From 94f1639cb417c8d984cb5de1ea8e028b05d0910e Mon Sep 17 00:00:00 2001 From: Michael Hunhoff Date: Wed, 23 Mar 2022 09:01:25 -0600 Subject: [PATCH] update hijack-thread-execution.yml to match additional scenarios --- host-interaction/process/inject/hijack-thread-execution.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/host-interaction/process/inject/hijack-thread-execution.yml b/host-interaction/process/inject/hijack-thread-execution.yml index 7924a647..1a12441b 100644 --- a/host-interaction/process/inject/hijack-thread-execution.yml +++ b/host-interaction/process/inject/hijack-thread-execution.yml @@ -2,7 +2,9 @@ rule: meta: name: hijack thread execution namespace: host-interaction/process/inject - author: 0x534a@mailbox.org + author: + - 0x534a@mailbox.org + - michael.hunhoff@mandiant.com scope: function att&ck: - Defense Evasion::Process Injection::Thread Execution Hijacking [T1055.003] @@ -17,8 +19,8 @@ rule: - match: create thread - match: suspend thread - api: kernel32.GetThreadContext - - match: allocate RWX memory - optional: + - match: allocate RWX memory - match: write process memory - api: kernel32.SetThreadContext - match: resume thread