Add comments in encrypt-data-using-dpapi.yml

mandiant · May 17, 2024 · eecaabe · eecaabe
1 parent 8ea0993
commit eecaabe
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/data-manipulation/encryption/dpapi/encrypt-data-using-dpapi.yml b/data-manipulation/encryption/dpapi/encrypt-data-using-dpapi.yml
@@ -27,5 +27,9 @@ rule:
       - and:
         - match: link function at runtime on Windows
         - or:
+          # RtlEncryptMemory is available as SystemFunction040 export in Advapi32.dll
+          # CryptProtectMemory is a wrapper function for SystemFunction040
           - string: "SystemFunction040"
+          # RtlDecryptMemory is available as SystemFunction041 export in Advapi32.dll
+          # CryptUnprotectMemory is a wrapper function for SystemFunction041
           - string: "SystemFunction041"