vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix MBC names and IDs

Browse source
This commit is contained in:
Baptistin Boilot 2022-02-06 11:13:23 +01:00
parent b01bd14e59
commit efea9a37d9
No known key found for this signature in database
GPG key ID: 42D12035787C7B55
6 changed files with 6 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml
View file

@ -7,7 +7,7 @@ rule:
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc:
- Anti-Behavioral Analysis::Virtual Machine Detection::Product Key/ID Testing [B0007.005]
- Anti-Behavioral Analysis::Sandbox Detection::Product Key/ID Testing [B0007.005]
references:
- https://github.com/LloydLabs/wsb-detect
examples:

2
anti-analysis/packer/gopacker/packed-with-gopacker.yml
View file

@ -8,7 +8,7 @@ rule:
att&ck:
- Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
mbc:
- Anti-Static Analysis::Software Packing::Standard Compression [OB0002.F0001.002]
- Anti-Static Analysis::Software Packing::Standard Compression [F0001.002]
references:
- https://github.com/nirhaas/gopacker
examples:

2
anti-analysis/reference-analysis-tools-strings.yml
View file

@ -5,7 +5,7 @@ rule:
author: michael.hunhoff@mandiant.com
scope: file
mbc:
- Discovery::Analysis Tool Discovery::Process Detection [B0013.001]
- Discovery::Analysis Tool Discovery::Process detection [B0013.001]
references:
- https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiAnalysis/process.cpp
examples:

2
host-interaction/process/dump/create-process-memory-minidump.yml
View file

@ -6,7 +6,7 @@ rule:
author: michael.hunhoff@mandiant.com
scope: basic block
mbc:
- File System::Write File [C0052]
- File System::Writes File [C0052]
examples:
- 91a12a4cf437589ba70b1687f5acad19:0x43E1C9
features:

2
impact/inhibit-system-recovery/delete-volume-shadow-copies.yml
View file

@ -8,7 +8,7 @@ rule:
- Impact::Inhibit System Recovery [T1490]
- Defense Evasion::Indicator Removal on Host::File Deletion [T1070.004]
mbc:
- Impact::Disk Content Wipe::Delete Shadow Drive [F0014.001]
- Impact::Data Destruction::Delete Shadow Copies [E1485.m04]
examples:
- B87E9DD18A5533A09D3E48A7A1EFBCF6:0x140006AF0
features:

2
load-code/pe/rebuild-import-table.yml
View file

@ -5,7 +5,7 @@ rule:
author: "@Ana06"
scope: function
mbc:
- Defense Evasion::Hijack Execution Flow::Import Address Table (IAT) Hooking [F0005.m03]
- Defense Evasion::Hijack Execution Flow::Import Address Table (IAT) Hooking [F0015.003]
references:
- https://0x00sec.org/t/reflective-dll-injection/3080
- https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection