diff --git a/anti-analysis/anti-debugging/detect-debugging/anti-debugging-instructions.yml b/anti-analysis/anti-debugging/detect-debugging/anti-debugging-instructions.yml new file mode 100644 index 00000000..d96eef7e --- /dev/null +++ b/anti-analysis/anti-debugging/detect-debugging/anti-debugging-instructions.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: anti-debugging instructions + rule-category: anti-analysis/anti-debugging/detect-debugging + author: moritz.raabe@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 16-03.exe_:0x401300 + features: + - or: + - count(mnemonic(rdtsc)): 2 or more + - mnemonic: icebp diff --git a/anti-analysis/anti-debugging/detect-debugging/check-for-error-OutputDebugString.yml b/anti-analysis/anti-debugging/detect-debugging/check-for-error-OutputDebugString.yml new file mode 100644 index 00000000..49a7f56c --- /dev/null +++ b/anti-analysis/anti-debugging/detect-debugging/check-for-error-OutputDebugString.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: check for error OutputDebugString + rule-category: anti-analysis/anti-debugging/detect-debugging + author: michael.hunhoff@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 16-02.exe_:0x401020 + features: + - and: + - api: kernel32.SetLastError + - api: kernel32.GetLastError + - api: kernel32.OutputDebugString diff --git a/anti-analysis/anti-debugging/detect-debugging/check-for-time-delay-GetTickCount.yml b/anti-analysis/anti-debugging/detect-debugging/check-for-time-delay-GetTickCount.yml new file mode 100644 index 00000000..9d20710c --- /dev/null +++ b/anti-analysis/anti-debugging/detect-debugging/check-for-time-delay-GetTickCount.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: check for time delay using GetTickCount + rule-category: anti-analysis/anti-debugging/detect-debugging + author: michael.hunhoff@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 16-03.exe_:0x4013d0 + features: + - and: + - count(api(kernel32.GetTickCount)): 2 or more diff --git a/anti-analysis/anti-debugging/detect-debugging/check-for-time-delay-QueryPerformanceCounter.yml b/anti-analysis/anti-debugging/detect-debugging/check-for-time-delay-QueryPerformanceCounter.yml new file mode 100644 index 00000000..89b11457 --- /dev/null +++ b/anti-analysis/anti-debugging/detect-debugging/check-for-time-delay-QueryPerformanceCounter.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: check for time delay using QueryPerformanceCounter + rule-category: anti-analysis/anti-debugging/detect-debugging + author: michael.hunhoff@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 16-03.exe_:0x4011e0 + features: + - and: + - count(api(kernel32.QueryPerformanceCounter)): 2 or more diff --git a/anti-analysis/anti-debugging/detect-debugging/peb-BeingDebugged.yml b/anti-analysis/anti-debugging/detect-debugging/peb-BeingDebugged.yml new file mode 100644 index 00000000..c10d9df1 --- /dev/null +++ b/anti-analysis/anti-debugging/detect-debugging/peb-BeingDebugged.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: PEB access BeingDebugged flag + rule-category: anti-analysis/anti-debugging/detect-debugging + author: moritz.raabe@fireeye.com + reference: Practical Malware Analysis, Chapter 16, p. 353 + scope: basic block + examples: + - Practical Malware Analysis Lab 16-01.exe_:0x403530 + features: + - and: + - characteristic(peb access): true + - offset: 2 = PEB.BeingDebugged diff --git a/anti-analysis/anti-debugging/detect-debugging/peb-NtGlobalFlag.yml b/anti-analysis/anti-debugging/detect-debugging/peb-NtGlobalFlag.yml new file mode 100644 index 00000000..2f3d4498 --- /dev/null +++ b/anti-analysis/anti-debugging/detect-debugging/peb-NtGlobalFlag.yml @@ -0,0 +1,20 @@ +rule: + meta: + name: PEB check NtGlobalFlag flag + rule-category: anti-analysis/anti-debugging/detect-debugging + author: moritz.raabe@fireeye.com + references: + - Practical Malware Analysis, Chapter 16, p. 355 + - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb/index.htm + scope: basic block + examples: + - Practical Malware Analysis Lab 16-01.exe_:0x403530 + features: + - and: + - characteristic(peb access): true + - or: + # 32-bit + - offset: 0x68 = PEB.NtGlobalFlag + # 64-bit + - offset: 0xBC = PEB.NtGlobalFlag + - number: 0x70 = (FLG_HEAP_ENABLE_TAIL_CHECK | FLG_HEAP_ENABLE_FREE_CHECK | FLG_HEAP_VALIDATE_PARAMETERS) diff --git a/anti-analysis/anti-forensic/modify-filetime.yml b/anti-analysis/anti-forensic/modify-filetime.yml new file mode 100644 index 00000000..baaa4fa1 --- /dev/null +++ b/anti-analysis/anti-forensic/modify-filetime.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: modify file time + rule-category: anti-analysis/anti-forensic/modify-filetime + author: moritz.raabe@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 03-04.exe_:0x4014e0 + features: + - or: + - and: + - api: kernel32.GetSystemTime + - api: kernel32.FileTimeToLocalFileTime + - api: kernel32.GetSystemTimeAsFileTime + - api: kernel32.SystemTimeToFileTime + - api: kernel32.GetFileTime + - api: kernel32.SetFileTime diff --git a/anti-analysis/anti-vm/detect-vm-environment/anti-vm-instructions.yml b/anti-analysis/anti-vm/detect-vm-environment/anti-vm-instructions.yml new file mode 100644 index 00000000..ffbeb160 --- /dev/null +++ b/anti-analysis/anti-vm/detect-vm-environment/anti-vm-instructions.yml @@ -0,0 +1,18 @@ +rule: + meta: + name: anti-vm instructions + rule-category: anti-analysis/anti-vm/detect-vm-environment + author: moritz.raabe@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 17-03.exe_:0x401A80 + features: + - or: + - mnemonic: sdit + - mnemonic: sgdt + - mnemonic: sldt + - mnemonic: smsw + - mnemonic: str + - mnemonic: in + - mnemonic: cpuid + - mnemonic: vpcext diff --git a/anti-analysis/anti-vm/detect-vm-environment/anti-vm-strings.yml b/anti-analysis/anti-vm/detect-vm-environment/anti-vm-strings.yml new file mode 100644 index 00000000..c74a4e30 --- /dev/null +++ b/anti-analysis/anti-vm/detect-vm-environment/anti-vm-strings.yml @@ -0,0 +1,24 @@ +rule: + meta: + name: anti-vm strings + rule-category: anti-analysis/anti-vm/detect-vm-environment + author: moritz.raabe@fireeye.com + reference: https://github.com/ctxis/CAPE/blob/master/modules/signatures/antivm_* + scope: file + examples: + - Practical Malware Analysis Lab 17-02.dll_ + features: + - or: + - string: /VMWare/i + - string: /VMTools/i + - string: /vmGuestLib.dll/i + - string: /VBox/i + - string: /VirtualBox/i + - string: /drivers\\vboxdrv/i + - string: /HARDWARE\\ACPI\\(DSDT|FADT|RSDT)\\BOCHS/i + - string: /HARDWARE\\DESCRIPTION\\System\\(SystemBiosVersion|VideoBiosVersion)/i + - string: /HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\.*ProcessorNameString/i + - string: /HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0/i + - string: /SYSTEM\\(CurrentControlSet|ControlSet001)\\Enum\\IDE/i + - string: /SYSTEM\\(CurrentControlSet|ControlSet001)\\Services\\Disk\\Enum\\/i + - string: /SYSTEM\\(CurrentControlSet|ControlSet001)\\Control\\SystemInformation\\SystemManufacturer/i diff --git a/anti-analysis/anti-vm/detect-vm-environment/processor-manufacturer-constants.yml b/anti-analysis/anti-vm/detect-vm-environment/processor-manufacturer-constants.yml new file mode 100644 index 00000000..a3814373 --- /dev/null +++ b/anti-analysis/anti-vm/detect-vm-environment/processor-manufacturer-constants.yml @@ -0,0 +1,22 @@ +rule: + meta: + name: processor manufacturer constants + rule-category: anti-analysis/anti-vm/detect-vm-environment + author: matthew.williams@fireeye.com + reference: https://en.wikipedia.org/wiki/CPUID + scope: basic block + examples: + - 47E43BE32F2BDE64E34F9008A7693CC6:0x5AE50 + features: + - and: + - mnemonic: cmp + - or: + - number: 0x61774D56 # 'awMV' (VMware) + - number: 0x566E6558 # 'VneX' (Xen HVM) + - number: 0x7263694D # 'rciM' (Microsoft Hyper-V) + - number: 0x4B4D564B # 'KMVK' (KVM) + - number: 0x70726C20 # 'prl ' (Parallels) + - number: 0x786F4256 # 'xoBV' (VirtualBox) + - optional: + - mnemonic: cpuid + diff --git a/anti-analysis/data-obfuscation/string-obfuscation/stackstring-obfuscation.yml b/anti-analysis/data-obfuscation/string-obfuscation/stackstring-obfuscation.yml new file mode 100644 index 00000000..130e53c9 --- /dev/null +++ b/anti-analysis/data-obfuscation/string-obfuscation/stackstring-obfuscation.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: stackstring obfuscation + rule-category: anti-analysis/data-obfuscation/string-obfuscation + author: moritz.raabe@fireeye.com + scope: basic block + examples: + - Practical Malware Analysis Lab 16-03.exe_:0x4013D0 + features: + - characteristic(stack string): true diff --git a/anti-analysis/hiding/self-delete/self-delete-comspec.yml b/anti-analysis/hiding/self-delete/self-delete-comspec.yml new file mode 100644 index 00000000..6a9ce9f3 --- /dev/null +++ b/anti-analysis/hiding/self-delete/self-delete-comspec.yml @@ -0,0 +1,18 @@ +rule: + meta: + name: self delete via COMSPEC envrionment variable + rule-category: anti-analysis/hiding/self-delete + author: michael.hunhoff@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 14-02.exe_:0x401880 + features: + - and: + - match: get comspec path + - match: create process + # /c del + - string: /\/c\s*del\s*/ + - optional: + # > nul + - string: /\s*>\s*nul\s*/ + diff --git a/anti-analysis/packing/packed-with-confuser.yml b/anti-analysis/packing/packed-with-confuser.yml new file mode 100644 index 00000000..352cd1fc --- /dev/null +++ b/anti-analysis/packing/packed-with-confuser.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: packed with Confuser + rule-category: anti-analysis/packing/packed-with-confuser + author: william.ballenthin@fireeye.com + scope: file + examples: + - b9f5bd514485fb06da39beff051b9fdc + features: + - or: + - string: ConfusedByAttribute \ No newline at end of file diff --git a/anti-analysis/packing/packed-with-generic-packer.yml b/anti-analysis/packing/packed-with-generic-packer.yml new file mode 100644 index 00000000..09b12b8a --- /dev/null +++ b/anti-analysis/packing/packed-with-generic-packer.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: packed with generic packer + rule-category: anti-analysis/packing/packed-with-generic-packer + author: william.ballenthin@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 18-01.exe_:0x409dc0 + features: + - and: + - or: + - mnemonic: pusha + - mnemonic: pushad # vivisect + - or: + - mnemonic: popa + - mnemonic: popad # vivisect + - characteristic(cross section flow): true \ No newline at end of file diff --git a/anti-analysis/packing/packed-with-upx/upx-section-name.yml b/anti-analysis/packing/packed-with-upx/upx-section-name.yml new file mode 100644 index 00000000..9836a380 --- /dev/null +++ b/anti-analysis/packing/packed-with-upx/upx-section-name.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: UPX section name + rule-category: anti-analysis/packing/packed-with-upx + author: william.ballenthin@fireeye.com + scope: file + examples: + - CD2CBA9E6313E8DF2C1273593E649682 + - Practical Malware Analysis Lab 01-02.exe_:0x0401000 + features: + - or: + - section: UPX0 + - section: UPX1 diff --git a/anti-analysis/packing/packed-with-vmprotect.yml b/anti-analysis/packing/packed-with-vmprotect.yml new file mode 100644 index 00000000..f4d3b158 --- /dev/null +++ b/anti-analysis/packing/packed-with-vmprotect.yml @@ -0,0 +1,18 @@ +rule: + meta: + name: packed with VMProtect + rule-category: anti-analysis/packing/packed-with-vmprotect + author: william.ballenthin@fireeye.com + scope: file + references: + - https://www.pcworld.com/article/2824572/leaked-programming-manual-may-help-criminals-develop-more-atm-malware.html + examples: + - 971e599e6e707349eccea2fd4c8e5f67 + features: + - or: + - string: A debugger has been found running in your system. + - string: Please, unload it from memory and restart your program. + - string: File corrupted!. This program has been manipulated and maybe + - string: it's infected by a Virus or cracked. This file won't work anymore. + - section: .vmp0 + - section: .vmp1 \ No newline at end of file diff --git a/collection/output-peripheral-capture/capture-system-keystrokes/keystrokes-application-hook.yml b/collection/output-peripheral-capture/capture-system-keystrokes/keystrokes-application-hook.yml new file mode 100644 index 00000000..8004b81c --- /dev/null +++ b/collection/output-peripheral-capture/capture-system-keystrokes/keystrokes-application-hook.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: capture system keystrokes via application hook + rule-category: collection/output-peripheral-capture/capture-system-keystrokes + author: michael.hunhoff@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 12-03.exe_:0x401000 + features: + - and: + - match: set application hook + - or: + - number: 13 = WH_KEYBOARD_LL + - number: 2 = WH_KEYBOARD diff --git a/collection/output-peripheral-capture/capture-system-keystrokes/keystrokes-polling.yml b/collection/output-peripheral-capture/capture-system-keystrokes/keystrokes-polling.yml new file mode 100644 index 00000000..71e2642b --- /dev/null +++ b/collection/output-peripheral-capture/capture-system-keystrokes/keystrokes-polling.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: capture system keystrokes via polling + rule-category: collection/output-peripheral-capture/capture-system-keystrokes + author: michael.hunhoff@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 11-03.dll_:0x10001030 + features: + - or: + - api: user32.GetAsyncKeyState + - api: user32.GetKeyState + - api: user32.GetKeyboardState + - api: user32.VkKeyScan + - api: user32.VkKeyScanEx + - api: user32.GetKeyNameText diff --git a/collection/output-peripheral-capture/capture-system-screenshot/screenshot-winapi.yml b/collection/output-peripheral-capture/capture-system-screenshot/screenshot-winapi.yml new file mode 100644 index 00000000..93760d07 --- /dev/null +++ b/collection/output-peripheral-capture/capture-system-screenshot/screenshot-winapi.yml @@ -0,0 +1,20 @@ +rule: + meta: + name: capture screenshot via WinAPI + rule-category: collection/output-peripheral-capture/capture-system-screenshot + author: moritz.raabe@fireeye.com + scope: function + examples: + - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314610A + features: + - and: + - or: + - api: user32.GetWindowDC + - api: user32.GetDC + - api: gdi32.BitBlt + - api: gdi32.CreateCompatibleDC + - api: gdi32.CreateCompatibleBitmap + - optional: + - or: + - api: user32.GetSystemMetrics # fetch screen dimensions + - api: user32.GetDesktopWindow # get entire desktop diff --git a/communication/client/tcp-client/tcp-client.yml b/communication/client/tcp-client/tcp-client.yml new file mode 100644 index 00000000..0af898da --- /dev/null +++ b/communication/client/tcp-client/tcp-client.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: TCP client + rule-category: communication/client/tcp-client + author: william.ballenthin@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 01-01.dll_:0x10001010 + features: + - and: + - match: connect via TCP socket diff --git a/communication/communication-via-ftp/ftp-put/ftp-put.yml b/communication/communication-via-ftp/ftp-put/ftp-put.yml new file mode 100644 index 00000000..87c04c6d --- /dev/null +++ b/communication/communication-via-ftp/ftp-put/ftp-put.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: send FTP put via wininet + rule-category: communication/communication-via-ftp/ftp-put + author: michael.hunhof@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 20-02.exe_:0x401380 + features: + - and: + - api: wininet.FtpPutFile + - optional: + - or: + - api: wininet.FtpSetCurrentDirectory + - and: + - api: wininet.InternetConnect + - number: 0x15 = IPPORT_FTP diff --git a/communication/communication-via-http/initialize-win-http.yml b/communication/communication-via-http/initialize-win-http.yml new file mode 100644 index 00000000..8de735e3 --- /dev/null +++ b/communication/communication-via-http/initialize-win-http.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: initialize WinHTTP + rule-category: communication/communication-via-http/initialize-win-http + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6A352C3E55E8AE5ED39DC1BE7FB964B1:0x1000E670 + features: + - and: + - api: winhttp.WinHttpOpen diff --git a/communication/communication-via-http/read-http-header.yml b/communication/communication-via-http/read-http-header.yml new file mode 100644 index 00000000..2a0ef150 --- /dev/null +++ b/communication/communication-via-http/read-http-header.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: read HTTP header + rule-category: communication/communication-via-http/read-http-header + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6A352C3E55E8AE5ED39DC1BE7FB964B1:0x10002A30 + features: + - and: + - api: winhttp.WinHttpQueryHeaders diff --git a/communication/communication-via-http/receive-http-request/download-url-to-file.yml b/communication/communication-via-http/receive-http-request/download-url-to-file.yml new file mode 100644 index 00000000..7542b25e --- /dev/null +++ b/communication/communication-via-http/receive-http-request/download-url-to-file.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: download URL to file + rule-category: communication/communication-via-http/receive-http-response + author: matthew.williams@fireeye.com + scope: function + examples: + - F5C93AC768C8206E87544DDD76B3277C:0x100020F0 + - Practical Malware Analysis Lab 20-01.exe_:0x401040 + features: + - or: + - api: urlmon.URLDownloadToFile + - api: urlmon.URLDownloadToCacheFile diff --git a/communication/communication-via-http/receive-http-request/receive-http-request.yml b/communication/communication-via-http/receive-http-request/receive-http-request.yml new file mode 100644 index 00000000..90a17f9a --- /dev/null +++ b/communication/communication-via-http/receive-http-request/receive-http-request.yml @@ -0,0 +1,22 @@ +rule: + meta: + name: receive HTTP request + rule-category: communication/communication-via-http/receive-http-request + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6A352C3E55E8AE5ED39DC1BE7FB964B1:0x10001D30 + - 6A352C3E55E8AE5ED39DC1BE7FB964B1:0x100027D0 + features: + - or: + - and: + - api: httpapi.HttpReceiveHttpRequest + - or: + - number: 0 + - number: 1 = HTTP_RECEIVE_REQUEST_FLAG_COPY_BODY + - number: 2 = HTTP_RECEIVE_REQUEST_FLAG_FLUSH_BODY + - and: + - api: httpapi.HttpReceiveRequestEntityBody + - or: + - number: 0 # Windows Server 2003 with SP1 and Windows XP with SP2: This parameter is reserved and must be zero + - number: 1 = HTTP_RECEIVE_REQUEST_ENTITY_BODY_FLAG_FILL_BUFFER diff --git a/communication/communication-via-http/receive-http-response/decompress-response-com.yml b/communication/communication-via-http/receive-http-response/decompress-response-com.yml new file mode 100644 index 00000000..add5ff41 --- /dev/null +++ b/communication/communication-via-http/receive-http-response/decompress-response-com.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: decompress HTTP response via COM + rule-category: communication/communication-via-http/receive-http-response + author: matthew.williams@fireeye.com + scope: function + examples: + - FBBAAF569B63F6398503E4F1979CABEF:0x4067F0 + features: + - and: + - match: get HTTP content encoding + - match: decompression via COM diff --git a/communication/communication-via-http/receive-http-response/extract-HTML-body.yml b/communication/communication-via-http/receive-http-response/extract-HTML-body.yml new file mode 100644 index 00000000..bc35dae2 --- /dev/null +++ b/communication/communication-via-http/receive-http-response/extract-HTML-body.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: extract HTML body + rule-category: communication/communication-via-http/receive-http-response + author: matthew.williams@fireeye.com + scope: function + examples: + - 395EB0DDD99D2C9E37B6D0B73485EE9C:0x4020A9 + reference: https://docs.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/aa752574(v=vs.85) + features: + - and: + - bytes: 25 44 2C 33 CB 26 D0 11 B4 83 00 C0 4F D9 01 19 = CLSID_IHTMLDocument2 + - offset: 0x24 = IHTMLDocument2Vtbl.get_body + - offset: 0xF0 = IHTMLElementVtbl.get_innerText diff --git a/communication/communication-via-http/receive-http-response/get-http-content-encoding.yml b/communication/communication-via-http/receive-http-response/get-http-content-encoding.yml new file mode 100644 index 00000000..02c3f958 --- /dev/null +++ b/communication/communication-via-http/receive-http-response/get-http-content-encoding.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: get HTTP content encoding + rule-category: communication/communication-via-http/receive-http-response + author: matthew.williams@fireeye.com + scope: basic block + examples: + - FBBAAF569B63F6398503E4F1979CABEF:0x4068D9 + features: + - and: + - api: wininet.HttpQueryInfo + - number: 0x1D = HTTP_QUERY_CONTENT_ENCODING diff --git a/communication/communication-via-http/receive-http-response/receive-http-response.yml b/communication/communication-via-http/receive-http-response/receive-http-response.yml new file mode 100644 index 00000000..d00a0cc2 --- /dev/null +++ b/communication/communication-via-http/receive-http-response/receive-http-response.yml @@ -0,0 +1,15 @@ +rule: + meta: + name: receive HTTP response + rule-category: communication/communication-via-http/receive-http-response + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6A352C3E55E8AE5ED39DC1BE7FB964B1:0x10002790 + features: + - or: + - api: winhttp.WinHttpReceiveResponse + - and: + - api: winhttp.WinHttpReadData + - optional: + - api: winhttp.WinHttpQueryDataAvailable diff --git a/communication/communication-via-http/send-http-request/create-http-request.yml b/communication/communication-via-http/send-http-request/create-http-request.yml new file mode 100644 index 00000000..5d0ea8e3 --- /dev/null +++ b/communication/communication-via-http/send-http-request/create-http-request.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: create HTTP request + rule-category: communication/communication-via-http/send-http-request + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6A352C3E55E8AE5ED39DC1BE7FB964B1:0x10002650 + features: + - or: + - api: winhttp.WinHttpOpenRequest diff --git a/communication/communication-via-http/send-http-request/iwebbrowser2-get-document.yml b/communication/communication-via-http/send-http-request/iwebbrowser2-get-document.yml new file mode 100644 index 00000000..17b6f79a --- /dev/null +++ b/communication/communication-via-http/send-http-request/iwebbrowser2-get-document.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: IWebBrowser2 get document + rule-category: communication/communication-via-http/send-http-request + author: matthew.williams@fireeye.com + scope: function + examples: + - 395EB0DDD99D2C9E37B6D0B73485EE9C:0x402000 + # https://docs.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/aa752127(v%3Dvs.85) + features: + - and: + - api: oleaut32.SysAllocString + - api: oleaut32.VariantInit + - offset: 0x2C = pBrowser2->Navigate + - offset: 0x48 = pBrowser2->get_Document + - offset: 0x80 = pBrowser2->Quit + - count(characteristic(indirect call)): 3 or more diff --git a/communication/communication-via-http/send-http-request/iwebbrowser2-initialize.yml b/communication/communication-via-http/send-http-request/iwebbrowser2-initialize.yml new file mode 100644 index 00000000..41cba29b --- /dev/null +++ b/communication/communication-via-http/send-http-request/iwebbrowser2-initialize.