From fcbdeb21efee200ccaee0cf288a56f46de46c5a2 Mon Sep 17 00:00:00 2001 From: Willi Ballenthin Date: Wed, 21 Oct 2020 09:42:51 -0600 Subject: [PATCH] manipulate console: fix logic --- host-interaction/console/manipulate-console.yml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/host-interaction/console/manipulate-console.yml b/host-interaction/console/manipulate-console.yml index f6abf885..464d2ae6 100644 --- a/host-interaction/console/manipulate-console.yml +++ b/host-interaction/console/manipulate-console.yml @@ -9,12 +9,14 @@ rule: examples: - 3aa7ee4d67f562933bc998f352b1f319:0x705413A0 features: - - or: - - api: kernel32.SetConsoleCursorPosition - - api: kernel32.ReadConsoleOutputCharacter - - api: kernel32.WriteConsoleOutputCharacter - - api: kernel32.WriteConsoleOutput - - api: kernel32.WriteConsoleInput + - and: + - or: + - api: kernel32.SetConsoleCursorPosition + - api: kernel32.ReadConsoleOutputCharacter + - api: kernel32.WriteConsoleOutputCharacter + - api: kernel32.WriteConsoleOutput + - api: kernel32.WriteConsoleInput + # see https://github.com/fireeye/capa/issues/348 - optional: - api: kernel32.GetStdHandle - number: 0xfffffff5 = STD_OUTPUT_HANDLE