vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update execute-shellcode-via-windows-callback-function.yml - Add functions that can be used to execute shellcode

Browse source
This commit is contained in:
jtothej 2024-08-11 12:09:18 +02:00
parent 0e2500fa8a
commit 99c5cf0ea7
1 changed files with 32 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

33
load-code/shellcode/execute-shellcode-via-windows-callback-function.yml
View file

@ -29,28 +29,59 @@ rule:
- and:
- match: allocate or change RWX memory
- or:
- api: AddPropSheetPageProc
- api: CallWindowProc
- api: CertEnumSystemStore
- api: CertEnumSystemStoreLocation
- api: CreateTimerQueueTimer
- api: CryptEnumOIDInfo
- and:
- api: DPA_Create
- api: DPA_SetPtr
- api: DPA_EnumCallback
- and:
- api: DSA_Create
- api: DSA_InsertItem
- api: DSA_EnumCallback
- api: DrawState
- api: EnumCalendarInfo
- api: EnumCalendarInfoEx
- api: EnumChildWindows
- api: EnumChildWindows
- api: EnumDateFormats
- api: EnumDesktops
- api: EnumDesktopWindows
- api: EnumDirTree
- api: EnumDisplayMonitors
- api: EnumFontFamilies
- api: EnumFontFamiliesEx
- api: EnumFonts
- api: EnumLanguageGroupLocales
- and:
- or:
- api: GetDC
- api: GetDCEx
- api: EnumObjects
- api: EnumProps
- api: EnumPropsEx
- api: EnumPwrSchemes
- api: EnumResourceTypes
- api: EnumSystemCodePages
- api: EnumSystemGeoID
- api: EnumSystemGeoNames
- api: EnumSystemLanguageGroups
- api: EnumSystemLocales
- api: EnumThreadWindows
- api: EnumTimeFormats
- api: EnumUILanguages
- api: EnumWindows
- api: EnumWindowStations
- api: EnumerateLoadedModules
- api: GrayString
- api: ImmEnumInputContext
- api: LineDDA
- and:
- api: SymInitialize
- or:
- api: SymEnumProcesses
- api: SymRegisterCallback
- api: VerifierEnumerateResource