mandiant / mandiant/capa-rules
mimikatz.exe_: enumerate PE sections
Open
false positive
- Dominant language
- No language data
- Stars
- 736
- Forks
- 245
- Avg merge
- 4d 53m
- Merged PRs (30d)
- 2
Description
Function: `0x4579D5`
What it does: Calls `EnumerateSecurityPackagesW` and iterates the results.
Why it matches: The loop iterates over `SecPkgInfo` structures. capa confused the struct member access offsets (like `0x6`, `0x14`) with PE Header offsets (`NumberOfSections`, `SizeOfRawData`).
Contributor guide
Research direction
Start with function 0x4579D5 in mimikatz.exe and trace the EnumerateSecurityPackagesW call and SecPkgInfo member offsets. Locate the relevant capa rule and verify that its matching logic no longer treats these accesses as PE header fields.
Written by the indexing model from the issue text.
Assessment
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100