Create get-operation-system-version.yml

https://github.com/fireeye/capa-rules/issues/28
2026-06-08 15:41:20 +00:00 · 2020-12-30 22:23:34 -03:00
parent c12233d5ae
commit fdf3afe7f6
1 changed files with 14 additions and 0 deletions
@@ -0,0 +1,14 @@
+rule:
+  meta:
+    name: get operation system version
+    namespace: host-interaction/os/version
+    author: johnk3r
+    scope: function
+    att&ck:
+      - Discovery::System Information Discovery [T1082]
+    examples:
+      - f4584aed97469c461826ea17ca9b3c1d:0x40589F
+  features:
+    - or:
+      - api: VerifyVersionInfo
+      - api: VerSetConditionMask