mandiant/capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules.git synced 2026-10-12 02:18:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

add rules for volume interaction via IOCTLs (#879)

Browse Source 
* add rules for volume interaction via IOCTLs

* rename interact with driver

* factor out IOCTL handling

* fix 'set-system-properties' for 'install driver'

* fmt
This commit is contained in:
Willi Ballenthin
2024-02-14 14:56:47 +01:00
committed by GitHub
parent 0c32d65705
commit 33feff1e46
11 changed files with 111 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host-interaction/driver/install-driver.yml
+7
View File
@@ -11,9 +11,16 @@ rule:
- Persistence::Create or Modify System Process::Windows Service [T1543.003]
mbc:
- Hardware::Install Driver [C0037]
references:
- https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/set.htm
examples:
- af60700383b75727f5256a0000c1476f:0x1127E
features:
- or:
- api: ntdll.NtLoadDriver
- api: ZwLoadDriver
- and:
- number: 38 = SystemLoadAndCallImage
- or:
- api: NtSetSystemInformation
- api: ZwSetSystemInformation
host-interaction/driver/interact-with-driver-via-control-codes.yml
-22
View File
@@ -1,22 +0,0 @@
rule:
meta:
name: interact with driver via control codes
namespace: host-interaction/driver
authors:
- [email protected]
scopes:
static: function
dynamic: thread
att&ck:
- Execution::System Services::Service Execution [T1569.002]
examples:
- Practical Malware Analysis Lab 10-03.exe_:0x401000
- 9412A66BC81F51A1FA916AC47C77E02AC1A7C9DFF543233ED70AA265EF6A1E76:0x10002DE0
features:
- or:
- api: DeviceIoControl
- api: NtUnloadDriver
- api: ZwUnloadDriver
- and:
- number: 38 = SystemLoadAndCallImage
- api: ZwSetSystemInformation
host-interaction/driver/interact-with-driver-via-ioctl.yml
+14
View File
@@ -0,0 +1,14 @@
rule:
meta:
name: interact with driver via IOCTL
namespace: host-interaction/driver
authors:
- [email protected]
scopes:
static: basic block
dynamic: thread
examples:
- Practical Malware Analysis Lab 10-03.exe_:0x40108c
features:
- or:
- api: DeviceIoControl
host-interaction/driver/unload-driver.yml
+17
View File
@@ -0,0 +1,17 @@
rule:
meta:
name: unload driver
namespace: host-interaction/driver
authors:
- [email protected]
scopes:
static: basic block
dynamic: call
att&ck:
- Persistence::Create or Modify System Process::Windows Service [T1543.003]
examples:
- 31cee4f66cf3b537e3d2d37a71f339f4:0x1400044ce
features:
- or:
- api: NtUnloadDriver
- api: ZwUnloadDriver
host-interaction/hardware/storage/get-disk-size.yml
+2 -2
View File
@@ -26,11 +26,11 @@ rule:
- property/read: System.IO.DriveInfo::AvailableFreeSpace
- basic block:
- and:
- api: DeviceIoControl
- match: interact with driver via IOCTL
- number: 0x7405C = IOCTL_DISK_GET_LENGTH_INFO
- call:
- and:
- api: DeviceIoControl
- match: interact with driver via IOCTL
- number: 0x7405C = IOCTL_DISK_GET_LENGTH_INFO
- and:
- or:
impact/wipe-disk/delete-drive-layout-via-ioctl.yml
+2 -2
View File
@@ -6,7 +6,7 @@ rule:
- [email protected]
scopes:
static: basic block
dynamic: thread
dynamic: call
att&ck:
- Impact::Disk Wipe::Disk Structure Wipe [T1561.002]
mbc:
@@ -20,6 +20,6 @@ rule:
features:
- and:
- or:
- api: DeviceIoControl
- match: interact with driver via IOCTL
- characteristic: indirect call
- number: 0x7c100 = IOCTL_DISK_DELETE_DRIVE_LAYOUT
nursery/get-disk-information-via-ioctl.yml
+25
View File
@@ -0,0 +1,25 @@
rule:
meta:
name: get disk information via IOCTL
namespace: host-interaction/hardware/storage
authors:
- [email protected]
scopes:
static: basic block
dynamic: call
att&ck:
- Discovery::System Information Discovery [T1082]
mbc:
- Discovery::System Information Discovery [E1082]
references:
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/
- http://www.ioctls.net/
features:
- and:
- or:
- match: interact with driver via IOCTL
- characteristic: indirect call
- or:
- number: 0x70050 = IOCTL_DISK_GET_DRIVE_LAYOUT_EX
- number: 0x24050 = IOCTL_DISK_GET_DRIVE_GEOMETRY_EX
- number: 0x2d1080 = IOCTL_STORAGE_GET_DEVICE_NUMBER
nursery/get-storage-device-properties.yml
+3 -1
View File
@@ -12,7 +12,9 @@ rule:
- https://docs.microsoft.com/en-us/windows/win32/api/winioctl/ni-winioctl-ioctl_storage_query_property
features:
- and:
- match: interact with driver via control codes
- or:
- characteristic: indirect call
- match: interact with driver via IOCTL
- number: 0x2D1400 = IOCTL_STORAGE_QUERY_PROPERTY
- optional:
- string: "\\\\.\\PhysicalDrive0"
nursery/get-volume-information-via-ioctl.yml
+21
View File
@@ -0,0 +1,21 @@
rule:
meta:
name: get volume information via IOCTL
namespace: host-interaction/hardware/storage
authors:
- [email protected]
scopes:
static: basic block
dynamic: call
att&ck:
- Discovery::System Information Discovery [T1082]
mbc:
- Discovery::System Information Discovery [E1082]
references:
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/
features:
- and:
- or:
- match: interact with driver via IOCTL
- characteristic: indirect call
- number: 0x90064 = FSCTL_GET_NTFS_VOLUME_DATA
nursery/resize-volume-shadow-copy-storage.yml
+1 -1
View File
@@ -10,5 +10,5 @@ rule:
dynamic: call
features:
- and:
- api: kernel32.DeviceIoControl
- match: interact with driver via IOCTL
- number: 0x53C028 = IOCTL_VOLSNAP_SET_MAX_DIFF_AREA_SIZE
nursery/unmount-volume-via-ioctl.yml
+19
View File
@@ -0,0 +1,19 @@
rule:
meta:
name: unmount volume via IOCTL
namespace: host-interaction/hardware/storage
authors:
- [email protected]
scopes:
static: function
dynamic: call
references:
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/
features:
- and:
- or:
- match: interact with driver via IOCTL
- characteristic: indirect call
- and:
- number: 0x90018 = FSCTL_LOCK_VOLUME
- number: 0x90020 = FSCTL_DISMOUNT_VOLUME