mirror of
https://github.com/vee1e/capa-rules.git
synced 2026-09-01 10:58:40 +00:00
Identify copying of PE sections, used in reflective-dll-injection. References: - https://0x00sec.org/t/reflective-dll-injection/3080 - https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection |
||
|---|---|---|
| .. | ||
| access-pe-header.yml | ||
| enumerate-pe-sections.yml | ||
| parse-pe-header.yml | ||