Import analyzer plugin rule suggestions vol. 2
henke37 opened this issue · comments
LoadDriver Yet another LoadLibrary replacement
LoadTypeLib Possible LoadLibrary replacement?
waveInOpen|DirectSoundCaptureCreate Records audio
EnableRouter|SetAdapterIpAddress|SetIpInterfaceEntry Messes with the network configuration
OleGetClipboard Reads the clipboard
CertAddCertificateContextToStore|CertOpenSystemStore Manipulates the system certificate store
InitiateShutdown|ExitWindows Turns the system off
Wmi* Uses WMI
SHTestTokenMembership|CheckTokenMembership|IsUserAnAdmin Checks for privileges
SHEnumKeyEx Another way to access the registery
Thanks for these! I'll add them very soon as well.
- According to the MSDN, LoadDriver is only available in Windows Mobile. As such, I'm not sure it should be included.
- I have also tried to use
LoadTypeLibto load a library such askernel32, but was unable to do so - I'm assuming it can only be used to load.tlblibraries. - To the best of my knowledge, the WMI isn't accessed with direct WMI* calls but through COM requests instead. Are there specific WMI functions that you know about? In any case, thinking about the WMI gave me the idea to add all the well known namespaces (i.e.
ROOT\CIMV2) to the suspicious strings plugin, so thanks for that!
I'm pushing the commit adding the rest of the suggestions in a minute, let me know if you consider that this issue can be closed.
Yeah, that's fine with me.