capa-rules/host-interaction/file-system/write/write-file-on-windows.yml at v8.0.0 · mandiant/capa-rules · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
rule:
  meta:
    name: write file on Windows
    namespace: host-interaction/file-system/write
    authors:
      - william.ballenthin@mandiant.com
      - anushka.virgaonkar@mandiant.com
    scopes:
      static: function
      dynamic: call
    mbc:
      - File System::Writes File [C0052]
    examples:
      - Practical Malware Analysis Lab 01-04.exe_:0x4011FC
      # ntdll
      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x1400025C4
  features:
    - or:
      - and:
        - os: windows
        - optional:
          - basic block:
            - or:
              - number: 0x40000000 = GENERIC_WRITE
              - number: 0x2 = FILE_WRITE_DATA
              - match: create or open file
          - call:
            - or:
              - number: 0x40000000 = GENERIC_WRITE
              - number: 0x2 = FILE_WRITE_DATA
              - match: create or open file
        - or:
          - api: kernel32.WriteFile
          - api: kernel32.WriteFileEx
          - api: NtWriteFile
          - api: ZwWriteFile
          - api: _fwrite
          - api: fwrite
      - api: System.IO.File::WriteAllBytes
      - api: System.IO.File::WriteAllBytesAsync
      - api: System.IO.File::WriteAllLines
      - api: System.IO.File::WriteAllLinesAsync
      - api: System.IO.File::WriteAllText
      - api: System.IO.File::WriteAllTextAsync
      - api: System.IO.File::AppendAllLines
      - api: System.IO.File::AppendAllLinesAsync
      - api: System.IO.File::AppendAllText
      - api: System.IO.File::AppendAllTextAsync
      - api: System.IO.File::AppendText
      - api: System.IO.FileInfo::AppendText