mandiant / mandiant/capa-rules
delay execution: add Beep WinAPI
- Dominant language
- No language data
- Stars
- 736
- Forks
- 245
- Avg merge
- 4d 53m
- Merged PRs (30d)
- 2
Description
## Summary
The [Beep](https://learn.microsoft.com/en-us/windows/win32/api/utilapiset/nf-utilapiset-beep) WinAPI allows programs to generate simple beep sounds through the computer's speaker. It takes two parameters: frequency (in Hertz) and duration (in milliseconds).
```cpp
BOOL Beep(
[in] DWORD dwFreq,
[in] DWORD dwDuration
);
```
When called, `Beep` invokes `NtDelayExecution`, which pauses the execution of the calling thread for a specified duration.
## Additional context
https://thehackernews.com/2023/02/experts-warn-of-beep-new-evasive.html
https://securityliterate.com/beeeeeeeeep-how-malware-uses-the-beep-winapi-function-for-anti-analysis/
Contributor guide
Research direction
Read the linked capa rule-name and format convention first, then review how rules represent API behavior. Use the Beep WinAPI documentation and the stated NtDelayExecution behavior to define the rule's scope. Done means adding a rule for this capability and validating it against an appropriate sample or test if the repository provides one.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- operating-systems, reverse-engineering, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100