vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-03 11:57:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

add mbc and att&ck tags

Browse source
This commit is contained in:
Desiree Beck 2021-12-14 16:16:07 -05:00
parent ab7d4c4f66
commit ed3661b379
9 changed files with 19 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
load-code/shellcode/execute-shellcode-via-enumuilanguages.yml
View file

@ -4,6 +4,8 @@ rule:
namespace: load-code/shellcode
author: jakub.jozwiak@mandiant.com
scope: function
mbc:
- Defense Evasion::Hijack Execution Flow::Abuse Windows Function Calls [F0015.006]
references:
- http://ropgadget.com/posts/abusing_win_functions.html
- https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/EnumUILanguagesW/EnumUILanguagesW.cpp