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: IWebBrowser2 initialize + rule-category: communication/communication-via-http/send-http-request + author: matthew.williams@fireeye.com + scope: basic block + examples: + - 395EB0DDD99D2C9E37B6D0B73485EE9C:0x402130 + # https://docs.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/aa752127(v%3Dvs.85) + features: + - and: + - api: ole32.CoCreateInstance + - bytes: 01 DF 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 = CLSID_InternetExplorer + - bytes: 61 16 0C D3 AF CD D0 11 8A 3E 00 C0 4F C9 E2 6E = IID_IWebBrowser2 diff --git a/communication/communication-via-http/send-http-request/send-http-request.yml b/communication/communication-via-http/send-http-request/send-http-request.yml new file mode 100644 index 00000000..9cd5ec06 --- /dev/null +++ b/communication/communication-via-http/send-http-request/send-http-request.yml @@ -0,0 +1,28 @@ +rule: + meta: + name: send HTTP request + rule-category: communication/communication-via-http/send-http-request + author: moritz.raabe@fireeye.com + scope: function + examples: + - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60 + - 6A352C3E55E8AE5ED39DC1BE7FB964B1:0x100026E0 + features: + - or: + - and: + - or: + - api: wininet.HttpOpenRequest + - api: wininet.InternetConnect + - or: + - api: wininet.HttpSendRequest + - api: wininet.HttpSendRequestEx + - and: + - api: winhttp.WinHttpSendRequest + - api: winhttp.WinHttpWriteData + - optional: + - or: + - api: winhttp.WinHttpOpenRequest + - api: winhttp.WinHttpConnect + - and: + - match: send data on socket + - string: /HTTP/i diff --git a/communication/communication-via-http/send-http-response/send-http-response.yml b/communication/communication-via-http/send-http-response/send-http-response.yml new file mode 100644 index 00000000..0a471bbb --- /dev/null +++ b/communication/communication-via-http/send-http-response/send-http-response.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: send HTTP response + rule-category: communication/communication-via-http/send-http-response + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6A352C3E55E8AE5ED39DC1BE7FB964B1:0x10001B20 + features: + - and: + - api: httpapi.HttpSendHttpResponse diff --git a/communication/communication-via-http/set-http-header.yml b/communication/communication-via-http/set-http-header.yml new file mode 100644 index 00000000..54acabb0 --- /dev/null +++ b/communication/communication-via-http/set-http-header.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: set HTTP header + rule-category: communication/communication-via-http/set-http-header + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6A352C3E55E8AE5ED39DC1BE7FB964B1:0x1000E230 + features: + - and: + - api: winhttp.WinHttpAddRequestHeaders diff --git a/communication/communication-via-http/start-http-server.yml b/communication/communication-via-http/start-http-server.yml new file mode 100644 index 00000000..b29eb74f --- /dev/null +++ b/communication/communication-via-http/start-http-server.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: start HTTP server + rule-category: communication/communication-via-http/start-http-server + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6A352C3E55E8AE5ED39DC1BE7FB964B1:0x10001970 + features: + - and: + - api: httpapi.HttpInitialize + - optional: + - api: httpapi.HttpTerminate diff --git a/communication/communication-via-pipes/connect-pipe.yml b/communication/communication-via-pipes/connect-pipe.yml new file mode 100644 index 00000000..d13195df --- /dev/null +++ b/communication/communication-via-pipes/connect-pipe.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: connect pipe + rule-category: communication/communication-via-pipes/connect-pipe + author: moritz.raabe@fireeye.com + scope: function + examples: + # Windows msdt.exe + - 152d4c9f63efb332ccb134c6953c0104:0x42e400 + features: + - or: + - api: kernel32.ConnectNamedPipe diff --git a/communication/communication-via-pipes/create-pipe.yml b/communication/communication-via-pipes/create-pipe.yml new file mode 100644 index 00000000..c1603afc --- /dev/null +++ b/communication/communication-via-pipes/create-pipe.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: create pipe + rule-category: communication/communication-via-pipes/create-pipe + author: moritz.raabe@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 03-02.dll_:0x10003a13 + features: + - or: + - api: kernel32.CreatePipe + - api: kernel32.CreateNamedPipe + diff --git a/communication/communication-via-pipes/create-two-anonymous-pipes.yml b/communication/communication-via-pipes/create-two-anonymous-pipes.yml new file mode 100644 index 00000000..4b4e9c19 --- /dev/null +++ b/communication/communication-via-pipes/create-two-anonymous-pipes.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: create two anonymous pipes + rule-category: communication/communication-via-pipes/create-two-anonymous-pipes + author: matthew.williams@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 14-02.exe_:0x4011C0 + features: + - and: + - count(api(CreatePipe)): 2 diff --git a/communication/communication-via-pipes/read-pipe.yml b/communication/communication-via-pipes/read-pipe.yml new file mode 100644 index 00000000..bc1af2d0 --- /dev/null +++ b/communication/communication-via-pipes/read-pipe.yml @@ -0,0 +1,15 @@ +rule: + meta: + name: read pipe + rule-category: communication/communication-via-pipes/read-pipe + description: PeekNamedPipe isn't required to read from a pipe; however, pipes are often utilized to capture the + output of a cmd.exe process. In a multi-thread instance, a new thread is created that calls + PeekNamedPipe and ReadFile to obtain the command output. + author: moritz.raabe@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 14-02.exe_:0x4014C0 + features: + - and: + - api: kernel32.PeekNamedPipe + - api: kernel32.ReadFile diff --git a/communication/communication-via-pipes/write-pipe.yml b/communication/communication-via-pipes/write-pipe.yml new file mode 100644 index 00000000..e1aa76d9 --- /dev/null +++ b/communication/communication-via-pipes/write-pipe.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: write pipe + rule-category: communication/communication-via-pipes/write-pipe + author: moritz.raabe@fireeye.com + scope: function + examples: + - C91887D861D9BD4A5872249B641BC9F9:0x401A77 + features: + - and: + - or: + - match: create pipe + - match: connect pipe + - api: kernel32.WriteFile diff --git a/communication/communication-via-reverse-shell/create-reverse-shell.yml b/communication/communication-via-reverse-shell/create-reverse-shell.yml new file mode 100644 index 00000000..4e1b4ec4 --- /dev/null +++ b/communication/communication-via-reverse-shell/create-reverse-shell.yml @@ -0,0 +1,27 @@ +rule: + meta: + name: create reverse shell + rule-category: communication/communication-via-reverse-shell/create-reverse-shell + author: moritz.raabe@fireeye.com + scope: function + examples: + - C91887D861D9BD4A5872249B641BC9F9:0x401A77 + features: + - or: + - and: + - match: create pipe + - api: kernel32.PeekNamedPipe + - api: kernel32.CreateProcess + - api: kernel32.ReadFile + - api: kernel32.WriteFile + - and: + - match: create process + - match: read pipe + - match: write pipe + - and: + - match: create pipe + - match: create process + - basic block: + - and: + - count(api(SetHandleInformation)): 2 or more + - number: 1 = HANDLE_FLAG_INHERIT diff --git a/communication/communication-via-socket/check-socket-status.yml b/communication/communication-via-socket/check-socket-status.yml new file mode 100644 index 00000000..a2a6095b --- /dev/null +++ b/communication/communication-via-socket/check-socket-status.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: check socket status + rule-category: communication/communication-via-socket/check-socket-status + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6A352C3E55E8AE5ED39DC1BE7FB964B1:0x1000C1F0 + features: + - and: + - api: ws2_32.select diff --git a/communication/communication-via-socket/receive-data/receive-data-on-socket.yml b/communication/communication-via-socket/receive-data/receive-data-on-socket.yml new file mode 100644 index 00000000..ffe90a74 --- /dev/null +++ b/communication/communication-via-socket/receive-data/receive-data-on-socket.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: receive data on socket + rule-category: communication/communication-via-socket/receive-data + author: moritz.raabe@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 01-01.dll_:0x10001010 + features: + - or: + - api: ws2_32.recv + - api: ws2_32.recvfrom + - api: ws2_32.WSARecv + - api: ws2_32.WSARecvDisconnect + - api: ws2_32.WSARecvEx + - api: ws2_32.WSARecvFrom + - api: ws2_32.WSARecvMsg diff --git a/communication/communication-via-socket/send-data/send-data-on-socket.yml b/communication/communication-via-socket/send-data/send-data-on-socket.yml new file mode 100644 index 00000000..8d45ca58 --- /dev/null +++ b/communication/communication-via-socket/send-data/send-data-on-socket.yml @@ -0,0 +1,15 @@ +rule: + meta: + name: send data on socket + rule-category: communication/communication-via-socket/send-data + author: moritz.raabe@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 01-01.dll_:0x10001010 + features: + - or: + - api: ws2_32.send + - api: ws2_32.sendto + - api: ws2_32.WSASend + - api: ws2_32.WSASendMsg + - api: ws2_32.WSASendTo diff --git a/communication/communication-via-socket/send-data/send-tcp-data-via-wfp.yml b/communication/communication-via-socket/send-data/send-tcp-data-via-wfp.yml new file mode 100644 index 00000000..f47b5fc6 --- /dev/null +++ b/communication/communication-via-socket/send-data/send-tcp-data-via-wfp.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: send TCP data via WFP API + rule-category: communication/communication-via-socket/send-data + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 493167E85E45363D09495D0841C30648:0x404560 + features: + - and: + - api: fwpkclnt.FwpsStreamInjectAsync0 + - number: 0x10000 = FWPS_STREAM_FLAG_SEND diff --git a/communication/communication-via-socket/set-socket-configuration.yml b/communication/communication-via-socket/set-socket-configuration.yml new file mode 100644 index 00000000..6d277af1 --- /dev/null +++ b/communication/communication-via-socket/set-socket-configuration.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: set socket configuration + rule-category: communication/communication-via-socket/set-socket-configuration + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6A352C3E55E8AE5ED39DC1BE7FB964B1:0x1000C1F0 + features: + - or: + - api: ws2_32.setsockopt + - api: ws2_32.ioctlsocket diff --git a/communication/communication-via-socket/tcp-communication/connect-to-tcp-socket.yml b/communication/communication-via-socket/tcp-communication/connect-to-tcp-socket.yml new file mode 100644 index 00000000..58002ac0 --- /dev/null +++ b/communication/communication-via-socket/tcp-communication/connect-to-tcp-socket.yml @@ -0,0 +1,15 @@ +rule: + meta: + name: connect via TCP socket + rule-category: communication/communication-via-socket/tcp-communication + author: moritz.raabe@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 01-01.dll_:0x10001010 + features: + - and: + - match: create TCP socket + - or: + - api: ws2_32.connect + - api: ws2_32.WSAConnect + - api: ConnectEx diff --git a/communication/communication-via-socket/tcp-communication/create-tcp-socket.yml b/communication/communication-via-socket/tcp-communication/create-tcp-socket.yml new file mode 100644 index 00000000..c3187f9f --- /dev/null +++ b/communication/communication-via-socket/tcp-communication/create-tcp-socket.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: create TCP socket + rule-category: communication/communication-via-socket/tcp-communication + author: william.ballenthin@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 01-01.dll_:0x10001010 + features: + - and: + - number: 6 = IPPROTO_TCP + - number: 1 = SOCK_STREAM + - number: 2 = AF_INET + - or: + - api: ws2_32.socket + - api: ws2_32.WSASocket diff --git a/communication/communication-via-socket/udp-communication/create-udp-socket.yml b/communication/communication-via-socket/udp-communication/create-udp-socket.yml new file mode 100644 index 00000000..a3709a0b --- /dev/null +++ b/communication/communication-via-socket/udp-communication/create-udp-socket.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: create UDP socket + rule-category: communication/communication-via-socket/udp-communication + author: moritz.raabe@fireeye.com + scope: function + examples: + - 203BD48BCC18434314AD60F4C8BC21E3D3422EB0624B22B827410F9BC63B4082:0x401240 + features: + - and: + - count(number(2 = AF_INET/SOCK_DGRAM)): 2 or more + - or: + - api: ws2_32.socket + - api: ws2_32.WSASocket diff --git a/communication/communication-via-wininet/connect-to-internet-host.yml b/communication/communication-via-wininet/connect-to-internet-host.yml new file mode 100644 index 00000000..fa17d43e --- /dev/null +++ b/communication/communication-via-wininet/connect-to-internet-host.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: connect to internet host + rule-category: communication/communication-via-wininet/connect-to-internet-host + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6f99a2c8944cb02ff28c6f9ced59b161:0x40E2F0 + features: + - and: + - optional: + - match: open internet session + - api: wininet.InternetConnect diff --git a/communication/communication-via-wininet/connect-to-internet-url.yml b/communication/communication-via-wininet/connect-to-internet-url.yml new file mode 100644 index 00000000..f79bfed5 --- /dev/null +++ b/communication/communication-via-wininet/connect-to-internet-url.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: connect to internet url + rule-category: communication/communication-via-wininet/connect-to-internet-url + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6f99a2c8944cb02ff28c6f9ced59b161:0x40E2F0 + features: + - and: + - optional: + - match: open internet session + - api: wininet.InternetOpenUrl diff --git a/communication/communication-via-wininet/open-internet-session.yml b/communication/communication-via-wininet/open-internet-session.yml new file mode 100644 index 00000000..845da5d2 --- /dev/null +++ b/communication/communication-via-wininet/open-internet-session.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: open internet session + rule-category: communication/communication-via-wininet/open-internet-session + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6f99a2c8944cb02ff28c6f9ced59b161:0x40E2F0 + features: + - and: + - api: wininet.InternetOpen + - optional: + - api: wininet.InternetCloseHandle diff --git a/communication/communication-via-wininet/read-file-from-internet.yml b/communication/communication-via-wininet/read-file-from-internet.yml new file mode 100644 index 00000000..44bb1402 --- /dev/null +++ b/communication/communication-via-wininet/read-file-from-internet.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: read file from internet + rule-category: communication/communication-via-http/read-file-from-internet + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6f99a2c8944cb02ff28c6f9ced59b161:0x40D590 + features: + - and: + - optional: + - or: + - match: connect to internet host + - match: connect to internet url + - api: wininet.InternetReadFile + - api: wininet.InternetReadFileEx diff --git a/communication/communication-via-wininet/write-file-to-internet.yml b/communication/communication-via-wininet/write-file-to-internet.yml new file mode 100644 index 00000000..63ea5efe --- /dev/null +++ b/communication/communication-via-wininet/write-file-to-internet.yml @@ -0,0 +1,15 @@ +rule: + meta: + name: write file to internet + rule-category: communication/communication-via-http/write-file-to-internet + author: matthew.williams@fireeye.com + scope: basic block + examples: + - EAAD7DFC78304B977D3844CC63577152:0x4500CB + features: + - and: + - optional: + - or: + - match: connect to internet host + - match: connect to internet url + - api: wininet.InternetWriteFile diff --git a/communication/initialize-winsock.yml b/communication/initialize-winsock.yml new file mode 100644 index 00000000..b9a32f90 --- /dev/null +++ b/communication/initialize-winsock.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: initialize winsock + rule-category: communication/initialize-winsock + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6A352C3E55E8AE5ED39DC1BE7FB964B1:0x10001D30 + features: + - and: + - api: ws2_32.WSAStartup diff --git a/communication/receive-data.yml b/communication/receive-data.yml new file mode 100644 index 00000000..f7eda911 --- /dev/null +++ b/communication/receive-data.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: receive data + rule-category: communication/receive-data + description: all known techniques for receiving data from a potential C2 server + author: william.ballenthin@fireeye.com + scope: function + examples: + - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60 + features: + - or: + - match: receive data on socket + - match: read file from internet + - match: download URL to file diff --git a/communication/send-data.yml b/communication/send-data.yml new file mode 100644 index 00000000..3d0d6608 --- /dev/null +++ b/communication/send-data.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: send data + rule-category: communication/send-data + description: all known techniques for sending data to a potential C2 server + author: william.ballenthin@fireeye.com + scope: function + examples: + - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60 + features: + - or: + - match: send HTTP request + - match: send data on socket + - match: write file to internet diff --git a/communication/server/tcp-server/tcp-server.yml b/communication/server/tcp-server/tcp-server.yml new file mode 100644 index 00000000..321f721a --- /dev/null +++ b/communication/server/tcp-server/tcp-server.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: TCP server + rule-category: communication/server/tcp-server + author: william.ballenthin@fireeye.com + scope: function + examples: + - AF2F4142463F42548B8650A3ADF5CEB2:0x10010880 + features: + - and: + - match: create TCP socket + - api: listen + - api: accept + - api: WSAAccept diff --git a/data-manipulation/compression/compression-winapi.yml b/data-manipulation/compression/compression-winapi.yml new file mode 100644 index 00000000..e869e460 --- /dev/null +++ b/data-manipulation/compression/compression-winapi.yml @@ -0,0 +1,26 @@ +rule: + meta: + name: compression via WinAPI + author: moritz.raabe@fireeye.com + rule-category: data-manipulation/compression/compression-winapi + scope: function + examples: + - 638dcc3d37b3a574044233c9637d7288:0x401020 + features: + - or: + # these APIs are not typically intended for user mode programs. + # they're only accessible via GetProcAddress on ntoskrnl/ntdll. + - api: RtlDecompressBuffer + - string: RtlDecompressBuffer + + - api: RtlDecompressBufferEx + - string: RtlDecompressBufferEx + + - api: RtlDecompressBufferEx2 + - string: RtlDecompressBufferEx2 + + - api: RtlCompressBuffer + - string: RtlCompressBuffer + + - api: RtlCompressBufferLZNT1 + - string: RtlCompressBufferLZNT1 diff --git a/data-manipulation/compression/decompression-com.yml b/data-manipulation/compression/decompression-com.yml new file mode 100644 index 00000000..e2be44b9 --- /dev/null +++ b/data-manipulation/compression/decompression-com.yml @@ -0,0 +1,15 @@ +rule: + meta: + name: decompression via COM + rule-category: data-manipulation/compression/decompression-com + author: matthew.williams@fireeye.com + scope: function + examples: + - FBBAAF569B63F6398503E4F1979CABEF:0x40691F + reference: https://www.virusbulletin.com/virusbulletin/2012/09/urlzone-reloaded-new-evolution/ + features: + - and: + - api: ole32.CoCreateInstance + - bytes: D0 7C C3 54 44 D9 D0 11 A9 F4 00 60 97 94 23 11 = StdEncodingFilterFac + - bytes: 00 DE BD 70 8E C1 D0 11 A9 CE 00 60 97 94 23 11 = IEncodingFilterFactory + - count(offset(0x10)): 2 or more # IEncodingFilterFactory.GetDefaultFilter and .DoDecode diff --git a/data-manipulation/encode-data/contains-base64-string.yml b/data-manipulation/encode-data/contains-base64-string.yml new file mode 100644 index 00000000..b7a5430b --- /dev/null +++ b/data-manipulation/encode-data/contains-base64-string.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: contains Base64 string + rule-category: data-manipulation/encode-data/encode-data-using-base64 + author: moritz.raabe@fireeye.com + scope: file + examples: + - BFB9B5391A13D0AFD787E87AB90F14F5 + - 074072B261FC27B65C72671F13510C05 + - 5DB2D2BE20D59AA0BE6709A6850F1775 + features: + - string: /ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ diff --git a/data-manipulation/encode-data/encode-data-using-base64.yml b/data-manipulation/encode-data/encode-data-using-base64.yml new file mode 100644 index 00000000..d9a611c7 --- /dev/null +++ b/data-manipulation/encode-data/encode-data-using-base64.yml @@ -0,0 +1,27 @@ +rule: + meta: + name: encodes data with Base64 + rule-category: data-manipulation/encode-data/encode-data-using-base64 + author: moritz.raabe@fireeye.com + scope: function + examples: + - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314889C + - 074072B261FC27B65C72671F13510C05:0x100049B2 + - 5DB2D2BE20D59AA0BE6709A6850F1775:0x18001CC30 + - 08AC667C65D36D6542917655571E61C8:0x406EAA + features: + - and: + - mnemonic: shl + - mnemonic: shr + - number: 0x3F # modulo 64 + - or: + - number: 0x3D = '=' + - number: 0x3D3D = '==' + - match: loop + - optional: + - number: 2 + - number: 3 + - number: 4 + - number: 6 + - number: 0xF + - string: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" diff --git a/data-manipulation/encode-data/encode-data-using-xor.yml b/data-manipulation/encode-data/encode-data-using-xor.yml new file mode 100644 index 00000000..552edaab --- /dev/null +++ b/data-manipulation/encode-data/encode-data-using-xor.yml @@ -0,0 +1,33 @@ +rule: + meta: + name: encode via XOR + author: moritz.raabe@fireeye.com + rule-category: data-manipulation/encode-data/encode-data-using-xor + scope: basic block + examples: + - 2D3EDC218A90F03089CC01715A9F047F:0x403D7E + features: + - and: + - characteristic(tight loop): True + - characteristic(nzxor): True + # Reduce false positives + - not: + - or: + # ~i: Bitwise negation operation for unsigned numbers + - number: 0xFFFFFFFF # 32 bits + - number: 0xFFFFFFFFFFFFFFFF # 64 bits + # ~i: Bitwise negation operation for numbers in 2 complement representation + - number: 0x0FFFFFFF # 32 bits + - number: 0x0FFFFFFFFFFFFFFF # 64 bits + # Magic constants used in the implementation of strings functions + # such as `strlen` and `strcat` in the Windows standard library: + # (((i - 0x81010101) ^ ~i) & 0x81010100) + ## 32 bits + - number: 0x7EFEFEFF + - number: 0x81010101 # -0x81010101 = 0x7EFEFEFF + - number: 0x81010100 # 0x81010100 = ~0x7EFEFEFF + ## 64 bits + - number: 0x7EFEFEFEFEFEFEFF + - number: 0x8101010101010101 + - number: 0x8101010101010100 + diff --git a/data-manipulation/encrypt-data/encrypt-data-using-aes/aes-winapi.yml b/data-manipulation/encrypt-data/encrypt-data-using-aes/aes-winapi.yml new file mode 100644 index 00000000..e669662f --- /dev/null +++ b/data-manipulation/encrypt-data/encrypt-data-using-aes/aes-winapi.yml @@ -0,0 +1,25 @@ +rule: + meta: + name: AES via WinAPI + rule-category: data-manipulation/encrypt-data/encrypt-data-using-aes + author: moritz.raabe@fireeye.com + scope: function + examples: + - BC577119D1A5B7DA489E7B5817D3CC38:0x10002FAC + features: + - and: + - or: + - number: 0x6611 = CALG_AES + - number: 0x660E = CALG_AES_128 + - number: 0x660F = CALG_AES_192 + - number: 0x6610 = CALG_AES_256 + - or: + - api: CryptGenKey + - api: CryptDeriveKey + - api: CryptImportKey + - optional: + - or: + - number: 1 = PROV_RSA_FULL + - api: CryptAcquireContext + - api: CryptEncrypt + - api: CryptDecrypt diff --git a/data-manipulation/encrypt-data/encrypt-data-using-aes/decrypt-data-with-aes-asm-instr.yml b/data-manipulation/encrypt-data/encrypt-data-using-aes/decrypt-data-with-aes-asm-instr.yml new file mode 100644 index 00000000..05e3b194 --- /dev/null +++ b/data-manipulation/encrypt-data/encrypt-data-using-aes/decrypt-data-with-aes-asm-instr.