add runtime resolved functions

mandiant · Oct 11, 2023 · 1be6720 · 1be6720
1 parent 7ddf609
commit 1be6720
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 0 deletions.
diff --git a/lib/allocate-memory.yml b/lib/allocate-memory.yml
@@ -19,3 +19,13 @@ rule:
       - api: ZwAllocateVirtualMemory
       - api: NtMapViewOfSection
       - api: ZwMapViewOfSection
+      - and:
+        - match: link function at runtime on Windows
+        - or:
+          - string: "VirtualAlloc"
+          - string: "VirtualAllocEx"
+          - string: "VirtualAllocExNuma"
+          - string: "NtAllocateVirtualMemory"
+          - string: "ZwAllocateVirtualMemory"
+          - string: "NtMapViewOfSection"
+          - string: "ZwMapViewOfSection"
diff --git a/lib/change-memory-protection.yml b/lib/change-memory-protection.yml
@@ -15,3 +15,10 @@ rule:
       - api: kernel32.VirtualProtectEx
       - api: NtProtectVirtualMemory
       - api: ZwProtectVirtualMemory
+      - and:
+        - match: link function at runtime on Windows
+        - or:
+          - string: "VirtualProtect"
+          - string: "VirtualProtectEx"
+          - string: "NtProtectVirtualMemory"
+          - string: "ZwProtectVirtualMemory"