From 9cdd9337450d0d1bbc3616a9889eeda6f2a10a17 Mon Sep 17 00:00:00 2001 From: brightmt <50853930+brightmt@users.noreply.github.com> Date: Wed, 2 Oct 2024 11:10:24 -0400 Subject: [PATCH] Update allocate-thread-local-storage.md Changed allocate TLS detection to new CAPA link --- micro-behaviors/process/allocate-thread-local-storage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/micro-behaviors/process/allocate-thread-local-storage.md b/micro-behaviors/process/allocate-thread-local-storage.md index 365b0a2..92f43bd 100644 --- a/micro-behaviors/process/allocate-thread-local-storage.md +++ b/micro-behaviors/process/allocate-thread-local-storage.md @@ -41,7 +41,7 @@ Malware allocates thread local storage. |Tool: capa|Mapping|APIs| |---|---|---| -|[allocate thread local storage](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/allocate-thread-local-storage.yml)|Allocate Thread Local Storage (C0040)|kernel32.TlsAlloc| +|[allocate thread local storage](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/tls/allocate-thread-local-storage.yml)|Allocate Thread Local Storage (C0040)|kernel32.TlsAlloc| ### C0040 Snippet