From 642ccf0cc43b4dad0bfd347b4ae78ecf9d4469f3 Mon Sep 17 00:00:00 2001 From: johnk3r Date: Tue, 29 Dec 2020 21:40:36 -0300 Subject: [PATCH 01/13] Create get-enumeration-function.yml --- .../gui/window/get-enumeration-function.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 host-interaction/gui/window/get-enumeration-function.yml diff --git a/host-interaction/gui/window/get-enumeration-function.yml b/host-interaction/gui/window/get-enumeration-function.yml new file mode 100644 index 00000000..3c81b43b --- /dev/null +++ b/host-interaction/gui/window/get-enumeration-function.yml @@ -0,0 +1,19 @@ +rule: + meta: + name: get enumeration functions + namespace: host-interaction/gui/window + author: johnk3r + scope: function + att&ck: + - Discovery::Application Windows Discovery [T1010] + examples: + - 5e6764534b3a1e4d3abacc4810b6985d:0x4011C0 + - a74ee8200aace7d19dee79871bbf2ed3:0x403750 + - 74fa32d2b277f583010b692a3f91b627:0x66BAEA67 + - 021f49678cd633dc8cf99c61b3af3dda:0x40E44A + features: + - or: + - api: EnumResourceTypes + - api: EnumWindowStations + - api: EnumDesktops + - api: EnumWindows \ No newline at end of file From 332e5e248985907fb3ba188d60dd5933e90ae15a Mon Sep 17 00:00:00 2001 From: johnk3r Date: Tue, 29 Dec 2020 21:53:33 -0300 Subject: [PATCH 02/13] Rename get-enumeration-function.yml to get-enumeration-functions.yml --- ...t-enumeration-function.yml => get-enumeration-functions.yml} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename host-interaction/gui/window/{get-enumeration-function.yml => get-enumeration-functions.yml} (95%) diff --git a/host-interaction/gui/window/get-enumeration-function.yml b/host-interaction/gui/window/get-enumeration-functions.yml similarity index 95% rename from host-interaction/gui/window/get-enumeration-function.yml rename to host-interaction/gui/window/get-enumeration-functions.yml index 3c81b43b..7a25b6b2 100644 --- a/host-interaction/gui/window/get-enumeration-function.yml +++ b/host-interaction/gui/window/get-enumeration-functions.yml @@ -16,4 +16,4 @@ rule: - api: EnumResourceTypes - api: EnumWindowStations - api: EnumDesktops - - api: EnumWindows \ No newline at end of file + - api: EnumWindows From 5ec67552d94466eb39d9e1b544386efc84ca8daf Mon Sep 17 00:00:00 2001 From: johnk3r Date: Wed, 30 Dec 2020 18:54:24 -0300 Subject: [PATCH 03/13] Update and rename get-enumeration-functions.yml to enumerate GUI resources.yml --- ...et-enumeration-functions.yml => enumerate GUI resources.yml} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename host-interaction/gui/window/{get-enumeration-functions.yml => enumerate GUI resources.yml} (93%) diff --git a/host-interaction/gui/window/get-enumeration-functions.yml b/host-interaction/gui/window/enumerate GUI resources.yml similarity index 93% rename from host-interaction/gui/window/get-enumeration-functions.yml rename to host-interaction/gui/window/enumerate GUI resources.yml index 7a25b6b2..1ad3a910 100644 --- a/host-interaction/gui/window/get-enumeration-functions.yml +++ b/host-interaction/gui/window/enumerate GUI resources.yml @@ -1,6 +1,6 @@ rule: meta: - name: get enumeration functions + name: enumerate GUI resources namespace: host-interaction/gui/window author: johnk3r scope: function From c9ca55d4a10c9a6a01b82792da228999d9538f9e Mon Sep 17 00:00:00 2001 From: johnk3r Date: Wed, 30 Dec 2020 18:54:57 -0300 Subject: [PATCH 04/13] Update enumerate GUI resources.yml --- host-interaction/gui/window/enumerate GUI resources.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/host-interaction/gui/window/enumerate GUI resources.yml b/host-interaction/gui/window/enumerate GUI resources.yml index 1ad3a910..247fb5ed 100644 --- a/host-interaction/gui/window/enumerate GUI resources.yml +++ b/host-interaction/gui/window/enumerate GUI resources.yml @@ -1,7 +1,7 @@ rule: meta: name: enumerate GUI resources - namespace: host-interaction/gui/window + namespace: host-interaction/gui author: johnk3r scope: function att&ck: From e0748e5db2f7a96b93246e8d375bbd004c8e268c Mon Sep 17 00:00:00 2001 From: johnk3r Date: Wed, 30 Dec 2020 18:56:26 -0300 Subject: [PATCH 05/13] Rename enumerate GUI resources.yml to ..enumerate GUI resources.yml --- ...