mirror of
https://github.com/mandiant/capa-rules.git
synced 2026-10-12 02:18:39 +00:00
@@ -2,13 +2,14 @@ rule:
|
||||
meta:
|
||||
name: resolve DNS
|
||||
namespace: host-interaction/network/dns/resolve
|
||||
author: [email protected]
|
||||
author:
|
||||
- [email protected]
|
||||
- johnk3r
|
||||
scope: function
|
||||
mbc:
|
||||
- Communication::DNS Communication::Resolve [C0011.001]
|
||||
examples:
|
||||
- 82986A4302421ABA1DB9DB34A8BC2BA1:0x401530 # winternals networking lab
|
||||
- Practical Malware Analysis Lab 01-01.dll_:0x10001010
|
||||
- 17264e3126a97c319a6a0c61e6da951e:0x5FDC25D0
|
||||
features:
|
||||
- or:
|
||||
- api: ws2_32.gethostbyname
|
||||
|
||||
Reference in New Issue
Block a user