-
Notifications
You must be signed in to change notification settings - Fork 160
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add rule unhook-a-dll.yml #921
Conversation
@@ -0,0 +1,26 @@ | |||
rule: | |||
meta: | |||
name: unhook a DLL |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
the reference talks about overwriting ntdll's .text section to remove hooks, should we adjust the rule name and logic to that specific usage?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I initially created the rule specifically for NTDLL but then decided to make it more generic. Most likely NTDLL will be the unhooking target in most samples anyway but I wanted to match also on less common DLLs. If you think the rule is too broad I'll change it to its initial form.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
hm, I think it shouldn't result in many FPs and if so, we can fine tune it
for when we do come back to it later, can you please add this comment to the rule?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
and how about renaming to better reflect what's captured here, e.g. overwrite DLL .text section to remove hooks
or similar?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for suggestions! Updated the rule in 3a03215
- 282c32269a9893c5741ca682268369421c43ac21d73b1f6c23386d61c93bf3e9:0x1400014A4 | ||
features: | ||
- and: | ||
- api: GetModuleHandle |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
add GetModuleHandleEx
?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Added in 3a03215
@@ -0,0 +1,26 @@ | |||
rule: | |||
meta: | |||
name: unhook a DLL |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
hm, I think it shouldn't result in many FPs and if so, we can fine tune it
for when we do come back to it later, can you please add this comment to the rule?
@@ -0,0 +1,26 @@ | |||
rule: | |||
meta: | |||
name: unhook a DLL |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
and how about renaming to better reflect what's captured here, e.g. overwrite DLL .text section to remove hooks
or similar?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
great, thank you very much!
Add rule unhook-a-dll.yml