Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade rules for static and dynamic scopes #837

Closed
wants to merge 2 commits into from
Closed

Upgrade rules for static and dynamic scopes #837

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
364413c
upgraded rules using script
mr-tz Oct 13, 2023
1451da7
manual upgrades
mr-tz Oct 16, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
4 changes: 3 additions & 1 deletion ...alysis/anti-av/block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-av
authors:
- [email protected]
scope: basic block
scopes:
static: basic block
dynamic: call # TODO check if scope thread instead
mr-tz marked this conversation as resolved.
Show resolved Hide resolved
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: call # TODO check if scope thread instead
dynamic: call

att&ck:
- Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-av
authors:
- "@_re_fox"
scope: basic block
scopes:
static: basic block
dynamic: call # TODO check if scope thread instead
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: call # TODO check if scope thread instead
dynamic: thread

mbc:
- Anti-Behavioral Analysis::Virtual Machine Detection [B0009]
- Anti-Behavioral Analysis::Sandbox Detection [B0007]
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-av/patch-event-tracing-for-windows-function.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-av
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # TODO upgrade manually, contains match
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains match
dynamic: thread

att&ck:
- Defense Evasion::Impair Defenses::Indicator Blocking [T1562.006]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-av/protect-spawned-processes-with-mitigation-policies.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-av
authors:
- [email protected]
scope: basic block
scopes:
static: basic block
dynamic: call # TODO check if scope thread instead
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: call # TODO check if scope thread instead
dynamic: call

att&ck:
- Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ rule:
authors:
- [email protected]
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # TODO upgrade manually, contains unsupported feature property for dynamic scope
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains unsupported feature property for dynamic scope
dynamic: call

mbc:
- Anti-Behavioral Analysis::Debugger Detection::CheckRemoteDebuggerPresent [B0001.002]
- Anti-Behavioral Analysis::Debugger Detection::WudfIsAnyDebuggerPresent [B0001.031]
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # TODO upgrade manually, contains unsupported feature mnemonic for dynamic scope
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains unsupported feature mnemonic for dynamic scope
dynamic: unsupported

mbc:
- Anti-Behavioral Analysis::Debugger Detection::Hardware Breakpoints [B0001.005]
references:
Expand Down
4 changes: 3 additions & 1 deletion ...debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # TODO upgrade manually, contains Subscope
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains Subscope
dynamic: unsupported

mbc:
- Anti-Behavioral Analysis::Debugger Detection [B0001]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-for-outputdebugstring-error.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: basic block
scopes:
static: basic block
dynamic: call # TODO check if scope thread instead
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: call # TODO check if scope thread instead
dynamic: thread

mbc:
- Anti-Behavioral Analysis::Debugger Detection::OutputDebugString [B0001.016]
examples:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: basic block
scopes:
static: basic block
dynamic: unspecified # TODO upgrade manually, contains match
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains match
dynamic: unsupported

mbc:
- Anti-Behavioral Analysis::Debugger Detection::Process Environment Block BeingDebugged [B0001.035]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # TODO upgrade manually, contains Subscope
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains Subscope
dynamic: unsupported

mbc:
- Anti-Behavioral Analysis::Debugger Detection::Process Environment Block NtGlobalFlag [B0001.036]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-for-protected-handle-exception.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # TODO upgrade manually, contains Subscope
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this one is a bit more tricky

mbc:
- Anti-Behavioral Analysis::Debugger Detection::SetHandleInformation [B0001.024]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # TODO upgrade manually, contains Subscope
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains Subscope
dynamic: unsupported

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we add comments on why this is for each rule?

mbc:
- Anti-Behavioral Analysis::Debugger Detection::Software Breakpoints [B0001.025]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # TODO upgrade manually, contains Subscope
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains Subscope
dynamic: unsupported # requires low-level mnemonic features

mbc:
- Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCount [B0001.032]
examples:
Expand Down
4 changes: 3 additions & 1 deletion ...is/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: thread
mbc:
- Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check QueryPerformanceCounter [B0001.033]
examples:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: basic block
scopes:
static: basic block
dynamic: unspecified # TODO upgrade manually, contains unsupported feature mnemonic for dynamic scope
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains unsupported feature mnemonic for dynamic scope
dynamic: unsupported # requires low-level mnemonic features

mbc:
- Anti-Behavioral Analysis::Debugger Detection [B0001]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-for-unexpected-memory-writes.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: basic block
scopes:
static: basic block
dynamic: call # TODO check if scope thread instead
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: call # TODO check if scope thread instead
dynamic: call

mbc:
- Anti-Behavioral Analysis::Debugger Detection::Memory Write Watching [B0001.010]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-process-job-object.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # TODO upgrade manually, contains match
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains match
dynamic: unsupported # requires `contain loop` match, but could be rewritten for dynamic without this

mbc:
- Anti-Behavioral Analysis::Debugger Detection [B0001]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-processdebugport.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: basic block
scopes:
static: basic block
dynamic: call # TODO check if scope thread instead
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: call # TODO check if scope thread instead
dynamic: call

mbc:
- Anti-Behavioral Analysis::Debugger Detection::NtQueryInformationProcess [B0001.012]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # TODO upgrade manually, contains unsupported feature mnemonic for dynamic scope
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains unsupported feature mnemonic for dynamic scope
dynamic: unsupported # requires low-level mnemonic features

