adding rules based on more PMA labs

anti-analysis/anti-forensic/self-deletion/self-delete.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: self delete via COMSPEC environment variable
+    name: self delete
     namespace: anti-analysis/anti-forensic/self-deletion
     author: michael.hunhoff@fireeye.com
     scope: function
@@ -12,10 +12,12 @@ rule:
       - Practical Malware Analysis Lab 14-02.exe_:0x401880
   features:
     - and:
-      - match: get COMSPEC environment variable
+      - or:
+        - match: get COMSPEC environment variable
+        - string: "cmd.exe"
       - match: create process
       - string: /\/c\s*del\s*/
         description: "/c del"
       - optional:
-        - string: /\s*>\s*nul\s*/
+        - string: /\s*>\s*nul\s*/i
           description: "> nul"

anti-analysis/packer/pecompact/packed-with-pecompact.yml

@@ -11,6 +11,7 @@ rule:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
     examples:
+      - Practical Malware Analysis Lab 18-03.exe_
   features:
     - or:
       - section: PEC2TO

host-interaction/driver/create-device-object.yml

@@ -0,0 +1,14 @@
+rule:
+  meta:
+    name: create device object
+    namespace: host-interaction/driver
+    author: "@mr-tz"
+    scope: function
+    examples:
+      - Practical Malware Analysis Lab 10-03.sys_:0x00010706
+  features:
+    - and:
+      - api: IoCreateDevice
+      - optional:
+        - description: sets up a symbolic link between a device object name and a user-visible name for the device
+        - api: IoCreateSymbolicLink

host-interaction/file-system/read/read-file-via-mapping.yml

@@ -11,12 +11,16 @@ rule:
       - basic block:
         - and:
           - api: kernel32.MapViewOfFile
-          - number: 4 = FILE_MAP_READ
+          - or:
+            - number: 4 = FILE_MAP_READ
+            - number: 6 = FILE_MAP_WRITE | FILE_MAP_READ
       - optional:
         - api: kernel32.UnmapViewOfFile
         - and:
           - match: get file size
-          - basic block:
-            - and:
-              - api: kernel32.CreateFileMapping
+        - basic block:
+          - and:
+            - api: kernel32.CreateFileMapping
+            - or:
               - number: 2 = PAGE_READONLY
+              - number: 4 = PAGE_READWRITE

host-interaction/gui/window/get-text/get-graphical-window-text.yml

@@ -8,11 +8,17 @@ rule:
       - Discovery::Application Window Discovery::Window Text [E1010.m01]
     examples:
       - B7841B9D5DC1F511A93CC7576672EC0C:0x10007A50
+      - Practical Malware Analysis Lab 11-03.dll_:0x10001000
   features:
-    - and:
-      - optional:
-        - api: user32.IsWindowVisible
-      - basic block:
-        - and:
-          - number: 0xD = WM_GETTEXT
-          - api: user32.SendMessage
+    - or:
+      - and:
+        - optional:
+          - api: user32.IsWindowVisible
+        - basic block:
+          - and:
+            - number: 0xD = WM_GETTEXT
+            - api: user32.SendMessage
+      - and:
+        - optional:
+          - api: user32.GetForegroundWindow
+        - api: user32.GetWindowText

host-interaction/mutex/check-mutex-and-exit.yml

@@ -11,15 +11,20 @@ rule:
       - Process::Terminate Process [C0018]
     examples:
       - 1d8fd13c890060464019c0f07b928b1a:0x402eb0
+      - Practical Malware Analysis Lab 11-03.dll_:0x10001410
   features:
     - and:
       - match: create mutex
-      - api: ExitProcess
       - or:
-        - api: WaitForSingleObject
-        - and:
-          - api: GetLastError
-          - or:
-            - number: 2 = ERROR_FILE_NOT_FOUND
-            - number: 0xB7 = ERROR_ALREADY_EXISTS
-            - number: 5 = ERROR_ACCESS_DENIED
+        - api: ExitProcess
+        - api: exit
+        - api: _Exit
+        - api: _exit
+        - or:
+          - api: WaitForSingleObject
+          - and:
+            - api: GetLastError
+            - or:
+              - number: 2 = ERROR_FILE_NOT_FOUND
+              - number: 0xB7 = ERROR_ALREADY_EXISTS
+              - number: 5 = ERROR_ACCESS_DENIED

