mandiant/capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules.git synced 2026-10-12 02:18:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

add more APIs to "link function at runtime on Windows" to remove FNs (#1029)

Browse Source
This commit is contained in:
Mike Hunhoff
2025-03-19 11:29:07 -06:00
committed by GitHub
parent e85887a875
commit 48a553e1ca
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
linking/runtime-linking/link-function-at-runtime-on-windows.yml
+4 -1
View File
@@ -4,7 +4,7 @@ rule:
namespace: linking/runtime-linking
authors:
- [email protected]
- michael.hunhoff@mandiant.com
- mehunhoff@google.com
scopes:
static: instruction
dynamic: call
@@ -19,3 +19,6 @@ rule:
- or:
- api: kernel32.GetProcAddress
- api: ntdll.LdrGetProcedureAddress
- api: ntdll.LdrGetProcedureAddressEx
- api: ntdll.LdrGetProcedureAddressForCaller
- api: MmGetSystemRoutineAddress