new/updated rules from recent malware samples (#1063)

host-interaction/process/modify/acquire-debug-privileges.yml

@@ -12,7 +12,11 @@ rule:
     examples:
       - Practical Malware Analysis Lab 01-04.exe_:0x401174
   features:
-    - and:
-      - string: "SeDebugPrivilege"
-      - optional:
-        - match: modify access privileges
+    - or:
+      - and:
+        - string: "SeDebugPrivilege"
+        - optional:
+          - match: modify access privileges
+      - and:
+        - api: RtlAdjustPrivilege
+        - number: 20 = SE_DEBUG_PRIVILEGE

host-interaction/process/terminate/terminate-process.yml

@@ -4,7 +4,7 @@ rule:
     namespace: host-interaction/process/terminate
     authors:
       - [email protected]
-      - michael.hunhoff@mandiant.com
+      - mehunhoff@google.com
       - [email protected]
     scopes:
       static: function
@@ -33,3 +33,4 @@ rule:
           - api: kernel32.TerminateProcess
           - api: ntdll.NtTerminateProcess
           - api: kernel32.ExitProcess
+          - api: ZwTerminateProcess

nursery/acquire-load-driver-privileges.yml

@@ -0,0 +1,15 @@
+rule:
+  meta:
+    name: acquire load driver privileges
+    namespace: host-interaction/process/modify
+    authors:
+      - [email protected]
+    scopes:
+      static: basic block
+      dynamic: call
+    att&ck:
+      - Privilege Escalation::Access Token Manipulation [T1134]
+  features:
+    - and:
+      - api: RtlAdjustPrivilege
+      - number: 10 = SE_LOAD_DRIVER_PRIVILEGE

nursery/communicate-using-ftp.yml

@@ -0,0 +1,24 @@
+rule:
+  meta:
+    name: communicate using FTP
+    namespace: communication/ftp
+    authors:
+      - [email protected]
+    scopes:
+      static: instruction
+      dynamic: call
+    mbc:
+      - Communication::FTP Communication::WinINet [C0004.002]
+  features:
+    - or:
+      - api: FtpGetCurrentDirectory
+      - api: FtpGetFile
+      - api: FtpSetCurrentDirectory
+      - api: FtpOpenFile
+      - api: FtpGetFileSize
+      - api: FtpDeleteFile
+      - api: FtpCreateDirectory
+      - api: FtpRemoveDirectory
+      - api: FtpRenameFile
+      - api: FtpDownload
+      - api: FtpGetDirectory