Import analyzer plugin rule suggestions
henke37 opened this issue · comments
EnumDeviceDrivers|GetDeviceDriverFileNameW
Checks for driversEvtClearLog|ClearEventLog
Empties the system event logTerminateProcess
Messes with other processesPrintWindow
Takes screenshotsSetKernelObjectSecurity|SetFileSecurity|SetNamedSecurityInfo|SetSecurityInfo
Manipulates DACLsOpenSCManagerW|CreateService|DeleteService
Manipulates servicesCoLoadLibrary
Replacement forLoadLibrary
Thanks a lot for these suggestions! They will be implemented shortly.
I just removed TerminateProcess
from the list: turns out it gets imported by default in _report_gsfailure
, which means that any /GS-protected binary would have it. The presence of this particular import is therefore not very meaningful.
Same goes for IsDebuggerPresent
, which seems to be referenced in just any PE (from ___scrt_fastfail
).