From d81e7577282963d71ad3beffecc5d484b8522b81 Mon Sep 17 00:00:00 2001 From: Moritz Raabe Date: Wed, 30 Jun 2021 23:38:17 +0200 Subject: [PATCH] adding rules based on more PMA labs --- ...vironment-variable.yml => self-delete.yml} | 8 +++-- .../pecompact}/packed-with-pecompact.yml | 1 + .../driver/create-device-object.yml | 14 ++++++++ .../read/read-file-via-mapping.yml | 12 ++++--- .../get-text/get-graphical-window-text.yml | 20 +++++++---- .../mutex/check-mutex-and-exit.yml | 21 ++++++----- .../process/create/execute-command.yml | 16 +++++++++ .../process/list/enumerate-processes.yml | 11 +++--- .../list/enumerate-process-modules.yml | 36 ++++++++++++------- .../thread/list/enumerate-threads.yml | 7 ++++ load-code/pe/parse-pe-header.yml | 13 +++++++ .../spawn-thread-to-rwx-shellcode.yml | 2 ++ 12 files changed, 122 insertions(+), 39 deletions(-) rename anti-analysis/anti-forensic/self-deletion/{self-delete-via-comspec-environment-variable.yml => self-delete.yml} (78%) rename {nursery => anti-analysis/packer/pecompact}/packed-with-pecompact.yml (93%) create mode 100644 host-interaction/driver/create-device-object.yml create mode 100644 host-interaction/process/create/execute-command.yml rename {nursery => load-code/shellcode}/spawn-thread-to-rwx-shellcode.yml (76%) diff --git a/anti-analysis/anti-forensic/self-deletion/self-delete-via-comspec-environment-variable.yml b/anti-analysis/anti-forensic/self-deletion/self-delete.yml similarity index 78% rename from anti-analysis/anti-forensic/self-deletion/self-delete-via-comspec-environment-variable.yml rename to anti-analysis/anti-forensic/self-deletion/self-delete.yml index c0cd9ce0..a606918c 100644 --- a/anti-analysis/anti-forensic/self-deletion/self-delete-via-comspec-environment-variable.yml +++ b/anti-analysis/anti-forensic/self-deletion/self-delete.yml @@ -1,6 +1,6 @@ rule: meta: - name: self delete via COMSPEC environment variable + name: self delete namespace: anti-analysis/anti-forensic/self-deletion author: michael.hunhoff@fireeye.com scope: function @@ -12,10 +12,12 @@ rule: - Practical Malware Analysis Lab 14-02.exe_:0x401880 features: - and: - - match: get COMSPEC environment variable + - or: + - match: get COMSPEC environment variable + - string: "cmd.exe" - match: create process - string: /\/c\s*del\s*/ description: "/c del" - optional: - - string: /\s*>\s*nul\s*/ + - string: /\s*>\s*nul\s*/i description: "> nul" diff --git a/nursery/packed-with-pecompact.yml b/anti-analysis/packer/pecompact/packed-with-pecompact.yml similarity index 93% rename from nursery/packed-with-pecompact.yml rename to anti-analysis/packer/pecompact/packed-with-pecompact.yml index 8142e276..2dd41769 100644 --- a/nursery/packed-with-pecompact.yml +++ b/anti-analysis/packer/pecompact/packed-with-pecompact.yml @@ -11,6 +11,7 @@ rule: references: - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/ examples: + - Practical Malware Analysis Lab 18-03.exe_ features: - or: - section: PEC2TO diff --git a/host-interaction/driver/create-device-object.yml b/host-interaction/driver/create-device-object.yml new file mode 100644 index 00000000..5b4d0f84 --- /dev/null +++ b/host-interaction/driver/create-device-object.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: create device object + namespace: host-interaction/driver + author: "@mr-tz" + scope: function + examples: + - Practical Malware Analysis Lab 10-03.sys_:0x00010706 + features: + - and: + - api: IoCreateDevice + - optional: + - description: sets up a symbolic link between a device object name and a user-visible name for the device + - api: IoCreateSymbolicLink diff --git a/host-interaction/file-system/read/read-file-via-mapping.yml b/host-interaction/file-system/read/read-file-via-mapping.yml index 9971ef66..3969f4d9 100644 --- a/host-interaction/file-system/read/read-file-via-mapping.yml +++ b/host-interaction/file-system/read/read-file-via-mapping.yml @@ -11,12 +11,16 @@ rule: - basic block: - and: - api: kernel32.MapViewOfFile - - number: 4 = FILE_MAP_READ + - or: + - number: 4 = FILE_MAP_READ + - number: 6 = FILE_MAP_WRITE | FILE_MAP_READ - optional: - api: kernel32.UnmapViewOfFile - and: - match: get file size - - basic block: - - and: - - api: kernel32.CreateFileMapping + - basic block: + - and: + - api: kernel32.CreateFileMapping + - or: - number: 2 = PAGE_READONLY + - number: 4 = PAGE_READWRITE diff --git a/host-interaction/gui/window/get-text/get-graphical-window-text.yml b/host-interaction/gui/window/get-text/get-graphical-window-text.yml index e65a4f95..4f8b9a4f 100644 --- a/host-interaction/gui/window/get-text/get-graphical-window-text.yml +++ b/host-interaction/gui/window/get-text/get-graphical-window-text.yml @@ -8,11 +8,17 @@ rule: - Discovery::Application Window Discovery::Window Text [E1010.m01] examples: - B7841B9D5DC1F511A93CC7576672EC0C:0x10007A50 + - Practical Malware Analysis Lab 11-03.dll_:0x10001000 features: - - and: - - optional: - - api: user32.IsWindowVisible - - basic block: - - and: - - number: 0xD = WM_GETTEXT - - api: user32.SendMessage + - or: + - and: + - optional: + - api: user32.IsWindowVisible + - basic block: + - and: + - number: 0xD = WM_GETTEXT + - api: user32.SendMessage + - and: + - optional: + - api: user32.GetForegroundWindow + - api: user32.GetWindowText diff --git a/host-interaction/mutex/check-mutex-and-exit.yml b/host-interaction/mutex/check-mutex-and-exit.yml index 39c0a13e..8d410ac8 100644 --- a/host-interaction/mutex/check-mutex-and-exit.yml +++ b/host-interaction/mutex/check-mutex-and-exit.yml @@ -11,15 +11,20 @@ rule: - Process::Terminate Process [C0018] examples: - 1d8fd13c890060464019c0f07b928b1a:0x402eb0 + - Practical Malware Analysis Lab 11-03.dll_:0x10001410 features: - and: - match: create mutex - - api: ExitProcess - or: - - api: WaitForSingleObject - - and: - - api: GetLastError - - or: - - number: 2 = ERROR_FILE_NOT_FOUND - - number: 0xB7 = ERROR_ALREADY_EXISTS - - number: 5 = ERROR_ACCESS_DENIED + - api: ExitProcess + - api: exit + - api: _Exit + - api: _exit + - or: + - api: WaitForSingleObject + - and: + - api: GetLastError + - or: + - number: 2 = ERROR_FILE_NOT_FOUND + - number: 0xB7 = ERROR_ALREADY_EXISTS + - number: 5 = ERROR_ACCESS_DENIED diff --git a/host-interaction/process/create/execute-command.yml b/host-interaction/process/create/execute-command.yml new file mode 100644 index 00000000..062dee3a --- /dev/null +++ b/host-interaction/process/create/execute-command.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: execute command + namespace: host-interaction/process/create + author: "@mr-tz" + scope: function + mbc: + - Process::Create Process [C0017] + examples: + - Practical Malware Analysis Lab 11-03.exe_:0x4012D0 + features: + - or: + - api: system + - api: _system + - api: wsystem + - api: _wsystem diff --git a/host-interaction/process/list/enumerate-processes.yml b/host-interaction/process/list/enumerate-processes.yml index e15d43c7..b180c6fc 100644 --- a/host-interaction/process/list/enumerate-processes.yml +++ b/host-interaction/process/list/enumerate-processes.yml @@ -15,8 +15,9 @@ rule: - api: kernel32.Process32First - api: kernel32.Process32Next - optional: - - and: - - or: - - number: 0xF = TH32CS_SNAPALL - - number: 0x2 = TH32CS_SNAPPROCESS - - api: kernel32.CreateToolhelp32Snapshot + - basic block: + - and: + - or: + - number: 0xF = TH32CS_SNAPALL + - number: 0x2 = TH32CS_SNAPPROCESS + - api: kernel32.CreateToolhelp32Snapshot