mandiant / mandiant/capa-rules

delay execution: add Beep WinAPI

Open
#915 0 comments 1 reaction 0 assignees View on GitHub
rule idea
Dominant language
No language data
Stars
736
Forks
245
Avg merge
4d 53m
Merged PRs (30d)
2

Description

## Summary

The [Beep](https://learn.microsoft.com/en-us/windows/win32/api/utilapiset/nf-utilapiset-beep) WinAPI allows programs to generate simple beep sounds through the computer's speaker. It takes two parameters: frequency (in Hertz) and duration (in milliseconds).

```cpp
BOOL Beep(
[in] DWORD dwFreq,
[in] DWORD dwDuration
);
```

When called, `Beep` invokes `NtDelayExecution`, which pauses the execution of the calling thread for a specified duration.

## Additional context
https://thehackernews.com/2023/02/experts-warn-of-beep-new-evasive.html
https://securityliterate.com/beeeeeeeeep-how-malware-uses-the-beep-winapi-function-for-anti-analysis/

Contributor guide

Open the contributing guide

Research direction

Read the linked capa rule-name and format convention first, then review how rules represent API behavior. Use the Beep WinAPI documentation and the stated NtDelayExecution behavior to define the rule's scope. Done means adding a rule for this capability and validating it against an appropriate sample or test if the repository provides one.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
operating-systems, reverse-engineering, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.