Create add-value-to-global-atom-table.yml (#831)

* Create add-value-to-global-atom-table.yml
mandiant · Oct 10, 2023 · 773c75c · 773c75c
1 parent 330d0f9
commit 773c75c
Showing 1 changed file with 15 additions and 0 deletions.
diff --git a/nursery/add-value-to-global-atom-table.yml b/nursery/add-value-to-global-atom-table.yml
@@ -0,0 +1,15 @@
+rule:
+  meta:
+    name: add value to global atom table
+    namespace: host-interaction/process/inject
+    authors:
+      - "@mr-tz"
+    scope: function
+    references:
+      - https://www.fortinet.com/blog/threat-research/atombombing-brand-new-code-injection-technique-for-windows
+      - https://github.com/BreakingMalwareResearch/atom-bombing
+  features:
+    - and:
+      - api: AddAtom
+      - api: GlobalAddAtom
+      - api: GlobalAddAtomEx