Create add-value-to-global-atom-table.yml

mandiant · Sep 23, 2023 · 1f3e403 · 1f3e403
1 parent b9c2bc1
commit 1f3e403
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/nursery/add-value-to-global-atom-table.yml b/nursery/add-value-to-global-atom-table.yml
@@ -0,0 +1,13 @@
+rule:
+  meta:
+    name: add value to global atom table
+    namespace: host-interaction/process/inject
+    authors:
+      - "@mr-tz"
+    scope: function
+    references:
+      - https://www.fortinet.com/blog/threat-research/atombombing-brand-new-code-injection-technique-for-windows
+      - https://github.com/BreakingMalwareResearch/atom-bombing
+  features:
+    - and:
+      - api: GlobalAddAtom