mirror of
https://github.com/mandiant/capa-rules
synced 2026-06-08 15:41:20 +00:00
Yacine Elhamer
31 lines
1.1 KiB
YAML
31 lines
1.1 KiB
YAML
rule:
|
|
meta:
|
|
name: disable driver code integrity
|
|
namespace: host-interaction/driver
|
|
authors:
|
|
- william.ballenthin@mandiant.com
|
|
scopes:
|
|
static: function
|
|
dynamic: unspecified # rule hasn't been migrated yet
|
|
att&ck:
|
|
- Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001]
|
|
mbc:
|
|
- Defense Evasion::Disable or Evade Security Tools::Disable Code Integrity [F0004.009]
|
|
references:
|
|
- https://www.fuzzysecurity.com/tutorials/28.html
|
|
- https://j00ru.vexillium.org/2010/06/insight-into-the-driver-signature-enforcement/
|
|
examples:
|
|
- 31CEE4F66CF3B537E3D2D37A71F339F4:0x140004070
|
|
features:
|
|
- and:
|
|
- or:
|
|
- string: "CiInitialize"
|
|
description: exported symbol name used to resolve code integrity configuration
|
|
- substring: "g_CiEnabled"
|
|
description: non-exported name for code integrity flag
|
|
- substring: "g_CiOptions"
|
|
description: non-exported name for code integrity settings
|
|
- optional:
|
|
- string: /CI.dll/i
|
|
description: code integrity implementation DLL
|