vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #505 from jtothej/shellcode-via-enumuilanguages

Browse source 
Adding execute-shellcode-via-enumuilanguages.yml
This commit is contained in:
Willi Ballenthin 2021-12-06 10:57:12 -07:00 • committed by GitHub
commit ad56aeb0e0
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

15
load-code/shellcode/execute-shellcode-via-enumuilanguages.yml Normal file
View file

@ -0,0 +1,15 @@
rule:
meta:
name: execute shellcode via EnumUILanguages
namespace: load-code/shellcode
author: jakub.jozwiak@mandiant.com
scope: function
references:
- http://ropgadget.com/posts/abusing_win_functions.html
- https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/EnumUILanguagesW/EnumUILanguagesW.cpp
examples:
- ffcf88ead82bdfc159376026f5a9a7da49e593497674bdb6fa7f7d03dd9398d9:0x140001000
features:
- and:
- match: allocate RWX memory
- api: EnumUILanguages