Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

encrypt data using RC4 via SystemFunction032 #825

Merged
merged 7 commits into from
Oct 10, 2023

Conversation

richardweiss80
Copy link
Contributor

Added Advapi32.SystemFunction032 capa rule.

Kind regards,
Richard

@google-cla
Copy link

google-cla bot commented Sep 5, 2023

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

Copy link
Collaborator

@mr-tz mr-tz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome, thanks! just a few minor comments.

nursery/encrypt-data-using-rc4-via-systemfunction032.yml Outdated Show resolved Hide resolved
nursery/encrypt-data-using-rc4-via-systemfunction032.yml Outdated Show resolved Hide resolved
nursery/encrypt-data-using-rc4-via-systemfunction032.yml Outdated Show resolved Hide resolved
Copy link
Collaborator

@mr-tz mr-tz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

great, thanks!

Comment on lines 21 to 25
- and:
- or:
- string: /advapi32/i
- string: /cryptsp/i
- string: "SystemFunction032"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh, one other idea: how about an optional: match: link function at runtime on Windows?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome idea, will add and test it

Copy link
Collaborator

@mr-tz mr-tz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks, also see https://github.com/mandiant/capa-rules/pull/828/files
both rules should be consistent now

@mr-tz mr-tz merged commit 18f8a33 into mandiant:master Oct 10, 2023
3 checks passed
@mr-tz
Copy link
Collaborator

mr-tz commented Oct 10, 2023

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants