Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix the dynamic flavor scope for allocate-or-change-rw-memory.yml #860

Merged
merged 3 commits into from
Dec 11, 2023

Conversation

yelhamer
Copy link
Contributor

@yelhamer yelhamer commented Dec 9, 2023

As mentioned by @mike-hunhoff , the rule in its current format can match if the number: 0x4 = PAGE_READWRITE feature is present in another call in the same thread. Setting the rule's dynamic scope to call helps prevent this.

@yelhamer
Copy link
Contributor Author

yelhamer commented Dec 9, 2023

I've fixed two additional rules (allocate-memory.yml and change-memory-protection.yml) that were previously matching at thread level.

Copy link
Collaborator

@mike-hunhoff mike-hunhoff left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

great, thanks!

@mike-hunhoff mike-hunhoff merged commit d19f712 into mandiant:master Dec 11, 2023
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants