Update encrypt-data-using-dpapi.yml rule

mandiant · May 17, 2024 · 8ea0993 · 8ea0993
1 parent 7128cdb
commit 8ea0993
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/data-manipulation/encryption/dpapi/encrypt-data-using-dpapi.yml b/data-manipulation/encryption/dpapi/encrypt-data-using-dpapi.yml
@@ -22,3 +22,10 @@ rule:
       - api: crypt32.CryptUnprotectData
       - api: System.Security.Cryptography.ProtectedData::Unprotect
       - api: System.Security.Cryptography.ProtectedData::Protect
+      - api: SystemFunction040
+      - api: SystemFunction041
+      - and:
+        - match: link function at runtime on Windows
+        - or:
+          - string: "SystemFunction040"
+          - string: "SystemFunction041"