admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into dynamic-syntax

Browse Source
This commit is contained in:
Willi Ballenthin
2023-10-17 10:29:30 +00:00
parent d923cf4b8f 8f806bbf6c
commit 9cb8848b03
53 changed files with 422 additions and 124 deletions
Download Patch File Download Diff File Expand all files Collapse all files
load-code/shellcode/execute-shellcode-via-createthreadpoolwait.yml
+1 -1
View File
@@ -13,7 +13,7 @@ rule:
- a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf:0x10001010
features:
- and:
- match: allocate RWX memory
- match: allocate or change RWX memory
- api: CreateEvent
- api: CreateThreadpoolWait
- api: SetThreadpoolWait