mbc:
- Anti-Behavioral Analysis::Debugger Detection::Anti-debugging Instructions [B0001.034]
examples:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-evasion/hide-thread-from-debugger.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ rule:
authors:
- [email protected]
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # TODO upgrade manually, contains Subscope
att&ck:
- Defense Evasion::Debugger Evasion [T1622]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ rule:
authors:
- [email protected]
description: Looks for instructions related to executing 64-bit code from a 32-bit process (Heaven's Gate)
scope: function
scopes:
static: function
dynamic: unspecified # TODO upgrade manually, contains Subscope
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains Subscope
dynamic: unsupported # requires low-level mnemonic features

mbc:
- Defense Evasion::Disable or Evade Security Tools::Heavens Gate [F0004.008]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-disasm/contain-anti-disasm-techniques.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-disasm
authors:
- [email protected]
scope: file
scopes:
static: file
dynamic: unspecified # TODO upgrade manually, contains match
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains match
dynamic: unsupported # match requires low-level mnemonic features

mbc:
- Anti-Static Analysis::Disassembler Evasion [B0012]
examples:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-emulation/wine
authors:
- "@_re_fox"
scope: function
scopes:
static: function
dynamic: thread
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-forensic/clear-logs
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # TODO upgrade manually, contains Subscope
att&ck:
- Defense Evasion::Indicator Removal::Clear Windows Event Logs [T1070.001]
examples:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-forensic/crash-the-windows-event-logging-service.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-forensic
authors:
- [email protected]
scope: basic block
scopes:
static: basic block
dynamic: call # TODO check if scope thread instead
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: call # TODO check if scope thread instead
dynamic: thread

att&ck:
- Defense Evasion::Impair Defenses::Disable Windows Event Logging [T1562.002]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-forensic/impersonate-file-version-information.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ rule:
authors:
- [email protected]
description: Looks for Windows API calls associated with reading and then writing file version information of executables on disk. Malware can use these calls to overwrite its own version information with that of a legitimate executable on the system (for instance, explorer.exe) to make it appear to be a legitimate application.
scope: function
scopes:
static: function
dynamic: unspecified # TODO upgrade manually, contains match
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains match
dynamic: thread

att&ck:
- Defense Evasion::Indicator Removal [T1070]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-forensic/patch-process-command-line.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ rule:
authors:
- [email protected]
- "@_re_fox"
scope: function
scopes:
static: function
dynamic: unspecified # TODO upgrade manually, contains Subscope
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains Subscope
dynamic: unsupported # requires low-level features

att&ck:
- Defense Evasion::Process Injection [T1055]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-forensic/self-deletion/self-delete.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ rule:
authors:
- [email protected]
- "@mr-tz"
scope: function
scopes:
static: function
dynamic: unspecified # TODO upgrade manually, contains match
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains match
dynamic: thread

att&ck:
- Defense Evasion::Indicator Removal::File Deletion [T1070.004]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-forensic/spoof-parent-pid.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ rule:
namespace: anti-analysis/anti-forensic
authors:
- [email protected]
scope: basic block
scopes:
static: basic block
dynamic: call # TODO check if scope thread instead
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: call # TODO check if scope thread instead
dynamic: call

att&ck:
- Defense Evasion::Access Token Manipulation::Parent PID Spoofing [T1134.004]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-forensic/timestomp/timestomp-file.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-forensic/timestomp
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: thread
att&ck:
- Defense Evasion::Indicator Removal::Timestomp [T1070.006]
examples:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-vm/vm-detection/check-for-foreground-window-switch.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ rule:
authors:
- [email protected]
description: Detect usage of GetForegroundWindow and Sleep APIs to check if there is any foreground window switch. Typically, sandboxes do not switch the foreground window like a user would in a normal environment.
scope: function
scopes:
static: function
dynamic: unspecified # TODO upgrade manually, contains unsupported feature mnemonic for dynamic scope
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains unsupported feature mnemonic for dynamic scope
dynamic: unsupported # match requires low-level mnemonic features

att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks [T1497.002]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-vm/vm-detection
authors:
- "@_re_fox"
scope: function
scopes:
static: function
dynamic: unspecified # TODO upgrade manually, contains match
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains match
dynamic: thread

att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-vm/vm-detection/check-for-sandbox-username-or-hostname.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ rule:
authors:
- "@_re_fox"
- "[email protected]"
scope: function
scopes:
static: function
dynamic: unspecified # TODO upgrade manually, contains match
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains match
dynamic: thread

att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion [T1497]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-vm/vm-detection
authors:
- BitsOfBinary
scope: function
scopes:
static: function
dynamic: thread
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks [T1497.002]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-vm/vm-detection
authors:
- "@_re_fox"
scope: basic block
scopes:
static: basic block
dynamic: unspecified # TODO upgrade manually, contains match
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains match
dynamic: thread

att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-vm/vm-detection
authors:
- "@_re_fox"
scope: function
scopes:
static: function
dynamic: unspecified # TODO upgrade manually, contains match
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: unspecified # TODO upgrade manually, contains match
dynamic: unsupported # contain loop match requires low-level match feature

att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc:
Expand Down
Loading
Loading