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: AES decrypt using assembly instructions + rule-category: data-manipulation/encrypt-data/decrypt-data-with-aes + author: moritz.raabe@fireeye.com + scope: function + examples: + - 66602B5FAB602CB4E6F754748D249542:0x4097D0 + features: + - or: + - mnemonic: aesdec # Perform One Round of an AES Decryption Flow + - mnemonic: vaesdec + - mnemonic: aesdeclast # Perform Last Round of an AES Decryption Flow + - mnemonic: vaesdeclast diff --git a/data-manipulation/encrypt-data/encrypt-data-using-aes/encrypt-data-with-aes-asm-instr.yml b/data-manipulation/encrypt-data/encrypt-data-using-aes/encrypt-data-with-aes-asm-instr.yml new file mode 100644 index 00000000..73b76961 --- /dev/null +++ b/data-manipulation/encrypt-data/encrypt-data-using-aes/encrypt-data-with-aes-asm-instr.yml @@ -0,0 +1,18 @@ +rule: + meta: + name: AES encrypt using assembly instructions + rule-category: data-manipulation/encrypt-data/encrypt-data-with-aes + author: moritz.raabe@fireeye.com + scope: function + examples: + - 8BA66E4B618FFDC8255F1DF01F875DDE6FD0561305D9F8307BE7BB11D02AE363:0x436E20 + features: + - or: + - mnemonic: aesenc # Perform One Round of an AES Encryption Flow + - mnemonic: vaesenc + - mnemonic: aesenclast # Perform Last Round of an AES Encryption Flow + - mnemonic: vaesenclast + - mnemonic: aesimc # Perform the AES InvMixColumn Transformation + - mnemonic: vaesimc + - mnemonic: aeskeygenassist # AES Round Key Generation Assist + - mnemonic: vaeskeygenassist diff --git a/data-manipulation/encrypt-data/encrypt-data-using-aes/encrypt-data-with-aes-dotnet.yml b/data-manipulation/encrypt-data/encrypt-data-using-aes/encrypt-data-with-aes-dotnet.yml new file mode 100644 index 00000000..31ec685c --- /dev/null +++ b/data-manipulation/encrypt-data/encrypt-data-using-aes/encrypt-data-with-aes-dotnet.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: references .NET AES encryption class + rule-category: data-manipulation/encrypt-data/encrypt-data-with-aes + author: william.ballenthin@fireeye.com + scope: file + examples: + - b9f5bd514485fb06da39beff051b9fdc + features: + - and: + - string: RijndaelManaged + - string: CryptoStream + - string: System.Security.Cryptography diff --git a/data-manipulation/encrypt-data/encrypt-data-using-rc4/rc4-ksa.yml b/data-manipulation/encrypt-data/encrypt-data-using-rc4/rc4-ksa.yml new file mode 100644 index 00000000..60f88a6d --- /dev/null +++ b/data-manipulation/encrypt-data/encrypt-data-using-rc4/rc4-ksa.yml @@ -0,0 +1,34 @@ +rule: + meta: + name: RC4 key-scheduling algorithm (KSA) + author: moritz.raabe@fireeye.com + rule-category: data-manipulation/encrypt-data/encrypt-data-using-rc4 + scope: function + examples: + - 34404A3FB9804977C6AB86CB991FB130:0x403D40 + - C805528F6844D7CAF5793C025B56F67D:0x4067AE + - 9324D1A8AE37A36AE560C37448C9705A:0x404950 + - 782A48821D88060ADF0F7EF3E8759FEE3DDAD49E942DAAD18C5AF8AE0E9EB51E:0x405C42 + features: + - or: + - and: + - basic block: + - and: + # TODO misses if regular loop is used + - characteristic(tight loop): true + - or: + - number: 0xFF + - number: 0x100 + - match: assembly modulo 256 + - or: + - mnemonic: div + - mnemonic: idiv + # optimized, writes DWORDs instead of bytes + - and: + - or: + - number: 0xFFFEFDFC + - mnemonic: sub + - or: + - number: 0x03020100 + - mnemonic: add + - number: 0x4040404 diff --git a/data-manipulation/encrypt-data/encrypt-data-using-rc4/rc4-prga.yml b/data-manipulation/encrypt-data/encrypt-data-using-rc4/rc4-prga.yml new file mode 100644 index 00000000..b1c938d1 --- /dev/null +++ b/data-manipulation/encrypt-data/encrypt-data-using-rc4/rc4-prga.yml @@ -0,0 +1,22 @@ +rule: + meta: + name: RC4 PRGA + rule-category: data-manipulation/encrypt-data/encrypt-data-using-rc4 + author: moritz.raabe@fireeye.com + scope: function + examples: + - 34404A3FB9804977C6AB86CB991FB130:0x403DB0 + - 34404A3FB9804977C6AB86CB991FB130:0x403E50 + - 9324D1A8AE37A36AE560C37448C9705A:0x4049F0 + features: + - and: + # TODO: maybe add characteristic for nzxor reg size + - characteristic(nzxor): True + # TODO optimized code uses an 8-bit register for this, e.g. BL at 782a48821d88060adf0f7ef3e8759fee3ddad49e942daad18c5af8ae0e9eb51e:0x405CC1 + - match: assembly modulo 256 + # TODO this should not call (many) sub routines, fix +# - count(characteristic(calls from)): (0, 4) + - optional: + - or: + - number: 0xFF + - number: 0x100 diff --git a/data-manipulation/encrypt-data/encrypt-data-using-rc4/rc4-winapi.yml b/data-manipulation/encrypt-data/encrypt-data-using-rc4/rc4-winapi.yml new file mode 100644 index 00000000..ebbe0fb3 --- /dev/null +++ b/data-manipulation/encrypt-data/encrypt-data-using-rc4/rc4-winapi.yml @@ -0,0 +1,23 @@ +rule: + meta: + name: RC4 encrypt via WinAPI + rule-category: data-manipulation/encrypt-data/encrypt-data-using-rc4 + author: moritz.raabe@fireeye.com + scope: function + examples: + - 2A584DFC657348D164274A12BFF9BBD8:0x404D42 + - 32BB43F8847ECF158C1E96891ED9A28C:0x10003A88 + features: + - and: + - or: + - number: 0x6801 = CALG_RC4 + - or: + - api: CryptGenKey + - api: CryptDeriveKey + - api: CryptImportKey + - optional: + - or: + - number: 1 = PROV_RSA_FULL + - api: CryptAcquireContext + - api: CryptEncrypt + - api: CryptDecrypt diff --git a/data-manipulation/encrypt-data/encrypt-data-using-rc6/rc56.yml b/data-manipulation/encrypt-data/encrypt-data-using-rc6/rc56.yml new file mode 100644 index 00000000..048635a9 --- /dev/null +++ b/data-manipulation/encrypt-data/encrypt-data-using-rc6/rc56.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: RC6 (or RC5) + note: both RC5 and RC6 use these same constants. RC6 is probably more common. + rule-category: data-manipulation/encrypt-data/encrypt-data-using-rc6 + author: william.ballenthin@fireeye.com + scope: function + examples: + - D87BA0BFCE1CDB17FD243B8B1D247E88:0x402390 + features: + - and: + # ref: https://github.com/stamparm/cryptospecs/blob/master/symmetrical/sources/rc6.c#L66 + - number: 0xB7E15163 + - or: + - number: 0x9e3779b9 # when we add an unsigned + - number: 0x61C88647 # when we subtracted an unsigned \ No newline at end of file diff --git a/data-manipulation/encrypt-data/encrypt-data-with-dpapi.yml b/data-manipulation/encrypt-data/encrypt-data-with-dpapi.yml new file mode 100644 index 00000000..53dc1d18 --- /dev/null +++ b/data-manipulation/encrypt-data/encrypt-data-with-dpapi.yml @@ -0,0 +1,15 @@ +rule: + meta: + name: encrypts or decrypts data using DPAPI + rule-category: data-manipulation/encrypt-data/encrypt-data-with-dpapi + author: william.ballenthin@fireeye.com + scope: function + examples: + - 6cc148363200798a12091b97a17181a1:0x1400CE9A0 + features: + - or: + - api: CryptProtectMemory + - api: CryptUnprotectMemory + - api: crypt32.CryptProtectData + - api: crypt32.CryptUnprotectData + diff --git a/data-manipulation/encrypt-data/use-wincrypt.yml b/data-manipulation/encrypt-data/use-wincrypt.yml new file mode 100644 index 00000000..a60c063e --- /dev/null +++ b/data-manipulation/encrypt-data/use-wincrypt.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: use of wincrypt + rule-category: data-manipulation/encrypt-data/use-wincrypt + author: moritz.raabe@fireeye.com + scope: function + examples: + - A45E377DBB98A6B44FD4034BC3FFF9B0:0x4017A0 + features: + - and: + - or: + - api: CryptAcquireContext + - api: CryptGenKey + - api: CryptImportKey + - or: + - api: CryptEncrypt + - api: CryptDecrypt diff --git a/data-manipulation/hash-data/calculate-crc32.yml b/data-manipulation/hash-data/calculate-crc32.yml new file mode 100644 index 00000000..d5f6c776 --- /dev/null +++ b/data-manipulation/hash-data/calculate-crc32.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: CRC32 hash + rule-category: data-manipulation/hash-data/hash-data-using-crc32 + author: moritz.raabe@fireeye.com + scope: function + examples: + - 2D3EDC218A90F03089CC01715A9F047F:0x403CBD + - 7D28CB106CB54876B2A5C111724A07CD:0x402350 # RtlComputeCrc32 + features: + - or: + - and: + - mnemonic: shr + - number: 0xEDB88320 + - number: 8 + - characteristic(nzxor): True + - api: RtlComputeCrc32 diff --git a/data-manipulation/hash-data/calculate-sha1-hash.yml b/data-manipulation/hash-data/calculate-sha1-hash.yml new file mode 100644 index 00000000..d6c5bf89 --- /dev/null +++ b/data-manipulation/hash-data/calculate-sha1-hash.yml @@ -0,0 +1,22 @@ +rule: + meta: + name: SHA1 hash + rule-category: data-manipulation/hash-data/hash-data-using-sha1 + author: moritz.raabe@fireeye.com + scope: function + examples: + - D063B1804E8D2BB26BD2E097141C1BBC:0x4344D0 + features: + - or: + - and: + # Magic initialization constants used in SHA1 + # The first four are also used in MD4 and MD5 + - number: 0x67452301 + - number: 0xEFCDAB89 + - number: 0x98BADCFE + - number: 0x10325476 + - number: 0xC3D2E1F0 + - basic block: + - and: + - number: 0x8004 = CALG_SHA1 + - api: advapi32.CryptCreateHash diff --git a/data-manipulation/hash-data/calculate-sha224-hash.yml b/data-manipulation/hash-data/calculate-sha224-hash.yml new file mode 100644 index 00000000..71f7b0b4 --- /dev/null +++ b/data-manipulation/hash-data/calculate-sha224-hash.yml @@ -0,0 +1,19 @@ +rule: + meta: + name: SHA224 hash + rule-category: data-manipulation/hash-data/hash-data-using-sha224 + author: moritz.raabe@fireeye.com + scope: function + examples: + - 6CC148363200798A12091B97A17181A1:0x14011FEB0 + features: + - or: + - and: + - number: 0xc1059ed8 + - number: 0x367cd507 + - number: 0x3070dd17 + - number: 0xf70e5939 + - number: 0xffc00b31 + - number: 0x68581511 + - number: 0x64f98fa7 + - number: 0xbefa4fa4 diff --git a/data-manipulation/hash-data/calculate-sha256-hash.yml b/data-manipulation/hash-data/calculate-sha256-hash.yml new file mode 100644 index 00000000..922fb118 --- /dev/null +++ b/data-manipulation/hash-data/calculate-sha256-hash.yml @@ -0,0 +1,20 @@ +rule: + meta: + name: SHA256 hash + rule-category: data-manipulation/hash-data/hash-data-using-sha256 + author: moritz.raabe@fireeye.com + scope: function + examples: + - C0CFFCF211035A839E28D542DE300298:0x180011400 + - 6CC148363200798A12091B97A17181A1:0x140120240 + features: + - or: + - and: + - number: 0x6A09E667 + - number: 0xBB67AE85 + - number: 0x3C6EF372 + - number: 0xA54FF53A + - number: 0x510E527F + - number: 0x9B05688C + - number: 0x1F83D9AB + - number: 0x5BE0CD19 diff --git a/destructive/overwrite-master-boot-record.yml b/destructive/overwrite-master-boot-record.yml new file mode 100644 index 00000000..54567e62 --- /dev/null +++ b/destructive/overwrite-master-boot-record.yml @@ -0,0 +1,21 @@ +rule: + meta: + name: overwrite master boot record + rule-category: destructive/overwrite-master-boot-record + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 39C05B15E9834AC93F206BC114D0A00C357C888DB567BA8F5345DA0529CBED41:0x100070A0 + features: + - and: + - string: \\.\PHYSICALDRIVE0 + - api: kernel32.WriteFile + # MBR/sector size in bytes + - number: 0x200 + - or: + # MBR signature constant + - number: 0x55 + # MBR signature constant + - number: 0xAA + - optional: + - api: kernel32.CreateFile diff --git a/discovery/datamine/datamine-keystrokes.yml b/discovery/datamine/datamine-keystrokes.yml new file mode 100644 index 00000000..64d1d052 --- /dev/null +++ b/discovery/datamine/datamine-keystrokes.yml @@ -0,0 +1,24 @@ +rule: + meta: + name: datamine keystrokes + rule-category: discovery/datamine/datamine-keystrokes + author: moritz.raabe@fireeye.com + scope: function + examples: + - C91887D861D9BD4A5872249B641BC9F9:0x4015FD + features: + - or: + - and: + - api: SetWindowsHookEx + - api: GetKeyState + - and: + - api: RegisterHotKey + - api: user32.keybd_event + - api: UnregisterHotKey + - and: + - api: CallNextHookEx + - api: user32.GetKeyNameText + - api: user32.GetAsyncKeyState + - api: user32.GetForgroundWindow + - api: user32.AttachThreadInput + - api: user32.MapVirtualKey diff --git a/discovery/datamine/datamine-sql/sql-statements.yml b/discovery/datamine/datamine-sql/sql-statements.yml new file mode 100644 index 00000000..0e1e090f --- /dev/null +++ b/discovery/datamine/datamine-sql/sql-statements.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: SQL statements + author: william.ballenthin@fireeye.com + rule-category: discovery/datamine/datamine-sql + scope: function + examples: + - 5F66B82558CA92E54E77F216EF4C066C:0x42B1DF + features: + - and: + - string: /SELECT.*FROM.*WHERE/ diff --git a/discovery/datamine/enumerate-files-ntdll.yml b/discovery/datamine/enumerate-files-ntdll.yml new file mode 100644 index 00000000..98049143 --- /dev/null +++ b/discovery/datamine/enumerate-files-ntdll.yml @@ -0,0 +1,21 @@ +rule: + meta: + name: enumerate files using NTDLL functions + rule-category: discovery/datamine/datamine-files + author: moritz.raabe@fireeye.com + scope: function + references: + - https://github.com/hfiref0x/TDL/blob/cc4b46ae1c939b14a22a734a727b163f873a41b5/Source/Furutaka/sup.c#L315 + examples: + - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x14000203C + features: + - and: + - basic block: + - and: + - number: 1 = DIRECTORY_QUERY + - api: ntdll.NtOpenDirectoryObject + - api: ntdll.NtQueryDirectoryObject + - optional: + - api: ntdll.RtlAllocateHeap + - match: loop + - characteristic(indirect call): True diff --git a/discovery/datamine/enumerate-files.yml b/discovery/datamine/enumerate-files.yml new file mode 100644 index 00000000..33bad9ae --- /dev/null +++ b/discovery/datamine/enumerate-files.yml @@ -0,0 +1,23 @@ +rule: + meta: + name: enumerate files + rule-category: discovery/datamine/datamine-files + author: moritz.raabe@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 01-01.exe_:0x4011E0 + - Practical Malware Analysis Lab 20-02.exe_:0x401000 + features: + - and: + - or: + - api: kernel32.FindFirstFile + - api: kernel32.FindFirstFileEx + - api: kernel32.FindFirstFileTransacted + - api: kernel32.FindFirstFileName + - api: kernel32.FindFirstFileNameTransacted + - or: + - api: kernel32.FindNextFile + - api: kernel32.FindNextFileName + - optional: + - api: kernel32.FindClose + - match: loop diff --git a/discovery/host-configuration-probing/check-os-version.yml b/discovery/host-configuration-probing/check-os-version.yml new file mode 100644 index 00000000..21c9bc80 --- /dev/null +++ b/discovery/host-configuration-probing/check-os-version.yml @@ -0,0 +1,36 @@ +rule: + meta: + name: check os version + rule-category: discovery/host-configuration-probing/check-os-version + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 493167E85E45363D09495D0841C30648:0x401000 + features: + - and: + - or: + - api: RtlGetVersion + - api: ntoskrnl.PsGetVersion + - api: GetVersion + - api: GetVersionEx + - mnemonic: cmp + - or: + - and: + - number: 5 # Windows 2000 + - optional: + - or: + - number: 0 + - number: 1 # Windows XP + - number: 2 # Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2 + - and: + - number: 6 # Windows Vista / Windows Server 2008 + - optional: + - or: + - number: 0 + - number: 1 # Windows Server 2008 R2 / Windows 7 + - number: 2 # Windows Server 2012 / Windows 8 + - number: 3 # Windows Server 2012 R2 / Windows 8.1 + - and: + - number: 10 # Windows Server 2016 / Windows Server 2019 / Windows 10 + - optional: + - number: 0 diff --git a/discovery/host-configuration-probing/get-system-info.yml b/discovery/host-configuration-probing/get-system-info.yml new file mode 100644 index 00000000..5fc56488 --- /dev/null +++ b/discovery/host-configuration-probing/get-system-info.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: get system information + rule-category: discovery/host-configuration-probing/get-system-information + author: moritz.raabe@fireeye.com + scope: function + examples: + - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140002280 + features: + - or: + - api: kernel32.GetSystemInfo + - api: kernel32.GetNativeSystemInfo + - api: ntdll.NtQuerySystemInformation + - api: ntdll.NtQuerySystemInformationEx + - api: ntdll.RtlGetNativeSystemInformation + - api: ZwQuerySystemInformation + - api: ZwQuerySystemInformationEx diff --git a/discovery/host-configuration-probing/inspect-cpu-information/get-cpu-information-registry.yml b/discovery/host-configuration-probing/inspect-cpu-information/get-cpu-information-registry.yml new file mode 100644 index 00000000..6d4e55c8 --- /dev/null +++ b/discovery/host-configuration-probing/inspect-cpu-information/get-cpu-information-registry.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: get CPU information from registry + rule-category: discovery/host-configuration-probing/inspect-cpu-information + author: moritz.raabe@fireeye.com + scope: function + examples: + - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A + features: + - and: + - match: query registry value + - string: /Hardware\\Description\\System\\CentralProcessor/i diff --git a/discovery/host-configuration-probing/inspect-hostname/get-hostname.yml b/discovery/host-configuration-probing/inspect-hostname/get-hostname.yml new file mode 100644 index 00000000..dd2bad34 --- /dev/null +++ b/discovery/host-configuration-probing/inspect-hostname/get-hostname.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: get hostname + rule-category: discovery/host-configuration-probing/inspect-hostname + author: moritz.raabe@fireeye.com + scope: function + examples: + - 9324D1A8AE37A36AE560C37448C9705A:0x4052A0 + features: + - or: + - api: kernel32.GetComputerName + - api: kernel32.GetComputerNameEx + - api: GetComputerObjectName + - api: ws2_32.gethostname diff --git a/discovery/host-configuration-probing/inspect-keyboard-layout/get-keyboard-layout.yml b/discovery/host-configuration-probing/inspect-keyboard-layout/get-keyboard-layout.yml new file mode 100644 index 00000000..d101df21 --- /dev/null +++ b/discovery/host-configuration-probing/inspect-keyboard-layout/get-keyboard-layout.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: get keyboard layout + rule-category: discovery/host-configuration-probing/inspect-keyboard-layout + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6F99A2C8944CB02FF28C6F9CED59B161:0x4193C0 + - C91887D861D9BD4A5872249B641BC9F9:0x4015FD + features: + - and: + - or: + - api: user32.GetKeyboardLayoutList + - api: user32.GetKeyboardLayout + - api: user32.GetKeyboardLayoutName + - optional: + - api: kernel32.GetLocaleInfo diff --git a/discovery/host-configuration-probing/inspect-memory-information/get-memory-status.yml b/discovery/host-configuration-probing/inspect-memory-information/get-memory-status.yml new file mode 100644 index 00000000..0e8bc4f5 --- /dev/null +++ b/discovery/host-configuration-probing/inspect-memory-information/get-memory-status.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: get memory capacity + rule-category: discovery/host-configuration-probing/inspect-memory-information + author: moritz.raabe@fireeye.com + scope: function + examples: + - 9324D1A8AE37A36AE560C37448C9705A:0x4052A0 + features: + - or: + - api: kernel32.GlobalMemoryStatus + - api: kernel32.GlobalMemoryStatusEx + # TODO kernel32.GetSystemInfo with offset diff --git a/discovery/host-configuration-probing/inspect-service-information/query-service-status.yml b/discovery/host-configuration-probing/inspect-service-information/query-service-status.yml new file mode 100644 index 00000000..01b27384 --- /dev/null +++ b/discovery/host-configuration-probing/inspect-service-information/query-service-status.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: query service status + rule-category: discovery/host-configuration-probing/inspect-service-information + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 9DC209F66DA77858E362E624D0BE86B3:0x403C70 + features: + - or: + - api: advapi32.QueryServiceStatusEx + - api: advapi32.QueryServiceStatus diff --git a/discovery/host-configuration-probing/inspect-storage-information/get-disk-information.yml b/discovery/host-configuration-probing/inspect-storage-information/get-disk-information.yml new file mode 100644 index 00000000..85d6aa8f --- /dev/null +++ b/discovery/host-configuration-probing/inspect-storage-information/get-disk-information.yml @@ -0,0 +1,20 @@ +rule: + meta: + name: get disk information + rule-category: discovery/host-configuration-probing/inspect-storage-information + author: moritz.raabe@fireeye.com + scope: function + examples: + - 9324D1A8AE37A36AE560C37448C9705A:0x4052A0 + - 972B219F18379907A045431303F4DA7D:0x41064E + features: + - or: + - api: kernel32.GetDriveType + - api: kernel32.GetLogicalDrives + - api: kernel32.GetDiskFreeSpace + - api: kernel32.GetDiskFreeSpaceEx + - api: kernel32.GetVolumeInformation + - api: kernel32.GetVolumeNameForVolumeMountPoint + - api: kernel32.GetVolumePathNamesForVolumeName + - api: kernel32.GetLogicalDriveStrings + - api: kernel32.QueryDosDevice diff --git a/discovery/host-configuration-probing/query-environment-variable.yml b/discovery/host-configuration-probing/query-environment-variable.yml new file mode 100644 index 00000000..6f5ab333 --- /dev/null +++ b/discovery/host-configuration-probing/query-environment-variable.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: query environment variable + rule-category: discovery/host-configuration-probing/query-environment-variable + author: michael.hunhoff@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 14-02.exe_:0x401880 + features: + - or: + - api: kernel32.GetEnvironmentVariable + - api: kernel32.GetEnvironmentStrings + - api: kernel32.ExpandEnvironmentStrings diff --git a/discovery/network-environment-probing/get-local-ip-addresses.yml b/discovery/network-environment-probing/get-local-ip-addresses.yml new file mode 100644 index 00000000..3792a8fd --- /dev/null +++ b/discovery/network-environment-probing/get-local-ip-addresses.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: get local IPv4 addresses + rule-category: discovery/network-environment-probing/get-local-ip-addresses + author: moritz.raabe@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 05-01.dll_:0x100037e6 + - 4C0553285D724DCAF5909924B4E3E90A:0x402010 + features: + - and: + - api: GetAdaptersInfo + - offset: 0x1B0 = IP_ADAPTER_INFO.IpAddressList.IpAddress + # loop feature? diff --git a/discovery/network-environment-probing/get-mac-address.yml b/discovery/network-environment-probing/get-mac-address.yml new file mode 100644 index 00000000..e1546757 --- /dev/null +++ b/discovery/network-environment-probing/get-mac-address.yml @@ -0,0 +1,20 @@ +rule: + meta: + name: get MAC address + rule-category: discovery/network-environment-probing/get-mac-address + author: moritz.raabe@fireeye.com + scope: function + examples: + - 65CFE3A06D981CE36F6BCDAA7E633B3F:0x48FCA0 + features: + - and: + - api: iphlpapi.GetAdaptersInfo + - or: + - offset: 0x194 = IP_ADAPTER_INFO.Address + - offset: 0x195 = IP_ADAPTER_INFO.Address+1 + - offset: 0x196 = IP_ADAPTER_INFO.Address+2 + - offset: 0x197 = IP_ADAPTER_INFO.Address+3 + - offset: 0x198 = IP_ADAPTER_INFO.Address+4 + - offset: 0x199 = IP_ADAPTER_INFO.Address+5 + - optional: + - string: "%02X-%02X-%02X-%02X-%02X-%02X" diff --git a/discovery/network-environment-probing/get-networking-interfaces.yml b/discovery/network-environment-probing/get-networking-interfaces.yml new file mode 100644 index 00000000..d8b3d73a --- /dev/null +++ b/discovery/network-environment-probing/get-networking-interfaces.