Import analyzer plugin rule suggestions vol. 2
henke37 opened this issue · comments
LoadDriver
Yet another LoadLibrary replacement
LoadTypeLib
Possible LoadLibrary replacement?
waveInOpen|DirectSoundCaptureCreate
Records audio
EnableRouter|SetAdapterIpAddress|SetIpInterfaceEntry
Messes with the network configuration
OleGetClipboard
Reads the clipboard
CertAddCertificateContextToStore|CertOpenSystemStore
Manipulates the system certificate store
InitiateShutdown|ExitWindows
Turns the system off
Wmi*
Uses WMI
SHTestTokenMembership|CheckTokenMembership|IsUserAnAdmin
Checks for privileges
SHEnumKeyEx
Another way to access the registery
Thanks for these! I'll add them very soon as well.
- According to the MSDN, LoadDriver is only available in Windows Mobile. As such, I'm not sure it should be included.
- I have also tried to use
LoadTypeLib
to load a library such askernel32
, but was unable to do so - I'm assuming it can only be used to load.tlb
libraries. - To the best of my knowledge, the WMI isn't accessed with direct WMI* calls but through COM requests instead. Are there specific WMI functions that you know about? In any case, thinking about the WMI gave me the idea to add all the well known namespaces (i.e.
ROOT\CIMV2
) to the suspicious strings plugin, so thanks for that!
I'm pushing the commit adding the rest of the suggestions in a minute, let me know if you consider that this issue can be closed.
Yeah, that's fine with me.