add first set of exploit detection rules (#1046)

* add ntoskrnl.exe loading rule

* fix name

* add explicit os

* add suspicious ntquerysysteinformation detections

* ntfscontrolfile wip

* fix ntfscontrolfile rule

* rename ntquerysysinfo rule

* add ntoskrnl gadgets rule

* make descs more generic

* refactor rules to exploitation namespace

* add caveat to ntfscontrolfile rule

* tweak rule names

* tweak ntfscontrolfile name

exploitation/enumeration/make-suspicious-ntquerysysteminformation-call.yml

@@ -0,0 +1,23 @@
+rule:
+  meta:
+    name: make suspicious NtQuerySystemInformation call
+    namespace: exploitation/enumeration
+    authors:
+      - [email protected]
+    description: look for suspicious NtQuerySystemInformation calls used to enumerate kernel information in LPEs
+    scopes:
+      static: basic block
+      dynamic: call
+    references:
+      - https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/query.htm?tx=61
+    examples:
+      - cb0ce85efef94a4f7eacb4571ebf71b12ebbf9fb9faba96e853552822668aa22.exe_:0x140001260
+  features:
+    - and:
+      - os: windows
+      - api: NtQuerySystemInformation
+      - or:
+        - number: 0xb = SystemModuleInformation
+        - number: 0x10 = SystemHandleInformation
+        - number: 0x40 = SystemExtendedHandleInformation
+        - number: 0x42 = SystemBigPoolInformation

exploitation/gadgets/load-ntoskrnl.yml

@@ -0,0 +1,19 @@
+rule:
+  meta:
+    name: load ntoskrnl
+    namespace: exploitation/gadgets
+    authors:
+      - [email protected]
+    description: look for calls to LoadLibrary* for ntoskrnl.exe, which can be indicative of kernel gadgets being resolved in user-mode for LPEs
+    scopes:
+      static: basic block
+      dynamic: call
+    examples:
+      - cb0ce85efef94a4f7eacb4571ebf71b12ebbf9fb9faba96e853552822668aa22.exe_:0x1400013E0
+  features:
+    - and:
+      - os: windows
+      - string: "ntoskrnl.exe"
+      - or:
+        - api: LoadLibrary
+        - api: LoadLibraryEx

exploitation/gadgets/resolve-ntoskrnl-gadgets.yml

@@ -0,0 +1,27 @@
+rule:
+  meta:
+    name: resolve ntoskrnl gadgets
+    namespace: exploitation/gadgets
+    authors:
+      - [email protected]
+    description: look for suspicious GetProcAddress calls used to resolve addresses of functions often used for gadgets in LPEs
+    scopes:
+      static: basic block
+      dynamic: call
+    examples:
+      - b87b8637121d5e213ca02b45cbaca496bdf1fcc4bfddce48eea6e41637ffedd4.exe_:0x1400021B1
+  features:
+    - and:
+      - os: windows
+      - api: GetProcAddress
+      - or:
+        - string: "RtlSetAllBits"
+        - string: "RtlClearAllBits"
+        - string: "RtlClearBit"
+        - string: "RtlCopyLuid"
+        - string: "PsInitialSystemProcess"
+        - string: "PsReferencePrimaryToken"
+        - string: "SeQueryInformationToken"
+        - string: "SeSetAccessStateGenericMapping"
+        - string: "PoFxProcessorNotification"
+        - string: "HalDispatchTable"

exploitation/spraying/make-suspicious-ntfscontrolfile-call.yml

@@ -0,0 +1,32 @@
+rule:
+  meta:
+    name: make suspicious NtFsControlFile call
+    namespace: exploitation/spraying
+    authors:
+      - [email protected]
+    description: look for suspicious possible NtFsControlFile calls that may be used for spraying objects into kernel heap pools
+    scopes:
+      static: basic block
+      dynamic: unsupported  # requires characteristics, mnemonic features
+    references:
+      - https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntfscontrolfile
+      - https://www.sstic.org/media/SSTIC2020/SSTIC-actes/pool_overflow_exploitation_since_windows_10_19h1/SSTIC2020-Article-pool_overflow_exploitation_since_windows_10_19h1-bayet_fariello.pdf
+      - https://github.com/vp777/Windows-Non-Paged-Pool-Overflow-Exploitation
+      - https://gist.github.com/daaximus/e813aa52980fc2a97a8a8a1082338de4
+    examples:
+      - 7d333c9b11b06ef0982b61bfc062631bb6cf9d12d0d4f2cf1b807a25ddf62fbc.exe_:0x140001B99
+      - 86a8f267cf0f51c032f7b1777eb1e51f7cd1badf3f3894e2557a3f571fca9f3d.exe_:0x1400BE30B
+  features:
+    - and:
+      - os: windows
+      - or:
+        - number: 0x11003c = FSCTL_PIPE_SET_HANDLE_ATTRIBUTE
+        - number: 0x110038 = FSCTL_PIPE_GET_HANDLE_ATTRIBUTE
+        - number: 0x119ff8 = FSCTL_PIPE_INTERNAL_WRITE
+      # TODO(zdw): replace this with count(number(0)): 3 once https://github.com/mandiant/capa/pull/2639 lands
+      - instruction:
+        - mnemonic: xor
+      - instruction:
+        - mnemonic: call
+      - not:
+        - characteristic: nzxor