Update get-os-version.yml

mandiant · Jul 22, 2023 · dfdd5d8 · dfdd5d8
1 parent a49c174
commit dfdd5d8
Showing 1 changed file with 15 additions and 0 deletions.
diff --git a/lib/get-os-version.yml b/lib/get-os-version.yml
@@ -18,3 +18,18 @@ rule:
       - api: VerSetConditionMask
       - api: RtlGetNtVersionNumbers
       - api: GetProductInfo
+      - and:
+        - match: PEB access
+        - or:
+          - and:
+            - arch: i386
+            - or:
+              - offset: 0xA4 = PEB->OSMajorVersion
+              - offset: 0xA8 = PEB->OSMinorVersion
+              - offset: 0xAC = PEB->OSBuildNumber
+          - and:
+            - arch: amd64
+            - or:
+              - offset: 0x118 = PEB->OSMajorVersion
+              - offset: 0x11C = PEB->OSMinorVersion
+              - offset: 0x120 = PEB->OSBuildNumber