admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

use new description syntax

Browse Source
This commit is contained in:
Moritz Raabe
2020-09-30 17:48:02 +02:00
parent cb7fd040b7
commit 33ae14eb53
10 changed files with 27 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml
+2 -2
View File
@@ -14,6 +14,7 @@ rule:
features:
- and:
- or:
- description: read/write EFLAGS register
- and:
- mnemonic: pushf
- mnemonic: popf
@@ -23,12 +24,11 @@ rule:
- and:
- mnemonic: pushfq
- mnemonic: popfq
# description: read/write EFLAGS register
- or:
- description: set trap flag
- and:
- mnemonic: or
- number: 0x100
- and:
- mnemonic: bts
- number: 0x8
# description: set trap flag
data-manipulation/compression/decompress-data-using-quicklz.yml
+3 -3
View File
@@ -19,6 +19,7 @@ rule:
- or:
- basic block:
- and:
- description: Mode 1 decompression
- mnemonic: xor
- mnemonic: shr
- mnemonic: and
@@ -27,17 +28,17 @@ rule:
- or:
- offset: 0x4000
- offset: 0x8000
# description: Mode 1 decompression
- basic block:
- and:
- description: Mode 2 decompression
- mnemonic: shr
- mnemonic: and
- mnemonic: mov
- number: 0x5
- number: 0x1
- number: 0x7FF
# description: Mode 2 decompression
- and:
- description: Mode 3 decompression
- basic block:
- and:
- mnemonic: shr
@@ -51,4 +52,3 @@ rule:
- mnemonic: shr
- mnemonic: and
- number: 0x3FF
# description: Mode 3 decompression
data-manipulation/encryption/des/encrypt-data-using-des.yml
+1 -1
View File
@@ -23,6 +23,7 @@ rule:
- bytes: 20 01 02 03 04 05 04 05 06 07 08 09 08 09 0a 0b 0c 0d 0c 0d 0e 0f 10 11 10 11 12 13 14 15 14 15 16 17 18 19 18 19 1a 1b 1c 1d 1c 1d 1e 1f 20 01 = DES Expansion
- bytes: 10 07 14 15 1d 0c 1c 11 01 0f 17 1a 05 12 1f 0a 02 08 18 0e 20 1b 03 09 13 0d 1e 06 16 0b 04 19 = PBOX
- and:
- description: DES RawProcessBlock
- number: 0x18
- number: 0x10
- number: 0x8
@@ -30,4 +31,3 @@ rule:
- characteristic: nzxor
- count(mnemonic(shr)): 8 or more
- mnemonic: ror
# description: DES RawProcessBlock
data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml
+3 -4
View File
@@ -17,24 +17,23 @@ rule:
- and:
- basic block:
- and:
- description: initialize S
# misses if regular loop is used,
# however we cannot model that a loop contains a certain number
- characteristic: tight loop
- or:
- number: 0xFF
- number: 0x100
# description: initialize S
- or:
- match: calculate modulo 256 via x86 assembly
# compiler may do this via zero-extended mov from 8-bit register
- count(mnemonic(movzx)): 2 or more
# description: modulo 256
- or:
- description: modulo key length
- mnemonic: div
- mnemonic: idiv
# description: modulo key length
# optimized, writes DWORDs instead of bytes
- and:
- description: optimized, writes DWORDs instead of bytes
- or:
- number: 0xFFFEFDFC
- mnemonic: sub
data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml
-1
View File
@@ -19,7 +19,6 @@ rule:
- match: calculate modulo 256 via x86 assembly
# compiler may do this via zero-extended mov from 8-bit register
- count(mnemonic(movzx)): 4 or more
# description: modulo 256
# should not call (many) functions
- count(characteristic(calls from)): (0, 4)
# should not be too simple
data-manipulation/hashing/murmur/hash-data-using-murmur3.yml
+3 -3
View File
@@ -29,22 +29,22 @@ rule:
- number: 0x4cf5ad432745937f = 64-bit c2 for 128-bit hash
- basic block:
- and:
- description: 'hash >> 16; hash >> 13; hash >> 16'
- count(mnemonic(shr)): 3
- number: 16
- number: 13
- optional:
- count(characteristic(nzxor)): 3 or more
# description: 'hash >> 16; hash >> 13; hash >> 16'
- and:
# Group this two blocks under an `and` as on their own they are not
# unique enough and would cause false positives
- basic block:
- and:
- description: k ROL r1
- mnemonic: rol
- number: 15 = r1
# description: k ROL r1
- basic block:
- and:
- description: hash ROL r2
- mnemonic: rol
- number: 13 = r2
# description: hash ROL r2
data-manipulation/hashing/tiger/hash-data-using-tiger.yml
+1 -1
View File
@@ -14,6 +14,7 @@ rule:
- bytes: 55 3c 32 26 85 60 0e 5b f5 59 1b fa a9 c1 46 1a fa 8f 4c 7c a1 45 e2 a9 d7 55 29 db 59 51 ca 65 c2 af 35 ce 76 0a db 05 45 3d 11 a9 7e c7 ea 81 0d 0a ac b6 8a f8 8e 52 ff e3 7b 59 53 a2 9e a0 56 cd 48 ac b3 df 0d 43 6f e4 5c f4 7a a6 b3 c4 5e d0 e2 fb d8 cf ce 4e f0 35 99 b3 10 6f f5 3e c6 19 d6 9c 82 d6 22 0b 69 20 df 74 0a 46 fd 17 40 ed 10 85 8e cc f8 6c a7 ca 6e 3a bf 24 c8 d6 49 70 81 1a 58 3d 24 61 a2 63 c1 bb b6 ac 8b 04 32 cc 44 7d c2 8a a3 d9 ab 10 f4 aa 5b ff dd 7f 4b 82 04 a8 5a 49 6d ad 94 9f 8c = sbox4
- or:
- and:
- description: tiger key schedule
- number: 0xa5a5a5a5a5a5a5a5
- number: 0x0123456789abcdef
- number: 0x13
@@ -21,4 +22,3 @@ rule:
- count(mnemonic(shr)) : 2 or more
- count(mnemonic(shl)) : 2 or more
- characteristic: nzxor
# description: tiger key schedule
lib/validate-credit-card-number-using-luhn-algorithm-with-lookup-table.yml
+6 -6
View File
@@ -16,6 +16,7 @@ rule:
- basic block:
- or:
- 8 or more:
- description: Digital root lookup table
- number: 0x0
- number: 0x2
- number: 0x4
@@ -26,8 +27,8 @@ rule:
- number: 0x5
- number: 0x7
- number: 0x9
# description: Digital root lookup table
- 8 or more:
- description: Digital root lookup table via neg numbers
- number: 0x0
- number: 0x1
- number: 0x2
@@ -37,27 +38,27 @@ rule:
- number: 0xfffffffd
- number: 0xfffffffe
- number: 0xffffffff
# description: Digital root lookup table via neg numbers
- basic block:
- or:
- and:
- description: Conversion of chr to int (SUB 0x30)
- number: 0x30
- mnemonic: sub
# description: Conversion of chr to int (SUB 0x30)
- and:
- description: Conversion of chr to int (LEA REG,[REG+ -0x30])
- mnemonic: lea
- offset: -0x30
# description: Conversion of chr to int (LEA REG,[REG+ -0x30])
- basic block:
- or:
- and:
- description: Final section returning checkum % 10
- mnemonic: idiv
- mnemonic: cdq
- number: 0xa
- optional :
- mnemonic: neg
# description: Final section returning checkum % 10
- and:
- description: Compiler optimized returning checkum % 10
- mnemonic: shr
- mnemonic: imul
- number: 0x66666667
@@ -65,4 +66,3 @@ rule:
- number: 0x2
- optional :
- mnemonic: neg
# description: Compiler optimized returning checkum % 10
lib/validate-credit-card-number-using-luhn-algorithm-with-no-lookup-table.yml
+7 -7
View File
@@ -23,30 +23,30 @@ rule:
- number: 0x1
- mnemonic: cmp
- number: 0x9
# description: Digital Root check number*2 < 0x9
- description: Digital Root check number*2 < 0x9
- and:
- basic block:
- and:
- mnemonic: cmp
- number: 0x9
# description: Compare number to 0x9 for Digital Root
- description: Compare number to 0x9 for Digital Root
- basic block:
- or:
- mnemonic: add
- and:
- mnemonic: shl
- number: 0x1
# description: 2*Number for Digital Root
- description: 2*Number for Digital Root
- basic block:
- or:
- and:
- number: 0x30
- mnemonic: sub
# description: Conversion of chr to int (SUB 0x30)
- description: Conversion of chr to int (SUB 0x30)
- and:
- mnemonic: lea
- offset: -0x30
# description: Conversion of chr to int (LEA REG,[REG+ -0x30])
- description: Conversion of chr to int (LEA REG,[REG+ -0x30])
- basic block:
- or:
- and:
@@ -55,7 +55,7 @@ rule:
- number: 0xa
- optional :
- mnemonic: neg
# description: Final section returning checkum % 10
- description: Final section returning checkum % 10
- and:
- mnemonic: shr
- mnemonic: imul
@@ -64,4 +64,4 @@ rule:
- number: 0x2
- optional :
- mnemonic: neg
# description: Compiler optimized returning checkum % 10
- description: Compiler optimized returning checkum % 10
nursery/empty-recycle-bin-quietly.yml
+1 -1
View File
@@ -15,5 +15,5 @@ rule:
- and:
- mnemonic: lea
- offset: 7 = SHERB_NOSOUND|SHERB_NOPROGRESSUI|SHERB_NOCONFIRMATION
# description: accounts for argument loaded via LEA (lea r8d, [rdx+7])
- description: accounts for argument loaded via LEA (lea r8d, [rdx+7])
- number: 7 = SHERB_NOSOUND|SHERB_NOPROGRESSUI|SHERB_NOCONFIRMATION