vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-05 12:57:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

manipulate safe mode programs: restrict to windows

Browse source
This commit is contained in:
Willi Ballenthin 2021-10-25 12:47:43 -06:00 • committed by GitHub
parent fe1aa57334
commit abe6402a55
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 7 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

12
host-interaction/bootloader/manipulate-safe-mode-programs.yml
View file

@ -9,8 +9,10 @@ rule:
examples:
- 3446b3889a52d81119d8c482a2a282b9:0x409AA8
features:
- or:
- substring: "Control\\SafeBoot\\Minimal\\"
description: registry key for safe mode, no networking
- substring: "Control\\SafeBoot\\Network\\"
description: registry key for safe mode, with networking
- and:
- os: windows
- or:
- substring: "Control\\SafeBoot\\Minimal\\"
description: registry key for safe mode, no networking
- substring: "Control\\SafeBoot\\Network\\"
description: registry key for safe mode, with networking