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: get networking interfaces + rule-category: discovery/network-environment-probing/get-networking-interfaces + author: moritz.raabe@fireeye.com + scope: function + examples: + - B7841B9D5DC1F511A93CC7576672EC0C:0x1000EBF0 + features: + - or: + - api: iphlpapi.GetIfTable + - api: iphlpapi.GetAdaptersInfo diff --git a/discovery/network-environment-probing/test-for-connectivity/get-internet-connection-state.yml b/discovery/network-environment-probing/test-for-connectivity/get-internet-connection-state.yml new file mode 100644 index 00000000..8ead6525 --- /dev/null +++ b/discovery/network-environment-probing/test-for-connectivity/get-internet-connection-state.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: get internet connection state + rule-category: machine-access-control/network-environment-probing/test-for-connectivity + author: matthew.williams@fireeye.com + scope: basic block + examples: + - 648FC498110B11B4313A47A776E6BA40:0x6633F0 + features: + - and: + - api: wininet.InternetGetConnectedState + - optional: + - mnemonic: cmp + - or: + - number: 0 + - number: 1 diff --git a/discovery/session-configuration-probing/inspect-user-name/get-username.yml b/discovery/session-configuration-probing/inspect-user-name/get-username.yml new file mode 100644 index 00000000..00fe5119 --- /dev/null +++ b/discovery/session-configuration-probing/inspect-user-name/get-username.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: get session user name + rule-category: discovery/session-configuration-probing/get-user-name + author: moritz.raabe@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 14-01.exe_:0x401285 + features: + - or: + - api: advapi32.GetUserName + - api: secur32.GetUserNameEx + - basic block: + - and: + # - match: get session information (see #463) + - api: wtsapi32.WTSQuerySessionInformation + - number: 5 = WTSUserName diff --git a/lib/asm-mod-256.yml b/lib/asm-mod-256.yml new file mode 100644 index 00000000..47cdabcb --- /dev/null +++ b/lib/asm-mod-256.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: assembly modulo 256 + author: moritz.raabe@fireeye.com + scope: basic block + lib: true + examples: + - 9324D1A8AE37A36AE560C37448C9705A:0x4049A9 + features: + # and ecx, 800000FFh + # and ecx, 0FFh + - and: + - mnemonic: and + - or: + - number: 0x800000FF + - number: 0xFF diff --git a/lib/crypto.yml b/lib/crypto.yml new file mode 100644 index 00000000..b4458cd7 --- /dev/null +++ b/lib/crypto.yml @@ -0,0 +1,20 @@ +rule: + meta: + name: crypto + author: moritz.raabe@fireeye.com + scope: function + lib: true + examples: + - A45E377DBB98A6B44FD4034BC3FFF9B0:0x4017A0 + - D9EEC34D1D5409264FD06B751DBA3C7BD1C96F169196960B101113DCC5485A73:0x402DD0 + features: + - or: + # TODO ref category data-manipulation/encrypt-data/ + - match: references AES constants + - match: RC4 key-scheduling algorithm (KSA) + - match: RC4 PRGA + - match: RC4 encrypt via WinAPI + - match: RC6 (or RC5) + - match: encrypt using Salsa20 or ChaCha + - match: encrypts or decrypts data using DPAPI + - match: use of wincrypt diff --git a/lib/loop.yml b/lib/loop.yml new file mode 100644 index 00000000..591b2dfc --- /dev/null +++ b/lib/loop.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: loop + author: moritz.raabe@fireeye.com + scope: function + lib: true + examples: + - 08AC667C65D36D6542917655571E61C8:0x406EAA + features: + - or: + - characteristic(loop): True + - characteristic(recursive call): True + - basic block: + - characteristic(tight loop): True diff --git a/lib/write-process-memory.yml b/lib/write-process-memory.yml new file mode 100644 index 00000000..ec37fe39 --- /dev/null +++ b/lib/write-process-memory.yml @@ -0,0 +1,15 @@ +rule: + meta: + name: write process memory + author: moritz.raabe@fireeye.com + rule-category: machine-access-control/process-manipulation/write-process-memory + scope: function + lib: true + examples: + - 2D3EDC218A90F03089CC01715A9F047F:0x4027CF + features: + - or: + - api: kernel32.WriteProcessMemory + - api: ntdll.NtWriteVirtualMemory + - api: ntdll.ZwWriteVirtualMemory + - api: NtWow64WriteVirtualMemory64 diff --git a/load-code/load-driver/interact-driver.yml b/load-code/load-driver/interact-driver.yml new file mode 100644 index 00000000..cdcf6508 --- /dev/null +++ b/load-code/load-driver/interact-driver.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: interact driver + author: moritz.raabe@fireeye.com + rule-category: load-code/load-driver/interact-driver + scope: function + examples: + - Practical Malware Analysis Lab 10-03.exe_:0x401000 + - 9412A66BC81F51A1FA916AC47C77E02AC1A7C9DFF543233ED70AA265EF6A1E76:0x10002DE0 + features: + - or: + - api: DeviceIoControl + - api: NtUnloadDriver + - api: ZwUnloadDriver + - and: + - number: 38 = SystemLoadAndCallImage + - api: ZwSetSystemInformation diff --git a/load-code/load-driver/load-driver.yml b/load-code/load-driver/load-driver.yml new file mode 100644 index 00000000..762cdf0e --- /dev/null +++ b/load-code/load-driver/load-driver.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: load driver + rule-category: load-code/load-driver/load-driver + author: moritz.raabe@fireeye.com + scope: function + examples: + - af60700383b75727f5256a0000c1476f:0x1127E + features: + - or: + - and: + - or: + - number: 1 = SERVICE_KERNEL_DRIVER + - number: 2 = SERVICE_FILE_SYSTEM_DRIVER + - api: CreateService + - api: ntdll.NtLoadDriver + - api: ZwLoadDriver diff --git a/load-code/load-pe/access-pe-header.yml b/load-code/load-pe/access-pe-header.yml new file mode 100644 index 00000000..e685868e --- /dev/null +++ b/load-code/load-pe/access-pe-header.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: access PE header + rule-category: load-code/load-module/access-pe-header + author: moritz.raabe@fireeye.com + scope: function + examples: + - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x1400018E0 + features: + - or: + - api: ntdll.RtlImageNtHeader + - api: ntdll.RtlImageNtHeaderEx diff --git a/load-code/load-pe/manually-parse-pe-file.yml b/load-code/load-pe/manually-parse-pe-file.yml new file mode 100644 index 00000000..67a1031a --- /dev/null +++ b/load-code/load-pe/manually-parse-pe-file.yml @@ -0,0 +1,32 @@ +rule: + meta: + name: manually parse PE file + rule-category: load-code/load-module/parse-pe + author: moritz.raabe@fireeye.com + scope: function + examples: + - 9324D1A8AE37A36AE560C37448C9705A:0x403DD0 + features: + # TODO filter out false positives + - or: + - and: + - mnemonic: cmp + - or: + - number: 0x4550 = IMAGE_DOS_SIGNATURE (MZ) + - and: + - number: 0x50 + - number: 0x45 + - or: + - number: 0x5A4D = IMAGE_NT_SIGNATURE (PE) + - and: + - number: 0x4D + - number: 0x5A + - and: + # - offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew + - or: + - and: # 32-bit + - offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage + - offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase + - and: # 64-bit + - offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage + - offset: 0x30 = IMAGE_NT_HEADERS64.OptionalHeader.ImageBase diff --git a/load-code/runtime-linking/PEB-LDR_DATA-access.yml b/load-code/runtime-linking/PEB-LDR_DATA-access.yml new file mode 100644 index 00000000..f529bb3b --- /dev/null +++ b/load-code/runtime-linking/PEB-LDR_DATA-access.yml @@ -0,0 +1,75 @@ +rule: + meta: + name: PEB ldr_data access + rule-category: load-code/runtime-linking/invoke-manual-loader + author: moritz.raabe@fireeye.com + scope: function + examples: + - 3FDFB2D522E7DEECAAAF2F87420F7E75:0x4117B7 + features: + - or: + # x32 + - and: + # resolve the PEB + - or: + - characteristic(peb access): true + # in the case of CallObfuscator, gs:[rax] + # ref: https://github.com/d35ha/CallObfuscator/blob/5834aff9ff4511f1408ae4ce80b79737af4ae77b/ShellCode/shell_x64.asm#L8 + - and: + - number: 0x30 # x32 + - characteristic(fs access): true + # in 0f5d5d07c6533bc6d991836ce79daaa1 + # then we have: + # + # xor edx, edx + # mov edx, fs:[edx+30h] + - and: + - offset: 0x30 # x32 + - characteristic(fs access): true + + # LDR_DATA* Ldr; + # good PEB layout reference here: + # https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm + - offset: 0x0C # x32 + + # resolve a module list + - or: + # LIST_ENTRY InLoadOrderModuleList; + - offset: 0x0C # x32 + # LIST_ENTRY InMemoryOrderModuleList; + - offset: 0x14 # x32 + # LIST_ENTRY InInitializationOrderModuleList; + - offset: 0x1C # x32 + + # x64 + - and: + # resolve the PEB + - or: + - characteristic(peb access): true + # in the case of CallObfuscator, gs:[rax] + # ref: https://github.com/d35ha/CallObfuscator/blob/5834aff9ff4511f1408ae4ce80b79737af4ae77b/ShellCode/shell_x64.asm#L8 + - and: + - number: 0x60 # x64 + - characteristic(gs access): true + # in 0f5d5d07c6533bc6d991836ce79daaa1 + # then we have: + # + # xor edx, edx + # mov edx, fs:[edx+30h] + - and: + - offset: 0x60 # x64 + - characteristic(gs access): true + + # LDR_DATA* Ldr; + # good PEB layout reference here: + # https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm + - offset: 0x18 # x64 + + # resolve a module list + - or: + # LIST_ENTRY InLoadOrderModuleList; + - offset: 0x10 # x64 + # LIST_ENTRY InMemoryOrderModuleList; + - offset: 0x20 # x64 + # LIST_ENTRY InInitializationOrderModuleList; + - offset: 0x30 # x64 diff --git a/load-code/runtime-linking/runtime-linking.yml b/load-code/runtime-linking/runtime-linking.yml new file mode 100644 index 00000000..f649657f --- /dev/null +++ b/load-code/runtime-linking/runtime-linking.yml @@ -0,0 +1,21 @@ +rule: + meta: + name: link function at runtime + rule-category: load-code/runtime-linking/invoke-dynamic-loader + author: moritz.raabe@fireeye.com + scope: function + examples: + - 9324D1A8AE37A36AE560C37448C9705A:0x404130 + - Practical Malware Analysis Lab 01-04.exe_:0x401350 + features: + - and: + - or: + - api: kernel32.LoadLibrary + - api: kernel32.GetModuleHandle + - api: kernel32.GetModuleHandleEx + - api: ntdll.LdrLoadDll + - or: + - api: kernel32.GetProcAddress + - api: ntdll.LdrGetProcedureAddress + - optional: + - characteristic(indirect call): True diff --git a/load-data/load-data-from-self/load-data-from-resource.yml b/load-data/load-data-from-self/load-data-from-resource.yml new file mode 100644 index 00000000..6502aca3 --- /dev/null +++ b/load-data/load-data-from-self/load-data-from-resource.yml @@ -0,0 +1,30 @@ +rule: + meta: + name: extract resource via API + author: william.ballenthin@fireeye.com + rule-category: load-data/load-data-from-self/load-data-from-resource + scope: function + examples: + - BF88E1BD4A3BDE10B419A622278F1FF7:0x401000 + - Practical Malware Analysis Lab 01-04.exe_:0x4011FC + # ntdll + - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA + features: + - or: + - and: + - or: + - api: kernel32.LoadResource + - api: kernel32.LockResource + - api: ntdll.LdrAccessResource + - optional: + - match: resource (.rsrc) section + - api: kernel32.GetModuleHandle + # may occur in parent function, see 0664B09A86EC2DF7DFE01A93E184A1FA23DF66EA82CAB39000944E418EC1F7B2 + - or: + - api: kernel32.FindResource + - api: kernel32.FindResourceEx + - api: ntdll.LdrFindResource_U + - api: ntdll.LdrFindResourceEx_U + - api: kernel32.SizeofResource + - api: kernel32.FreeResource + - api: user32.LoadString diff --git a/machine-access-control/application-hook-manipulation/set-application-hook.yml b/machine-access-control/application-hook-manipulation/set-application-hook.yml new file mode 100644 index 00000000..deb23f52 --- /dev/null +++ b/machine-access-control/application-hook-manipulation/set-application-hook.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: set application hook + rule-category: machine-access-control/application-hook-manipulation/set-application-hook + author: michael.hunhoff@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 12-03.exe_:0x401000 + features: + - and: + - or: + - api: user32.SetWindowsHookEx + - api: user32.UnhookWindowsHookEx diff --git a/machine-access-control/application-hook-manipulation/set-global-application-hook.yml b/machine-access-control/application-hook-manipulation/set-global-application-hook.yml new file mode 100644 index 00000000..9988c43c --- /dev/null +++ b/machine-access-control/application-hook-manipulation/set-global-application-hook.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: set global application hook + rule-category: machine-access-control/application-hook-manipulation/set-global-application-hook + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 39C05B15E9834AC93F206BC114D0A00C357C888DB567BA8F5345DA0529CBED41:0x100096c6 + features: + - and: + - match: set application hook + - number: 0x3 = WM_GETMESSAGE + - count(number(0x0)): 1 or more diff --git a/machine-access-control/clipboard-manipulation/open-clipboard.yml b/machine-access-control/clipboard-manipulation/open-clipboard.yml new file mode 100644 index 00000000..eba08175 --- /dev/null +++ b/machine-access-control/clipboard-manipulation/open-clipboard.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: open clipboard + rule-category: machine-access-control/clipboard-manipulation/open-clipboard + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6f99a2c8944cb02ff28c6f9ced59b161:0x403180 + features: + - and: + - api: user32.OpenClipboard + - optional: + - api: user32.CloseClipboard diff --git a/machine-access-control/clipboard-manipulation/read-clipboard-data.yml b/machine-access-control/clipboard-manipulation/read-clipboard-data.yml new file mode 100644 index 00000000..444d866a --- /dev/null +++ b/machine-access-control/clipboard-manipulation/read-clipboard-data.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: read clipboard data + rule-category: machine-access-control/clipboard-manipulation/read-clipboard-data + author: michael.hunhoff@fireeye.com + scope: function + examples: + - C91887D861D9BD4A5872249B641BC9F9:0x40156F + - 93dfc146f60bd796eb28d4e4f348f2e4:0x401050 + features: + - and: + - optional: + - match: open clipboard + - api: user32.GetClipboardData diff --git a/machine-access-control/clipboard-manipulation/replace-clipboard-data.yml b/machine-access-control/clipboard-manipulation/replace-clipboard-data.yml new file mode 100644 index 00000000..0388bc2f --- /dev/null +++ b/machine-access-control/clipboard-manipulation/replace-clipboard-data.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: replace clipboard data + rule-category: machine-access-control/clipboard-manipulation/replace-clipboard-data + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6f99a2c8944cb02ff28c6f9ced59b161:0x403180 + features: + - and: + - optional: + - match: open clipboard + - match: write clipboard data + - api: user32.EmptyClipboard diff --git a/machine-access-control/clipboard-manipulation/write-clipboard-data.yml b/machine-access-control/clipboard-manipulation/write-clipboard-data.yml new file mode 100644 index 00000000..4604c9f7 --- /dev/null +++ b/machine-access-control/clipboard-manipulation/write-clipboard-data.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: write clipboard data + rule-category: machine-access-control/clipboard-manipulation/write-clipboard-data + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6F99A2C8944CB02FF28C6F9CED59B161:0x403180 + features: + - and: + - optional: + - match: open clipboard + - api: user32.SetClipboardData diff --git a/machine-access-control/directory-manipulation/create-directory.yml b/machine-access-control/directory-manipulation/create-directory.yml new file mode 100644 index 00000000..4061d899 --- /dev/null +++ b/machine-access-control/directory-manipulation/create-directory.yml @@ -0,0 +1,19 @@ +rule: + meta: + name: create directory + rule-category: machine-access-control/directory-manipulation/create-directory + author: moritz.raabe@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 17-02.dll_:0x10008f62 + features: + - or: + - api: kernel32.CreateDirectory + - api: kernel32.CreateDirectoryEx + - api: kernel32.CreateDirectoryTransacted + - api: NtCreateDirectoryObject + - api: ZwCreateDirectoryObject + - api: SHCreateDirectory + - api: SHCreateDirectoryEx + - api: _mkdir + - api: _wmkdir diff --git a/machine-access-control/directory-manipulation/delete-directory.yml b/machine-access-control/directory-manipulation/delete-directory.yml new file mode 100644 index 00000000..bc34675c --- /dev/null +++ b/machine-access-control/directory-manipulation/delete-directory.yml @@ -0,0 +1,15 @@ +rule: + meta: + name: delete directory + rule-category: machine-access-control/directory-manipulation/delete-directory + author: moritz.raabe@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 05-01.dll_:0x10009236 + - AFB6EC3D721A5CB67863487B0E51A34C167F629CF701F8BC7A038C117B4DDA44:0x429AA0 + features: + - or: + - api: RemoveDirectory + - api: RemoveDirectoryTransacted + - api: _rmdir + - api: _wrmdir diff --git a/machine-access-control/environment-manipulation/set-environment-variable.yml b/machine-access-control/environment-manipulation/set-environment-variable.yml new file mode 100644 index 00000000..8f4de418 --- /dev/null +++ b/machine-access-control/environment-manipulation/set-environment-variable.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: set environment variable + rule-category: machine-access-control/environment-manipulation/set-environment-variable + author: michael.hunhoff@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 11-03.exe_:0x406580 + features: + - or: + - api: kernel32.SetEnvironmentStrings + - api: kernel32.SetEnvironmentVariable diff --git a/machine-access-control/file-manipulation/bypass-windows-file-protection.yml b/machine-access-control/file-manipulation/bypass-windows-file-protection.yml new file mode 100644 index 00000000..374a29f0 --- /dev/null +++ b/machine-access-control/file-manipulation/bypass-windows-file-protection.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: bypass windows file protection via undocumented SFC API + rule-category: machine-access-control/file-manipulation/bypass-windows-file-protection + author: michael.hunhoff@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 01-04.exe_:0x401174 + features: + - and: + - string: sfc_os.dll # System File Checker + - number: 0x2 # SfcTerminateWatcherThread + - match: link function at runtime diff --git a/machine-access-control/file-manipulation/check-file-existence.yml b/machine-access-control/file-manipulation/check-file-existence.yml new file mode 100644 index 00000000..a7434a27 --- /dev/null +++ b/machine-access-control/file-manipulation/check-file-existence.yml @@ -0,0 +1,21 @@ +rule: + meta: + name: check file exists + rule-category: machine-access-control/file-manipulation/check-file-exists + author: moritz.raabe@fireeye.com + scope: function + examples: + - 31600AD0D1A7EA615690DF111AE36C73:0x401284 + features: + - or: + - basic block: + - and: + - api: kernel32.GetFileAttributes + - mnemonic: cmp + - number: 0xFFFFFFFF = INVALID_FILE_ATTRIBUTES + - basic block: + - and: + - api: kernel32.GetLastError + - mnemonic: cmp + - number: 2 = ERROR_FILE_NOT_FOUND + - api: shlwapi.PathFileExists diff --git a/machine-access-control/file-manipulation/copy-file.yml b/machine-access-control/file-manipulation/copy-file.yml new file mode 100644 index 00000000..56341ce9 --- /dev/null +++ b/machine-access-control/file-manipulation/copy-file.yml @@ -0,0 +1,19 @@ +rule: + meta: + name: copy file + rule-category: machine-access-control/file-manipulation/copy-file + author: moritz.raabe@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 01-01.dll_:0x401440 + features: + - or: + - api: kernel32.CopyFile + - api: kernel32.CopyFileEx + - api: CopyFile2 + - api: CopyFileTransacted + - basic block: + - and: + - number: 2 = FO_COPY + - or: + - api: kernel32.SHFileOperation diff --git a/machine-access-control/file-manipulation/delete-file.yml b/machine-access-control/file-manipulation/delete-file.yml new file mode 100644 index 00000000..1b260dde --- /dev/null +++ b/machine-access-control/file-manipulation/delete-file.yml @@ -0,0 +1,30 @@ +rule: + meta: + name: delete file + rule-category: machine-access-control/file-manipulation/delete-file + author: moritz.raabe@fireeye.com + scope: function + examples: + - 946A99F36A46D335DEC080D9A4371940:0x100015F0 + # MoveFileEx + - 31600AD0D1A7EA615690DF111AE36C73:0x401A15 + # NtDeleteFile + - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001E04 + features: + - or: + - api: kernel32.DeleteFile + - api: DeleteFileTransacted + - api: NtDeleteFile + - api: ZwDeleteFile + - api: remove + - api: _wremove + - basic block: + - and: + - number: 3 = FO_DELETE + - or: + - api: kernel32.SHFileOperation + - basic block: + - and: + - number: 4 = MOVEFILE_DELAY_UNTIL_REBOOT + - number: 0 = NULL + - api: MoveFileEx diff --git a/machine-access-control/file-manipulation/get-common-file-path.yml b/machine-access-control/file-manipulation/get-common-file-path.yml new file mode 100644 index 00000000..dda5eb44 --- /dev/null +++ b/machine-access-control/file-manipulation/get-common-file-path.yml @@ -0,0 +1,27 @@ +rule: + meta: + name: get common file path + rule-category: machine-access-control/file-manipulation/get-common-file-path + author: moritz.raabe@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 03-02.dll_:0x10003415 + - 972B219F18379907A045431303F4DA7D:0x404887 + features: + - or: + - api: kernel32.GetTempPath + - api: kernel32.GetTempFileName + - api: kernel32.GetSystemDirectory + - api: kernel32.GetWindowsDirectory + - api: kernel32.GetSystemWow64Directory + - api: GetAllUsersProfileDirectory + - api: GetAppContainerFolderPath + - api: GetCurrentDirectory + - api: GetDefaultUserProfileDirectory + - api: GetProfilesDirectory + - api: GetUserProfileDirectory + - api: SHGetFolderPathAndSubDir + - api: shell32.SHGetFolderPath + - api: shell32.SHGetFolderLocation + - api: shell32.SHGetSpecialFolderPath + - api: shell32.SHGetSpecialFolderLocation \ No newline at end of file diff --git a/machine-access-control/file-manipulation/read-file.yml b/machine-access-control/file-manipulation/read-file.yml new file mode 100644 index 00000000..7e717345 --- /dev/null +++ b/machine-access-control/file-manipulation/read-file.yml @@ -0,0 +1,23 @@ +rule: + meta: + name: read file + rule-category: machine-access-control/file-manipulation/read-file + author: moritz.raabe@fireeye.com + scope: function + examples: + - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314567B + features: + - or: + - and: + - optional: + - and: + - number: 0x80000000 = GENERIC_READ + - or: + - api: kernel32.CreateFile + - or: + - api: kernel32.ReadFile + - api: ReadFileEx + - api: NtReadFile + - api: ZwReadFile + - api: _read + - api: fread diff --git a/machine-access-control/file-manipulation/resolve-windows-program-files.yml b/machine-access-control/file-manipulation/resolve-windows-program-files.yml new file mode 100644 index 00000000..95c901ba --- /dev/null +++ b/machine-access-control/file-manipulation/resolve-windows-program-files.yml @@ -0,0 +1,18 @@ +rule: + meta: + name: resolve Windows program files directory + rule-category: machine-access-control/file-manipulation/resolve-windows-program-files + author: moritz.raabe@fireeye.com + scope: basic block + examples: + - BC452CC1128CCF7FA9F76D83CDA79132740414973600FED14509749FE946816E:0x407880 + features: + - and: + - or: + - number: 0x26 = CSIDL_PROGRAM_FILES + - number: 0x2A = CSIDL_PROGRAM_FILESX86 + - or: + - api: shell32.SHGetFolderPath + - api: shell32.SHGetFolderLocation + - api: shell32.SHGetSpecialFolderPath + - api: shell32.SHGetSpecialFolderLocation diff --git a/machine-access-control/file-manipulation/set-file-attributes.yml b/machine-access-control/file-manipulation/set-file-attributes.yml new file mode 100644 index 00000000..6f7874cf --- /dev/null +++ b/machine-access-control/file-manipulation/set-file-attributes.