Commit 9046badb by Marc Rivero López Committed by GitHub

Update MALW_CAP_Win32Inet.yara

parent e523343c
...@@ -9,35 +9,43 @@ ...@@ -9,35 +9,43 @@
rule Str_Win32_Winsock2_Library rule Str_Win32_Winsock2_Library
{ {
meta: meta:
author = "@adricnet" author = "@adricnet"
description = "Match Winsock 2 API library declaration" description = "Match Winsock 2 API library declaration"
method = "String match" method = "String match"
strings: strings:
$ws2_lib = "Ws2_32.dll" nocase $ws2_lib = "Ws2_32.dll" nocase
$wsock2_lib = "WSock32.dll" nocase $wsock2_lib = "WSock32.dll" nocase
condition: condition:
(any of ($ws2_lib, $wsock2_lib)) (any of ($ws2_lib, $wsock2_lib))
} }
rule Str_Win32_Wininet_Library rule Str_Win32_Wininet_Library
{ {
meta: meta:
author = "@adricnet" author = "@adricnet"
description = "Match Windows Inet API library declaration" description = "Match Windows Inet API library declaration"
method = "String match" method = "String match"
strings: strings:
$wininet_lib = "WININET.dll" nocase $wininet_lib = "WININET.dll" nocase
condition: condition:
(all of ($wininet*)) (all of ($wininet*))
} }
rule Str_Win32_Internet_API rule Str_Win32_Internet_API
{ {
meta: meta:
author = "@adricnet" author = "@adricnet"
description = "Match Windows Inet API call" description = "Match Windows Inet API call"
method = "String match, trim the As" method = "String match, trim the As"
strings: strings:
$wininet_call_closeh = "InternetCloseHandle" $wininet_call_closeh = "InternetCloseHandle"
$wininet_call_readf = "InternetReadFile" $wininet_call_readf = "InternetReadFile"
...@@ -54,6 +62,7 @@ rule Str_Win32_Http_API ...@@ -54,6 +62,7 @@ rule Str_Win32_Http_API
author = "@adricnet" author = "@adricnet"
description = "Match Windows Http API call" description = "Match Windows Http API call"
method = "String match, trim the As" method = "String match, trim the As"
strings: strings:
$wininet_call_httpr = "HttpSendRequest" $wininet_call_httpr = "HttpSendRequest"
$wininet_call_httpq = "HttpQueryInfo" $wininet_call_httpq = "HttpQueryInfo"
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment