import existing rules, forgetting about 938 prior commits

load-code/load-driver/interact-driver.yml

@@ -0,0 +1,17 @@
+rule:
+  meta:
+    name: interact driver
+    author: moritz.raabe@fireeye.com
+    rule-category: load-code/load-driver/interact-driver
+    scope: function
+    examples:
+      - Practical Malware Analysis Lab 10-03.exe_:0x401000
+      - 9412A66BC81F51A1FA916AC47C77E02AC1A7C9DFF543233ED70AA265EF6A1E76:0x10002DE0
+  features:
+    - or:
+      - api: DeviceIoControl
+      - api: NtUnloadDriver
+      - api: ZwUnloadDriver
+      - and:
+        - number: 38 = SystemLoadAndCallImage
+        - api: ZwSetSystemInformation

load-code/load-driver/load-driver.yml

@@ -0,0 +1,17 @@
+rule:
+  meta:
+    name: load driver
+    rule-category: load-code/load-driver/load-driver
+    author: moritz.raabe@fireeye.com
+    scope: function
+    examples:
+      - af60700383b75727f5256a0000c1476f:0x1127E
+  features:
+    - or:
+      - and:
+        - or:
+          - number: 1 = SERVICE_KERNEL_DRIVER
+          - number: 2 = SERVICE_FILE_SYSTEM_DRIVER
+        - api: CreateService
+      - api: ntdll.NtLoadDriver
+      - api: ZwLoadDriver

load-code/load-pe/access-pe-header.yml

@@ -0,0 +1,12 @@
+rule:
+  meta:
+    name: access PE header
+    rule-category: load-code/load-module/access-pe-header
+    author: moritz.raabe@fireeye.com
+    scope: function
+    examples:
+      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x1400018E0
+  features:
+    - or:
+      - api: ntdll.RtlImageNtHeader
+      - api: ntdll.RtlImageNtHeaderEx

load-code/load-pe/manually-parse-pe-file.yml

@@ -0,0 +1,32 @@
+rule:
+  meta:
+    name: manually parse PE file
+    rule-category: load-code/load-module/parse-pe
+    author: moritz.raabe@fireeye.com
+    scope: function
+    examples:
+      - 9324D1A8AE37A36AE560C37448C9705A:0x403DD0
+  features:
+    # TODO filter out false positives
+    - or:
+      - and:
+        - mnemonic: cmp
+        - or:
+          - number: 0x4550 = IMAGE_DOS_SIGNATURE (MZ)
+          - and:
+            - number: 0x50
+            - number: 0x45
+        - or:
+          - number: 0x5A4D = IMAGE_NT_SIGNATURE (PE)
+          - and:
+            - number: 0x4D
+            - number: 0x5A
+      - and:
+        # - offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew
+        - or:
+          - and:  # 32-bit
+            - offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage
+            - offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
+          - and:  # 64-bit
+            - offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage
+            - offset: 0x30 = IMAGE_NT_HEADERS64.OptionalHeader.ImageBase

load-code/runtime-linking/PEB-LDR_DATA-access.yml

@@ -0,0 +1,75 @@
+rule:
+  meta:
+    name: PEB ldr_data access
+    rule-category: load-code/runtime-linking/invoke-manual-loader
+    author: moritz.raabe@fireeye.com
+    scope: function
+    examples:
+      - 3FDFB2D522E7DEECAAAF2F87420F7E75:0x4117B7
+  features:
+    - or:
+      # x32
+      - and:
+        # resolve the PEB
+        - or:
+          - characteristic(peb access): true
+          # in the case of CallObfuscator, gs:[rax]
+          # ref: https://github.com/d35ha/CallObfuscator/blob/5834aff9ff4511f1408ae4ce80b79737af4ae77b/ShellCode/shell_x64.asm#L8
+          - and:
+            - number: 0x30  # x32
+            - characteristic(fs access): true
+          # in 0f5d5d07c6533bc6d991836ce79daaa1
+          # then we have:
+          #
+          #     xor edx, edx
+          #     mov edx, fs:[edx+30h]
+          - and:
+            - offset: 0x30  # x32
+            - characteristic(fs access): true
+
+        # LDR_DATA* Ldr;
+        # good PEB layout reference here:
+        # https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm
+        - offset: 0x0C  # x32
+
+        # resolve a module list
+        - or:
+          # LIST_ENTRY    InLoadOrderModuleList;
+          - offset: 0x0C  # x32
+          # LIST_ENTRY    InMemoryOrderModuleList;
+          - offset: 0x14  # x32
+          # LIST_ENTRY    InInitializationOrderModuleList;
+          - offset: 0x1C  # x32
+
+      # x64
+      - and:
+        # resolve the PEB
+        - or:
+          - characteristic(peb access): true
+          # in the case of CallObfuscator, gs:[rax]
+          # ref: https://github.com/d35ha/CallObfuscator/blob/5834aff9ff4511f1408ae4ce80b79737af4ae77b/ShellCode/shell_x64.asm#L8
+          - and:
+            - number: 0x60  # x64
+            - characteristic(gs access): true
+          # in 0f5d5d07c6533bc6d991836ce79daaa1
+          # then we have:
+          #
+          #     xor edx, edx
+          #     mov edx, fs:[edx+30h]
+          - and:
+            - offset: 0x60  # x64
+            - characteristic(gs access): true
+
+        # LDR_DATA* Ldr;
+        # good PEB layout reference here:
+        # https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm
+        - offset: 0x18  # x64
+
+        # resolve a module list
+        - or:
+          # LIST_ENTRY    InLoadOrderModuleList;
+          - offset: 0x10  # x64
+          # LIST_ENTRY    InMemoryOrderModuleList;
+          - offset: 0x20  # x64
+          # LIST_ENTRY    InInitializationOrderModuleList;
+          - offset: 0x30  # x64

load-code/runtime-linking/runtime-linking.yml

@@ -0,0 +1,21 @@
+rule:
+  meta:
+    name: link function at runtime
+    rule-category: load-code/runtime-linking/invoke-dynamic-loader
+    author: moritz.raabe@fireeye.com
+    scope: function
+    examples:
+      - 9324D1A8AE37A36AE560C37448C9705A:0x404130
+      - Practical Malware Analysis Lab 01-04.exe_:0x401350
+  features:
+    - and:
+      - or:
+        - api: kernel32.LoadLibrary
+        - api: kernel32.GetModuleHandle
+        - api: kernel32.GetModuleHandleEx
+        - api: ntdll.LdrLoadDll
+      - or:
+        - api: kernel32.GetProcAddress
+        - api: ntdll.LdrGetProcedureAddress
+      - optional:
+        - characteristic(indirect call): True