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: set file attributes + rule-category: machine-access-control/file-manipulation/set-file-attributes + author: moritz.raabe@fireeye.com + scope: function + examples: + - 946A99F36A46D335DEC080D9A4371940:0x100015f0 + features: + - or: + - api: kernel32.SetFileAttributes diff --git a/machine-access-control/file-manipulation/write-file.yml b/machine-access-control/file-manipulation/write-file.yml new file mode 100644 index 00000000..f31c7f3b --- /dev/null +++ b/machine-access-control/file-manipulation/write-file.yml @@ -0,0 +1,30 @@ +rule: + meta: + name: write file + rule-category: machine-access-control/file-manipulation/write-file + author: william.ballenthin@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 01-04.exe_:0x4011FC + # ntdll + - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x1400025C4 + features: + - and: + - optional: + - or: + - and: + - number: 0x40000000 = GENERIC_WRITE + - or: + - api: kernel32.CreateFile + - and: + - number: 0x2 = FILE_WRITE_DATA + - or: + - api: ntdll.NtCreateFile + - api: ZwCreateFile + - or: + - api: kernel32.WriteFile + - api: kernel32.WriteFileEx + - api: ntdll.NtWriteFile + - api: ZwWriteFile + - api: _fwrite + - api: fwrite diff --git a/machine-access-control/gui-window-manipulation/find-taskbar.yml b/machine-access-control/gui-window-manipulation/find-taskbar.yml new file mode 100644 index 00000000..c0e673e9 --- /dev/null +++ b/machine-access-control/gui-window-manipulation/find-taskbar.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: find taskbar + rule-category: machine-access-control/gui-window-manipulation/find-taskbar + author: moritz.raabe@fireeye.com + scope: function + examples: + - B7841B9D5DC1F511A93CC7576672EC0C:0x10007250 + features: + - and: + - string: Shell_TrayWnd + - match: find window diff --git a/machine-access-control/gui-window-manipulation/find-window.yml b/machine-access-control/gui-window-manipulation/find-window.yml new file mode 100644 index 00000000..86f1c228 --- /dev/null +++ b/machine-access-control/gui-window-manipulation/find-window.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: find window + rule-category: machine-access-control/gui-window-manipulation/find-window + author: moritz.raabe@fireeye.com + scope: function + examples: + - 7C843E75D4F02087B932FE280DF9C90C:0x41B180 + features: + - or: + - api: user32.FindWindow + - api: user32.FindWindowEx diff --git a/machine-access-control/gui-window-manipulation/get-window-text.yml b/machine-access-control/gui-window-manipulation/get-window-text.yml new file mode 100644 index 00000000..f5d8989a --- /dev/null +++ b/machine-access-control/gui-window-manipulation/get-window-text.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: get window text + rule-category: machine-access-control/gui-window-manipulation/get-window-text + author: moritz.raabe@fireeye.com + scope: function + examples: + - B7841B9D5DC1F511A93CC7576672EC0C:0x10007A50 + features: + - and: + - optional: + - api: user32.IsWindowVisible + - basic block: + - and: + - number: 0xD = WM_GETTEXT + - api: user32.SendMessage diff --git a/machine-access-control/mouse-manipulation/swap-mouse-buttons.yml b/machine-access-control/mouse-manipulation/swap-mouse-buttons.yml new file mode 100644 index 00000000..64fad650 --- /dev/null +++ b/machine-access-control/mouse-manipulation/swap-mouse-buttons.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: swap mouse buttons + rule-category: machine-access-control/mouse-manipulation/swap-mouse-buttons + author: moritz.raabe@fireeye.com + scope: function + examples: + - B7841B9D5DC1F511A93CC7576672EC0C:0x10007250 + features: + - or: + - api: user32.SwapMouseButton diff --git a/machine-access-control/mutex-manipulation/check-mutex.yml b/machine-access-control/mutex-manipulation/check-mutex.yml new file mode 100644 index 00000000..9f4bb390 --- /dev/null +++ b/machine-access-control/mutex-manipulation/check-mutex.yml @@ -0,0 +1,18 @@ +rule: + meta: + name: check mutex + author: moritz.raabem@fireeye.com + rule-category: machine-access-control/mutex-manipulation/check-mutex + scope: basic block + examples: + - Practical Malware Analysis Lab 01-01.dll_:0x10001010 + features: + - and: + - or: + - api: kernel32.OpenMutex + - match: create mutex + - optional: + - or: + - api: kernel32.GetLastError + - number: 2 = ERROR_FILE_NOT_FOUND + - number: 0xB7 = ERROR_ALREADY_EXISTS diff --git a/machine-access-control/mutex-manipulation/get-mutex-handle/create-mutex.yml b/machine-access-control/mutex-manipulation/get-mutex-handle/create-mutex.yml new file mode 100644 index 00000000..063ddd36 --- /dev/null +++ b/machine-access-control/mutex-manipulation/get-mutex-handle/create-mutex.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: create mutex + rule-category: machine-access-control/mutex-manipulation/create-mutex + author: moritz.raabe@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 01-01.dll_:0x10001010 + features: + - or: + - api: kernel32.CreateMutex + - api: kernel32.CreateMutexEx diff --git a/machine-access-control/network-manipulation/capture-network-traffic/copy-network-traffic.yml b/machine-access-control/network-manipulation/capture-network-traffic/copy-network-traffic.yml new file mode 100644 index 00000000..b57d899e --- /dev/null +++ b/machine-access-control/network-manipulation/capture-network-traffic/copy-network-traffic.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: copy network traffic + rule-category: machine-access-control/network-manipulation/capture-network-traffic + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 493167E85E45363D09495D0841C30648:0x404780 + features: + - and: + - api: fwpkclnt.FwpsCopyStreamDataToBuffer0 diff --git a/machine-access-control/network-manipulation/filter-network-traffic/register-network-filter-via-wfp.yml b/machine-access-control/network-manipulation/filter-network-traffic/register-network-filter-via-wfp.yml new file mode 100644 index 00000000..bf84bac3 --- /dev/null +++ b/machine-access-control/network-manipulation/filter-network-traffic/register-network-filter-via-wfp.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: register network filter via WFP API + rule-category: machine-access-control/network-manipulation/filter-network-traffic + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 493167E85E45363D09495D0841C30648:0x404220 + features: + - and: + - api: fwpkclnt.FwpmFilterAdd0 diff --git a/machine-access-control/network-manipulation/resolve-dns/resolve-dns.yml b/machine-access-control/network-manipulation/resolve-dns/resolve-dns.yml new file mode 100644 index 00000000..53452f1e --- /dev/null +++ b/machine-access-control/network-manipulation/resolve-dns/resolve-dns.yml @@ -0,0 +1,20 @@ +rule: + meta: + name: resolve dns + rule-category: machine-access-control/network-manipulation/resolve-dns + author: william.ballenthin@fireeye.com + scope: function + examples: + - 82986A4302421ABA1DB9DB34A8BC2BA1:0x401530 # winternals networking lab + - Practical Malware Analysis Lab 01-01.dll_:0x10001010 + features: + - or: + - api: ws2_32.inet_addr + - api: ws2_32.gethostbyname + - api: DnsQuery_A + - api: DnsQuery_W + - api: DnsQuery_UTF8 + - api: DnsQueryEx + - api: getaddrinfo + - api: GetAddrInfo + - api: GetAddrInfoEx diff --git a/machine-access-control/operating-system-manipulation/os-shutdown.yml b/machine-access-control/operating-system-manipulation/os-shutdown.yml new file mode 100644 index 00000000..8d6c49dd --- /dev/null +++ b/machine-access-control/operating-system-manipulation/os-shutdown.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: shutdown system + author: michael.hunhoff@fireeye.com + rule-category: machine-access-control/operating-system-manipulation/os-shutdown + scope: function + examples: + - 39C05B15E9834AC93F206BC114D0A00C357C888DB567BA8F5345DA0529CBED41:0x10008D60 + features: + - or: + - api: user32.ExitWindowsEx + - api: user32.ExitWindows diff --git a/machine-access-control/process-manipulation/adjust-privileges/modify-access-privileges.yml b/machine-access-control/process-manipulation/adjust-privileges/modify-access-privileges.yml new file mode 100644 index 00000000..03c7962c --- /dev/null +++ b/machine-access-control/process-manipulation/adjust-privileges/modify-access-privileges.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: modify access privileges + rule-category: machine-access-control/process-manipulation/adjust-privileges + author: moritz.raabe@fireeye.com + scope: function + examples: + - 9324D1A8AE37A36AE560C37448C9705A:0x403BE0 + features: + - and: + - api: advapi32.AdjustTokenPrivileges + - optional: + - or: + - api: advapi32.LookupPrivilegeValue diff --git a/machine-access-control/process-manipulation/code-injection/thread-injection.yml b/machine-access-control/process-manipulation/code-injection/thread-injection.yml new file mode 100644 index 00000000..b469f535 --- /dev/null +++ b/machine-access-control/process-manipulation/code-injection/thread-injection.yml @@ -0,0 +1,24 @@ +rule: + meta: + name: thread injection + author: anamaria.martinezgom@fireeye.com + rule-category: machine-access-control/process-manipulation/thread-injection + scope: function + examples: + - Practical Malware Analysis Lab 12-01.exe_:0x4010D0 + - 2D3EDC218A90F03089CC01715A9F047F:0x4027CF + features: + - and: + - or: + - api: kernel32.VirtualAlloc + - api: kernel32.VirtualAllocEx + - api: kernel32.VirtualAllocExNuma + - match: write process memory + - or: + - api: kernel32.CreateRemoteThread + - api: ntdll.RtlCreateUserThread + - optional: + - or: + - api: kernel32.OpenProcess + - number: 0x40 = PAGE_EXECUTE_READWRITE + - number: 0x3000 = MEM_COMMIT or MEM_RESERVE diff --git a/machine-access-control/process-manipulation/create-process-suspended.yml b/machine-access-control/process-manipulation/create-process-suspended.yml new file mode 100644 index 00000000..ee5727e7 --- /dev/null +++ b/machine-access-control/process-manipulation/create-process-suspended.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: create process suspended + author: william.ballenthin@fireeye.com + rule-category: machine-access-control/process-manipulation/create-process-suspended + scope: basic block + examples: + - Practical Malware Analysis Lab 03-03.exe_:0x4010EA + features: + - and: + - or: + - number: 0x08000004 = CREATE_NO_WINDOW | CREATE_SUSPENDED + - number: 4 = CREATE_SUSPENDED + - or: + - api: kernel32.CreateProcess + - api: advapi32.CreateProcessAsUser diff --git a/machine-access-control/process-manipulation/create-process-with-modified-stdhandles-and-window.yml b/machine-access-control/process-manipulation/create-process-with-modified-stdhandles-and-window.yml new file mode 100644 index 00000000..00b5dfc3 --- /dev/null +++ b/machine-access-control/process-manipulation/create-process-with-modified-stdhandles-and-window.yml @@ -0,0 +1,27 @@ +rule: + meta: + name: create process with modified stdhandles and window + rule-category: machine-access-control/process-manipulation/create-process-with-modified-stdhandles-and-window + author: matthew.williams@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 14-02.exe_:0x4011C0 + reference: https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/ns-processthreadsapi-startupinfoa + features: + - and: + - or: + # API functions below accept a pointer to a STARTUPINFO structure (see StartupInfo.cb feature below) + - api: kernel32.CreateProcess + - api: kernel32.CreateProcessInternal + - api: advapi32.CreateProcessAsUser + - api: advapi32.CreateProcessWithLogon + - api: advapi32.CreateProcessWithToken + - number: 0x101 = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW + # STARTF_USESTDHANDLES indicates the hStdInput, hStdOutput, and hStdError members contain additional information + # STARTF_USESHOWWINDOW indicates the wShowWindow member contains additional information + - or: + - number: 0x44 # StartupInfo.cb (size) x86 + - number: 0x68 # StartupInfo.cb (size) x64 + # STARTUPINFOEX size values not currently supported + - optional: + - api: kernel32.GetStartupInfo diff --git a/machine-access-control/process-manipulation/create-process.yml b/machine-access-control/process-manipulation/create-process.yml new file mode 100644 index 00000000..c69e0a17 --- /dev/null +++ b/machine-access-control/process-manipulation/create-process.yml @@ -0,0 +1,26 @@ +rule: + meta: + name: create process + rule-category: machine-access-control/process-manipulation/create-process + author: moritz.raabe@fireeye.com + scope: basic block + examples: + - 9324D1A8AE37A36AE560C37448C9705A:0x406DB0 + - Practical Malware Analysis Lab 01-04.exe_:0x4011FC + features: + - or: + - api: kernel32.WinExec + - api: kernel32.CreateProcess + - api: shell32.ShellExecute + - api: shell32.ShellExecuteEx + - api: advapi32.CreateProcessAsUser + - api: advapi32.CreateProcessWithLogon + - api: advapi32.CreateProcessWithToken + - api: kernel32.CreateProcessInternal + - api: ntdll.NtCreateUserProcess + - api: ntdll.NtCreateProcess + - api: ntdll.NtCreateProcessEx + - api: ntdll.ZwCreateProcess + - api: ntdll.ZwCreateProcessEx + - api: ntdll.ZwCreateUserProcess + - api: ntdll.RtlCreateUserProcess diff --git a/machine-access-control/process-manipulation/enumerate-process-modules.yml b/machine-access-control/process-manipulation/enumerate-process-modules.yml new file mode 100644 index 00000000..e79bb0d7 --- /dev/null +++ b/machine-access-control/process-manipulation/enumerate-process-modules.yml @@ -0,0 +1,23 @@ +rule: + meta: + name: enumerate process modules + rule-category: machine-access-control/process-manipulation/list-processes + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6F99A2C8944CB02FF28C6F9CED59B161:0x419FF8 + - 9B2FD471274C41626B75DDBB5C897877:0x100046B0 + features: + - and: + - optional: + - or: + - api: kernel32.OpenProcess + - api: kernel32.CloseHandle + - or: + - api: kernel32.K32EnumProcessModules + - api: kernel32.K32EnumProcessModulesEx + - api: kernel32.K32EnumProcesses + # depending on OS version in kernel32 or psapi + - api: EnumProcessModules + - api: EnumProcessModulesEx + - api: EnumProcesses diff --git a/machine-access-control/process-manipulation/enumerate-processes-remote-desktop-session-host.yml b/machine-access-control/process-manipulation/enumerate-processes-remote-desktop-session-host.yml new file mode 100644 index 00000000..7ba3088f --- /dev/null +++ b/machine-access-control/process-manipulation/enumerate-processes-remote-desktop-session-host.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: enumerate processes on remote desktop session host + rule-category: machine-access-control/process-manipulation/list-processes + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 6f99a2c8944cb02ff28c6f9ced59b161:0x414B70 + features: + - and: + - or: + - api: wtsapi32.WTSEnumerateProcesses + - api: wtsapi32.WTSEnumerateProcessesEx + - optional: + - or: + - api: wtsapi32.WTSFreeMemory + - api: wtsapi32.WTSOpenServer diff --git a/machine-access-control/process-manipulation/enumerate-processes.yml b/machine-access-control/process-manipulation/enumerate-processes.yml new file mode 100644 index 00000000..f4ced05e --- /dev/null +++ b/machine-access-control/process-manipulation/enumerate-processes.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: enumerate processes + rule-category: machine-access-control/process-manipulation/list-processes + author: moritz.raabe@fireeye.com + scope: function + examples: + - 2D3EDC218A90F03089CC01715A9F047F:0x403DAB + - 35d04ecd797041eee796f4ddaa96cae8:0x10004F34 + features: + - and: + - or: + - number: 0xF = TH32CS_SNAPALL + - number: 0x2 = TH32CS_SNAPPROCESS + - api: kernel32.CreateToolhelp32Snapshot + - api: kernel32.Process32First + - api: kernel32.Process32Next diff --git a/machine-access-control/process-manipulation/execute-cmd-command-and-capture-output.yml b/machine-access-control/process-manipulation/execute-cmd-command-and-capture-output.yml new file mode 100644 index 00000000..149206f8 --- /dev/null +++ b/machine-access-control/process-manipulation/execute-cmd-command-and-capture-output.yml @@ -0,0 +1,24 @@ +rule: + meta: + name: execute cmd command and capture output + rule-category: machine-access-control/process-manipulation/execute-cmd-command-and-capture-output + author: matthew.williams@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 14-02.exe_:0x4011C0 + reference: https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/ns-processthreadsapi-startupinfoa + features: + - and: + - match: create process with modified stdhandles and window + - match: create pipe + - or: + - match: get comspec path + - string: \\cmd.exe + - string: cmd.exe + - string: "cmd.exe /c " + - string: C:\\Windows\\system32\\cmd.exe + - optional: + - api: kernel32.GetSystemDirectory + - api: kernel32.SetCurrentDirectory + - match: create thread + - match: read pipe diff --git a/machine-access-control/process-manipulation/find-process-by-pid.yml b/machine-access-control/process-manipulation/find-process-by-pid.yml new file mode 100644 index 00000000..bf50dda0 --- /dev/null +++ b/machine-access-control/process-manipulation/find-process-by-pid.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: find process by PID + rule-category: machine-access-control/process-manipulation/find-process-by-pid + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 493167E85E45363D09495D0841C30648:0x404B00 + features: + - and: + - api: ntoskrnl.PsLookupProcessByProcessId + - optional: + - api: ntoskrnl.ObfDereferenceObject diff --git a/machine-access-control/process-manipulation/process-doppelganging.yml b/machine-access-control/process-manipulation/process-doppelganging.yml new file mode 100644 index 00000000..363e5347 --- /dev/null +++ b/machine-access-control/process-manipulation/process-doppelganging.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: process doppelganging + author: moritz.raabe@fireeye.com + rule-category: machine-access-control/process-manipulation/process-doppelganging + scope: file + examples: + # proc_doppel64.exe from https://github.com/hasherezade/process_doppelganging/releases/tag/0.2 + - A5D66324DAAEE5672B913AA461D4BD3A + features: + - and: + - string: /CreateFileTransacted./ + - or: + - string: ZwCreateSection + - string: NtCreateSection + - string: RollbackTransaction diff --git a/machine-access-control/process-manipulation/process-replacement.yml b/machine-access-control/process-manipulation/process-replacement.yml new file mode 100644 index 00000000..ccffda0b --- /dev/null +++ b/machine-access-control/process-manipulation/process-replacement.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: process replacement + author: william.ballenthin@fireeye.com + rule-category: machine-access-control/process-manipulation/process-replacement + scope: function + examples: + - Practical Malware Analysis Lab 12-02.exe_:0x4010EA + features: + - and: + - match: create process suspended + - and: + - match: write process memory + - or: + - api: kernel32.ResumeThread + - api: ntdll.NtResumeThread diff --git a/machine-access-control/process-manipulation/terminate-process.yml b/machine-access-control/process-manipulation/terminate-process.yml new file mode 100644 index 00000000..ce627989 --- /dev/null +++ b/machine-access-control/process-manipulation/terminate-process.yml @@ -0,0 +1,15 @@ +rule: + meta: + name: terminate process + author: moritz.raabe@fireeye.com + rule-category: machine-access-control/process-manipulation/terminate-process + scope: function + examples: + - C91887D861D9BD4A5872249B641BC9F9:0x401A77 + features: + - and: + - optional: + - api: kernel32.OpenProcess + - or: + - api: kernel32.TerminateProcess + - api: ntdll.NtTerminateProcess diff --git a/machine-access-control/registry-manipulation/create-registry-entry/create-registry-key-value.yml b/machine-access-control/registry-manipulation/create-registry-entry/create-registry-key-value.yml new file mode 100644 index 00000000..35a2ed5d --- /dev/null +++ b/machine-access-control/registry-manipulation/create-registry-entry/create-registry-key-value.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: set registry value + rule-category: machine-access-control/registry-manipulation/create-registry-entry + author: moritz.raabe@fireeye.com + scope: function + examples: + - BFB9B5391A13D0AFD787E87AB90F14F5:0x13147AF0 + features: + - and: + - or: + - match: create registry key + - match: open registry key + - or: + - api: advapi32.RegSetValue + - api: advapi32.RegSetValueEx \ No newline at end of file diff --git a/machine-access-control/registry-manipulation/create-registry-entry/create-registry-key.yml b/machine-access-control/registry-manipulation/create-registry-entry/create-registry-key.yml new file mode 100644 index 00000000..32ccb845 --- /dev/null +++ b/machine-access-control/registry-manipulation/create-registry-entry/create-registry-key.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: create registry key + rule-category: machine-access-control/registry-manipulation/create-registry-entry + author: michael.hunhoff@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 03-02.dll_:0x10004706 + - Practical Malware Analysis Lab 11-01.exe_:0x401000 + features: + - or: + - api: advapi32.RegCreateKey + - api: advapi32.RegCreateKeyEx + - api: advapi32.RegCreateKeyTransacted diff --git a/machine-access-control/registry-manipulation/delete-registry-entry/delete-registry-entry.yml b/machine-access-control/registry-manipulation/delete-registry-entry/delete-registry-entry.yml new file mode 100644 index 00000000..9f707c17 --- /dev/null +++ b/machine-access-control/registry-manipulation/delete-registry-entry/delete-registry-entry.yml @@ -0,0 +1,20 @@ +rule: + meta: + name: delete registry key + rule-category: machine-access-control/registry-manipulation/delete-registry-entry + author: moritz.raabe@fireeye.com + scope: function + examples: + - 034B7231A49387604E81A5A5D2FE7E08F6982C418A28B719D2FAACE3C312EBB5:0x4012A8 + - 493167E85E45363D09495D0841C30648:0x404D60 + features: + - or: + - api: advapi32.RegDeleteKey + - api: advapi32.RegDeleteKeyEx + - api: advapi32.RegDeleteKeyTransacted + - api: advapi32.RegDeleteKeyValue + - api: advapi32.RegDeleteTree + - api: advapi32.RegDeleteValue + - api: SHDeleteKey + - api: SHDeleteValue + - api: ZwDeleteKey diff --git a/machine-access-control/registry-manipulation/open-registry-key/open-registry-key.yml b/machine-access-control/registry-manipulation/open-registry-key/open-registry-key.yml new file mode 100644 index 00000000..39eb7293 --- /dev/null +++ b/machine-access-control/registry-manipulation/open-registry-key/open-registry-key.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: open registry key + rule-category: machine-access-control/registry-manipulation/open-registry-key + author: michael.hunhoff@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 03-02.dll_:0x10004706 + - 493167E85E45363D09495D0841C30648:0x404D60 + features: + - or: + - api: advapi32.RegOpenKey + - api: advapi32.RegOpenKeyEx + - api: ZwOpenKey diff --git a/machine-access-control/registry-manipulation/query-registry-entry/query-registry-entry.yml b/machine-access-control/registry-manipulation/query-registry-entry/query-registry-entry.yml new file mode 100644 index 00000000..35ec8d39 --- /dev/null +++ b/machine-access-control/registry-manipulation/query-registry-entry/query-registry-entry.