adding rules based on more PMA labs

2026-09-01 10:58:40 +00:00 · 2021-06-30 23:38:17 +02:00 · 2021-06-30 23:38:17 +02:00 · d81e757728
commit d81e757728
parent a207fbba0a
12 changed files with 122 additions and 39 deletions
--- a/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml
+++ b/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml
@ -0,0 +1,12 @@
+rule:
+  meta:
+    name: spawn thread to RWX shellcode
+    namespace: load-code/shellcode
+    author: moritz.raabe@fireeye.com
+    scope: function
+    examples:
+      - Practical Malware Analysis Lab 19-02.exe_:0x401230
+  features:
+    - and:
+      - match: allocate RWX memory
+      - match: create thread