mirror of
https://github.com/S12cybersecurity/YaraRules
synced 2026-06-08 12:22:33 +00:00
S12cybersecurity
62 lines
2.5 KiB
Plaintext
62 lines
2.5 KiB
Plaintext
rule WIN_APC_Injection_NtQueueApcThreadEx2_SpecialUserAPC_0x12DarkDev
|
|
{
|
|
meta:
|
|
author = "0x12 Dark Development"
|
|
description = "Detects modern APC process injection using NtQueueApcThreadEx2 with QUEUE_USER_APC_FLAGS_SPECIAL_USER_APC (0x2) - Tartarus Gate technique"
|
|
date = "2025-12-09"
|
|
version = "2.1"
|
|
mitre = "T1055.004"
|
|
confidence = "High"
|
|
category = "Process Injection"
|
|
reference = "https://medium.com/@0x12darkdev"
|
|
|
|
strings:
|
|
// NtQueueApcThreadEx2 function name (common in unpacked samples)
|
|
$api1 = "NtQueueApcThreadEx2" ascii wide
|
|
|
|
// Special User APC flag: 0x2 (most common)
|
|
$flag1 = { 02 00 00 00 } // QUEUE_USER_APC_FLAGS_SPECIAL_USER_APC
|
|
|
|
// KERNEL_USER_APC struct pattern (Windows 11 23H2+ style)
|
|
// ApcRoutine = remote shellcode addr, Args = NULLs
|
|
$struct1 = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
|
|
|
|
// Old style: direct shellcode pointer as 4th arg
|
|
$old_call = { 48 8D 0D ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8B ?? ?? ?? ?? ?? 4C 8D 0D ?? ?? ?? ?? 41 B8 02 00 00 00 } // call NtQueueApcThreadEx2 with 0x2
|
|
|
|
// VirtualAllocEx + PAGE_EXECUTE_READWRITE (0x40) pattern
|
|
$rwx1 = { 40 00 00 00 } // MEM_COMMIT | PAGE_EXECUTE_READWRITE
|
|
|
|
// Common APC queue sequence: OpenThread + VirtualAllocEx + WriteProcessMemory + NtQueueApcThreadEx2
|
|
$seq1 = "OpenThread" ascii wide
|
|
$seq2 = "VirtualAllocEx" ascii wide
|
|
$seq3 = "WriteProcessMemory" ascii wide
|
|
|
|
// Speck encryption artifacts (optional bonus for your style)
|
|
$speck1 = "speck_decrypt" ascii wide nocase
|
|
$speck2 = "decryptShellcode" ascii wide
|
|
$speck3 = { 48 8D 0D ?? ?? ?? ?? 48 8B C8 E8 ?? ?? ?? ?? 48 89 } // typical Speck decrypt call pattern
|
|
|
|
condition:
|
|
// Must have the API name OR strong behavioral pattern
|
|
$api1 or
|
|
|
|
// Special User APC flag + RWX allocation
|
|
( $flag1 and $rwx1 ) or
|
|
|
|
// KERNEL_USER_APC struct (24 NULL bytes = 3x PVOIDs) near flag
|
|
( $flag1 and $struct1 within 100 ) or
|
|
|
|
// Classic call sequence with 0x2 flag
|
|
( $old_call and $flag1 ) or
|
|
|
|
// Full behavioral chain
|
|
( 2 of ($seq*) and $rwx1 and $flag1 ) or
|
|
|
|
// Bonus: Speck + Special APC (your exact combo)
|
|
( any of ($speck*) and $flag1 )
|
|
|
|
// File size filter to reduce FP on clean ntdll.dll
|
|
and filesize < 15MB
|
|
}
|