new/update rules using .NET ctor method (#626)

communication/socket/udp/send/create-udp-socket.yml

@@ -5,6 +5,7 @@ rule:
     authors:
       - moritz.raabe@mandiant.com
       - joakim@intezer.com
+      - michael.hunhoff@mandiant.com
     scope: basic block
     mbc:
       - Communication::Socket Communication::Create UDP Socket [C0001.010]
@@ -17,3 +18,4 @@ rule:
         - api: ws2_32.socket
         - api: ws2_32.WSASocket
         - api: socket
+        - api: System.Net.Sockets.Socket::ctor

communication/tcp/client/act-as-tcp-client.yml

@@ -4,11 +4,13 @@ rule:
     namespace: communication/tcp/client
     authors:
       - william.ballenthin@mandiant.com
+      - michael.hunhoff@mandiant.com
     scope: function
     mbc:
       - Communication::Socket Communication::TCP Client [C0001.008]
     examples:
       - Practical Malware Analysis Lab 01-01.dll_:0x10001010
   features:
-    - and:
+    - or:
       - match: connect TCP socket
+      - api: System.Net.Sockets.TcpClient::ctor

data-manipulation/hashing/sha1/hash-data-using-sha1.yml

@@ -4,6 +4,7 @@ rule:
     namespace: data-manipulation/hashing/sha1
     authors:
       - moritz.raabe@mandiant.com
+      - michael.hunhoff@mandiant.com
     scope: function
     mbc:
       - Cryptography::Cryptographic Hash::SHA1 [C0029.002]
@@ -22,3 +23,7 @@ rule:
         - and:
           - number: 0x8004 = CALG_SHA1
           - api: advapi32.CryptCreateHash
+      - and:
+        - api: System.Security.Cryptography.SHA1Managed::ctor
+        - optional:
+          - api: System.Security.Cryptography.HashAlgorithm::ComputeHash

data-manipulation/hashing/sha256/hash-data-using-sha256.yml

@@ -28,4 +28,5 @@ rule:
           - api: System.Security.Cryptography.SHA256Managed::Initialize
           - api: System.Security.Cryptography.SHA256CryptoServiceProvider::Initialize
           - api: System.Security.Cryptography.SHA256::Create
+          - api: System.Security.Cryptography.SHA256Managed::ctor
         - api: System.Security.Cryptography.HashAlgorithm::ComputeHash

host-interaction/mutex/create-mutex.yml

@@ -4,6 +4,7 @@ rule:
     namespace: host-interaction/mutex
     authors:
       - moritz.raabe@mandiant.com
+      - michael.hunhoff@mandiant.com
     scope: function
     mbc:
       - Process::Create Mutex [C0042]
@@ -13,3 +14,4 @@ rule:
     - or:
       - api: kernel32.CreateMutex
       - api: kernel32.CreateMutexEx
+      - api: System.Threading.Mutex::ctor

host-interaction/thread/create/create-thread.yml

@@ -34,4 +34,7 @@ rule:
       - and:
         - os: linux
         - api: pthread_create
-      - api: System.Threading.Thread::Start
+      - and:
+        - api: System.Threading.Thread::Start
+        - optional:
+          - api: System.Threading.Thread::ctor

nursery/compile-csharp-in-dotnet.yml

@@ -0,0 +1,13 @@
+rule:
+  meta:
+    name: compile CSharp in .NET
+    namespace: load-code/dotnet/csharp
+    authors:
+      - michael.hunhoff@mandiant.com
+    scope: function
+    att&ck:
+      - Defense Evasion::Obfuscated Files or Information::Compile After Delivery [T1027.004]
+  features:
+    - and:
+      - match: compile .NET assembly
+      - api: Microsoft.CSharp.CSharpCodeProvider::ctor

nursery/compile-visual-basic-in-dotnet.yml

@@ -0,0 +1,13 @@
+rule:
+  meta:
+    name: compile Visual Basic in .NET
+    namespace: load-code/dotnet/vb
+    authors:
+      - michael.hunhoff@mandiant.com
+    scope: function
+    att&ck:
+      - Defense Evasion::Obfuscated Files or Information::Compile After Delivery [T1027.004]
+  features:
+    - and:
+      - match: compile .NET assembly
+      - api: Microsoft.VisualBasic.VBCodeProvider::ctor

