mirror of
https://github.com/mandiant/capa-rules
synced 2026-06-08 15:41:20 +00:00
Hafiz Farhad
77f06fd049
* Separate socket connection rules for TCP and UDP - Introduce a generic "connect socket" rule capturing common connection APIs (connect, ws2_32.connect, WSAConnect, ConnectEx, and related ConnectEx setup patterns). - Refactor the TCP connect rule to require a match on "create TCP socket" and the generic rule, preserving TCP-specific behaviors while maximizing reuse. - Add a new UDP connect rule that requires a match on "create UDP socket" and the generic connect rule. Closes #965. * Update socket rule examples with correct offsets for UDP/TCP * Updated suggested changes
71 lines
2.2 KiB
YAML
71 lines
2.2 KiB
YAML
rule:
|
|
meta:
|
|
name: connect socket
|
|
namespace: communication/socket
|
|
authors:
|
|
- moritz.raabe@mandiant.com
|
|
- joakim@intezer.com
|
|
- mrhafizfarhad@gmail.com
|
|
description: Detects socket connection attempts using common APIs or ConnectEx setup.
|
|
scopes:
|
|
static: basic block
|
|
dynamic: span of calls
|
|
examples:
|
|
- Practical Malware Analysis Lab 01-01.dll_:0x10001010
|
|
features:
|
|
- or:
|
|
- api: connect
|
|
- api: ws2_32.connect
|
|
- api: ws2_32.#4 = connect
|
|
- api: ws2_32.WSAConnect
|
|
- api: ws2_32.#33 = WSAConnect
|
|
- api: ConnectEx
|
|
- or:
|
|
- and:
|
|
# static
|
|
- basic block:
|
|
# candidate for GUID: WSAID_CONNECTEX/25a207b9-ddf3-4660-8ee9-76e58c74063e
|
|
- and:
|
|
- number: 0x25A207B9
|
|
- number: 0x4660DDF3
|
|
- number: 0xE576E98E
|
|
- number: 0x3E06748C
|
|
- basic block:
|
|
- and:
|
|
- or:
|
|
- api: ws2_32.WSAIoctl
|
|
- api: ws2_32.#60 = WSAIoctl
|
|
- number: 0xC8000006 = SIO_GET_EXTENSION_FUNCTION_POINTER
|
|
- basic block:
|
|
- and:
|
|
- or:
|
|
- api: setsockopt
|
|
- api: ws2_32.#21 = setsockopt
|
|
- number: 0xFFFF = SOL_SOCKET
|
|
- number: 0x7010 = SO_UPDATE_CONNECT_CONTEXT
|
|
# socket must be bound to ConnectEx
|
|
# https://gist.github.com/joeyadams/4158972
|
|
- or:
|
|
- api: bind
|
|
- api: ws2_32.#2 = bind
|
|
- and:
|
|
# dynamic
|
|
- call:
|
|
- and:
|
|
- or:
|
|
- api: ws2_32.WSAIoctl
|
|
- api: ws2_32.#60 = WSAIoctl
|
|
- number: 0xC8000006 = SIO_GET_EXTENSION_FUNCTION_POINTER
|
|
- call:
|
|
- and:
|
|
- or:
|
|
- api: setsockopt
|
|
- api: ws2_32.#21 = setsockopt
|
|
- number: 0xFFFF = SOL_SOCKET
|
|
- number: 0x7010 = SO_UPDATE_CONNECT_CONTEXT
|
|
# socket must be bound to ConnectEx
|
|
# https://gist.github.com/joeyadams/4158972
|
|
- or:
|
|
- api: bind
|
|
- api: ws2_32.#2 = bind
|