
(CAPA) CAPA_Detect_Confuser
Created the . Updated 1 year, 5 months ago.
rule:
meta:
name: packed with Confuser
namespace: anti-analysis/packer/confuser
authors:
- william.ballenthin@mandiant.com
scope: file
att&ck:
- Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
mbc:
- Anti-Static Analysis::Software Packing::Confuser [F0001.009]
examples:
- b9f5bd514485fb06da39beff051b9fdc
features:
- or:
- string: "ConfusedByAttribute"
Associated Techniques
Technique Name | Technique ID's | Has Snippet(s) |
---|---|---|
ConfuserEx | U1417 |