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: query registry entry + rule-category: machine-access-control/registry-manipulation/query-registry-entry + author: william.ballenthin@fireeye.com + scope: function + examples: + - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A + - Practical Malware Analysis Lab 03-02.dll_:0x100047AD + features: + - and: + - or: + - match: create registry key + - match: open registry key + - or: + - api: advapi32.RegQueryValue + - api: advapi32.RegQueryValueEx diff --git a/machine-access-control/registry-manipulation/query-registry-entry/query-registry-key.yml b/machine-access-control/registry-manipulation/query-registry-entry/query-registry-key.yml new file mode 100644 index 00000000..9dd9dafd --- /dev/null +++ b/machine-access-control/registry-manipulation/query-registry-entry/query-registry-key.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: query registry key + rule-category: machine-access-control/registry-manipulation/query-registry-entry + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 493167E85E45363D09495D0841C30648:0x404930 + features: + - or: + - api: ZwQueryKey diff --git a/machine-access-control/registry-manipulation/query-registry-entry/query-registry-value.yml b/machine-access-control/registry-manipulation/query-registry-entry/query-registry-value.yml new file mode 100644 index 00000000..dbc4a827 --- /dev/null +++ b/machine-access-control/registry-manipulation/query-registry-entry/query-registry-value.yml @@ -0,0 +1,19 @@ +rule: + meta: + name: query registry value + rule-category: machine-access-control/registry-manipulation/query-registry-entry + author: william.ballenthin@fireeye.com + scope: function + examples: + - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A + - Practical Malware Analysis Lab 03-02.dll_:0x100047AD + features: + - and: + - optional: + - or: + - match: create registry key + - match: open registry key + - or: + - api: advapi32.RegQueryValue + - api: advapi32.RegQueryValueEx + - api: ZwEnumerateValueKey diff --git a/machine-access-control/service-manipulation/create-service.yml b/machine-access-control/service-manipulation/create-service.yml new file mode 100644 index 00000000..51114e36 --- /dev/null +++ b/machine-access-control/service-manipulation/create-service.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: create service + rule-category: machine-access-control/service-manipulation/create-service + author: moritz.raabe@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 03-02.dll_:0x10004706 + features: + - and: + - api: advapi32.CreateService + - optional: + - api: advapi32.OpenSCManager diff --git a/machine-access-control/service-manipulation/delete-service.yml b/machine-access-control/service-manipulation/delete-service.yml new file mode 100644 index 00000000..af99c348 --- /dev/null +++ b/machine-access-control/service-manipulation/delete-service.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: delete service + rule-category: machine-access-control/service-manipulation/delete-service + author: moritz.raabe@fireeye.com + scope: function + examples: + - E544A4D616B60147D9774B48C2B65EF2:0x402140 + - Practical Malware Analysis Lab 03-02.dll_:0x10004B18 + features: + - and: + - optional: + - match: get service handle + - api: advapi32.DeleteService diff --git a/machine-access-control/service-manipulation/enumerate-services.yml b/machine-access-control/service-manipulation/enumerate-services.yml new file mode 100644 index 00000000..5d3f770c --- /dev/null +++ b/machine-access-control/service-manipulation/enumerate-services.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: enumerate services + rule-category: machine-access-control/service-manipulation/enumerate-services + author: moritz.raabe@fireeye.com + scope: function + examples: + - 3D760B6FC84571C928BED835863FC302:0x4062E0 + features: + - or: + - api: advapi32.EnumServicesStatus + - api: advapi32.EnumServicesStatusEx diff --git a/machine-access-control/service-manipulation/modify-service.yml b/machine-access-control/service-manipulation/modify-service.yml new file mode 100644 index 00000000..173499f7 --- /dev/null +++ b/machine-access-control/service-manipulation/modify-service.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: modify service + rule-category: machine-access-control/service-manipulation/modify-service + author: moritz.raabe@fireeye.com + scope: function + examples: + - 7D16EFD0078F22C17A4BD78B0F0CC468:0x401000 + features: + - and: + - optional: + - match: get service handle + - api: advapi32.ChangeServiceConfig + - api: advapi32.ChangeServiceConfig2 diff --git a/machine-access-control/service-manipulation/run-as-service.yml b/machine-access-control/service-manipulation/run-as-service.yml new file mode 100644 index 00000000..8102bb26 --- /dev/null +++ b/machine-access-control/service-manipulation/run-as-service.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: run as service + rule-category: persistence/continuous-execution/persist-via-windows-service + author: moritz.raabe@fireeye.com + scope: file + examples: + - Practical Malware Analysis Lab 03-02.dll_ + features: + - or: + - export: ServiceMain + - import: RegisterServiceCtrlHandler + - import: RegisterServiceCtrlHandlerEx diff --git a/machine-access-control/service-manipulation/start-service.yml b/machine-access-control/service-manipulation/start-service.yml new file mode 100644 index 00000000..d5ddd594 --- /dev/null +++ b/machine-access-control/service-manipulation/start-service.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: start service + rule-category: machine-access-control/service-manipulation/start-service + author: moritz.raabe@fireeye.com + scope: function + examples: + - E544A4D616B60147D9774B48C2B65EF2:0x401FA0 + features: + - and: + - optional: + - match: get service handle + - api: advapi32.StartService diff --git a/machine-access-control/service-manipulation/stop-service.yml b/machine-access-control/service-manipulation/stop-service.yml new file mode 100644 index 00000000..92e4a0ff --- /dev/null +++ b/machine-access-control/service-manipulation/stop-service.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: stop service + rule-category: machine-access-control/service-manipulation/stop-service + author: moritz.raabe@fireeye.com + scope: function + examples: + - E544A4D616B60147D9774B48C2B65EF2:0x402140 + features: + - and: + - optional: + - match: get service handle + - number: 0x1 = SERVICE_CONTROL_STOP + - or: + - api: advapi32.ControlService + - api: advapi32.ControlServiceEx diff --git a/machine-access-control/thread-manipulation/create-thread.yml b/machine-access-control/thread-manipulation/create-thread.yml new file mode 100644 index 00000000..6b727e0a --- /dev/null +++ b/machine-access-control/thread-manipulation/create-thread.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: create thread + rule-category: machine-access-control/process-manipulation/create-thread + author: moritz.raabe@fireeye.com + scope: function + examples: + - 946A99F36A46D335DEC080D9A4371940:0x10001DA0 + features: + - or: + - api: kernel32.CreateThread + - api: _beginthread + - api: _beginthreadex diff --git a/machine-access-control/thread-manipulation/terminate-thread.yml b/machine-access-control/thread-manipulation/terminate-thread.yml new file mode 100644 index 00000000..20259f87 --- /dev/null +++ b/machine-access-control/thread-manipulation/terminate-thread.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: terminate thread + rule-category: machine-access-control/thread-manipulation/terminate-thread + author: moritz.raabe@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 03-02.dll_:0x10003286 + features: + - or: + - api: kernel32.TerminateThread diff --git a/maec/malware-category/downloader/download-write-file.yml b/maec/malware-category/downloader/download-write-file.yml new file mode 100644 index 00000000..18d6257c --- /dev/null +++ b/maec/malware-category/downloader/download-write-file.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: download and write file + author: moritz.raabe@fireeye.com + maec/malware-category: downloader + scope: function + examples: + - 5D7C34B6854D48D3DA4F96B71550A221:0x401346 + features: + - and: + - match: receive data + - match: write file diff --git a/maec/malware-category/launcher/write-execute-file.yml b/maec/malware-category/launcher/write-execute-file.yml new file mode 100644 index 00000000..dfec3a13 --- /dev/null +++ b/maec/malware-category/launcher/write-execute-file.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: write and execute file + maec/malware-category: launcher + author: moritz.raabe@fireeye.com + scope: function + examples: + - 9324D1A8AE37A36AE560C37448C9705A:0x403A40 + - Practical Malware Analysis Lab 01-04.exe_:0x4011FC + features: + - and: + - match: write file + - match: create process diff --git a/memory-access/memory-manipulation/allocate-rwx.yml b/memory-access/memory-manipulation/allocate-rwx.yml new file mode 100644 index 00000000..d44f36d4 --- /dev/null +++ b/memory-access/memory-manipulation/allocate-rwx.yml @@ -0,0 +1,22 @@ +rule: + meta: + name: allocate RWX memory + author: moritz.raabe@fireeye.com + rule-category: memory-access/memory-manipulation/allocate-rwx-memory + scope: basic block + examples: + - Practical Malware Analysis Lab 03-03.exe_:0x4010EA + # ntdll + - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA + features: + - and: + - or: + - api: kernel32.VirtualAlloc + - api: kernel32.VirtualAllocEx + - api: kernel32.VirtualAllocExNuma + - api: kernel32.VirtualProtect + - api: kernel32.VirtualProtectEx + - api: ntdll.NtAllocateVirtualMemory + - api: ZwAllocateVirtualMemory + - or: + - number: 0x40 = PAGE_EXECUTE_READWRITE diff --git a/memory-access/memory-manipulation/kernel-to-user/allocate-user-process-rwx.yml b/memory-access/memory-manipulation/kernel-to-user/allocate-user-process-rwx.yml new file mode 100644 index 00000000..6592b38c --- /dev/null +++ b/memory-access/memory-manipulation/kernel-to-user/allocate-user-process-rwx.yml @@ -0,0 +1,15 @@ +rule: + meta: + name: allocate user process RWX memory + rule-category: memory-access/memory-manipulation/kernel-to-user + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 493167E85E45363D09495D0841C30648:0x404B00 + features: + - and: + - match: attach user process memory + - match: allocate RWX memory + - number: 0xFFFFFFFF = NtCurrentProcess() + - optional: + - match: find process by PID diff --git a/memory-access/memory-manipulation/kernel-to-user/attach-user-process-memory.yml b/memory-access/memory-manipulation/kernel-to-user/attach-user-process-memory.yml new file mode 100644 index 00000000..d3cbc823 --- /dev/null +++ b/memory-access/memory-manipulation/kernel-to-user/attach-user-process-memory.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: attach user process memory + rule-category: memory-access/memory-manipulation/kernel-to-user + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 493167E85E45363D09495D0841C30648:0x404B00 + features: + - and: + - api: ntoskrnl.KeStackAttachProcess + - api: ntoskrnl.KeUnstackDetachProcess diff --git a/memory-access/memory-manipulation/kernel-to-user/free-user-process-memory.yml b/memory-access/memory-manipulation/kernel-to-user/free-user-process-memory.yml new file mode 100644 index 00000000..4f1cf514 --- /dev/null +++ b/memory-access/memory-manipulation/kernel-to-user/free-user-process-memory.yml @@ -0,0 +1,15 @@ +rule: + meta: + name: free user process memory + rule-category: memory-access/memory-manipulation/kernel-to-user + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 493167E85E45363D09495D0841C30648:0x404B00 + features: + - and: + - match: attach user process memory + - number: 0xFFFFFFFF = NtCurrentProcess() + - api: ZwFreeVirtualMemory + - optional: + - match: find process by PID diff --git a/nursery/.gitignore b/nursery/.gitignore new file mode 100644 index 00000000..e69de29b diff --git a/nursery/COM-create-shortcut.yml b/nursery/COM-create-shortcut.yml new file mode 100644 index 00000000..e6e3609d --- /dev/null +++ b/nursery/COM-create-shortcut.yml @@ -0,0 +1,18 @@ +rule: + meta: + name: create shortcut via COM + rule-category: machine-access-control/file-manipulation/create-shortcut-via-COM + author: matthew.williams@fireeye.com + scope: function + reference: + - https://docs.microsoft.com/en-us/windows/win32/shell/links#creating-a-shortcut-and-a-folder-shortcut-to-a-file + features: + - and: + - bytes: 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 = CLSID_ShellLink + - or: + - bytes: EE 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 = IID_IShellLinkA + - bytes: F9 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 = IID_IShellLinkW + - bytes: 0B 01 00 00 00 00 00 00 C0 00 00 00 00 00 00 46 = IID_IPersistFile + - offset: 0x50 = psl->SetPath + - offset: 0x18 = ppf->Save + - api: ole32.CoCreateInstance diff --git a/nursery/access-event-log.yml b/nursery/access-event-log.yml new file mode 100644 index 00000000..bd49cd66 --- /dev/null +++ b/nursery/access-event-log.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: access event log + author: moritz.raabe@fireeye.com + rule-category: other-features/access-event-log + scope: function + features: + - or: + - api: OpenEventLog + - api: ClearEventLog + - api: OpenBackupEventLog + - api: ReportEvent diff --git a/nursery/apc-injection.yml b/nursery/apc-injection.yml new file mode 100644 index 00000000..13026d08 --- /dev/null +++ b/nursery/apc-injection.yml @@ -0,0 +1,22 @@ +rule: + meta: + name: APC injection + author: william.ballenthin@fireeye.com + rule-category: machine-access-control/process-manipulation/code-injection + scope: function + features: + - and: + - or: + - match: write process memory + - api: kernel32.MapViewOfSection + - api: ntdll.NtMapViewOfSection + - api: ntdll.ZwMapViewOfSection + - api: kernel32.MapViewOfFile + - or: + - api: kernel32.QueueUserAPC + - api: ntdll.NtQueueApcThread + - optional: + - or: + - api: kernel32.CreateProcess + - api: kernel32.OpenProcess + diff --git a/nursery/calculate-crc32b.yml b/nursery/calculate-crc32b.yml new file mode 100644 index 00000000..396f4daa --- /dev/null +++ b/nursery/calculate-crc32b.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: CRC32b hash + rule-category: data-manipulation/hash-data/hash-data-using-crc32 + author: moritz.raabe@fireeye.com + scope: function + features: + - and: + - number: 0x4C11DB7 + - characteristic(nzxor): True diff --git a/nursery/calculate-md4-hash.yml b/nursery/calculate-md4-hash.yml new file mode 100644 index 00000000..c2a7f1ed --- /dev/null +++ b/nursery/calculate-md4-hash.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: MD4 hash + rule-category: data-manipulation/hash-data/hash-data-using-md4 + author: anamaria.martinezgom@fireeye.com + scope: basic block + features: + - and: + - number: 0x8002 = CALG_MD4 + - api: advapi32.CryptCreateHash diff --git a/nursery/calculate-md5-hash.yml b/nursery/calculate-md5-hash.yml new file mode 100644 index 00000000..9db902b1 --- /dev/null +++ b/nursery/calculate-md5-hash.yml @@ -0,0 +1,20 @@ +rule: + meta: + name: MD5 hash + rule-category: data-manipulation/hash-data/hash-data-using-md5 + author: moritz.raabe@fireeye.com + scope: function + features: + - or: + - and: + # Magic initialization constants used in MD4 and MD5 + - number: 0x67452301 # A + - number: 0xefcdab89 # B + - number: 0x98badcfe # C + - number: 0x10325476 # D + - not: + - number: 0xc3d2e1f0 # if this is there, it's likely SHA1 + - basic block: + - and: + - number: 0x8003 = CALG_MD5 + - api: advapi32.CryptCreateHash diff --git a/nursery/calculate-sha1-hash-via-wincrypt.yml b/nursery/calculate-sha1-hash-via-wincrypt.yml new file mode 100644 index 00000000..360e94a5 --- /dev/null +++ b/nursery/calculate-sha1-hash-via-wincrypt.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: SHA1 hash via wincrypt + rule-category: data-manipulation/hash-data/hash-data-using-sha1 + author: michael.hunhoff@fireeye.com + scope: function + features: + - or: + - and: + - match: initialize wincrypt hash + - number: 0x8004 = CALG_SHA1 + - api: advapi32.CryptHashData diff --git a/nursery/check-token-membership.yml b/nursery/check-token-membership.yml new file mode 100644 index 00000000..ed93f34a --- /dev/null +++ b/nursery/check-token-membership.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: check token membership + rule-category: discovery/session-configuration-probing/inspect-session-information + author: michael.hunhoff@fireeye.com + scope: function + features: + - and: + - api: advapi32.CheckTokenMembership + - optional: + - api: advapi32.AllocateAndInitializeSid + - api: advapi32.FreeSid diff --git a/nursery/command-file-transfer-c2s.yml b/nursery/command-file-transfer-c2s.yml new file mode 100644 index 00000000..801b6135 --- /dev/null +++ b/nursery/command-file-transfer-c2s.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: c2s file transfer command + rule-category: command-and-control/handle-command/file-transfer + author: william.ballenthin@fireeye.com + scope: function + features: + - and: + - match: read file + - match: send data diff --git a/nursery/command-file-transfer-s2c.yml b/nursery/command-file-transfer-s2c.yml new file mode 100644 index 00000000..b0c217d4 --- /dev/null +++ b/nursery/command-file-transfer-s2c.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: s2c file transfer command + rule-category: command-and-control/handle-command/file-transfer + author: william.ballenthin@fireeye.com + scope: function + features: + - and: + - match: receive data + - match: write file diff --git a/nursery/connect-network-resource.yml b/nursery/connect-network-resource.yml new file mode 100644 index 00000000..991f8c5e --- /dev/null +++ b/nursery/connect-network-resource.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: connect network resource + rule-category: communication/communication-via-network-resource/connect-network-resource + author: michael.hunhoff@fireeye.com + scope: function + description: connect to disk or print resource + features: + - and: + - or: + - api: mpr.WNetAddConnection + - api: mpr.WNetAddConnection2 + - api: mpr.WNetAddConnection3 + - optional: + - api: mpr.WNetCancelConnection + - api: mpr.WNetCancelConnection2 diff --git a/nursery/credssp-get-inbound-credentials-handle.yml b/nursery/credssp-get-inbound-credentials-handle.yml new file mode 100644 index 00000000..5b684f75 --- /dev/null +++ b/nursery/credssp-get-inbound-credentials-handle.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: credssp get inbound credentials handle + rule-category: other-features/credssp/credssp-get-inbound-credentials-handle + author: matthew.williams@fireeye.com + scope: basic block + reference: + - https://docs.microsoft.com/en-us/windows/win32/api/sspi/nf-sspi-acquirecredentialshandlea + - https://docs.microsoft.com/en-us/windows/win32/secauthn/getting-schannel-credentials + features: + - and: + - api: secur32.AcquireCredentialsHandle + - number: 1 = SECPKG_CRED_INBOUND diff --git a/nursery/credssp-get-outbound-credentials-handle.yml b/nursery/credssp-get-outbound-credentials-handle.yml new file mode 100644 index 00000000..f0298929 --- /dev/null +++ b/nursery/credssp-get-outbound-credentials-handle.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: credssp get outbound credentials handle + rule-category: other-features/credssp/credssp-get-outbound-credentials-handle + author: matthew.williams@fireeye.com + scope: basic block + reference: + - https://docs.microsoft.com/en-us/windows/win32/api/sspi/nf-sspi-acquirecredentialshandlea + - https://docs.microsoft.com/en-us/windows/win32/secauthn/getting-schannel-credentials + features: + - and: + - api: secur32.AcquireCredentialsHandle + - number: 2 = SECPKG_CRED_OUTBOUND diff --git a/nursery/datamine-credit-card-data.yml b/nursery/datamine-credit-card-data.yml new file mode 100644 index 00000000..57511991 --- /dev/null +++ b/nursery/datamine-credit-card-data.yml @@ -0,0 +1,22 @@ +rule: + meta: + name: datamine credit card data + rule-category: discovery/datamine/datamine-credit-card-data + author: matthew.williams@fireeye.com + scope: function + features: + - and: + - basic block: + - and: + - mnemonic: cmp + - number: 0x5E = '^' (Track 1 separator) + - basic block: + - and: + - mnemonic: cmp + - number: 0x3D = '=' (Track 2 separator) + - basic block: + - and: + - mnemonic: cmp + # seen in 518185ED134F93DF708590E74473DA8E and 05B2D1AF23CF96E295BBBFC6CDC76E1F + - number: 0x44 = 'D' (Unknown separator) + - match: read process memory diff --git a/nursery/datamine-cryptocurrency.yml b/nursery/datamine-cryptocurrency.yml new file mode 100644 index 00000000..852e68c7 --- /dev/null +++ b/nursery/datamine-cryptocurrency.yml @@ -0,0 +1,46 @@ +rule: + meta: + name: datamine cryptocurrency + rule-category: discovery/datamine/datamine-cryptocurrency + author: moritz.raabe@fireeye.com + scope: file + reference: https://github.com/ctxis/CAPE/blob/master/modules/signatures/cryptomining.py + features: + - or: + - string: "stratum+tcp://" + - string: "xmrig" + - string: "xmr-stak" + - string: "supportxmr.com:" + - string: "dwarfpool.com:" + - string: "minergate" + - string: "xmr." + - string: "monero." + - string: "Bitcoin" + - string: "Bitcoin" + - string: "BitcoinGold" + - string: "BtcCash" + - string: "Ethereum" + - string: "BlackCoin" + - string: "ByteCoin" + - string: "EmerCoin" + - string: "ReddCoin" + - string: "Peercoin" + - string: "Ripple" + - string: "Miota" + - string: "Cardano" + - string: "Lisk" + - string: "Stratis" + - string: "Waves" + - string: "Qtum" + - string: "Stellar" + - string: "ViaCoin" + - string: "Electroneum" + - string: "Dash" + - string: "Doge" + - string: "Monero" + - string: "Graft" + - string: "Zcash" + - string: "Ya.money" + - string: "Ya.disc" + - string: "Steam" + - string: "vk.cc" diff --git a/nursery/debug-build.yml b/nursery/debug-build.yml new file mode 100644 index 00000000..7bbe3053 --- /dev/null +++ b/nursery/debug-build.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: debug build + rule-category: other-features/debug-build + author: william.ballenthin@fireeye.com + scope: file + features: + - or: + - string: "Assertion failed!" + - string: "Assertion failed:" + diff --git a/nursery/decrypt-data-using-sspi.yml b/nursery/decrypt-data-using-sspi.yml new file mode 100644 index 00000000..b17bd9f2 --- /dev/null +++ b/nursery/decrypt-data-using-sspi.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: decrypt data using sspi + rule-category: data-manipulation/decrypt-data/decrypt-data-using-sspi + author: matthew.williams@fireeye.com + scope: basic block + reference: https://docs.microsoft.com/en-us/windows/win32/api/sspi/nf-sspi-decryptmessage + features: + - and: + - api: secur32.DecryptMessage + diff --git a/nursery/empty-recycle-bin.yml b/nursery/empty-recycle-bin.yml new file mode 100644 index 00000000..f7d421e3 --- /dev/null +++ b/nursery/empty-recycle-bin.yml @@ -0,0 +1,9 @@ +rule: + meta: + name: empty recycle bin + author: moritz.raabe@fireeye.com + rule-category: other-features/empty-recycle-bin + scope: function + features: + - or: + - api: SHEmptyRecycleBin diff --git a/nursery/encode-data-using-base64-winapi.yml b/nursery/encode-data-using-base64-winapi.yml new file mode 100644 index 00000000..3fef89ce --- /dev/null +++ b/nursery/encode-data-using-base64-winapi.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: encodes data with Base64 via WINAPI + rule-category: data-manipulation/encode-data/encode-data-using-base64 + author: moritz.raabe@fireeye.com + scope: basic block + features: + - and: + - number: 1 = CRYPT_STRING_BASE64 + - api: CryptStringToBinary diff --git a/nursery/encrypt-data-using-sspi.yml b/nursery/encrypt-data-using-sspi.yml new file mode 100644 index 00000000..2ad84fb8 --- /dev/null +++ b/nursery/encrypt-data-using-sspi.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: encrypt data using sspi + rule-category: data-manipulation/encrypt-data/encrypt-data-using-sspi + author: matthew.williams@fireeye.com + scope: basic block + reference: https://docs.microsoft.com/en-us/windows/win32/api/sspi/nf-sspi-encryptmessage + features: + - and: + - api: secur32.EncryptMessage + diff --git a/nursery/encrypt-data-with-aes-static.yml b/nursery/encrypt-data-with-aes-static.yml new file mode 100644 index 00000000..d483c52c --- /dev/null +++ b/nursery/encrypt-data-with-aes-static.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: references AES constants + rule-category: data-manipulation/encrypt-data/encrypt-data-with-aes + author: william.ballenthin@fireeye.com + scope: function + features: + - or: + - bytes: 50 a7 f4 51 53 65 41 7e = d-0 + - bytes: 63 7c 77 7b f2 6b 6f c5 = s-box + - bytes: 52 09 6a d5 30 36 a5 38 = inv-s-box diff --git a/nursery/encrypt-salsa20.yml b/nursery/encrypt-salsa20.yml new file mode 100644 index 00000000..6d3f1a29 --- /dev/null +++ b/nursery/encrypt-salsa20.yml @@ -0,0 +1,20 @@ +rule: + meta: + name: encrypt using Salsa20 or ChaCha + author: moritz.raabe@fireeye.com + rule-category: data-manipulation/encrypt-data/encrypt-data-using-salsa20 + scope: function + features: + # The constant words spell "expand 32-byte k" in ASCII (i.e. the 4 words are "expa", "nd 3", "2-by", and "te k") + - or: + - string: expand 32-byte k + - and: + - string: expa + - string: nd 3 + - string: 2-by + - string: te k + - and: + - number: 0x61707865 # apxe + - number: 0x3320646E # 3 dn + - number: 0x79622D32 # yb-2 + - number: 0x6B206574 # k et diff --git a/nursery/enumerate-browser-history.yml b/nursery/enumerate-browser-history.yml new file mode 100644 index 00000000..f1ee33cc --- /dev/null +++ b/nursery/enumerate-browser-history.yml @@ -0,0 +1,15 @@ +rule: + meta: + name: enumerate browser history + rule-category: discovery/datamine/enumerate-browser-history + author: michael.hunhoff@fireeye.com + scope: function + features: + - and: + - api: ole32.CoCreateInstance + - bytes: 11 DC A0 AF 13 C3 D0 11 83 1A 00 C0 4F D5 AE 38 = IUrlHistoryStg2 + - bytes: 40 4A 37 3C E4 BA CF 11 BF 7D 00 AA 00 69 46 EE = CUrlHistory + - offset: 28 = IUrlHistoryStg2.EnumUrls # enumerate IE URLs + - optional: + - offset: 20 = IEnumSTATURL.Reset # reset iterator to start of IE URLs + - offset: 12 = IEnumSTATURL.Next diff --git a/nursery/enumerate-disk-volumes.yml b/nursery/enumerate-disk-volumes.yml new file mode 100644 index 00000000..579780c6 --- /dev/null +++ b/nursery/enumerate-disk-volumes.yml @@ -0,0 +1,20 @@ +rule: + meta: + name: enumerate disk volumes + rule-category: discovery/datamine/enumerate-disk-volumes + author: michael.hunhoff@fireeye.com + scope: function + features: + - and: + - match: loop + - or: + - and: + - api: kernel32.FindFirstVolume + - api: kernel32.FindNextVolume + - optional: + - api: kernel32.FindVolumeClose + - and: + - api: kernel32.FindFirstVolumeMountPoint + - api: kernel32.FindNextVolumeMountPoint + - optional: + - api: kernel32.FindVolumeMountPointClose diff --git a/nursery/enumerate-threads.yml b/nursery/enumerate-threads.yml new file mode 100644 index 00000000..8b0e117a --- /dev/null +++ b/nursery/enumerate-threads.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: enumerate threads + author: moritz.raabe@fireeye.com + rule-category: machine-access-control/process-manipulation/enumerate-threads + scope: function + features: + - and: + - api: kernel32.Thread32First + - api: kernel32.Thread32Next diff --git a/nursery/enumerate-windows.yml b/nursery/enumerate-windows.yml new file mode 100644 index 00000000..02af96ad --- /dev/null +++ b/nursery/enumerate-windows.yml @@ -0,0 +1,9 @@ +rule: + meta: + name: enumerate windows + rule-category: machine-access-control/gui-window-manipulation/enumerate-windows + author: moritz.raabe@fireeye.com + scope: function + features: + - or: + - api: user32.EnumWindows diff --git a/nursery/example.yml b/nursery/example.yml new file mode 100644 index 00000000..1482f485 --- /dev/null +++ b/nursery/example.yml @@ -0,0 +1,8 @@ +rule: + meta: + name: example + author: william.ballenthin@fireeye.com + scope: function + features: + - or: + - api: Foo32.bar diff --git a/nursery/get-comspec-path.yml b/nursery/get-comspec-path.yml new file mode 100644 index 00000000..fb90572d --- /dev/null +++ b/nursery/get-comspec-path.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: get comspec path + rule-category: discovery/host-configuration-probing/get-comspec-path + author: matthew.williams@fireeye.com + scope: function + features: + - and: + - match: query environment variable + - or: + - string: COMSPEC + - string: "%COMSPEC%" diff --git a/nursery/get-file-size.yml b/nursery/get-file-size.yml new file mode 100644 index 00000000..000933c7 --- /dev/null +++ b/nursery/get-file-size.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: get file size + rule-category: machine-access-control/file-manipulation/get-file-size + author: michael.hunhoff@fireeye.com + scope: function + features: + - or: + - api: kernel32.GetFileSize + - api: kernel32.GetFileSizeEx diff --git a/nursery/get-file-version-info.yml b/nursery/get-file-version-info.yml new file mode 100644 index 00000000..1970e681 --- /dev/null +++ b/nursery/get-file-version-info.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: get file version info + rule-category: machine-access-control/file-manipulation/get-file-version-info + author: michael.hunhoff@fireeye.com + scope: function + features: + - and: + - api: version.GetFileVersionInfo + - api: version.GetFileVersionInfoSize + - optional: + # retrieves specified version information from the specified version-information resource + - api: version.VerQueryValue diff --git a/nursery/get-installed-programs-via-registry.yml b/nursery/get-installed-programs-via-registry.yml new file mode 100644 index 00000000..4c0e4cbb --- /dev/null +++ b/nursery/get-installed-programs-via-registry.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: get installed programs via registry + rule-category: machine-access-control/inspect-installed-programs/get-installed-programs + author: moritz.raabe@fireeye.com + scope: function + features: + - and: + - match: open registry key + - string: /SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall/i + - characteristic(loop): true diff --git a/nursery/get-networking-parameters.yml b/nursery/get-networking-parameters.yml new file mode 100644 index 00000000..d8214ae0 --- /dev/null +++ b/nursery/get-networking-parameters.yml @@ -0,0 +1,9 @@ +rule: + meta: + name: get networking parameters + rule-category: discovery/network-environment-probing/get-networking-parameters + author: michael.hunhoff@fireeye.com + scope: function + features: + - or: + - api: iphlpapi.GetNetworkParams diff --git a/nursery/get-proxy-via-registry.yml b/nursery/get-proxy-via-registry.yml new file mode 100644 index 00000000..6fc125f1 --- /dev/null +++ b/nursery/get-proxy-via-registry.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: get proxy via registry + rule-category: machine-access-control/network-environment-probing/test-for-proxy + author: moritz.raabe@fireeye.com + scope: function + features: + - and: + - match: open registry key + - string: ProxyServer diff --git a/nursery/get-routing-table.yml b/nursery/get-routing-table.yml new file mode 100644 index 00000000..2f82c85f --- /dev/null +++ b/nursery/get-routing-table.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: get routing table + rule-category: discovery/network-environment-probing/get-routing-table + author: michael.hunhoff@fireeye.com + scope: function + features: + - or: + - api: iphlpapi.GetIpForwardTable + - api: iphlpapi.GetIpForwardTable2 diff --git a/nursery/get-service-handle.yml b/nursery/get-service-handle.yml new file mode 100644 index 00000000..e45736d4 --- /dev/null +++ b/nursery/get-service-handle.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: get service handle + author: moritz.raabe@fireeye.com + scope: function + lib: true + features: + - or: + - api: advapi32.CreateService + - api: advapi32.OpenService diff --git a/nursery/get-session-information.yml b/nursery/get-session-information.yml new file mode 100644 index 00000000..59c8677b --- /dev/null +++ b/nursery/get-session-information.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: get session information + rule-category: discovery/session-configuration-probing/inspect-session-information + author: michael.hunhoff@fireeye.com + scope: function + features: + - and: + - api: wtsapi32.WTSQuerySessionInformation + - optional: + - api: wtsapi32.WTSFreeMemory diff --git a/nursery/host-header.yml b/nursery/host-header.yml new file mode 100644 index 00000000..dd32aa98 --- /dev/null +++ b/nursery/host-header.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: HTTP request with Host header + rule-category: communication/communication-via-http/send-http-request + author: anamaria.martinezgom@fireeye.com + scope: function + features: + - and: + - match: send HTTP request + - string: /Host:/i diff --git a/nursery/http-with-cookie.yml b/nursery/http-with-cookie.yml new file mode 100644 index 00000000..9cb9ab4a --- /dev/null +++ b/nursery/http-with-cookie.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: HTTP request with cookie + rule-category: communication/communication-via-http/send-http-request + author: anamaria.martinezgom@fireeye.com + scope: function + features: + - and: + - match: send HTTP request + - string: /Cookie:/i diff --git a/nursery/initialize-wincrypt-hash.yml b/nursery/initialize-wincrypt-hash.yml new file mode 100644 index 00000000..d9398738 --- /dev/null +++ b/nursery/initialize-wincrypt-hash.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: initialize wincrypt hash + rule-category: data-manipulation/hash-data/initialize-wincrypt-hash + author: michael.hunhoff@fireeye.com + scope: function + features: + - and: + - api: advapi32.CryptCreateHash + - optional: + - api: advapi32.CryptDestroyHash diff --git a/nursery/installshield.yml b/nursery/installshield.yml new file mode 100644 index 00000000..380a626c --- /dev/null +++ b/nursery/installshield.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: installer InstallShield + rule-category: other-features/installer/installshield + author: moritz.raabe@fireeye.com + scope: file + features: + - or: + # AppHelp has an export ApphelpCheckInstallShieldPackage, + # which we want to avoid FP'ing on, + # so do an exact match for this string. + # ok to relax if there are counterexamples. + - string: InstallShield diff --git a/nursery/load-shellcode-rwx-thread.yml b/nursery/load-shellcode-rwx-thread.yml new file mode 100644 index 00000000..e3d6abb4 --- /dev/null +++ b/nursery/load-shellcode-rwx-thread.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: load shellcode RWX thread + rule-category: load-code/load-shellcode/load-shellcode-rwx-thread + author: moritz.raabe@fireeye.com + scope: function + features: + - and: + - match: allocate RWX memory + - match: create thread diff --git a/nursery/move-file.yml b/nursery/move-file.yml new file mode 100644 index 00000000..3202d208 --- /dev/null +++ b/nursery/move-file.yml @@ -0,0 +1,19 @@ +rule: + meta: + name: move file + rule-category: machine-access-control/file-manipulation/move-file + author: moritz.raabe@fireeye.com + scope: function + features: + - or: + - api: kernel32.MoveFile + - api: kernel32.MoveFileEx + - api: MoveFileWithProgress + - api: MoveFileTransacted + - api: rename + - api: _wrename + - basic block: + - and: + - number: 1 = FO_MOVE + - or: + - api: kernel32.SHFileOperation diff --git a/nursery/nsis-installer.yml b/nursery/nsis-installer.yml new file mode 100644 index 00000000..b789210a --- /dev/null +++ b/nursery/nsis-installer.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: NSIS installer + rule-category: other-features/installer/nsis + author: moritz.raabe@fireeye.com + scope: file + reference: https://nsis.sourceforge.io/Main_Page + features: + - or: + - string: /http://nsis\.sf\.net/ diff --git a/nursery/raw-disk-access.yml b/nursery/raw-disk-access.yml new file mode 100644 index 00000000..09768ad3 --- /dev/null +++ b/nursery/raw-disk-access.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: raw disk read + rule-category: machine-access-control/disk-manipulation/raw-disk-access + author: william.ballenthin@fireeye.com + scope: file + features: + - or: + - string: \\\\.\\PhysicalDrive0 + - string: "\\\\.\\C:" diff --git a/nursery/read-file-via-mapping.yml b/nursery/read-file-via-mapping.yml new file mode 100644 index 00000000..50f28151 --- /dev/null +++ b/nursery/read-file-via-mapping.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: read file via mapping + rule-category: machine-access-control/file-manipulation/read-file-via-mapping + author: michael.hunhoff@fireeye.com + scope: function + features: + - and: + - api: kernel32.MapViewOfFile + - number: 4 = FILE_MAP_READ + - optional: + - api: kernel32.UnmapViewOfFile + - and: + - match: get file size + - api: kernel32.CreateFileMapping + - number: 2 = PAGE_READONLY diff --git a/nursery/read-process-memory.yml b/nursery/read-process-memory.yml new file mode 100644 index 00000000..3049921c --- /dev/null +++ b/nursery/read-process-memory.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: read process memory + rule-category: memory-access/read-memory/read-process-memory + author: matthew.williams@fireeye.com + scope: function + features: + - and: + - api: kernel32.ReadProcessMemory + - optional: + - or: + - api: kernel32.OpenProcess + - api: kernel32.VirtualQueryEx diff --git a/nursery/reference-screen-saver-executable.yml b/nursery/reference-screen-saver-executable.yml new file mode 100644 index 00000000..d0fd297c --- /dev/null +++ b/nursery/reference-screen-saver-executable.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: reference screen saver executable + rule-category: persistence + author: michael.hunhoff@fireeye.com + scope: function + description: SCRNSAVE.EXE registry value specifies the name of the screen saver executable file + features: + - and: + - string: SCRNSAVE.EXE + - optional: + - string: ScreenSaveTimeOut + - string: Control Panel\Desktop + - match: set registry value diff --git a/nursery/reference-windows-startup-folder.yml b/nursery/reference-windows-startup-folder.yml new file mode 100644 index 00000000..cb50b5e5 --- /dev/null +++ b/nursery/reference-windows-startup-folder.yml @@ -0,0 +1,9 @@ +rule: + meta: + name: reference Windows startup folder + rule-category: persistence + author: matthew.williams@fireeye.com + scope: file + features: + - or: + - string: /Start Menu\\Programs\\Startup/i diff --git a/nursery/regular-expression-engine.yml b/nursery/regular-expression-engine.yml new file mode 100644 index 00000000..11ed6f7d --- /dev/null +++ b/nursery/regular-expression-engine.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: uses regular expression engine + rule-category: discovery/datamine/regular-expression-engine + author: william.ballenthin@fireeye.com + scope: file + features: + - or: + - string: "regex_error(error_syntax)" # from C++ STL regex, ref: http://www.cplusplus.com/reference/regex/regex_error/ + - string: "regex_error(error_collate): The expression contained an invalid collating element name." diff --git a/nursery/resolve-windows-startup-folder.yml b/nursery/resolve-windows-startup-folder.yml new file mode 100644 index 00000000..a8d47d23 --- /dev/null +++ b/nursery/resolve-windows-startup-folder.yml @@ -0,0 +1,18 @@ +rule: + meta: + name: resolve Windows startup folder + rule-category: persistence + author: matthew.williams@fireeye.com + scope: basic block + examples: + - 07F7846BBCDA782E5639292AD93907EB:0x40121A + features: + - and: + - or: + - number: 0x07 = CSIDL_STARTUP + - number: 0x18 = CSIDL_COMMON_STARTUP + - or: + - api: shell32.SHGetFolderPath + - api: shell32.SHGetFolderLocation + - api: shell32.SHGetSpecialFolderPath + - api: shell32.SHGetSpecialFolderLocation diff --git a/nursery/run-powershell-expression.yml b/nursery/run-powershell-expression.yml new file mode 100644 index 00000000..d1c0ca1b --- /dev/null +++ b/nursery/run-powershell-expression.yml @@ -0,0 +1,15 @@ +rule: + meta: + name: run Powershell expression + rule-category: load-code/load-powershell/run-powershell-expression + author: anamaria.martinezgom@fireeye.com + scope: function + features: + - and: + - or: + - string: / iex\(/i + - string: / iex /i + - string: /Invoke-Expression/i + - optional: + - string: /powershell.exe / + diff --git a/nursery/schannel-get-client-handle.yml b/nursery/schannel-get-client-handle.yml new file mode 100644 index 00000000..ccd4652e --- /dev/null +++ b/nursery/schannel-get-client-handle.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: schannel get client handle + rule-category: other-features/schannel/schannel-get-client-handle + author: matthew.williams@fireeye.com + scope: function + reference: + - https://docs.microsoft.com/en-us/windows/win32/secauthn/getting-schannel-credentials + - https://docs.microsoft.com/en-us/windows/win32/api/credssp/ns-credssp-credssp_cred + - https://docs.microsoft.com/en-us/windows/win32/api/credssp/ne-credssp-credspp_submit_type + features: + - and: + - match: credssp get outbound credentials handle + - number: 4 = CredsspSchannelCreds + - optional: + - string: "Microsoft Unified Security Protocol Provider" diff --git a/nursery/schannel-get-remote-cert-context.yml b/nursery/schannel-get-remote-cert-context.yml new file mode 100644 index 00000000..daf9326c --- /dev/null +++ b/nursery/schannel-get-remote-cert-context.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: schannel get remote cert context + rule-category: other-features/schannel/schannel-get-remote-cert-context + author: matthew.williams@fireeye.com + scope: basic block + reference: https://docs.microsoft.com/en-us/windows/win32/secauthn/querycontextattributes--schannel + features: + - and: + - api: secur32.QueryContextAttributes + - number: 0x53 = SECPKG_ATTR_REMOTE_CERT_CONTEXT diff --git a/nursery/uac-bypass-env-variables.yml b/nursery/uac-bypass-env-variables.yml new file mode 100644 index 00000000..0d48a4db --- /dev/null +++ b/nursery/uac-bypass-env-variables.yml @@ -0,0 +1,20 @@ +rule: + meta: + name: UAC bypass exploiting Environment Variables + rule-category: machine-access-control/process-manipulation/uac-bypass + author: anamaria.martinezgom@fireeye.com + scope: function + references: + - https://www.tiraniddo.dev/2017/05/exploiting-environment-variables-in.html + - https://enigma0x3.net/2016/07/22/bypassing-uac-on-windows-10-using-disk-cleanup + features: + - and: + - string: schtasks.exe + - string: /Microsoft\\Windows\\DiskCleanup\\SilentCleanup/i + - match: create process + - optional: + - or: + - string: Environment + - string: windir + - match: set registry value + diff --git a/nursery/uac-bypass-with-com.yml b/nursery/uac-bypass-with-com.yml new file mode 100644 index 00000000..1a918d3a --- /dev/null +++ b/nursery/uac-bypass-with-com.yml @@ -0,0 +1,21 @@ +rule: + meta: + name: UAC bypass with COM interface + rule-category: machine-access-control/process-manipulation/uac-bypass + author: anamaria.martinezgom@fireeye.com + scope: function + references: + - https://gist.github.com/hfiref0x/196af729106b780db1c73428b5a5d68d + features: + - and: + - or: + - string: "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" # T_CLSID_CMSTPLUA + - bytes: F9 C7 5F 3E 51 9A 67 43 90 63 A1 20 24 4F BE C7 = T_CLSID_CMSTPLUA + - string: "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" # T_CLSID_CMSTPLUA + - optional: + - or: + - api: ole32.CoGetObject + - or: + - string: "{6EDD6D74-C007-4E75-B76A-E5740995E24C}" # IID_ICMLuaUtil + - bytes: 74 6D DD 6E 07 C0 75 4E B7 6A E5 74 09 95 E2 4C = IID_ICMLuaUtil + diff --git a/nursery/vmware-io-port.yml b/nursery/vmware-io-port.yml new file mode 100644 index 00000000..258b5362 --- /dev/null +++ b/nursery/vmware-io-port.yml @@ -0,0 +1,11 @@ +rule: + meta: + name: vmware io port + author: matthew.williams@fireeye.com + rule-category: anti-analysis/anti-vm/detect-vm-environment + scope: function + features: + - and: + - mnemonic: in + - number: 0x564D5868 = VMXh + - number: 0x5658 = VX \ No newline at end of file diff --git a/nursery/wiseinstall.yml b/nursery/wiseinstall.yml new file mode 100644 index 00000000..e608ad7f --- /dev/null +++ b/nursery/wiseinstall.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: installer Wise + rule-category: other-features/installer/wiseinstall + author: moritz.raabe@fireeye.com + scope: file + features: + - or: + - string: WiseMain + - string: /Wise Installation Wizard/ diff --git a/other-features/COM-firewall.yml b/other-features/COM-firewall.yml new file mode 100644 index 00000000..16f1e005 --- /dev/null +++ b/other-features/COM-firewall.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: access firewall settings via COM + rule-category: other-features/access-firewall-settings + author: moritz.raabe@fireeye.com + scope: function + examples: + - EB355BD63BDDCE02955792B4CD6539FB:0x10003927 + features: + - and: + - api: ole32.CoCreateInstance + - bytes: 42 E9 4C 30 39 6E D8 40 94 3A B9 13 C4 0C 9C D4 = CLSID_NetFwMgr + - bytes: F5 8A 89 F7 C4 CA 32 46 A2 EC DA 06 E5 11 1A F2 = IID_INetFwMgr diff --git a/other-features/accept-command-line-args.yml b/other-features/accept-command-line-args.yml new file mode 100644 index 00000000..4542ee55 --- /dev/null +++ b/other-features/accept-command-line-args.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: accept command line arguments + author: moritz.raabe@fireeye.com + rule-category: other-features/accept-command-line-arguments + scope: function + examples: + - Practical Malware Analysis Lab 10-03.exe_:0x401140 + - AFB6EC3D721A5CB67863487B0E51A34C167F629CF701F8BC7A038C117B4DDA44:0x407D50 + features: + - or: + - api: GetCommandLine + - api: CommandLineToArgv diff --git a/other-features/compiled-to-dot-net.yml b/other-features/compiled-to-dot-net.yml new file mode 100644 index 00000000..8d5fd521 --- /dev/null +++ b/other-features/compiled-to-dot-net.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: compiled to the .NET platform + rule-category: other-features/compiled-to-dot-net + author: william.ballenthin@fireeye.com + scope: file + examples: + - b9f5bd514485fb06da39beff051b9fdc + features: + - or: + - import: mscoree._CorExeMain + - import: mscoree._corexemain + - import: mscoree._CorDllMain + - import: mscoree._cordllmain diff --git a/other-features/compiled-with-autoit.yml b/other-features/compiled-with-autoit.yml new file mode 100644 index 00000000..3a84565d --- /dev/null +++ b/other-features/compiled-with-autoit.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: compiled with AutoIt + rule-category: other-features/compiled-with-autoit + author: william.ballenthin@fireeye.com + scope: file + examples: + - 55D77AB16377A8A314982F723FCC6FAE + features: + - or: + # strings from: https://fumik0.com/2019/03/25/lets-play-with-qulab-an-exotic-malware-developed-in-autoit/ + - string: "AutoIt has detected the stack has become corrupt.