From d88fa0fe82dc31e6012aab41ad1b7db959ea40f4 Mon Sep 17 00:00:00 2001
From: S12cybersecurity <79543461+S12cybersecurity@users.noreply.github.com>
Date: Wed, 24 Dec 2025 10:46:02 +0100
Subject: [PATCH] Add rule to detect suspicious PostThreadMessage usage

This rule detects binaries that utilize PostThreadMessage for IPC, which can indicate potential malicious behavior.
---
 ...icious_PostThreadMessage_IPC_Technique.yar | 29 +++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 Suspicious_PostThreadMessage_IPC_Technique.yar

diff --git a/Suspicious_PostThreadMessage_IPC_Technique.yar b/Suspicious_PostThreadMessage_IPC_Technique.yar
new file mode 100644
index 0000000..0acc269
--- /dev/null
+++ b/Suspicious_PostThreadMessage_IPC_Technique.yar
@@ -0,0 +1,29 @@
+rule Suspicious_PostThreadMessage_IPC_Technique {
+    meta:
+        description = "Detects binaries that use PostThreadMessage for potential inter-process communication (IPC). This uncommon API is sometimes abused by malware for stealthy cross-process messaging without creating named kernel objects."
+        author = "0x12 Dark Development"
+        date = "2025-12-24"
+        reference = "Windows PostThreadMessage API usage for covert IPC"
+        category = "suspicious_behavior"
+        threat_level = "medium"  // Legitimate apps rarely use it for IPC; mostly UI or injection-related
+
+    strings:
+        $api1 = "PostThreadMessageA" ascii wide nocase
+        $api2 = "PostThreadMessageW" ascii wide nocase
+        $api3 = "GetMessageA" ascii wide nocase
+        $api4 = "GetMessageW" ascii wide nocase
+        $api5 = "PeekMessageA" ascii wide nocase
+        $api6 = "PeekMessageW" ascii wide nocase
+        $api7 = "DispatchMessageA" ascii wide nocase
+        $api8 = "DispatchMessageW" ascii wide nocase
+
+        // Common constants used with custom messages
+        $const1 = "WM_USER" ascii wide
+        $const2 = "WM_APP" ascii wide
+
+    condition:
+        uint16(0) == 0x5A4D  // PE executable
+        and any of ($api1, $api2)  // Must use PostThreadMessage (key indicator)
+        and 2 of ($api3, $api4, $api5, $api6, $api7, $api8)  // Message loop APIs usually present in receiver
+        and any of ($const*)  // Custom message definitions (WM_USER + X or WM_APP + X)
+}