diff --git a/communication/socket/udp/send/create-udp-socket.yml b/communication/socket/udp/send/create-udp-socket.yml index 14e9a7ef..368bbd5a 100644 --- a/communication/socket/udp/send/create-udp-socket.yml +++ b/communication/socket/udp/send/create-udp-socket.yml @@ -5,6 +5,7 @@ rule: authors: - moritz.raabe@mandiant.com - joakim@intezer.com + - michael.hunhoff@mandiant.com scope: basic block mbc: - Communication::Socket Communication::Create UDP Socket [C0001.010] @@ -17,3 +18,4 @@ rule: - api: ws2_32.socket - api: ws2_32.WSASocket - api: socket + - api: System.Net.Sockets.Socket::ctor diff --git a/communication/tcp/client/act-as-tcp-client.yml b/communication/tcp/client/act-as-tcp-client.yml index c8ab187b..1757a3c9 100644 --- a/communication/tcp/client/act-as-tcp-client.yml +++ b/communication/tcp/client/act-as-tcp-client.yml @@ -4,11 +4,13 @@ rule: namespace: communication/tcp/client authors: - william.ballenthin@mandiant.com + - michael.hunhoff@mandiant.com scope: function mbc: - Communication::Socket Communication::TCP Client [C0001.008] examples: - Practical Malware Analysis Lab 01-01.dll_:0x10001010 features: - - and: + - or: - match: connect TCP socket + - api: System.Net.Sockets.TcpClient::ctor diff --git a/data-manipulation/hashing/sha1/hash-data-using-sha1.yml b/data-manipulation/hashing/sha1/hash-data-using-sha1.yml index 3d3431a9..cecf507e 100644 --- a/data-manipulation/hashing/sha1/hash-data-using-sha1.yml +++ b/data-manipulation/hashing/sha1/hash-data-using-sha1.yml @@ -4,6 +4,7 @@ rule: namespace: data-manipulation/hashing/sha1 authors: - moritz.raabe@mandiant.com + - michael.hunhoff@mandiant.com scope: function mbc: - Cryptography::Cryptographic Hash::SHA1 [C0029.002] @@ -22,3 +23,7 @@ rule: - and: - number: 0x8004 = CALG_SHA1 - api: advapi32.CryptCreateHash + - and: + - api: System.Security.Cryptography.SHA1Managed::ctor + - optional: + - api: System.Security.Cryptography.HashAlgorithm::ComputeHash diff --git a/data-manipulation/hashing/sha256/hash-data-using-sha256.yml b/data-manipulation/hashing/sha256/hash-data-using-sha256.yml index 9556a028..bfeea799 100644 --- a/data-manipulation/hashing/sha256/hash-data-using-sha256.yml +++ b/data-manipulation/hashing/sha256/hash-data-using-sha256.yml @@ -28,4 +28,5 @@ rule: - api: System.Security.Cryptography.SHA256Managed::Initialize - api: System.Security.Cryptography.SHA256CryptoServiceProvider::Initialize - api: System.Security.Cryptography.SHA256::Create + - api: System.Security.Cryptography.SHA256Managed::ctor - api: System.Security.Cryptography.HashAlgorithm::ComputeHash diff --git a/host-interaction/mutex/create-mutex.yml b/host-interaction/mutex/create-mutex.yml index 9e22d95c..7cb7472f 100644 --- a/host-interaction/mutex/create-mutex.yml +++ b/host-interaction/mutex/create-mutex.yml @@ -4,6 +4,7 @@ rule: namespace: host-interaction/mutex authors: - moritz.raabe@mandiant.com + - michael.hunhoff@mandiant.com scope: function mbc: - Process::Create Mutex [C0042] @@ -13,3 +14,4 @@ rule: - or: - api: kernel32.CreateMutex - api: kernel32.CreateMutexEx + - api: System.Threading.Mutex::ctor diff --git a/host-interaction/thread/create/create-thread.yml b/host-interaction/thread/create/create-thread.yml index 09631f84..bba2ea2e 100644 --- a/host-interaction/thread/create/create-thread.yml +++ b/host-interaction/thread/create/create-thread.yml @@ -34,4 +34,7 @@ rule: - and: - os: linux - api: pthread_create - - api: System.Threading.Thread::Start + - and: + - api: System.Threading.Thread::Start + - optional: + - api: System.Threading.Thread::ctor diff --git a/nursery/compile-csharp-in-dotnet.yml b/nursery/compile-csharp-in-dotnet.yml new file mode 100644 index 00000000..e910bc3a --- /dev/null +++ b/nursery/compile-csharp-in-dotnet.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: compile CSharp in .NET + namespace: load-code/dotnet/csharp + authors: + - michael.hunhoff@mandiant.com + scope: function + att&ck: + - Defense Evasion::Obfuscated Files or Information::Compile After Delivery [T1027.004] + features: + - and: + - match: compile .NET assembly + - api: Microsoft.CSharp.CSharpCodeProvider::ctor diff --git a/nursery/compile-visual-basic-in-dotnet.yml b/nursery/compile-visual-basic-in-dotnet.yml new file mode 100644 index 00000000..4958676d --- /dev/null +++ b/nursery/compile-visual-basic-in-dotnet.yml @@ -0,0 +1,13 @@ +rule: + meta: + name: compile Visual Basic in .NET + namespace: load-code/dotnet/vb + authors: + - michael.hunhoff@mandiant.com + scope: function + att&ck: + - Defense Evasion::Obfuscated Files or Information::Compile After Delivery [T1027.004] + features: + - and: + - match: compile .NET assembly + - api: Microsoft.VisualBasic.VBCodeProvider::ctor diff --git a/nursery/compress-data-using-gzip-in-dotnet.yml b/nursery/compress-data-using-gzip-in-dotnet.yml new file mode 100644 index 00000000..ad9b473a --- /dev/null +++ b/nursery/compress-data-using-gzip-in-dotnet.