vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Adding execute-shellcode-via-createthreadpoolwait.yml

Browse source
This commit is contained in:
jtothej 2021-12-11 22:07:29 +08:00
parent ab7d4c4f66
commit c0b42ae17d
1 changed files with 19 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

19
load-code/shellcode/execute-shellcode-via-createthreadpoolwait.yml Normal file
View file

@ -0,0 +1,19 @@
rule:
meta:
name: execute shellcode via CreateThreadpoolWait
namespace: load-code/shellcode
author: jakub.jozwiak@mandiant.com
scope: function
references:
- https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/CreateThreadPoolWait/CreateThreadPoolWait.cpp
examples:
- a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf:0x10001010
features:
- and:
- match: allocate RWX memory
- api: CreateEvent
- api: CreateThreadpoolWait
- api: SetThreadpoolWait
- or:
- api: WaitForSingleObject
- api: WaitForThreadpoolWaitCallbacks