mirror of
https://github.com/mandiant/capa-rules
synced 2026-06-08 15:41:20 +00:00
Willi Ballenthin
38 lines
1.2 KiB
YAML
38 lines
1.2 KiB
YAML
rule:
|
|
meta:
|
|
name: PEB access
|
|
authors:
|
|
- michael.hunhoff@mandiant.com
|
|
lib: true
|
|
scope: basic block
|
|
mbc:
|
|
- Anti-Behavioral Analysis::Debugger Detection::Process Environment Block [B0001.019]
|
|
references:
|
|
- https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp
|
|
examples:
|
|
- al-khaser_x86.exe_:0x420D20
|
|
features:
|
|
- or:
|
|
- characteristic: peb access
|
|
- and:
|
|
# https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp#L41
|
|
- characteristic: fs access
|
|
- or:
|
|
- offset/x32: 0x30
|
|
- and:
|
|
- number/x32: 0x30
|
|
- mnemonic: add
|
|
- and:
|
|
- characteristic: gs access
|
|
- or:
|
|
- offset/x64: 0x60
|
|
- and:
|
|
- number/x64: 0x60
|
|
- mnemonic: add
|
|
- and:
|
|
# WoW64 PEB address is fetched via the WoW64 Thread Environment Block (TEB) at FS:[0x18]-0x2000
|
|
# https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp#L45
|
|
- characteristic: fs access
|
|
- mnemonic: sub
|
|
- number: 0x2000
|