mirror of
https://github.com/mandiant/capa-rules.git
synced 2026-10-12 02:18:39 +00:00
Still / AzakaandMoritz
1fd0d8e141
* Add SysWhisper2 detection & add int 2e to syscall detection --------- Signed-off-by: Still Hsu <[email protected]> Co-authored-by: Moritz <[email protected]>
35 lines
938 B
YAML
35 lines
938 B
YAML
rule:
|
|
meta:
|
|
name: execute syscall
|
|
namespace: anti-analysis
|
|
authors:
|
|
- "@kulinacs"
|
|
- "@mr-tz"
|
|
- [email protected]
|
|
- [email protected]
|
|
description: may be used to evade hooks or hinder analysis
|
|
scopes:
|
|
static: basic block
|
|
dynamic: unsupported # requires mnemonic features
|
|
references:
|
|
- https://github.com/j00ru/windows-syscalls
|
|
- https://codemachine.com/articles/system_call_instructions.html
|
|
- https://www.felixcloutier.com/x86/sysenter
|
|
features:
|
|
- or:
|
|
- and:
|
|
- or:
|
|
- os: linux
|
|
- os: android
|
|
- api: syscall # https://man7.org/linux/man-pages/man2/syscall.2.html
|
|
- and:
|
|
- or:
|
|
- mnemonic: sysenter
|
|
- mnemonic: syscall
|
|
- instruction:
|
|
- mnemonic: int
|
|
- operand[0].number: 0x2e
|
|
- or:
|
|
- mnemonic: ret
|
|
- mnemonic: retn
|