enumerate-files-via-ntdll-functions.yml

rule:
  meta:
    name: enumerate files via ntdll functions
    namespace: host-interaction/file-system/files/list
    authors:
      - moritz.raabe@mandiant.com
    scope: function
    att&ck:
      - Discovery::File and Directory Discovery [T1083]
    references:
      - https://github.com/hfiref0x/TDL/blob/cc4b46ae1c939b14a22a734a727b163f873a41b5/Source/Furutaka/sup.c#L315
    examples:
      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x14000203C
  features:
    - and:
      - basic block:
        - and:
          - number: 1 = DIRECTORY_QUERY
          - api: ntdll.NtOpenDirectoryObject
      - api: ntdll.NtQueryDirectoryObject
      - optional:
        - api: RtlAllocateHeap
        - match: contain loop
        - characteristic: indirect call