admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update allocate-memory.md

Browse Source 
Updated bad CAPA rule link
This commit is contained in:
brightmt
2024-10-02 10:06:44 -04:00
committed by GitHub
parent 4874fd4b35
commit 91ec7133ff
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
micro-behaviors/memory/allocate-memory.md
+1 -1
View File
@@ -48,7 +48,7 @@ Malware allocates memory, often to unpack itself.
|Tool: capa|Mapping|APIs|
|---|---|---|
|[allocate RWX memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/allocate-rwx-memory.yml)|Allocate Memory (C0007)|--|
|[allocate or change RWX memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/allocate-or-change-rwx-memory.yml)|Allocate Memory (C0007)|--|
|[allocate memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-memory.yml)|Allocate Memory (C0007)|kernel32.VirtualAlloc, kernel32.VirtualAllocEx, kernel32.VirtualAllocExNuma, kernel32.VirtualProtect, kernel32.VirtualProtectEx, NtAllocateVirtualMemory, ZwAllocateVirtualMemory, NtMapViewOfSection, ZwMapViewOfSection, NtProtectVirtualMemory, ZwProtectVirtualMemory|
|[allocate RW memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-rw-memory.yml)|Allocate Memory (C0007)|--|
|[spawn thread to RWX shellcode](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml)|Allocate Memory (C0007)|--|