diff --git a/host-interaction/process/modules/list/enumerate-process-modules.yml b/host-interaction/process/modules/list/enumerate-process-modules.yml index 6cffc478..4ab1271a 100644 --- a/host-interaction/process/modules/list/enumerate-process-modules.yml +++ b/host-interaction/process/modules/list/enumerate-process-modules.yml @@ -10,16 +10,28 @@ rule: - 6F99A2C8944CB02FF28C6F9CED59B161:0x419FF8 - 9B2FD471274C41626B75DDBB5C897877:0x100046B0 features: - - and: - - optional: + - or: + - and: + - optional: + - or: + - api: kernel32.OpenProcess + - api: kernel32.CloseHandle - or: - - api: kernel32.OpenProcess - - api: kernel32.CloseHandle - - or: - - api: kernel32.K32EnumProcessModules - - api: kernel32.K32EnumProcessModulesEx - - api: kernel32.K32EnumProcesses - # depending on OS version in kernel32 or psapi - - api: EnumProcessModules - - api: EnumProcessModulesEx - - api: EnumProcesses + - api: kernel32.K32EnumProcessModules + - api: kernel32.K32EnumProcessModulesEx + - api: kernel32.K32EnumProcesses + # depending on OS version in kernel32 or psapi + - api: EnumProcessModules + - api: EnumProcessModulesEx + - api: EnumProcesses + - and: + - api: kernel32.Module32First + - api: kernel32.Module32Next + - optional: + - basic block: + - and: + - or: + - number: 0x8 = TH32CS_SNAPMODULE + - number: 0x10 = TH32CS_SNAPMODULE32 + - number: 0x18 = TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32 + - api: kernel32.CreateToolhelp32Snapshot diff --git a/host-interaction/thread/list/enumerate-threads.yml b/host-interaction/thread/list/enumerate-threads.yml index b66328b7..044e0da0 100644 --- a/host-interaction/thread/list/enumerate-threads.yml +++ b/host-interaction/thread/list/enumerate-threads.yml @@ -10,3 +10,10 @@ rule: - and: - api: kernel32.Thread32First - api: kernel32.Thread32Next + - optional: + - basic block: + - and: + - or: + - number: 0x4 = TH32CS_SNAPTHREAD + # TH32CS_SNAPTHREAD includes all threads in the system in the snapshot + - api: kernel32.CreateToolhelp32Snapshot diff --git a/load-code/pe/parse-pe-header.yml b/load-code/pe/parse-pe-header.yml index eeb92377..d69513a4 100644 --- a/load-code/pe/parse-pe-header.yml +++ b/load-code/pe/parse-pe-header.yml @@ -32,3 +32,16 @@ rule: - and: - offset/x64: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage - offset/x64: 0x30 = IMAGE_NT_HEADERS64.OptionalHeader.ImageBase + - basic block: + - and: + - offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew + - 3 or more: + - offset: 0x4 = IMAGE_NT_HEADERS.FileHeader.Machine + - offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections + - offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader + - offset: 0x16 = IMAGE_NT_HEADERS.FileHeader.Characteristics + - offset: 0x28 = IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint # for 32 and 64 bit + - offset/x32: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase + - offset/x32: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage + - offset/x64: 0x30 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase + - offset/x64: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage diff --git a/nursery/spawn-thread-to-rwx-shellcode.yml b/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml similarity index 76% rename from nursery/spawn-thread-to-rwx-shellcode.yml rename to load-code/shellcode/spawn-thread-to-rwx-shellcode.yml index e31283d8..d09136a4 100644 --- a/nursery/spawn-thread-to-rwx-shellcode.yml +++ b/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml @@ -4,6 +4,8 @@ rule: namespace: load-code/shellcode author: moritz.raabe@fireeye.com scope: function + examples: + - Practical Malware Analysis Lab 19-02.exe_:0x401230 features: - and: - match: allocate RWX memory