nursery/compress-data-using-gzip-in-dotnet.yml

@@ -0,0 +1,14 @@
+rule:
+  meta:
+    name: compress data using GZip in .NET
+    namespace: data-manipulation/compression
+    authors:
+      - michael.hunhoff@mandiant.com
+    scope: function
+    att&ck:
+      - Collection::Archive Collected Data::Archive via Library [T1560.002]
+    mbc:
+      - Data::Compress Data [C0024]
+  features:
+    - or:
+      - api: System.IO.Compression.GZipStream::ctor

nursery/create-process-via-wmi-in-dotnet.yml

@@ -1,7 +1,7 @@
 rule:
   meta:
-    name: create process via wmi
-    namespace: host-interaction/wmi/dotnet
+    name: create process via WMI in .NET
+    namespace: host-interaction/wmi
     authors:
       - anushka.virgaonkar@mandiant.com
     scope: function

nursery/execute-sqlite-statement-in-dotnet.yml

@@ -0,0 +1,18 @@
+rule:
+  meta:
+    name: execute SQLite statement in .NET
+    namespace: data-manipulation/database/sql
+    authors:
+      - michael.hunhoff@mandiant.com
+    scope: function
+  features:
+    - and:
+      - or:
+        - api: System.Data.SQLite.SQLiteCommand::ExecuteReader
+        - api: System.Data.SQLite.SQLiteCommand::ExecuteReaderAsync
+        - api: System.Data.SQLite.SQLiteCommand::ExecuteScalar
+        - api: System.Data.SQLite.SQLiteCommand::ExecuteDbDataReader
+        - api: System.Data.SQLite.SQLiteCommand::ExecuteDbDataReaderAsync
+        - api: System.Data.SQLite.SQLiteCommand::ExecuteNonQuery
+      - optional:
+        - api: System.Data.SQLite.SQLiteCommand::ctor

nursery/execute-via-asynchronous-task-in-dotnet.yml

@@ -0,0 +1,10 @@
+rule:
+  meta:
+    name: execute via asynchronous task in .NET
+    namespace: host-interaction/thread/task
+    authors:
+      - michael.hunhoff@mandiant.com
+    scope: function
+  features:
+    - or:
+      - api: System.Threading.Tasks.Task::ctor

nursery/execute-via-timer-in-dotnet.yml

@@ -0,0 +1,10 @@
+rule:
+  meta:
+    name: execute via timer in .NET
+    namespace: host-interaction/thread/timer
+    authors:
+      - michael.hunhoff@mandiant.com
+    scope: function
+  features:
+    - or:
+      - api: System.Threading.Timer::ctor

nursery/execute-wmi-query-in-dotnet.yml

@@ -0,0 +1,14 @@
+rule:
+  meta:
+    name: execute WMI query in .NET
+    namespace: host-interaction/wmi
+    authors:
+      - michael.hunhoff@mandiant.com
+    scope: function
+    att&ck:
+      - Execution::Windows Management Instrumentation [T1047]
+  features:
+    - and:
+      - api: System.Management.ManagementObjectSearcher::Get
+      - optional:
+        - api: System.Management.ManagementObjectSearcher::ctor

nursery/find-data-using-regex-in-dotnet.yml

@@ -13,3 +13,4 @@ rule:
       - api: System.Text.RegularExpressions.Regex::EnumerateMatches
       - api: System.Text.RegularExpressions.Regex::Replace
       - api: System.Text.RegularExpressions.Regex::Split
+      - api: System.Text.RegularExpressions.Regex::ctor

nursery/manipulate-network-credentials-in-dotnet.yml

@@ -0,0 +1,10 @@
+rule:
+  meta:
+    name: manipulate network credentials in .NET
+    namespace: communication/authentication
+    authors:
+      - michael.hunhoff@mandiant.com
+    scope: function
+  features:
+    - and:
+      - api: System.Net.NetworkCredential::ctor