mirror of
https://github.com/mandiant/capa-rules.git
synced 2026-10-12 02:18:39 +00:00
zdw@
e6df480758
* add ntoskrnl.exe loading rule * fix name * add explicit os * add suspicious ntquerysysteinformation detections * ntfscontrolfile wip * fix ntfscontrolfile rule * rename ntquerysysinfo rule * add ntoskrnl gadgets rule * make descs more generic * refactor rules to exploitation namespace * add caveat to ntfscontrolfile rule * tweak rule names * tweak ntfscontrolfile name
20 lines
559 B
YAML
20 lines
559 B
YAML
rule:
|
|
meta:
|
|
name: load ntoskrnl
|
|
namespace: exploitation/gadgets
|
|
authors:
|
|
- [email protected]
|
|
description: look for calls to LoadLibrary* for ntoskrnl.exe, which can be indicative of kernel gadgets being resolved in user-mode for LPEs
|
|
scopes:
|
|
static: basic block
|
|
dynamic: call
|
|
examples:
|
|
- cb0ce85efef94a4f7eacb4571ebf71b12ebbf9fb9faba96e853552822668aa22.exe_:0x1400013E0
|
|
features:
|
|
- and:
|
|
- os: windows
|
|
- string: "ntoskrnl.exe"
|
|
- or:
|
|
- api: LoadLibrary
|
|
- api: LoadLibraryEx
|