mirror of
https://github.com/vee1e/capa-rules.git
synced 2026-09-01 10:58:40 +00:00
af09ec07d0
* detect usage of TripleDESCryptoServiceProvider * detect usage of TripleDes via dotnet api * detect usage of TripleDesCryptoServiceProvider * removed duplicate file * seperate encrypt and decrypt methods * changed file names to match desc * lint fix * lint fix * small fixes
19 lines
706 B
YAML
19 lines
706 B
YAML
rule:
|
|
meta:
|
|
name: decrypt data using TripleDES in .NET
|
|
namespace: data-manipulation/encryption/des
|
|
authors:
|
|
- "0xRavenspar"
|
|
scopes:
|
|
static: instruction
|
|
dynamic: call
|
|
att&ck:
|
|
- Defense Evasion::Deobfuscate/Decode Files or Information [T1140]
|
|
mbc:
|
|
- Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]
|
|
- Cryptography::Decrypt Data::3DES [C0031.005]
|
|
references:
|
|
- https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.tripledescryptoserviceprovider.createdecryptor
|
|
features:
|
|
- or:
|
|
- api: System.Security.Cryptography.TripleDESCryptoServiceProvider::CreateDecryptor
|