Add new rule persist-via-shellserviceobjectdelayload-registry-key.yml#1117
Add new rule persist-via-shellserviceobjectdelayload-registry-key.yml#1117xpzhxhm wants to merge 2 commits intomandiant:masterfrom
Conversation
mike-hunhoff
left a comment
mike-hunhoff
left a comment
There was a problem hiding this comment.
Great, thanks @xpzhxhm . I've left comments for your review.
| namespace: persistence/registry | ||
| authors: | ||
| - xpzhxhm@gmail.com | ||
| description: Match on files using ShellServiceObjectDelayLoad to persist |
There was a problem hiding this comment.
Please expand this description to include how modifying this particular registry key achieves persistence.
| - xpzhxhm@gmail.com | ||
| description: Match on files using ShellServiceObjectDelayLoad to persist | ||
| scopes: | ||
| static: file |
There was a problem hiding this comment.
What about function or basic block scopes?
| - https://blog.virustotal.com/2024/03/com-objects-hijacking.html | ||
| examples: | ||
| - c05ec67e75693127e5556eee229b88f93c7cef926cfe905dfd5464be9d305c94 | ||
|
|
Update rules and description, improve scope to function/basic block by adding HKLM constant, remove blank line.
|
Hi @mike-hunhoff. |
|
I confirmed in IDA that this sample uses a helper function to write to the registry. The HKLM constant 0x80000002 and the string |
2 participants
Add new rule persist-via-shellserviceobjectdelayload-registry-key.yml
Closes #1114
Ref mandiant/capa-testfiles#303
https://blog.virustotal.com/2024/03/com-objects-hijacking.html