admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

manipulate console: use twos complement

Browse Source
This commit is contained in:
William Ballenthin
2020-10-20 15:02:49 -06:00
parent 9bff6f41ed
commit b5bb713431
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host-interaction/console/manipulate-console.yml
+1 -1
View File
@@ -17,4 +17,4 @@ rule:
- api: kernel32.WriteConsoleInput
- optional:
- api: kernel32.GetStdHandle
- number: -11 = STD_OUTPUT_HANDLE
- number: 0xfffffff5 = STD_OUTPUT_HANDLE