Skip to content

Commit

Permalink
Add capa rules create-thread-bypass-freeze.yml and check-thread-suspe…
Browse files Browse the repository at this point in the history
…nd-count-exceeded.yml to nursery. (#912)

* Add rules

---------

Co-authored-by: Willi Ballenthin <[email protected]>
  • Loading branch information
ejfocampo and williballenthin authored Sep 16, 2024
1 parent 123d6f7 commit 534ee22
Show file tree
Hide file tree
Showing 2 changed files with 50 additions and 0 deletions.
27 changes: 27 additions & 0 deletions nursery/check-thread-suspend-count-exceeded.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
rule:
meta:
name: check thread suspend count exceeded
authors:
- [email protected]
scopes:
static: file
dynamic: unsupported #requires mnemonic feature
att&ck:
- Defense Evasion::Debugger Evasion [T1622]
mbc:
- Anti-Behavioral Analysis::Debugger Detection [B0001]
references:
- https://secret.club/2021/01/04/thread-stuff.html
- https://research.checkpoint.com/2023/raspberry-robin-anti-evasion-how-to-exploit-analysis/
features:
- and:
- match: create thread bypassing process freeze
- function:
- and:
- or:
- api: ntdll.NtSuspendThread
- string: "NtSuspendThread"
- basic block:
- and:
- number: 0xc000004a = STATUS_SUSPEND_COUNT_EXCEEDED
- mnemonic: cmp
23 changes: 23 additions & 0 deletions nursery/create-thread-bypassing-process-freeze.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
rule:
meta:
name: create thread bypassing process freeze
authors:
- [email protected]
scopes:
static: basic block
dynamic: call
att&ck:
- Defense Evasion::Debugger Evasion [T1622]
mbc:
- Anti-Behavioral Analysis::Debugger Evasion [B0002]
references:
- https://secret.club/2021/01/04/thread-stuff.html
- https://research.checkpoint.com/2023/raspberry-robin-anti-evasion-how-to-exploit-analysis/
- https://www.pinvoke.dev/ntdll/ntcreatethreadex
- https://github.com/winsiderss/systeminformer/blob/master/phnt/include/ntpsapi.h
features:
- and:
- or:
- api: ntdll.NtCreateThreadEx
- string: "NtCreateThreadEx"
- number: 0x40 = Undocumented thread creation flag dubbed as THREAD_CREATE_FLAGS_BYPASS_PROCESS_FREEZE

0 comments on commit 534ee22

Please sign in to comment.