Skip to content

Instantly share code, notes, and snippets.

@LloydLabs

LloydLabs/Manual_Win64_System_Call.yar

Created July 10, 2021 21:57
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save LloydLabs/bd34bb01f19484fb3470b9cd24688488 to your computer and use it in GitHub Desktop.
Save LloydLabs/bd34bb01f19484fb3470b9cd24688488 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Manual_Win64_System_Call.yar
import "pe"
rule Manual_Win64_System_Call
{
meta:
author = "Lloyd @LloydLabs"
date = "10/07/2021"
description = "Allows to detect within malware when Windows system calls are manually invoked."
strings:
$ = {
4C 8B D1
B8 ?? ?? ?? ??
(0F 05 | CD 2E)
}
condition:
pe.is_pe and all of them
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment