mirror of
https://github.com/mandiant/capa-rules.git
synced 2026-10-12 02:18:39 +00:00
Still / Azaka
67f626eecb
* Initial support for nLoadImage Signed-off-by: Still Hsu <[email protected]> * Merge 'invoke .NET assembly method' rule match into condition Signed-off-by: Still Hsu <[email protected]> * Update dynamic scope per requested changes https://github.com/mandiant/capa-rules/pull/1172#discussion_r3647155878 Signed-off-by: Still Hsu <[email protected]> --------- Signed-off-by: Still Hsu <[email protected]>
31 lines
1005 B
YAML
31 lines
1005 B
YAML
rule:
|
|
meta:
|
|
name: invoke .NET assembly method
|
|
namespace: load-code/dotnet
|
|
authors:
|
|
- [email protected]
|
|
- [email protected]
|
|
scopes:
|
|
static: function
|
|
dynamic: span of calls
|
|
att&ck:
|
|
- Defense Evasion::Reflective Code Loading [T1620]
|
|
features:
|
|
- and:
|
|
- format: dotnet
|
|
- optional:
|
|
- api: System.Reflection.Module::GetMethod
|
|
- api: System.Reflection.Module::GetMethodImpl
|
|
- api: System.Reflection.Module::GetMethods
|
|
- api: System.Reflection.Module::ResolveMethod
|
|
- api: System.Type::GetMethod
|
|
- api: System.Type::GetMethodImpl
|
|
- api: System.Type::GetMethods
|
|
- or:
|
|
- api: System.Delegate::DynamicInvoke
|
|
- api: System.Delegate::DynamicInvokeImpl
|
|
- api: System.Type::InvokeMember
|
|
- api: System.Reflection.MethodInfo::Invoke
|
|
- api: System.Reflection.MethodBase::Invoke
|
|
- api: System.Reflection.ConstructorInfo::Invoke
|