mandiant / mandiant/capa-rules
[Rule Idea] - Hide Desktop Icons
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 736
- Forks
- 245
- Avg merge
- 4d 53m
- Merged PRs (30d)
- 2
Description
## Prerequisites
* [x] Put an X between the brackets on this line if you have done all of the following:
* Checked that your rule idea isn't already filed: [search](https://github.com/fireeye/capa-rules/issues?q=is%3Aissue+is%3Aopen+)
## Summary
A ransomware-like technique to hide desktop icons.
## Examples
Code segment is here -> https://vxug.fakedoma.in/papers/VXUG/Exclusive/HideDesktopIcons.cpp
## Features
* Folder flags of `0x00001000 = FWF_NOICONS`
* SetCurrentFolderFlags
## Additional context
## Rule details
### Namespace
* `host-interaction/gui/window/hide/`
### References
* https://vxug.fakedoma.in/papers/VXUG/Exclusive/HideDesktopIcons.cpp
### Other rule meta information
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the referenced HideDesktopIcons.cpp and the listed FWF_NOICONS and SetCurrentFolderFlags indicators. Add a capa rule under the specified host-interaction/gui/window/hide/ namespace that represents this behavior, and verify that the rule recognizes the referenced technique.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100