mandiant/capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules.git synced 2026-10-12 02:18:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

add APIs to "check mutex on windows" and "create or open mutex on windows" to reduce FNs (#1031)

Browse Source
This commit is contained in:
Mike Hunhoff
2025-03-20 09:00:29 -06:00
committed by GitHub
parent 48a553e1ca
commit 9acd31998f
2 changed files with 15 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host-interaction/mutex/check-mutex-on-windows.yml
+13 -11
View File
@@ -13,14 +13,16 @@ rule:
examples:
- 1d8fd13c890060464019c0f07b928b1a:0x402eb0
features:
- and:
- match: create or open mutex on Windows
- or:
- api: WaitForSingleObject
- basic block:
- and:
- api: GetLastError
- or:
- number: 2 = ERROR_FILE_NOT_FOUND
- number: 0xB7 = ERROR_ALREADY_EXISTS
- number: 5 = ERROR_ACCESS_DENIED
- or:
- api: ntdll.NtQueryMutant
- and:
- match: create or open mutex on Windows
- or:
- api: WaitForSingleObject
- basic block:
- and:
- api: GetLastError
- or:
- number: 2 = ERROR_FILE_NOT_FOUND
- number: 0xB7 = ERROR_ALREADY_EXISTS
- number: 5 = ERROR_ACCESS_DENIED
host-interaction/mutex/create-or-open-mutex-on-windows.yml
+2
View File
@@ -18,6 +18,8 @@ rule:
- api: kernel32.OpenMutex
- api: kernel32.CreateMutex
- api: kernel32.CreateMutexEx
- api: ntdll.NtCreateMutant
- api: ntdll.NtOpenMutant
- and:
- format: dotnet
- or: