vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Revert "Merge pull request #548 from mandiant/feature-remove-flavors"

Browse source 
This reverts commit bc28847dd9, reversing
changes made to 82308c4109.
This commit is contained in:
William Ballenthin 2022-04-27 06:23:36 -06:00
parent 3b72e490b3
commit d43a6ee544
43 changed files with 343 additions and 401 deletions
Download patch file Download diff file Expand all files Collapse all files

7
load-code/shellcode/execute-shellcode-via-copyfile2.yml
View file

@ -20,11 +20,8 @@ rule:
# lea r9d, [rcx+40h] ; flProtect
# call cs:VirtualAlloc
- match: allocate memory
- or:
- number: 0x40
- instruction:
- mnemonic: lea
- offset: 0x40
- mnemonic: lea
- offset: 0x40
- api: CopyFile2
- api: DeleteFileW
- number: 0x00000001 = COPY_FILE_FAIL_IF_EXISTS