(YARA) YARA_Detect_Possible_GetForegroundWindow_Evasion
import "pe"
rule UNPROTECT_Possible_GetForegroundWindow_Evasion
{
meta:
description = "Attempts to detect possible usage of sandbox evasion techniques using GetForegroundWindow API, based on module imports."
author = "Kyle Cucci"
date = "2020-09-30"
condition:
uint16(0) == 0x5A4D and
pe.imports("user32.dll", "GetForegroundWindow") and
pe.imports("kernel32.dll", "Sleep")
}
Associated Techniques
No associated technique found so far.
Matching Samples 10 most recent
Sample Name | Matching Techniques | First Seen | Last Seen |
---|---|---|---|
5.exe | 9 | 2025-05-30 | 11 hours, 50 minutes ago |
q.apk.exe | 8 | 2025-05-30 | 11 hours, 51 minutes ago |
familyhook hackvshack.net.dll | 5 | 2025-05-15 | 2 weeks, 1 day ago |
DP_Simple_Player.exe | 5 | 2025-05-13 | 2 weeks, 3 days ago |
Grimace.dll | 6 | 2025-05-11 | 2 weeks, 5 days ago |
hmpalert.exe | 8 | 2025-04-20 | 1 month ago |
DarkComet.exe | 8 | 2025-04-25 | 1 month ago |
DarkComet Remover 2 Portable.exe | 4 | 2025-04-19 | 1 month, 1 week ago |
FBH.dll | 10 | 2025-03-22 | 2 months, 1 week ago |
OutlastDev hackvshack.net.dll | 4 | 2025-03-02 | 2 months, 4 weeks ago |
Created
June 20, 2022
Last Revised
June 20, 2022