mirror of
https://github.com/mandiant/capa-rules
synced 2026-06-08 15:41:20 +00:00
Michael Hunhoff
26 lines
855 B
YAML
26 lines
855 B
YAML
rule:
|
|
meta:
|
|
name: delay execution
|
|
author: michael.hunhoff@fireeye.com
|
|
lib: true
|
|
scope: function
|
|
references:
|
|
- https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions
|
|
- https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp
|
|
examples:
|
|
- al-khaser_x86.exe_:0x449770
|
|
features:
|
|
- or:
|
|
- api: kernel32.Sleep
|
|
- api: kernel32.SleepEx
|
|
- api: NtDelayExecution
|
|
- api: WaitOnAddress
|
|
- api: kernel32.WaitForSingleObject
|
|
- api: kernel32.WaitForSingleObjectEx
|
|
- api: kernel32.WaitForMultipleObjects
|
|
- api: kernel32.WaitForMultipleObjectsEx
|
|
- api: kernel32.SignalObjectAndWait
|
|
- api: user32.MsgWaitForMultipleObjects
|
|
- api: user32.MsgWaitForMultipleObjectsEx
|
|
- api: kernel32.RegisterWaitForSingleObject
|