host-interaction/process/create/execute-command.yml

@@ -0,0 +1,16 @@
+rule:
+  meta:
+    name: execute command
+    namespace: host-interaction/process/create
+    author: "@mr-tz"
+    scope: function
+    mbc:
+      - Process::Create Process [C0017]
+    examples:
+      - Practical Malware Analysis Lab 11-03.exe_:0x4012D0
+  features:
+    - or:
+      - api: system
+      - api: _system
+      - api: wsystem
+      - api: _wsystem

host-interaction/process/list/enumerate-processes.yml

@@ -15,8 +15,9 @@ rule:
       - api: kernel32.Process32First
       - api: kernel32.Process32Next
       - optional:
-        - and:
-          - or:
-            - number: 0xF = TH32CS_SNAPALL
-            - number: 0x2 = TH32CS_SNAPPROCESS
-          - api: kernel32.CreateToolhelp32Snapshot
+        - basic block:
+          - and:
+            - or:
+              - number: 0xF = TH32CS_SNAPALL
+              - number: 0x2 = TH32CS_SNAPPROCESS
+            - api: kernel32.CreateToolhelp32Snapshot

host-interaction/process/modules/list/enumerate-process-modules.yml

@@ -10,16 +10,28 @@ rule:
       - 6F99A2C8944CB02FF28C6F9CED59B161:0x419FF8
       - 9B2FD471274C41626B75DDBB5C897877:0x100046B0
   features:
-    - and:
-      - optional:
+    - or:
+      - and:
+        - optional:
+          - or:
+            - api: kernel32.OpenProcess
+            - api: kernel32.CloseHandle
         - or:
-          - api: kernel32.OpenProcess
-          - api: kernel32.CloseHandle
-      - or:
-        - api: kernel32.K32EnumProcessModules
-        - api: kernel32.K32EnumProcessModulesEx
-        - api: kernel32.K32EnumProcesses
-        # depending on OS version in kernel32 or psapi
-        - api: EnumProcessModules
-        - api: EnumProcessModulesEx
-        - api: EnumProcesses
+          - api: kernel32.K32EnumProcessModules
+          - api: kernel32.K32EnumProcessModulesEx
+          - api: kernel32.K32EnumProcesses
+          # depending on OS version in kernel32 or psapi
+          - api: EnumProcessModules
+          - api: EnumProcessModulesEx
+          - api: EnumProcesses
+      - and:
+        - api: kernel32.Module32First
+        - api: kernel32.Module32Next
+        - optional:
+          - basic block:
+            - and:
+              - or:
+                - number: 0x8 = TH32CS_SNAPMODULE
+                - number: 0x10 = TH32CS_SNAPMODULE32
+                - number: 0x18 = TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32
+              - api: kernel32.CreateToolhelp32Snapshot

host-interaction/thread/list/enumerate-threads.yml

@@ -10,3 +10,10 @@ rule:
     - and:
       - api: kernel32.Thread32First
       - api: kernel32.Thread32Next
+      - optional:
+        - basic block:
+          - and:
+            - or:
+              - number: 0x4 = TH32CS_SNAPTHREAD
+              # TH32CS_SNAPTHREAD includes all threads in the system in the snapshot
+            - api: kernel32.CreateToolhelp32Snapshot

load-code/pe/parse-pe-header.yml

@@ -32,3 +32,16 @@ rule:
           - and:
             - offset/x64: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage
             - offset/x64: 0x30 = IMAGE_NT_HEADERS64.OptionalHeader.ImageBase
+      - basic block:
+        - and:
+          - offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew
+          - 3 or more:
+            - offset: 0x4 = IMAGE_NT_HEADERS.FileHeader.Machine
+            - offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections
+            - offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader
+            - offset: 0x16 = IMAGE_NT_HEADERS.FileHeader.Characteristics
+            - offset: 0x28 = IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint  # for 32 and 64 bit
+            - offset/x32: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
+            - offset/x32: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage
+            - offset/x64: 0x30 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
+            - offset/x64: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage

load-code/shellcode/spawn-thread-to-rwx-shellcode.yml

@@ -4,6 +4,8 @@ rule:
     namespace: load-code/shellcode
     author: moritz.raabe@fireeye.com
     scope: function
+    examples:
+      - Practical Malware Analysis Lab 19-02.exe_:0x401230
   features:
     - and:
       - match: allocate RWX memory