mandiant / mandiant/capa-rules

terminate process

Open
#299 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

false positive
Dominant language
No language data
Stars
736
Forks
245
Avg merge
4d 53m
Merged PRs (30d)
2

Description

## Summary

`terminate process` false positive that's hitting on the `__invoke_watson` function.

## Examples

Sample SHA256: `563dd5a95f439bc2b4170a74c8be565a1af076e6cbebd1d018b2809a1e8bc908`
Offset: `0x39DC`

## Possible improvements

Rule out non-library hits based on the `TerminateProcess` `uExitCode` value (i.e., `0xC0000417`)?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by examining the rule that matches `TerminateProcess` at offset `0x39DC` in sample SHA256 `563dd5a95f439bc2b4170a74c8be565a1af076e6cbebd1d018b2809a1e8bc908`, especially the `__invoke_watson` hit. Reproduce the detection and verify whether the `uExitCode` value distinguishes the library call from the intended capability; done means the false positive is no longer reported without losing valid hits.

Written by the indexing model from the issue text.

Assessment

Domain
reverse-engineering, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.