mandiant / capa-rules

Standard collection of rules for capa: the tool for enumerating the capabilities of programs
https://github.com/mandiant/capa/
Apache License 2.0
531 stars 160 forks source link

convert rules to use new COM features #853

Closed williballenthin closed 10 months ago

williballenthin commented 11 months ago

eg.

host-interaction/wmi/connect-to-wmi-namespace-via-wbemlocator.yml
10:      dynamic: unsupported  # requires offset, bytes features
21:          - bytes: 11 F8 90 45 3A 1D D0 11 89 1F 00 AA 00 4B 2E 24 = CLSID_WbemLocator
22:          - bytes: 87 A6 12 DC 7F 73 CF 11 88 4D 00 AA 00 4B 2E 24 = IID_IWbemLocator

anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml
29:        description: call $+5 pushes the current EIP onto the stack, +5 to jump past call insn bytes
32:        - number: 0x5 = length of add + retf insn bytes

host-interaction/hardware/storage/enumerate-disk-properties.yml
9:      dynamic: unsupported  # requires bytes features
21:          - bytes: 67 E9 36 4D 25 E3 CE 11 BF C1 08 00 2B E1 03 18 = GUID_DEVCLASS_DISKDRIVE

host-interaction/hardware/enumerate-devices-by-category.yml
10:      dynamic: unsupported  # requires offset, bytes features
18:        - bytes: 10 5D BE 62 EB 60 D0 11 BD 3B 00 A0 C9 11 CE 86 = SystemDeviceEnum
19:        - bytes: 22 08 84 29 84 5B D0 11 BD 3B 00 A0 C9 11 CE 86 = ICreateDevEnum
23:        - bytes: 10 B3 0B 86 01 5D D0 11 BD 3B 00 A0 C9 11 CE 86 = CVidCapClassManager
24:        - bytes: 62 A7 D9 33 C8 90 D0 11 BD 43 00 A0 C9 11 CE 86 = CWaveinClassManager

host-interaction/uac/bypass/bypass-uac-via-icmluautil.yml
21:        - bytes: F9 C7 5F 3E 51 9A 67 43 90 63 A1 20 24 4F BE C7 = T_CLSID_CMSTPLUA
28:            - bytes: 74 6D DD 6E 07 C0 75 4E B7 6A E5 74 09 95 E2 4C = IID_ICMLuaUtil

host-interaction/uac/bypass/bypass-uac-via-rpc.yml
25:        - bytes: 9A F9 1E 20 A0 7F 4C 44 93 99 19 BA 84 F1 2A 1A = IID_APPINFO
williballenthin commented 11 months ago

this requires v7 functionality from https://github.com/mandiant/capa/pull/1738