Skip to content

Commit

Permalink
Merge pull request #908 from mandiant/fix/dependency-scopes
Browse files Browse the repository at this point in the history
fix the scope of some rules with dependencies
  • Loading branch information
mr-tz authored Jun 14, 2024
2 parents ea14b38 + 0c7d1bd commit e63c454
Show file tree
Hide file tree
Showing 3 changed files with 8 additions and 15 deletions.
2 changes: 1 addition & 1 deletion collection/keylog/log-keystrokes-via-application-hook.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ rule:
authors:
- [email protected]
scopes:
static: function
static: basic block
dynamic: call
att&ck:
- Collection::Input Capture::Keylogging [T1056.001]
Expand Down
11 changes: 5 additions & 6 deletions host-interaction/gui/set-application-hook.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,11 @@ rule:
authors:
- [email protected]
scopes:
static: function
dynamic: thread
static: instruction
dynamic: call
examples:
- Practical Malware Analysis Lab 12-03.exe_:0x401000
features:
- and:
- or:
- api: user32.SetWindowsHookEx
- api: user32.UnhookWindowsHookEx
- or:
- api: user32.SetWindowsHookEx
- api: user32.UnhookWindowsHookEx
10 changes: 2 additions & 8 deletions linking/runtime-linking/link-function-at-runtime-on-windows.yml
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,8 @@ rule:
- [email protected]
- [email protected]
scopes:
static: function
dynamic: unsupported # requires characteristic features
static: instruction
dynamic: call
att&ck:
- Execution::Shared Modules [T1129]
examples:
Expand All @@ -19,9 +19,3 @@ rule:
- or:
- api: kernel32.GetProcAddress
- api: ntdll.LdrGetProcedureAddress
- optional:
- characteristic: indirect call
- api: kernel32.LoadLibrary
- api: kernel32.GetModuleHandle
- api: kernel32.GetModuleHandleEx
- api: ntdll.LdrLoadDll

0 comments on commit e63c454

Please sign in to comment.