{enumerate GUI resources.yml => ..enumerate GUI resources.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename host-interaction/gui/window/{enumerate GUI resources.yml => ..enumerate GUI resources.yml} (100%) diff --git a/host-interaction/gui/window/enumerate GUI resources.yml b/host-interaction/gui/window/..enumerate GUI resources.yml similarity index 100% rename from host-interaction/gui/window/enumerate GUI resources.yml rename to host-interaction/gui/window/..enumerate GUI resources.yml From 08b5124069ebc59682795a9eb183424a86404fa3 Mon Sep 17 00:00:00 2001 From: johnk3r Date: Wed, 30 Dec 2020 18:57:57 -0300 Subject: [PATCH 06/13] Rename host-interaction/gui/window/..enumerate GUI resources.yml to host-interaction/gui/enumerate-GUI-resources.yml --- .../..enumerate GUI resources.yml => enumerate-GUI-resources.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename host-interaction/gui/{window/..enumerate GUI resources.yml => enumerate-GUI-resources.yml} (100%) diff --git a/host-interaction/gui/window/..enumerate GUI resources.yml b/host-interaction/gui/enumerate-GUI-resources.yml similarity index 100% rename from host-interaction/gui/window/..enumerate GUI resources.yml rename to host-interaction/gui/enumerate-GUI-resources.yml From c12233d5aea29bd783758aaae5e118333f66208d Mon Sep 17 00:00:00 2001 From: johnk3r Date: Wed, 30 Dec 2020 18:59:11 -0300 Subject: [PATCH 07/13] Update and rename enumerate-GUI-resources.yml to enumerate-gui-resources.yml --- ...{enumerate-GUI-resources.yml => enumerate-gui-resources.yml} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename host-interaction/gui/{enumerate-GUI-resources.yml => enumerate-gui-resources.yml} (93%) diff --git a/host-interaction/gui/enumerate-GUI-resources.yml b/host-interaction/gui/enumerate-gui-resources.yml similarity index 93% rename from host-interaction/gui/enumerate-GUI-resources.yml rename to host-interaction/gui/enumerate-gui-resources.yml index 247fb5ed..ade2a91f 100644 --- a/host-interaction/gui/enumerate-GUI-resources.yml +++ b/host-interaction/gui/enumerate-gui-resources.yml @@ -1,6 +1,6 @@ rule: meta: - name: enumerate GUI resources + name: enumerate gui resources namespace: host-interaction/gui author: johnk3r scope: function From fdf3afe7f612d43ee4e4096401e25aec09b1e8cb Mon Sep 17 00:00:00 2001 From: johnk3r Date: Wed, 30 Dec 2020 22:23:34 -0300 Subject: [PATCH 08/13] Create get-operation-system-version.yml https://github.com/fireeye/capa-rules/issues/28 --- .../os/version/get-operation-system-version.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 host-interaction/os/version/get-operation-system-version.yml diff --git a/host-interaction/os/version/get-operation-system-version.yml b/host-interaction/os/version/get-operation-system-version.yml new file mode 100644 index 00000000..62b92f06 --- /dev/null +++ b/host-interaction/os/version/get-operation-system-version.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: get operation system version + namespace: host-interaction/os/version + author: johnk3r + scope: function + att&ck: + - Discovery::System Information Discovery [T1082] + examples: + - f4584aed97469c461826ea17ca9b3c1d:0x40589F + features: + - or: + - api: VerifyVersionInfo + - api: VerSetConditionMask \ No newline at end of file From bce0530dc83743401e988f4bd7daa009d4ed9a6c Mon Sep 17 00:00:00 2001 From: johnk3r Date: Wed, 30 Dec 2020 22:28:11 -0300 Subject: [PATCH 09/13] Delete get-operation-system-version.yml --- .../os/version/get-operation-system-version.yml | 14 -------------- 1 file changed, 14 deletions(-) delete mode 100644 host-interaction/os/version/get-operation-system-version.yml diff --git a/host-interaction/os/version/get-operation-system-version.yml b/host-interaction/os/version/get-operation-system-version.yml deleted file mode 100644 index 62b92f06..00000000 --- a/host-interaction/os/version/get-operation-system-version.yml +++ /dev/null @@ -1,14 +0,0 @@ -rule: - meta: - name: get operation system version - namespace: host-interaction/os/version - author: johnk3r - scope: function - att&ck: - - Discovery::System Information Discovery [T1082] - examples: - - f4584aed97469c461826ea17ca9b3c1d:0x40589F - features: - - or: - - api: VerifyVersionInfo - - api: VerSetConditionMask \ No newline at end of file From 4e1c15bb86af135979c271ec71e18928827964d9 Mon Sep 17 00:00:00 2001 From: johnk3r Date: Wed, 30 Dec 2020 22:33:08 -0300 Subject: [PATCH 10/13] Update enumerate-gui-resources.yml --- host-interaction/gui/enumerate-gui-resources.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/host-interaction/gui/enumerate-gui-resources.yml b/host-interaction/gui/enumerate-gui-resources.yml index ade2a91f..f0860ec2 100644 --- a/host-interaction/gui/enumerate-gui-resources.yml +++ b/host-interaction/gui/enumerate-gui-resources.yml @@ -2,7 +2,7 @@ rule: meta: name: enumerate gui resources namespace: host-interaction/gui - author: johnk3r + author: johnk3 scope: function att&ck: - Discovery::Application Windows Discovery [T1010] From a8ae2e2cd9499df58583a5ee22e057c9aad7be34 Mon Sep 17 00:00:00 2001 From: johnk3r Date: Wed, 30 Dec 2020 22:33:16 -0300 Subject: [PATCH 11/13] Update enumerate-gui-resources.yml --- host-interaction/gui/enumerate-gui-resources.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/host-interaction/gui/enumerate-gui-resources.yml b/host-interaction/gui/enumerate-gui-resources.yml index f0860ec2..ade2a91f 100644 --- a/host-interaction/gui/enumerate-gui-resources.yml +++ b/host-interaction/gui/enumerate-gui-resources.yml @@ -2,7 +2,7 @@ rule: meta: name: enumerate gui resources namespace: host-interaction/gui - author: johnk3 + author: johnk3r scope: function att&ck: - Discovery::Application Windows Discovery [T1010] From 6180321f514df46336695e1b60576f40e251297f Mon Sep 17 00:00:00 2001 From: johnk3r Date: Tue, 5 Jan 2021 09:35:12 -0300 Subject: [PATCH 12/13] Update enumerate-gui-resources.yml --- host-interaction/gui/enumerate-gui-resources.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/host-interaction/gui/enumerate-gui-resources.yml b/host-interaction/gui/enumerate-gui-resources.yml index ade2a91f..743511b9 100644 --- a/host-interaction/gui/enumerate-gui-resources.yml +++ b/host-interaction/gui/enumerate-gui-resources.yml @@ -5,7 +5,7 @@ rule: author: johnk3r scope: function att&ck: - - Discovery::Application Windows Discovery [T1010] + - Discovery::Application Window Discovery [T1010] examples: - 5e6764534b3a1e4d3abacc4810b6985d:0x4011C0 - a74ee8200aace7d19dee79871bbf2ed3:0x403750 From 539ad9524853f77758c88516e72c7a6cee0d35a3 Mon Sep 17 00:00:00 2001 From: johnk3r Date: Tue, 5 Jan 2021 09:39:51 -0300 Subject: [PATCH 13/13] Delete enumerate-graphical-windows.yml #31 --- nursery/enumerate-graphical-windows.yml | 11 ----------- 1 file changed, 11 deletions(-) delete mode 100644 nursery/enumerate-graphical-windows.yml diff --git a/nursery/enumerate-graphical-windows.yml b/nursery/enumerate-graphical-windows.yml deleted file mode 100644 index 27909129..00000000 --- a/nursery/enumerate-graphical-windows.yml +++ /dev/null @@ -1,11 +0,0 @@ -rule: - meta: - name: enumerate graphical windows - namespace: host-interaction/gui/window/find - author: moritz.raabe@fireeye.com - scope: function - att&ck: - - Discovery::Application Window Discovery [T1010] - features: - - or: - - api: user32.EnumWindows