleList + - offset: 0x14 = PEB.LDR_DATA.InMemoryOrderModuleList + - offset: 0x1C = PEB.LDR_DATA.InInitializationOrderModuleList - and: + - arch: amd64 - description: x64 - - or: - - description: resolve the PEB + - match: PEB access - - match: PEB access - # in the case of CallObfuscator, gs:[rax] - - and: - - number/x64: 0x60 - - characteristic: gs access - # in 0f5d5d07c6533bc6d991836ce79daaa1 - # then we have: - # - # xor edx, edx - # mov edx, fs:[edx+30h] - - and: - - offset/x64: 0x60 = PEB - - characteristic: gs access - - - offset/x64: 0x18 = PEB.LDR_DATA + - offset: 0x18 = PEB.LDR_DATA - or: - description: resolve a module list - - offset/x64: 0x10 = PEB.LDR_DATA.InLoadOrderModuleList - - offset/x64: 0x20 = PEB.LDR_DATA.InMemoryOrderModuleList - - offset/x64: 0x30 = PEB.LDR_DATA.InInitializationOrderModuleList + - offset: 0x10 = PEB.LDR_DATA.InLoadOrderModuleList + - offset: 0x20 = PEB.LDR_DATA.InMemoryOrderModuleList + - offset: 0x30 = PEB.LDR_DATA.InInitializationOrderModuleList diff --git a/linking/runtime-linking/get-kernel32-base-address.yml b/linking/runtime-linking/get-kernel32-base-address.yml index 85c3474c..fbd2d616 100644 --- a/linking/runtime-linking/get-kernel32-base-address.yml +++ b/linking/runtime-linking/get-kernel32-base-address.yml @@ -19,5 +19,9 @@ rule: - count(offset(0)): 2 # -> kernel32 -> LDR_DATA_TABLE_ENTRY.DllBase - or: - - offset/x32: 0x18 = LDR_DATA_TABLE_ENTRY.DllBase - - offset/x64: 0x30 = LDR_DATA_TABLE_ENTRY.DllBase + - and: + - arch: i386 + - offset: 0x18 = LDR_DATA_TABLE_ENTRY.DllBase + - and: + - arch: amd64 + - offset: 0x30 = LDR_DATA_TABLE_ENTRY.DllBase diff --git a/linking/runtime-linking/get-ntdll-base-address.yml b/linking/runtime-linking/get-ntdll-base-address.yml index 1379c69c..943caa89 100644 --- a/linking/runtime-linking/get-ntdll-base-address.yml +++ b/linking/runtime-linking/get-ntdll-base-address.yml @@ -19,5 +19,9 @@ rule: - count(offset(0)): 1 # -> ntdll -> LDR_DATA_TABLE_ENTRY.DllBase - or: - - offset/x32: 0x18 = LDR_DATA_TABLE_ENTRY.DllBase - - offset/x64: 0x30 = LDR_DATA_TABLE_ENTRY.DllBase + - and: + - arch: i386 + - offset: 0x18 = LDR_DATA_TABLE_ENTRY.DllBase + - and: + - arch: amd64 + - offset: 0x30 = LDR_DATA_TABLE_ENTRY.DllBase diff --git a/load-code/pe/enumerate-pe-sections.yml b/load-code/pe/enumerate-pe-sections.yml index 636ab804..de4734b7 100644 --- a/load-code/pe/enumerate-pe-sections.yml +++ b/load-code/pe/enumerate-pe-sections.yml @@ -25,8 +25,12 @@ rule: - description: (DWORD)dll_raw + dos_header->e_lfanew + sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * i - number: 0x28 = sizeof(IMAGE_SECTION_HEADER) - or: - - offset/x32: 0xF8 = sizeof(IMAGE_NT_HEADERS32) - - offset/x64: 0x108 = sizeof(IMAGE_NT_HEADERS64) + - and: + - arch: i386 + - offset: 0xF8 = sizeof(IMAGE_NT_HEADERS32) + - and: + - arch: amd64 + - offset: 0x108 = sizeof(IMAGE_NT_HEADERS64) - basic block: - and: - offset: 0xC = IMAGE_SECTION_HEADER.VirtualAddress diff --git a/load-code/pe/parse-pe-header.yml b/load-code/pe/parse-pe-header.yml index 5d342497..05085e42 100644 --- a/load-code/pe/parse-pe-header.yml +++ b/load-code/pe/parse-pe-header.yml @@ -29,11 +29,13 @@ rule: - offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew - or: - and: - - offset/x32: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage - - offset/x32: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase + - arch: i386 + - offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage + - offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase - and: - - offset/x64: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage - - offset/x64: 0x30 = IMAGE_NT_HEADERS64.OptionalHeader.ImageBase + - arch: amd64 + - offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage + - offset: 0x30 = IMAGE_NT_HEADERS64.OptionalHeader.ImageBase - basic block: - and: - offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew @@ -43,7 +45,12 @@ rule: - offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader - offset: 0x16 = IMAGE_NT_HEADERS.FileHeader.Characteristics - offset: 0x28 = IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint # for 32 and 64 bit - - offset/x32: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase - - offset/x32: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage - - offset/x64: 0x30 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase - - offset/x64: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage + - or: + - and: + - arch: i386 + - offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase + - offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage + - and: + - arch: amd64 + - offset: 0x30 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase + - offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage diff --git a/load-code/pe/rebuild-import-table.yml b/load-code/pe/rebuild-import-table.yml index c0c9c99c..136dd725 100644 --- a/load-code/pe/rebuild-import-table.yml +++ b/load-code/pe/rebuild-import-table.yml @@ -25,7 +25,11 @@ rule: - optional: - description: import by ordinal - or: - - number/x32: 0x80000000 = IMAGE_SNAP_BY_ORDINAL32 - - number/x64: 0x8000000000000000 = IMAGE_SNAP_BY_ORDINAL64 + - and: + - arch: i386 + - number: 0x80000000 = IMAGE_SNAP_BY_ORDINAL32 + - and: + - arch: amd64 + - number: 0x8000000000000000 = IMAGE_SNAP_BY_ORDINAL64 - number: 0xFFFF = IMAGE_ORDINAL - number: 0x2 = thunk->u1.AddressOfData diff --git a/load-code/shellcode/execute-shellcode-via-copyfile2.yml b/load-code/shellcode/execute-shellcode-via-copyfile2.yml index b7dbd5db..52b878d5 100644 --- a/load-code/shellcode/execute-shellcode-via-copyfile2.yml +++ b/load-code/shellcode/execute-shellcode-via-copyfile2.yml @@ -20,8 +20,11 @@ rule: # lea r9d, [rcx+40h] ; flProtect # call cs:VirtualAlloc - match: allocate memory - - mnemonic: lea - - offset: 0x40 + - or: + - number: 0x40 + - instruction: + - mnemonic: lea + - offset: 0x40 - api: CopyFile2 - api: DeleteFileW - number: 0x00000001 = COPY_FILE_FAIL_IF_EXISTS diff --git a/nursery/check-thread-yield-allowed.yml b/nursery/check-thread-yield-allowed.yml index 256ff7c4..898cb75a 100644 --- a/nursery/check-thread-yield-allowed.yml +++ b/nursery/check-thread-yield-allowed.yml @@ -12,7 +12,6 @@ rule: - and: - api: NtYieldExecution - match: contain loop - - basic block: - - and: - - mnemonic: cmp - - number: 0x40000024 = STATUS_NO_YIELD_PERFORMED + - instruction: + - mnemonic: cmp + - number: 0x40000024 = STATUS_NO_YIELD_PERFORMED diff --git a/nursery/generate-random-numbers-using-the-delphi-lcg.yml b/nursery/generate-random-numbers-using-the-delphi-lcg.yml index 084be00b..de96962b 100644 --- a/nursery/generate-random-numbers-using-the-delphi-lcg.yml +++ b/nursery/generate-random-numbers-using-the-delphi-lcg.yml @@ -11,6 +11,7 @@ rule: - https://community.osr.com/discussion/130410/generating-random-numbers features: - and: - - mnemonic: imul - - number: 0x8088405 = multiplier a + - instruction: + - mnemonic: imul + - number: 0x8088405 = multiplier a - mnemonic: inc = increment c diff --git a/nursery/hash-data-using-murmur2.yml b/nursery/hash-data-using-murmur2.yml index 68ac0a59..5a18023b 100644 --- a/nursery/hash-data-using-murmur2.yml +++ b/nursery/hash-data-using-murmur2.yml @@ -3,13 +3,13 @@ rule: name: hash data using murmur2 namespace: data-manipulation/hashing/murmur author: william.ballenthin@mandiant.com - scope: function + scope: instruction references: - https://github.com/abrandoned/murmur2/blob/master/MurmurHash2.c examples: features: - and: + - mnemonic: imul - or: - number: 0xc6a4a7935bd1e995 = 64-bit mixing constant m - number: 0x5bd1e995 = 32-bit mixing constant m - - mnemonic: imul diff --git a/nursery/log-keystrokes-via-raw-input-data.yml b/nursery/log-keystrokes-via-raw-input-data.yml index 451b75fe..6060f984 100644 --- a/nursery/log-keystrokes-via-raw-input-data.yml +++ b/nursery/log-keystrokes-via-raw-input-data.yml @@ -15,17 +15,15 @@ rule: - api: user32.GetRawInputData - number: 0x10000003 = RID_INPUT - number: 0x10 = sizeof(RAWINPUTHEADER) - - basic block: + - instruction: - description: check raw data is keyboard keydown - - and: - - mnemonic: cmp - - offset/x32: 0x18 = RAWINPUT->data.Message - - number: 0x100 = WM_KEYDOWN - - basic block: + - mnemonic: cmp + - offset: 0x18 = RAWINPUT->data.Message + - number: 0x100 = WM_KEYDOWN + - instruction: - description: check raw data is keyboard - - and: - - mnemonic: cmp - - offset/x32: 0x0 = RAWINPUT->header.dwType - - number: 0x1 = RIM_TYPEKEYBOARD + - mnemonic: cmp + - offset: 0x0 = RAWINPUT->header.dwType + - number: 0x1 = RIM_TYPEKEYBOARD - optional: - - offset/x32: 0x16 = RAWINPUT->data.VKey + - offset: 0x16 = RAWINPUT->data.VKey diff --git a/nursery/search-for-credit-card-data.yml b/nursery/search-for-credit-card-data.yml index ff8f1d2c..4fad8c5d 100644 --- a/nursery/search-for-credit-card-data.yml +++ b/nursery/search-for-credit-card-data.yml @@ -6,17 +6,14 @@ rule: scope: function features: - and: - - basic block: - - and: - - mnemonic: cmp - - number: 0x5E = '^' (Track 1 separator) - - basic block: - - and: - - mnemonic: cmp - - number: 0x3D = '=' (Track 2 separator) - - basic block: - - and: - - mnemonic: cmp - # seen in 518185ED134F93DF708590E74473DA8E and 05B2D1AF23CF96E295BBBFC6CDC76E1F - - number: 0x44 = 'D' (Unknown separator) + - instruction: + - mnemonic: cmp + - number: 0x5E = '^' (Track 1 separator) + - instruction: + - mnemonic: cmp + - number: 0x3D = '=' (Track 2 separator) + - instruction: + - mnemonic: cmp + # seen in 518185ED134F93DF708590E74473DA8E and 05B2D1AF23CF96E295BBBFC6CDC76E1F + - number: 0x44 = 'D' (Unknown separator) - match: read process memory