vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add RtlRegisterWait API to shellcode exec callback (#1094)

Browse source 
* Add RtlRegisterWait API to shellcode exec callback

* Require SetEvent to reduce fp
This commit is contained in:
Still / Azaka 2025-12-30 02:20:58 +09:00 • committed by GitHub
parent 6120dfb6e0
commit a4411edeea
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
load-code/shellcode/execute-shellcode-via-windows-callback-function.yml
View file

@ -21,6 +21,7 @@ rule:
- https://github.com/aahmad097/AlternativeShellcodeExec/
- https://osandamalith.com/2021/04/01/executing-shellcode-via-callbacks/
- https://github.com/tlsbollei/Malware-Training/blob/main/Code%20Injection/LdrCallEnclave.cpp
- https://osandamalith.com/2025/10/18/rtlregisterwait-shellcode-execution-poc/
examples:
- 10cd7afd580ee9c222b0a87ff241d306:0x10008BE0
- 268d61837aa248c1d49a973612a129ce:0x1000CEC0
@ -81,6 +82,9 @@ rule:
- api: ImmEnumInputContext
- api: LdrCallEnclave
- api: LineDDA
- and:
- api: RtlRegisterWait
- api: SetEvent
- and:
- api: SymInitialize
- or: