mirror of
https://github.com/S12cybersecurity/YaraRules
synced 2026-06-08 12:22:33 +00:00
S12cybersecurity
36 lines
1.5 KiB
Plaintext
36 lines
1.5 KiB
Plaintext
rule Windows_Discovery_CodeIntegrity_Status {
|
|
meta:
|
|
author = "0x12 Dark Development"
|
|
description = "Detects binaries querying Windows Code Integrity (CI) status via NtQuerySystemInformation (Class 103)"
|
|
technique = "Discovery - Code Integrity Status"
|
|
reference = "https://medium.com/@0x12darkdev/discover-code-integrity-protection-status-f7c87c0a9b8e"
|
|
date = "2026-04-09"
|
|
|
|
strings:
|
|
// The API used to query system information
|
|
$api = "NtQuerySystemInformation" ascii wide
|
|
|
|
// Specific bitmask flag names often found in PoCs or tools using this logic
|
|
$f1 = "CODEINTEGRITY_OPTION_ENABLED" ascii wide
|
|
$f2 = "CODEINTEGRITY_OPTION_TESTSIGN" ascii wide
|
|
$f3 = "CODEINTEGRITY_OPTION_UMCI_ENABLED" ascii wide
|
|
$f4 = "CODEINTEGRITY_OPTION_HVCI_KMCI_ENABLED" ascii wide
|
|
$f5 = "CODEINTEGRITY_OPTION_DEBUGMODE_ENABLED" ascii wide
|
|
|
|
/* Hex Pattern for SystemCodeIntegrityInformation (Value 103 / 0x67)
|
|
This value is passed as the first argument to NtQuerySystemInformation.
|
|
*/
|
|
// x64: mov rcx, 0x67
|
|
$class_x64 = { 48 C7 C1 67 00 00 00 }
|
|
|
|
// x86: push 0x67
|
|
$class_x86 = { 6A 67 }
|
|
|
|
condition:
|
|
uint16(0) == 0x5A4D and // Check for MZ header (PE file)
|
|
(
|
|
($api and 1 of ($f*)) or // API combined with interpretation strings
|
|
($api and (1 of ($class*))) // API combined with the specific Enum value
|
|
)
|
|
}
|