\n\nStack corruption typically occurs when either the wrong calling convention is used or when the function is called with the wrong number of arguments.\n\nAutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention." + - string: "AutoIt Error" + - string: />>>AUTOIT SCRIPT<<>>AUTOIT NO CMDEXECUTE<<<" + - string: "#requireadmin" + - string: "#OnAutoItStartRegister" \ No newline at end of file diff --git a/other-features/compiled-with-delphi.yml b/other-features/compiled-with-delphi.yml new file mode 100644 index 00000000..d21ff779 --- /dev/null +++ b/other-features/compiled-with-delphi.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: compiled from Borland Delphi + rule-category: other-features/compiled-with-delphi + author: william.ballenthin@fireeye.com + scope: file + examples: + - 4BDD67FF852C221112337FECD0681EAC + features: + - or: + - string: "This program must be run under Win32" + - string: Borland C++ - Copyright 2002 Borland Corporation + - string: /SOFTWARE\\Borland\\Delphi\\RTL/ + - string: Sysutils::Exception + - string: TForm1 + - import: BORLNDMM.DLL diff --git a/other-features/compiled-with-mingw.yml b/other-features/compiled-with-mingw.yml new file mode 100644 index 00000000..a4d7daa9 --- /dev/null +++ b/other-features/compiled-with-mingw.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: compiled with Mingw for Windows + rule-category: other-features/compiled-with-mingw + author: william.ballenthin@fireeye.com + scope: file + examples: + - 5b3968b47eb16a1cb88525e3b565eab1 + features: + - and: + - string: "Mingw runtime failure:" + - string: _Jv_RegisterClasses # from GCC + diff --git a/other-features/contains-pdb-path.yml b/other-features/contains-pdb-path.yml new file mode 100644 index 00000000..7f4c98e7 --- /dev/null +++ b/other-features/contains-pdb-path.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: contains pdb path + rule-category: other-features/contains-debugging-information + author: moritz.raabe@fireeye.com + scope: file + examples: + - 464EF2CA59782CE697BC329713698CCC # level32.exe + features: + - string: /:\\.*\.pdb/ diff --git a/other-features/debug-output.yml b/other-features/debug-output.yml new file mode 100644 index 00000000..6fefa561 --- /dev/null +++ b/other-features/debug-output.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: debug output + rule-category: other-features/debug-output + author: michael.hunhoff@fireeye.com + scope: function + examples: + - 493167E85E45363D09495D0841C30648:0x401000 + features: + - or: + - api: ntoskrnl.DbgPrint + - api: kernel32.OutputDebugString diff --git a/other-features/embedded-pe-file.yml b/other-features/embedded-pe-file.yml new file mode 100644 index 00000000..06725d83 --- /dev/null +++ b/other-features/embedded-pe-file.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: embedded PE file + rule-category: other-features/contains-embedded-data + author: moritz.raabe@fireeye.com + scope: file + examples: + - Practical Malware Analysis Lab 01-04.exe_:0x4060 + features: + - count(characteristic(embedded pe)): 1 or more diff --git a/other-features/hide-windows-taskbar.yml b/other-features/hide-windows-taskbar.yml new file mode 100644 index 00000000..7fffecce --- /dev/null +++ b/other-features/hide-windows-taskbar.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: hide windows taskbar + author: michael.hunhoff@fireeye.com + rule-category: other-features/hide-windows-taskbar + scope: function + examples: + - 39C05B15E9834AC93F206BC114D0A00C357C888DB567BA8F5345DA0529CBED41:0x10007250 + features: + - and: + - match: find taskbar + - api: user32.ShowWindow + - number: 0x0 = SW_HIDE diff --git a/other-features/linked-library/linked-with-cryptopp.yml b/other-features/linked-library/linked-with-cryptopp.yml new file mode 100644 index 00000000..de4acb06 --- /dev/null +++ b/other-features/linked-library/linked-with-cryptopp.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: links against Crypto++ + rule-category: other-features/linked-library/linked-with-cryptopp + author: moritz.raabe@fireeye.com + scope: file + examples: + - 8BA66E4B618FFDC8255F1DF01F875DDE6FD0561305D9F8307BE7BB11D02AE363 + - 66602B5FAB602CB4E6F754748D249542 + features: + - or: + - string: "Cryptographic algorithms are disabled after a power-up self test failed." + - string: ": this object requires an IV" + - string: "BER decode error" + - string: ".?AVException@CryptoPP@@" + - string: "FileStore: error reading file" + - string: "StreamTransformationFilter: PKCS_PADDING cannot be used with " diff --git a/other-features/linked-library/linked-with-libcurl.yml b/other-features/linked-library/linked-with-libcurl.yml new file mode 100644 index 00000000..130fdc8f --- /dev/null +++ b/other-features/linked-library/linked-with-libcurl.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: links against libcurl + rule-category: other-features/linked-library/linked-with-libcurl + author: moritz.raabe@fireeye.com + scope: file + examples: + - A90E5B3454AA71D9700B2EA54615F44B + features: + - or: + - string: /CLIENT libcurl/ + - string: /curl\.haxx\.se/ diff --git a/other-features/linked-library/linked-with-ms-detours.yml b/other-features/linked-library/linked-with-ms-detours.yml new file mode 100644 index 00000000..03718762 --- /dev/null +++ b/other-features/linked-library/linked-with-ms-detours.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: links against Microsoft Detours + rule-category: other-features/linked-library/linked-with-ms-detours + author: moritz.raabe@fireeye.com + scope: file + references: + - https://github.com/microsoft/Detours + examples: + - 071F2D1C4C2201EE95FFE2AA965000F5F615A11A12D345E33B9FB060E5597740 + features: + - or: + - section: .detourc + - section: .detourd diff --git a/other-features/linked-library/linked-with-openssl.yml b/other-features/linked-library/linked-with-openssl.yml new file mode 100644 index 00000000..afb004ad --- /dev/null +++ b/other-features/linked-library/linked-with-openssl.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: links against OpenSSL + rule-category: other-features/linked-library/linked-with-openssl + author: william.ballenthin@fireeye.com + scope: file + examples: + - 6cc148363200798a12091b97a17181a1 + features: + - or: + - string: RC4 for x86_64, CRYPTOGAMS by + - string: AES for x86_64, CRYPTOGAMS by + - string: DSA-SHA1-old + diff --git a/other-features/linked-library/linked-with-polarssl.yml b/other-features/linked-library/linked-with-polarssl.yml new file mode 100644 index 00000000..f2521228 --- /dev/null +++ b/other-features/linked-library/linked-with-polarssl.yml @@ -0,0 +1,15 @@ +rule: + meta: + name: links against PolarSSL/mbed TLS + rule-category: other-features/linked-library/linked-with-polarssl + author: william.ballenthin@fireeye.com + scope: file + examples: + - 232b0a8546035d9017fadf68398826edb0a1e055566bc1d356d6c9fdf1d7e485 + features: + - or: + - string: PolarSSLTest + - string: mbedtls_cipher_setup + - string: mbedtls_pk_verify + - string: mbedtls_ssl_write_record + - string: mbedtls_ssl_fetch_input diff --git a/other-features/linked-library/linked-with-zlib.yml b/other-features/linked-library/linked-with-zlib.yml new file mode 100644 index 00000000..eeae3dfe --- /dev/null +++ b/other-features/linked-library/linked-with-zlib.yml @@ -0,0 +1,12 @@ +rule: + meta: + name: links against ZLIB + rule-category: other-features/linked-library/linked-with-zlib + author: william.ballenthin@fireeye.com + scope: file + examples: + - 6cc148363200798a12091b97a17181a1 + features: + - or: + - string: /deflate .* Copyright/ + - string: /inflate .* Copyright/ diff --git a/other-features/lock-workstation.yml b/other-features/lock-workstation.yml new file mode 100644 index 00000000..a731c7af --- /dev/null +++ b/other-features/lock-workstation.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: lock workstation + author: michael.hunhoff@fireeye.com + rule-category: other-features/lock-workstation + scope: function + examples: + - 39C05B15E9834AC93F206BC114D0A00C357C888DB567BA8F5345DA0529CBED41:0x100084D0 + features: + - api: user32.LockWorkStation diff --git a/other-features/manipulate-cdrom-drive.yml b/other-features/manipulate-cdrom-drive.yml new file mode 100644 index 00000000..a6368e77 --- /dev/null +++ b/other-features/manipulate-cdrom-drive.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: manipulate cdrom drive + author: michael.hunhoff@fireeye.com + rule-category: other-features/manipulate-cdrom-drive + scope: function + examples: + - 39C05B15E9834AC93F206BC114D0A00C357C888DB567BA8F5345DA0529CBED41:0x10007250 + features: + - and: + - api: winmm.mciSendString + - or: + - string: set cdaudio door closed wait + - string: set cdaudio door open diff --git a/other-features/rsrc-section.yml b/other-features/rsrc-section.yml new file mode 100644 index 00000000..86900e95 --- /dev/null +++ b/other-features/rsrc-section.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: resource (.rsrc) section + rule-category: other-features/contains-rsrc-section + author: moritz.raabe@fireeye.com + scope: file + examples: + - A933A1A402775CFA94B6BEE0963F4B46:0x41fd25 + features: + - section: .rsrc diff --git a/other-features/tls-section.yml b/other-features/tls-section.yml new file mode 100644 index 00000000..270f7925 --- /dev/null +++ b/other-features/tls-section.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: thread local storage (.tls) section + rule-category: other-features/contains-tls-section + author: michael.hunhoff@fireeye.com + scope: file + examples: + - Practical Malware Analysis Lab 16-02.exe_ + features: + - section: .tls diff --git a/persistence/continuous-execution/persist-via-scheduled-task/COM-schedule-task.yml b/persistence/continuous-execution/persist-via-scheduled-task/COM-schedule-task.yml new file mode 100644 index 00000000..1a2dc834 --- /dev/null +++ b/persistence/continuous-execution/persist-via-scheduled-task/COM-schedule-task.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: schedule task via COM + author: moritz.raabe@fireeye.com + rule-category: persistence/continuous-execution/persist-via-scheduled-task + scope: function + examples: + - 2B8BEC5BCB1777EAA155D832F7AFC797:0x405887 + features: + - and: + - api: ole32.CoCreateInstance + - bytes: 2A D5 8B 14 AB A2 CE 11 B1 1F 00 AA 00 53 05 03 = CLSID_CTaskScheduler + - bytes: 27 D5 8B 14 AB A2 CE 11 B1 1F 00 AA 00 53 05 03 = IID_ITaskScheduler + - or: + - offset: 0x20 = pts->NewWorkItem + - offset: 0x24 = pts->AddWorkItem diff --git a/persistence/continuous-execution/persist-via-windows-registry-entry/persist-registry-app-init-dlls.yml b/persistence/continuous-execution/persist-via-windows-registry-entry/persist-registry-app-init-dlls.yml new file mode 100644 index 00000000..fdab7307 --- /dev/null +++ b/persistence/continuous-execution/persist-via-windows-registry-entry/persist-registry-app-init-dlls.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: persists via AppInit_DLLs + rule-category: persistence/continuous-execution/persist-via-windows-registry-entry + author: michael.hunhoff@fireye.com + scope: function + examples: + - Practical Malware Analysis Lab 11-02.dll_:0x1000158b + features: + - and: + - or: + - or: + - match: set registry value + - or: + - number: 0x80000002 = HKEY_LOCAL_MACHINE + - string: /SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows/i + - string: AppInit_DLLs \ No newline at end of file diff --git a/persistence/continuous-execution/persist-via-windows-registry-entry/persist-registry-gina-dll-key.yml b/persistence/continuous-execution/persist-via-windows-registry-entry/persist-registry-gina-dll-key.yml new file mode 100644 index 00000000..2a89915c --- /dev/null +++ b/persistence/continuous-execution/persist-via-windows-registry-entry/persist-registry-gina-dll-key.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: persist via GinaDLL registry key + rule-category: persistence/continuous-execution/persist-via-windows-registry-entry + author: michael.hunhoff@fireye.com + scope: function + examples: + - Practical Malware Analysis Lab 11-01.exe_:0x401000 + features: + - and: + - or: + - or: + - match: set registry value + - or: + - number: 0x80000002 = HKEY_LOCAL_MACHINE + - string: /SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon/i + - string: GinaDLL \ No newline at end of file diff --git a/persistence/continuous-execution/persist-via-windows-registry-entry/persist-registry-run-key.yml b/persistence/continuous-execution/persist-via-windows-registry-entry/persist-registry-run-key.yml new file mode 100644 index 00000000..67014699 --- /dev/null +++ b/persistence/continuous-execution/persist-via-windows-registry-entry/persist-registry-run-key.yml @@ -0,0 +1,21 @@ +rule: + meta: + name: persists via Run key + rule-category: persistence/continuous-execution/persist-via-windows-registry-entry + author: moritz.raabe@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 06-03.exe_:0x401130 + features: + - and: + - or: + - or: + - api: advapi32.RegOpenKey + - api: advapi32.RegOpenKeyEx + - or: + - api: advapi32.RegSetValue + - api: advapi32.RegSetValueEx + - or: + - number: 0x80000001 = HKEY_CURRENT_USER + - number: 0x80000002 = HKEY_LOCAL_MACHINE + - string: /Software\\Microsoft\\Windows\\CurrentVersion\\Run/i diff --git a/persistence/continuous-execution/persist-via-windows-service/persist-via-windows-service.yml b/persistence/continuous-execution/persist-via-windows-service/persist-via-windows-service.yml new file mode 100644 index 00000000..5171b679 --- /dev/null +++ b/persistence/continuous-execution/persist-via-windows-service/persist-via-windows-service.yml @@ -0,0 +1,18 @@ +rule: + meta: + name: persist via Windows service + rule-category: persistence/continuous-execution/persist-via-windows-service + author: moritz.raabe@fireeye.com + scope: function + examples: + - Practical Malware Analysis Lab 03-02.dll_:0x10004706 + features: + - and: + - basic block: + - and: + - number: 2 = SERVICE_AUTO_START + - api: advapi32.CreateService + - optional: + - or: + - api: advapi32.OpenService + - api: advapi32.StartService diff --git a/persistence/continuous-execution/persist-via-windows-startup-folder/write-file-to-startup-folder.yml b/persistence/continuous-execution/persist-via-windows-startup-folder/write-file-to-startup-folder.yml new file mode 100644 index 00000000..33abe7c5 --- /dev/null +++ b/persistence/continuous-execution/persist-via-windows-startup-folder/write-file-to-startup-folder.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: write file to Windows startup folder + rule-category: persistence/continuous-execution/persist-via-windows-startup-folder + author: matthew.williams@fireeye.com + scope: function + examples: + - 07F7846BBCDA782E5639292AD93907EB:0x401040 + features: + - and: + - match: resolve Windows startup folder + - or: + - match: copy file + - match: move file + - match: write file + diff --git a/pseudorandom-number-generation/prng-via-mersenne-twister.yml b/pseudorandom-number-generation/prng-via-mersenne-twister.yml new file mode 100644 index 00000000..dfe3c161 --- /dev/null +++ b/pseudorandom-number-generation/prng-via-mersenne-twister.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: prng via mersenne twister + rule-category: pseudorandom-number-generation/pseudorandom-number/prng-via-mersenne-twister + author: moritz.raabe@fireeye.com + scope: function + examples: + - D9630C174B8FF5C0AA26168DF523E63E:0x41A850 + features: + - or: + - number: 0x6C078965 + - number: 0x9908B0DF + - number: 0x9D2C5680 + - number: 0xEFC60000 + - number: 0xFF3A58AD + - number: 0xB5026F5AA96619E9 + - number: 0x71D67FFFEDA60000 diff --git a/readme.md b/readme.md index c4578c90..c5e8fd7d 100644 --- a/readme.md +++ b/readme.md @@ -1 +1,17 @@ -# Rules for Capa +Most rules fit into an `$objective/$behavior/$technique` taxonomy. +This is specified via the `rule.meta.rule-category` field. +By convention, we organize the rule files into a directory structure that mirrors this taxonomy. +For example, the rule [send-data-on-socket.yml](./communication/communication-via-socket/send-data/send-data-on-socket.yml) + is found in the directory + [communication](./communication/) / + [communication-via-socket](./communication/communication-via-socket/) / + [send-data](./communication/communication-via-socket/send-data/) + that also matches the rule category. + +Other directories here: + + - [maec](./maec/) - rules that match a sample's "disposition" and "role", which are specified via MAEC vocabularies: + - disposition: [analysis-conclusion-ov](./maec/analysis-conclusion/) + - role: [malware-category-ov](./maec/malware-category/) + - [other-features](./other-features/) - miscellaneous attributes of a sample, such as "embedded PE" or "resource section". + diff --git a/technical-targetting/automated-teller-machine-targetting/atm-dispenser-targetting.yml b/technical-targetting/automated-teller-machine-targetting/atm-dispenser-targetting.yml new file mode 100644 index 00000000..2b4b5810 --- /dev/null +++ b/technical-targetting/automated-teller-machine-targetting/atm-dispenser-targetting.yml @@ -0,0 +1,16 @@ +rule: + meta: + name: identifies ATM dispenser service provider + rule-category: technical-targetting/automated-teller-machine-targetting/atm-dispenser-targetting + author: william.ballenthin@fireeye.com + scope: file + references: + - https://doc.axxonsoft.com/confluence/display/atm70en/Configuring+the+connection+to+the+dispenser+service+provider + examples: + - b2ad4409323147b63e370745e5209996 + - 1f094dd65be477d15d871e72f0fdce5e + features: + - or: + - string: CurrencyDispenser1 # NCR + - string: CDM30 # Wincor + - string: DBD_AdvFuncDisp # Diebold \ No newline at end of file diff --git a/technical-targetting/automated-teller-machine-targetting/diebold-atm-targetting-file.yml b/technical-targetting/automated-teller-machine-targetting/diebold-atm-targetting-file.yml new file mode 100644 index 00000000..ccc408ed --- /dev/null +++ b/technical-targetting/automated-teller-machine-targetting/diebold-atm-targetting-file.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: references Diebold ATM routines + rule-category: technical-targetting/automated-teller-machine-targetting/diebold-atm-targetting + author: william.ballenthin@fireeye.com + scope: file + references: + - https://www.fireeye.com/blog/threat-research/2017/01/new_ploutus_variant.html + examples: + - b2ad4409323147b63e370745e5209996 + features: + - or: + - string: DBD_AdvFuncDisp # dispenser + - string: DBD_EPP4 # pin pad \ No newline at end of file diff --git a/technical-targetting/automated-teller-machine-targetting/diebold-nixdorf-atm-targetting.yml b/technical-targetting/automated-teller-machine-targetting/diebold-nixdorf-atm-targetting.yml new file mode 100644 index 00000000..b76c76cd --- /dev/null +++ b/technical-targetting/automated-teller-machine-targetting/diebold-nixdorf-atm-targetting.yml @@ -0,0 +1,70 @@ +rule: + meta: + name: loads Diebold Nixdorf ATM library (CSCWCNG.dll) + rule-category: technical-targetting/automated-teller-machine-targetting/diebold-nixdorf-atm-targetting + author: william.ballenthin@fireeye.com + scope: file + references: + - https://www.vkremez.com/2017/12/lets-learn-cutlet-atm-malware-internals.html + examples: + - 658b0502b53f718bd0611a638dfd5969 + - 8683c43f1e22363ce98f0a89ca4ed389 + - 953bc3e68f0a49c6ade30b52a2bfaaab + features: + - or: + - import: cscwcng.dll + - string: CSCWCNG.dll + - import: cscwcng.CscCngStatusWrite + - import: cscwcng.CscCngCasRefInit + - import: cscwcng.CscCngEncryption + - import: cscwcng.CscCngRecovery + - import: cscwcng.CscCngService + - import: cscwcng.CscCngOpen + - import: cscwcng.CscCngReset + - import: cscwcng.CscCngClose + - import: cscwcng.CscCngDispense + - import: cscwcng.CscCngTransport + - import: cscwcng.CscCngStatusRead + - import: cscwcng.CscCngInit + - import: cscwcng.CscCngGetRelease + - import: cscwcng.CscCngLock + - import: cscwcng.CscCngUnlock + - import: cscwcng.CscCngShutter + - import: cscwcng.CscCngPowerOff + - import: cscwcng.CscCngSelStatus + - import: cscwcng.CscCngBim + - import: cscwcng.CscCngConfigure + - import: cscwcng.CscCngStatistics + - import: cscwcng.CscCngControl + - import: cscwcng.CscCngPsm + - import: cscwcng.CscCngGetTrace + - import: cscwcng.CscCngOptimization + - import: cscwcng.CscCngSelftest + - import: cscwcng.CscCngEco + - string: CscCngStatusWrite + - string: CscCngCasRefInit + - string: CscCngEncryption + - string: CscCngRecovery + - string: CscCngService + - string: CscCngOpen + - string: CscCngReset + - string: CscCngClose + - string: CscCngDispense + - string: CscCngTransport + - string: CscCngStatusRead + - string: CscCngInit + - string: CscCngGetRelease + - string: CscCngLock + - string: CscCngUnlock + - string: CscCngShutter + - string: CscCngPowerOff + - string: CscCngSelStatus + - string: CscCngBim + - string: CscCngConfigure + - string: CscCngStatistics + - string: CscCngControl + - string: CscCngPsm + - string: CscCngGetTrace + - string: CscCngOptimization + - string: CscCngSelftest + - string: CscCngEco diff --git a/technical-targetting/automated-teller-machine-targetting/ncr-atm-targetting-file.yml b/technical-targetting/automated-teller-machine-targetting/ncr-atm-targetting-file.yml new file mode 100644 index 00000000..5b2f2597 --- /dev/null +++ b/technical-targetting/automated-teller-machine-targetting/ncr-atm-targetting-file.yml @@ -0,0 +1,20 @@ +rule: + meta: + name: loads NCR ATM library (MSXFS.dll) + rule-category: technical-targetting/automated-teller-machine-targetting/ncr-atm-targetting + author: william.ballenthin@fireeye.com + scope: file + references: + - https://www.pcworld.com/article/2824572/leaked-programming-manual-may-help-criminals-develop-more-atm-malware.html + examples: + - 971e599e6e707349eccea2fd4c8e5f67 + - 4bdd67ff852c221112337fecd0681eac + - 32d1f4b9c0cf2bb9512d88d27ca23c07 + - dc9eb40429d6fa2f15cd34479cb320c8 + - 5b3968b47eb16a1cb88525e3b565eab1 + - dc4dc746d8a14060fb5fc7edd4ef5282 + features: + - or: + - import: msxfs.dll # Extension for Financial Services (XFS) + - string: MSXFS.dll + - string: msxfs.dll \ No newline at end of file diff --git a/technical-targetting/automated-teller-machine-targetting/ncr-atm-targetting.yml b/technical-targetting/automated-teller-machine-targetting/ncr-atm-targetting.yml new file mode 100644 index 00000000..c975c39d --- /dev/null +++ b/technical-targetting/automated-teller-machine-targetting/ncr-atm-targetting.yml @@ -0,0 +1,46 @@ +rule: + meta: + name: loads/invokes NCR ATM library (MSXFS.dll) routines + rule-category: technical-targetting/automated-teller-machine-targetting/ncr-atm-targetting + author: william.ballenthin@fireeye.com + scope: function + references: + - https://www.pcworld.com/article/2824572/leaked-programming-manual-may-help-criminals-develop-more-atm-malware.html + examples: + - 84a1212f4a91066babcf594d87a85894:0x404470 # loads routines via GetProcAddress + # 971e599e6e707349eccea2fd4c8e5f67 # packed with vmprotect + features: + - or: + - string: msxfs.dll # Extension for Financial Services (XFS) + + - api: msxfs.WFSCleanUp + - string: WFSCleanUp + + - api: msxfs.WFSClose + - string: WFSClose + + - api: msxfs.WFSExecute + - string: WFSExecute + + - api: msxfs.WFSFreeResult + - string: WFSFreeResult + + - api: msxfs.WFSGetInfo + - string: WFSGetInfo + + - api: msxfs.WFSLock + - string: WFSLock + + - api: msxfs.WFSOpen + - string: WFSOpen + + - api: msxfs.WFSRegister + - string: WFSRegister + + - api: msxfs.WFSStartUp + - string: WFSStartUp + + - api: msxfs.WFSUnlock + - string: WFSUnlock + +