Merge pull request #805 from jtothej/getosver

Update get-os-version.yml - Get OS version via PEB
mandiant · Aug 7, 2023 · 3e7e50c · 3e7e50c
2 parents 322d5f0 + dfdd5d8
commit 3e7e50c
Showing 1 changed file with 15 additions and 0 deletions.
diff --git a/lib/get-os-version.yml b/lib/get-os-version.yml
@@ -18,3 +18,18 @@ rule:
       - api: VerSetConditionMask
       - api: RtlGetNtVersionNumbers
       - api: GetProductInfo
+      - and:
+        - match: PEB access
+        - or:
+          - and:
+            - arch: i386
+            - or:
+              - offset: 0xA4 = PEB->OSMajorVersion
+              - offset: 0xA8 = PEB->OSMinorVersion
+              - offset: 0xAC = PEB->OSBuildNumber
+          - and:
+            - arch: amd64
+            - or:
+              - offset: 0x118 = PEB->OSMajorVersion
+              - offset: 0x11C = PEB->OSMinorVersion
+              - offset: 0x120 = PEB->OSBuildNumber