mandiant / mandiant/capa-rules
access PEB ldr_data
Open
false positive
- Dominant language
- No language data
- Stars
- 736
- Forks
- 245
- Avg merge
- 4d 53m
- Merged PRs (30d)
- 2
Description
I think we can use operand[1].offset here to reduce FPs, examples:
Contributor guide
Research direction
No rule file or test is named. Start by locating the rule related to accessing PEB ldr_data and review the two attached examples, then inspect how operand[1].offset could be used. Done means the rule is narrowed to reduce the reported false positives without losing the intended matches.
Written by the indexing model from the issue text.
Assessment
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100