From b5bb713431e73207ad3fed86355eba95f7a4c1e2 Mon Sep 17 00:00:00 2001
From: William Ballenthin <william.ballenthin@fireeye.com>
Date: Tue, 20 Oct 2020 15:02:49 -0600
Subject: [PATCH] manipulate console: use twos complement

---
 host-interaction/console/manipulate-console.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/host-interaction/console/manipulate-console.yml b/host-interaction/console/manipulate-console.yml
index 28624221..f6abf885 100644
--- a/host-interaction/console/manipulate-console.yml
+++ b/host-interaction/console/manipulate-console.yml
@@ -17,4 +17,4 @@ rule:
       - api: kernel32.WriteConsoleInput
       - optional:
         - api: kernel32.GetStdHandle
-        - number: -11 = STD_OUTPUT_HANDLE
+        - number: 0xfffffff5 = STD_OUTPUT_HANDLE