mirror of
https://github.com/vee1e/capa-rules.git
synced 2026-09-02 03:17:19 +00:00
25 lines
1.1 KiB
YAML
25 lines
1.1 KiB
YAML
rule:
|
|
meta:
|
|
name: execute JScript via VsaEngine in .NET
|
|
namespace: load-code
|
|
authors:
|
|
- jakubjozwiak@google.com
|
|
description: Match on files capable of evaluating JScript code via Visual Studio for Applications engine.
|
|
scopes:
|
|
static: function
|
|
dynamic: span of calls
|
|
att&ck:
|
|
- Execution::Command and Scripting Interpreter::JavaScript [T1059.007]
|
|
references:
|
|
- https://weblog.west-wind.com/posts/2007/Feb/14/Evaluating-JavaScript-code-from-C
|
|
examples:
|
|
- 3f1f67e21469d9084696cc8ce75723405019ac085726ab9d51c97b797110ed1d:0x600000B
|
|
features:
|
|
- and:
|
|
- or:
|
|
- api: Microsoft.JScript.Vsa.VsaEngine::CreateEngine
|
|
- api: Microsoft.JScript.Vsa.VsaEngine::CreateEngineAndGetGlobalScope
|
|
- api: Microsoft.JScript.Vsa.VsaEngine::CreateEngineAndGetGlobalScopeWithType
|
|
- api: Microsoft.JScript.Vsa.VsaEngine::CreateEngineAndGetGlobalScopeWithTypeAndRootNamespace
|
|
- api: Microsoft.JScript.Vsa.VsaEngine::CreateEngineWithType
|
|
- api: Microsoft.JScript.Eval::JScriptEvaluate
|