mandiant / mandiant/capa-rules
patch process command line
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 736
- Forks
- 245
- Avg merge
- 4d 53m
- Merged PRs (30d)
- 2
Description
## Summary
Rule Name: `patch process command line`
The rule doesn't catch when the attacker gets the address of the command line using the structures `PEB` and `RTL_USER_PROCESS_PARAMETERS` from `winternl.h`.
## Examples
536c78f6f472a8e92c6f75e9535f23aa64917435639d8f9426bb14afc83c488e:0x140001500
Source Code: https://github.com/getel-arch/Hide-LOLBins/blob/main/src/hide_lolbins.c
## Possible improvements
* Runtime linking for NtQueryInformationProcess doesn't need to be required
* VirtualProtect is not required if the attacker creates the process with command line of the same length (in my example I've replaced the arguments with spaces)
* Needs to figure out an elegant way to detect usage of specific structure (I don't really have an insight on that)
## Additional context
None for now
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the `patch process command line` rule and the linked Hide-LOLBins C example, focusing on the PEB and RTL_USER_PROCESS_PARAMETERS path described in the issue. Review how the rule currently detects command-line patching and assess the listed NtQueryInformationProcess and VirtualProtect cases. Done means the rule catches the demonstrated behavior without requiring those APIs in every case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- reverse-engineering, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100