Repository navigation
Add PEB walking shellcode and known prologue shellcode yara rules - #606
Merged
Merged
Conversation
Added rules for detecting PEB walking (https://moval0x1.github.io/posts/the-peb-walk-anatomy/) in 32-bit and 64-bit architectures with relevant strings and conditions. Partial hand written but then used LLMs to improve, Shellcode_PEB_Walk_x86 44036734cd4197001620eba4d3227130.bin (from b9759ebc4a52c50e89ef4f1245cfe9d32c70b6666eb69b4a09f9ac199b516a48, this injects this shellcode into headless chrome for MINTSLOADER in-memory stager which then leads to ransomware attack) Shellcode_PEB_Walk_x64 unpackedshellcode_91817_be08d24b3b6d1ae15da0302ae0780dfaa56b509fe2e9bd39fc8449fdffd83708/be08d24b3b6d1ae15da0302ae0780dfaa56b509fe2e9bd39fc8449fdffd83708 (f9716135b3eb5b91e697cb02fda30a5c1d0de0867382d9f5b99ac576d9bacf48 GhostSocks) Shellcode_PEB_Walk_x86 HATBDFPHB2P9ISL6W008RJ.exe
Added a rule to detect common position-independent shellcode bootstrap prologues.
kevross33
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Added rules for detecting PEB walking (https://moval0x1.github.io/posts/the-peb-walk-anatomy/) in 32-bit and 64-bit architectures with relevant strings and conditions. Partial hand written but then used LLMs to improve.
Also rule for detecting known prologues seen in position independent code from various frameworks.
Shellcode_PEB_Walk_x86 44036734cd4197001620eba4d3227130.bin
Shellcode_GetPC_Bootstrap_Known_Prologue 44036734cd4197001620eba4d3227130.bin
(from b9759ebc4a52c50e89ef4f1245cfe9d32c70b6666eb69b4a09f9ac199b516a48, this injects this shellcode into headless chrome for MINTSLOADER in-memory stager which then leads to ransomware attack) Shellcode_PEB_Walk_x64 unpackedshellcode_91817_be08d24b3b6d1ae15da0302ae0780dfaa56b509fe2e9bd39fc8449fdffd83708/be08d24b3b6d1ae15da0302ae0780dfaa56b509fe2e9bd39fc8449fdffd83708
Shellcode_GetPC_Bootstrap_Known_Prologue unpackedshellcode_91817_be08d24b3b6d1ae15da0302ae0780dfaa56b509fe2e9bd39fc8449fdffd83708/be08d24b3b6d1ae15da0302ae0780dfaa56b509fe2e9bd39fc8449fdffd83708
(f9716135b3eb5b91e697cb02fda30a5c1d0de0867382d9f5b99ac576d9bacf48 GhostSocks) Shellcode_PEB_Walk_x86 HATBDFPHB2P9ISL6W008RJ.exe