Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

get-process-filename.yml: added x86 support #945

Merged
merged 10 commits into from
Oct 16, 2024
Merged

get-process-filename.yml: added x86 support #945

Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
22fe57d
Add rule get-process-filename.yml
mwilliams31 Sep 26, 2024
93ff8c0
Merge branch 'mandiant:master' into master
mwilliams31 Sep 27, 2024
634895a
New rule: open-recentdocs-registry-key.yml
mwilliams31 Sep 27, 2024
53c5c48
Added empty line at EOF
mwilliams31 Sep 27, 2024
bbac445
Adding example VMRay archive
mwilliams31 Oct 2, 2024
4e1cf66
Update nursery/open-recentdocs-registry-key.yml
mr-tz Oct 3, 2024
f240bbc
Rename nursery/open-recentdocs-registry-key.yml to host-interaction/r…
mr-tz Oct 3, 2024
a2998d9
Merge branch 'mandiant:master' into master
mwilliams31 Oct 11, 2024
c661125
Merge branch 'mandiant:master' into master
mwilliams31 Oct 15, 2024
67a6c0f
Added x86 support for get-process-filename.yml
mwilliams31 Oct 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 19 additions & 11 deletions host-interaction/process/get-process-filename.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,14 +15,22 @@ rule:
examples:
- cb948b13a5046a692ec3ed8cc16a9566:0x140013ee2
features:
- and:
# example:
# mov rax, gs:60h ; TEB.ProcessEnvironmentBlock
# mov rcx, [rax+18h] ; PEB64.Ldr
# mov rax, [rcx+20h] ; PEB_LDR_DATA.InMemoryOrderModuleList.Flink
# mov rcx, [rax+50h] ; LDR_DATA_TABLE_ENTRY.FullDllName.Buffer
- arch: amd64
- characteristic: peb access
- offset: 0x18 = PEB->Ldr
- offset: 0x20 = PEB->Ldr->InMemoryOrderModuleList->Flink
- offset: 0x50 = PEB->Ldr->InMemoryOrderModuleList->Flink->FullDllName
- or:
- and:
- arch: i386
- characteristic: peb access
- offset: 0x0C = PEB->Ldr
- offset: 0x14 = PEB->Ldr->InMemoryOrderModuleList->Flink
- offset: 0x28 = PEB->Ldr->InMemoryOrderModuleList->Flink->FullDllName

- and:
# example:
# mov rax, gs:60h ; TEB.ProcessEnvironmentBlock
# mov rcx, [rax+18h] ; PEB64.Ldr
# mov rax, [rcx+20h] ; PEB_LDR_DATA.InMemoryOrderModuleList.Flink
# mov rcx, [rax+50h] ; LDR_DATA_TABLE_ENTRY.FullDllName.Buffer
- arch: amd64
- characteristic: peb access
- offset: 0x18 = PEB->Ldr
- offset: 0x20 = PEB->Ldr->InMemoryOrderModuleList->Flink
- offset: 0x50 = PEB->Ldr->InMemoryOrderModuleList->Flink->FullDllName
Loading