mirror of
https://github.com/S12cybersecurity/YaraRules
synced 2026-06-08 12:22:33 +00:00
S12cybersecurity
40 lines
1.6 KiB
Plaintext
40 lines
1.6 KiB
Plaintext
rule Win_ProcInj_ThreadNameCalling_General {
|
|
meta:
|
|
author = "0x12 Dark Development"
|
|
description = "Detects process injection tools or malware using the Thread Name-Calling technique (abusing SetThreadDescription/GetThreadDescription + APC for remote code transfer/execution)"
|
|
date = "2025-12-22"
|
|
reference = "https://research.checkpoint.com/2024/thread-name-calling-using-thread-name-for-offense/"
|
|
technique = "T1055 Process Injection - Thread Name Abuse"
|
|
mitre_att = "T1055"
|
|
tlp = "WHITE"
|
|
|
|
strings:
|
|
// High-level APIs
|
|
$api1 = "SetThreadDescription" ascii wide
|
|
$api2 = "GetThreadDescription" ascii wide
|
|
|
|
// Low-level variants (ThreadNameInformation class)
|
|
$nt1 = "NtSetInformationThread" ascii wide
|
|
$nt2 = "NtQueryInformationThread" ascii wide
|
|
$class = { 00 00 00 00 26 00 00 00 } // ThreadNameInformation = 0x26 (little-endian DWORD)
|
|
|
|
// APC queuing APIs commonly used in this technique
|
|
$apc1 = "QueueUserAPC" ascii wide
|
|
$apc2 = "NtQueueApcThread" ascii wide
|
|
$apc3 = "NtQueueApcThreadEx" ascii wide
|
|
|
|
// Optional: VirtualProtect for making payload executable
|
|
$vp = "VirtualProtectEx" ascii wide
|
|
|
|
condition:
|
|
// Must be a PE file
|
|
uint16(0) == 0x5A4D and
|
|
|
|
// Core indicators: thread description APIs + APC queuing
|
|
(1 of ($api*) or all of ($nt*) or $class) and
|
|
any of ($apc*)
|
|
|
|
// Optional boost: presence of remote memory protection change (common after payload transfer)
|
|
or $vp
|
|
}
|