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: compress data using GZip in .NET + namespace: data-manipulation/compression + authors: + - michael.hunhoff@mandiant.com + scope: function + att&ck: + - Collection::Archive Collected Data::Archive via Library [T1560.002] + mbc: + - Data::Compress Data [C0024] + features: + - or: + - api: System.IO.Compression.GZipStream::ctor diff --git a/nursery/create-process-via-wmi.yml b/nursery/create-process-via-wmi-in-dotnet.yml similarity index 87% rename from nursery/create-process-via-wmi.yml rename to nursery/create-process-via-wmi-in-dotnet.yml index f309d8ff..d03178ec 100644 --- a/nursery/create-process-via-wmi.yml +++ b/nursery/create-process-via-wmi-in-dotnet.yml @@ -1,7 +1,7 @@ rule: meta: - name: create process via wmi - namespace: host-interaction/wmi/dotnet + name: create process via WMI in .NET + namespace: host-interaction/wmi authors: - anushka.virgaonkar@mandiant.com scope: function diff --git a/nursery/execute-sqlite-statement-in-dotnet.yml b/nursery/execute-sqlite-statement-in-dotnet.yml new file mode 100644 index 00000000..02263b3c --- /dev/null +++ b/nursery/execute-sqlite-statement-in-dotnet.yml @@ -0,0 +1,18 @@ +rule: + meta: + name: execute SQLite statement in .NET + namespace: data-manipulation/database/sql + authors: + - michael.hunhoff@mandiant.com + scope: function + features: + - and: + - or: + - api: System.Data.SQLite.SQLiteCommand::ExecuteReader + - api: System.Data.SQLite.SQLiteCommand::ExecuteReaderAsync + - api: System.Data.SQLite.SQLiteCommand::ExecuteScalar + - api: System.Data.SQLite.SQLiteCommand::ExecuteDbDataReader + - api: System.Data.SQLite.SQLiteCommand::ExecuteDbDataReaderAsync + - api: System.Data.SQLite.SQLiteCommand::ExecuteNonQuery + - optional: + - api: System.Data.SQLite.SQLiteCommand::ctor diff --git a/nursery/execute-via-asynchronous-task-in-dotnet.yml b/nursery/execute-via-asynchronous-task-in-dotnet.yml new file mode 100644 index 00000000..729b451d --- /dev/null +++ b/nursery/execute-via-asynchronous-task-in-dotnet.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: execute via asynchronous task in .NET + namespace: host-interaction/thread/task + authors: + - michael.hunhoff@mandiant.com + scope: function + features: + - or: + - api: System.Threading.Tasks.Task::ctor diff --git a/nursery/execute-via-timer-in-dotnet.yml b/nursery/execute-via-timer-in-dotnet.yml new file mode 100644 index 00000000..494d98cc --- /dev/null +++ b/nursery/execute-via-timer-in-dotnet.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: execute via timer in .NET + namespace: host-interaction/thread/timer + authors: + - michael.hunhoff@mandiant.com + scope: function + features: + - or: + - api: System.Threading.Timer::ctor diff --git a/nursery/execute-wmi-query-in-dotnet.yml b/nursery/execute-wmi-query-in-dotnet.yml new file mode 100644 index 00000000..8062e692 --- /dev/null +++ b/nursery/execute-wmi-query-in-dotnet.yml @@ -0,0 +1,14 @@ +rule: + meta: + name: execute WMI query in .NET + namespace: host-interaction/wmi + authors: + - michael.hunhoff@mandiant.com + scope: function + att&ck: + - Execution::Windows Management Instrumentation [T1047] + features: + - and: + - api: System.Management.ManagementObjectSearcher::Get + - optional: + - api: System.Management.ManagementObjectSearcher::ctor diff --git a/nursery/find-data-using-regex-in-dotnet.yml b/nursery/find-data-using-regex-in-dotnet.yml index 6ab22f9a..7345f166 100644 --- a/nursery/find-data-using-regex-in-dotnet.yml +++ b/nursery/find-data-using-regex-in-dotnet.yml @@ -13,3 +13,4 @@ rule: - api: System.Text.RegularExpressions.Regex::EnumerateMatches - api: System.Text.RegularExpressions.Regex::Replace - api: System.Text.RegularExpressions.Regex::Split + - api: System.Text.RegularExpressions.Regex::ctor diff --git a/nursery/manipulate-network-credentials-in-dotnet.yml b/nursery/manipulate-network-credentials-in-dotnet.yml new file mode 100644 index 00000000..38a2df96 --- /dev/null +++ b/nursery/manipulate-network-credentials-in-dotnet.yml @@ -0,0 +1,10 @@ +rule: + meta: + name: manipulate network credentials in .NET + namespace: communication/authentication + authors: + - michael.hunhoff@mandiant.com + scope: function + features: + - and: + - api: System.Net.NetworkCredential::ctor