(YARA) YARA_Detect_GuardPages
rule Detect_GuardPages: AntiDebug {
meta:
description = "Detect Guard Pages as anti-debug"
author = "Unprotect"
comment = "Experimental rule"
strings:
$1 = "GetSystemInfo" fullword ascii
$2 = "VirtualAlloc" fullword ascii
$3 = "RtlFillMemory" fullword ascii
$4 ="VirtualProtect" fullword ascii
$5 ="VirtualFree" fullword ascii
condition:
uint16(0) == 0x5A4D and filesize < 1000KB and 4 of them
}
Associated Techniques
Technique Name | Technique ID's | Snippet(s) | OS |
---|---|---|---|
Guard Pages | U0102 B0006.006 |
Matching Samples 10 most recent
Sample Name | Matching Techniques | First Seen | Last Seen |
---|---|---|---|
br1.dll | 10 | 2024-12-03 | 1 day, 2 hours ago |
396845aea1f1be292df345ea0a27...e8a89ce9487aea9996771dd7b48c | 6 | 2024-11-19 | 2 weeks, 1 day ago |
23b1971659b16e186f9e1b36d8bc...e512b346e78f77dc314503aac59a | 13 | 2024-11-19 | 2 weeks, 1 day ago |
al-khaser.exe | 24 | 2024-11-13 | 2 weeks, 6 days ago |
wdext.exe | 10 | 2024-11-13 | 3 weeks ago |
Created
June 22, 2022
Last Revised
June 22, 2022