Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add new rule for forwarded exports and update doc to with new charact… #801

Merged
merged 4 commits into from
Jul 19, 2023
Merged

Add new rule for forwarded exports and update doc to with new charact… #801

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a8d0030
Add new rule for forwarded exports and update doc to with new charact…
RonnieSalomonsen Jul 19, 2023
65ab87b
Update executable/pe/export/forwarded-export.yml
RonnieSalomonsen Jul 19, 2023
658b16f
Update doc/format.md
RonnieSalomonsen Jul 19, 2023
8b5e321
Update doc/format.md
RonnieSalomonsen Jul 19, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions doc/format.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -314,7 +314,8 @@ For example, the `characteristic: nzxor` feature describes non-zeroing XOR instr
| characteristic | scope | description |
|--------------------------------------|------------------------------------|-------------|
| `characteristic: embedded pe` | file | (XOR encoded) embedded PE files. |
| `characteristic: mixed mode` | file | File contains both managed and unmanaged (native) code, often seen in .NET |
| `characteristic: forwarded export` | file | PE file has a forwarded export. |
| `characteristic: mixed mode` | file | File contains both managed and unmanaged (native) code, often seen in .NET |
| `characteristic: loop` | function | Function contains a loop. |
| `characteristic: recursive call` | function | Function is recursive. |
| `characteristic: calls from` | function | There are unique calls from this function. Best used like: `count(characteristic(calls from)): 3 or more` |
Expand All @@ -328,7 +329,7 @@ For example, the `characteristic: nzxor` feature describes non-zeroing XOR instr
| `characteristic: cross section flow` | instruction, basic block, function | Function contains a call/jump to a different section. This is commonly seen in unpacking stubs. |
| `characteristic: indirect call` | instruction, basic block, function | Indirect call instruction; for example, `call edx` or `call qword ptr [rsp+78h]`. |
| `characteristic: call $+5` | instruction, basic block, function | Call just past the current instruction. |
| `characteristic: unmanaged call` | instruction, basic block, function | Function contains a call from managed code to unmanaged (native) code, often seen in .NET |
| `characteristic: unmanaged call` | instruction, basic block, function | Function contains a call from managed code to unmanaged (native) code, often seen in .NET |
RonnieSalomonsen marked this conversation as resolved.
Show resolved Hide resolved

## instruction features

Expand Down Expand Up @@ -604,6 +605,11 @@ Examples:

export: InstallA

To specify a [forwarded export](https://devblogs.microsoft.com/oldnewthing/20060719-24/?p=30473) use the format `<DLL path, lowercase>.<symbol name>`. Note that the path can be either implicit, relative, or absolute:

export: "c:/windows/system32/version.GetFileVersionInfoA"
export: "vresion.GetFileVersionInfoA"

### import

The name of a routine imported from a shared library.
Expand Down
13 changes: 13 additions & 0 deletions executable/pe/export/forwarded-export.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
rule:
meta:
name: forwarded export
namespace: executable/pe/export
authors:
- [email protected]
scope: file
att&ck:
- Execution::Shared Modules [T1129]
examples:
- 76FA734236DAA023444DEC26863401DC
features:
- characteristic: forwarded export
Loading