(YARA) YARA_Detect_Possible_GetForegroundWindow_Evasion

Download Raw

import "pe"
 
rule UNPROTECT_Possible_GetForegroundWindow_Evasion
{
    meta:
        description = "Attempts to detect possible usage of sandbox evasion techniques using GetForegroundWindow API, based on module imports."
        author = "Kyle Cucci"
        date = "2020-09-30"
 
    condition:
        uint16(0) == 0x5A4D and
        pe.imports("user32.dll", "GetForegroundWindow") and
        pe.imports("kernel32.dll", "Sleep")
}

Associated Techniques

Matching Samples 10 most recent

Sample Name Matching Techniques First Seen Last Seen
5.exe 9 2025-05-30 11 hours, 50 minutes ago
q.apk.exe 8 2025-05-30 11 hours, 51 minutes ago
familyhook hackvshack.net.dll 5 2025-05-15 2 weeks, 1 day ago
DP_Simple_Player.exe 5 2025-05-13 2 weeks, 3 days ago
Grimace.dll 6 2025-05-11 2 weeks, 5 days ago
hmpalert.exe 8 2025-04-20 1 month ago
DarkComet.exe 8 2025-04-25 1 month ago
DarkComet Remover 2 Portable.exe 4 2025-04-19 1 month, 1 week ago
FBH.dll 10 2025-03-22 2 months, 1 week ago
OutlastDev hackvshack.net.dll 4 2025-03-02 2 months, 4 weeks ago
View All

Created

June 20, 2022

Last Revised

June 20, 2022