vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 10:58:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Adding execute-shellcode-via-windows-fibers.yml

Browse source
This commit is contained in:
jtothej 2021-12-04 19:51:35 +08:00
parent b1cefa437e
commit ee2bf8a2cd
1 changed files with 17 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

17
load-code/shellcode/execute-shellcode-via-windows-fibers.yml Normal file
View file

@ -0,0 +1,17 @@
rule:
meta:
name: execute shellcode via Windows fibers
namespace: load-code/shellcode
author: jakub.jozwiak@mandiant.com
scope: function
references:
- https://www.ired.team/offensive-security/code-injection-process-injection/executing-shellcode-with-createfiber
- https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/FiberContextEdit/Source.cpp
examples:
- f03bdb9fa52f7b61ef03141fefff1498ad2612740b1fdbf6941f1c5af5eee70a:0x4026E0
features:
- and:
- match: allocate RWX memory
- api: ConvertThreadToFiber
- api: CreateFiber
- api: SwitchToFiber