mirror of
https://github.com/mandiant/capa-rules.git
synced 2026-10-12 02:18:39 +00:00
Ana María Martínez Gómez
70851020c5
* Add use-bigint-function Add new `data-manipulation/encryption/use-bigint-function.yml` rule to identify bigint functions as these functions may help reverse engineers identifying crypto. Example of bigint functions identified by this rule: - `bi_copi` - `bi_permanent` - `bi_depermant` - `bi_free` Reference: - https://github.com/ezhangle/krypton/blob/147d69429bfb03cce7113dca6dba36e77f8a9325/src/bigint.c - https://github.com/bnoordhuis/mongrel2/blob/3e9b57d82aeb627be0aebfb346199bfdfd67e530/src/crypto/bigint.c * Add rsa-encrypt Add new rule `data-manipulation/encryption/rsa/rsa-encrypt.yml` that identifies the RSA encryption implementation from: - https://github.com/ezhangle/krypton/blob/147d69429bfb03cce7113dca6dba36e77f8a9325/src/rsa.c#L232 - https://github.com/bnoordhuis/mongrel2/blob/3e9b57d82aeb627be0aebfb346199bfdfd67e530/src/crypto/rsa.c#L233 Rename current RSA encryption/decryption rules in the nursery to add `via WinAPI` to prevent name conflict.
19 lines
585 B
YAML
19 lines
585 B
YAML
rule:
|
|
meta:
|
|
name: decrypt data using RSA via WinAPI
|
|
namespace: data-manipulation/encryption/rsa
|
|
authors:
|
|
- [email protected]
|
|
scopes:
|
|
static: function
|
|
dynamic: call
|
|
att&ck:
|
|
- Defense Evasion::Deobfuscate/Decode Files or Information [T1140]
|
|
mbc:
|
|
- Cryptography::Decrypt Data::RSA [C0031.010]
|
|
references:
|
|
- https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.rsacryptoserviceprovider.decrypt
|
|
features:
|
|
- or:
|
|
- api: System.Security.Cryptography.RSACryptoServiceProvider::Decrypt
|