extend rule features and rename

mandiant · Dec 2, 2024 · 0e4ebef · 0e4ebef
1 parent 1649218
commit 0e4ebef
Show file tree

Hide file tree

Showing 2 changed files with 35 additions and 26 deletions.
diff --git a/...alysis/anti-av/block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml b/...alysis/anti-av/block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml
diff --git a/anti-analysis/anti-av/protect-process-using-arbitrary-code-guard-or-blockdlls.yml b/anti-analysis/anti-av/protect-process-using-arbitrary-code-guard-or-blockdlls.yml
@@ -0,0 +1,35 @@
+rule:
+  meta:
+    name: protect process using Arbitrary Code Guard or blockdlls
+    namespace: anti-analysis/anti-av
+    authors:
+      - [email protected]
+    scopes:
+      static: basic block
+      dynamic: call
+    att&ck:
+      - Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001]
+    mbc:
+      - Defense Evasion::Disable or Evade Security Tools::Modify Policy [F0004.005]
+    references:
+      - https://blog.xpnsec.com/protecting-your-malware/
+      - https://blogs.windows.com/msedgedev/2017/02/23/mitigating-arbitrary-native-code-execution/
+    examples:
+      - 2ebadd04f0ada89c36c1409b6e96423a68dd77b513db8db3da203c36d3753e5f:0x140002120
+  features:
+    - or:
+      - and:
+        - api: SetProcessMitigationPolicy
+        - number: 4 = sizeof(PROCESS_MITIGATION_DYNAMIC_CODE_POLICY)
+        - number: 1 = set policy.ProhibitDynamicCode
+        - number: 2 = ProcessDynamicCodePolicy
+      - and:
+        - api: SetProcessMitigationPolicy
+        - number: 4 = sizeof(PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY)
+        - number: 1 = set policy.flags to 1
+        - number: 8 = ProcessSignaturePolicy
+      - and:
+        - description: blockdlls
+        - api: InitializeProcThreadAttributeList
+        - number: 0x20007 = PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY
+        - number: 0x100000000000 = PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON