-
Notifications
You must be signed in to change notification settings - Fork 20
/
SUSP_MinimalImports.yar
31 lines (27 loc) · 1010 Bytes
/
SUSP_MinimalImports.yar
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
import "pe"
rule SUSP_MinimalImports_LoadLibrary_and_GetModuleFileName
{
meta:
author = "Greg Lesnewich"
description = "look for PE's that import less than 10 functions, 2 of which are variants of LoadLibrary and GetModuleFileName, likely to resolve additional APIs"
date = "2024-01-26"
version = "1.0"
DaysOfYara = "26/100"
condition:
pe.number_of_imported_functions < 10 and
pe.imports(/kernel32.dll/i, /LoadLibrary(A|ExA|ExW|W)/i) and
pe.imports(/kernel32.dll/i, /GetModuleFileName(A|ExA|ExW|W)/i)
}
rule SUSP_MinimalImports_LoadLibrary_and_GetProcAddress
{
meta:
author = "Greg Lesnewich"
description = "look for PE's that import less than 10 functions, 2 of which are variants of LoadLibrary and GetProcAddress, likely to resolve additional APIs"
date = "2024-01-26"
version = "1.0"
DaysOfYara = "26/100"
condition:
pe.number_of_imported_functions < 10 and
pe.imports(/kernel32.dll/i, /LoadLibrary(A|ExA|ExW|W)/i) and
pe.imports("kernel32.dll", "GetProcAddress")
}