admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update capture-screenshot.yml

Browse Source 
Extended to catch a copy of the screenshot functionality in arkei_stealer sample `7204e3efc2434012e13ca939db0d0b02`
This commit is contained in:
re-fox
2020-07-29 15:18:50 -04:00
committed by GitHub
parent d7a825aa7c
commit 609e55aa58
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
collection/screenshot/capture-screenshot.yml
+10 -2
View File
@@ -2,18 +2,26 @@ rule:
meta:
name: capture screenshot
namespace: collection/screenshot
author: moritz.raabe@fireeye.com
author:
- moritz.raabe@fireeye.com
- "@_re_fox"
scope: function
att&ck:
- Collection::Screen Capture [T1113]
examples:
- BFB9B5391A13D0AFD787E87AB90F14F5:0x1314610A
- 7204e3efc2434012e13ca939db0d0b02:0x414070
features:
- and:
- or:
- api: user32.GetWindowDC
- api: user32.GetDC
- api: gdi32.BitBlt
- and:
- api: gdi32.CreateDCA
- string: DISPLAY
- or:
- api: gdi32.BitBlt
- api: gdi32.GetDIBits
- api: gdi32.CreateCompatibleDC
- api: gdi32.CreateCompatibleBitmap
- optional: