admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

manipulate console: fix logic

Browse Source
This commit is contained in:
Willi Ballenthin
2020-10-21 09:42:51 -06:00
committed by GitHub
parent 0ba3bf1830
commit fcbdeb21ef
1 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host-interaction/console/manipulate-console.yml
+8 -6
View File
@@ -9,12 +9,14 @@ rule:
examples:
- 3aa7ee4d67f562933bc998f352b1f319:0x705413A0
features:
- or:
- api: kernel32.SetConsoleCursorPosition
- api: kernel32.ReadConsoleOutputCharacter
- api: kernel32.WriteConsoleOutputCharacter
- api: kernel32.WriteConsoleOutput
- api: kernel32.WriteConsoleInput
- and:
- or:
- api: kernel32.SetConsoleCursorPosition
- api: kernel32.ReadConsoleOutputCharacter
- api: kernel32.WriteConsoleOutputCharacter
- api: kernel32.WriteConsoleOutput
- api: kernel32.WriteConsoleInput
# see https://github.com/fireeye/capa/issues/348
- optional:
- api: kernel32.GetStdHandle
- number: 0xfffffff5 = STD_OUTPUT_HANDLE