YARA · Cod3nym detection-rules

COD3NYM_SUSP_Direct_Syscall_Shellcode_Invocation_Jan24

Detects direct syscall evasion technqiue using NtProtectVirtualMemory to invoke shellcode

Suspicious / huntingCod3nym detection-rulesDetection Rule License 1.1Compiles with YARA-X

Author: Jonathan Peters
Date: 2024-01-14
Score / Quality: 65 / 80

What this rule detects

Detects direct syscall evasion technqiue using NtProtectVirtualMemory to invoke shellcode

It defines 1 patterns (0 text, 1 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

susp-direct-syscall-shellcode-invocation-jan24.yarDetection Rule License 1.1

rule COD3NYM_SUSP_Direct_Syscall_Shellcode_Invocation_Jan24 : FILE
{
	meta:
		description = "Detects direct syscall evasion technqiue using NtProtectVirtualMemory to invoke shellcode"
		author = "Jonathan Peters"
		id = "2a0ce887-299d-5aad-bed3-3e698b4dea79"
		date = "2024-01-14"
		modified = "2024-01-14"
		reference = "https://unprotect.it/technique/evasion-using-direct-syscalls/"
		source_url = "https://github.com/cod3nym/detection-rules//blob/86a04c4594cb48895192aad4af164f21f568c136/yara/other/susp_direct_syscall_shellcode_invocation.yar#L1-L14"
		license_url = "https://github.com/cod3nym/detection-rules//blob/86a04c4594cb48895192aad4af164f21f568c136/LICENSE.md"
		hash = "f7cd214e7460c539d6f8d02b6650098e3983862ff658b76ea02c33f5a45fc836"
		logic_hash = "b5b0ad86289a4e2af7cdc909192f4dc9325c1763259f40adcc1e60c088c9e4f3"
		score = 65
		quality = 80
		tags = "FILE"

	strings:
		$ = { B8 40 00 00 00 67 4C 8D 08 49 89 CA 48 C7 C0 50 00 00 00 0F 05 [4-8] 4C 8D 3D 02 00 00 00 FF E0 }

	condition:
		all of them and filesize < 2MB
}

Strings (1 patterns)

Identifier	Type	Value	Modifiers
$	hex	{ B8 40 00 00 00 67 4C 8D 08 49 89 CA 48 C7 C0 50 00 00 00 0F 05 [4-8] 4C 8D 3D 02 00 00 00 FF E0 }

Condition

all of them and filesize < 2MB

In plain words (Heuristic)

The file must be smaller than 2MB (a cheap guard that skips large files).
All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://unprotect.it/technique/evasion-using-direct-syscalls/

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

f7cd214e7460c539d6f8d02b6650098e3983862ff658b76ea02c33f5a45fc836

Licence & attribution

Author: Jonathan Peters

Source repository: Cod3nym detection-rules @ 86a04c4594

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 2a0ce887-299d-5aad-bed3-3e698b4dea79

Tags:FILE

COD3NYM_SUSP_OBF_NET_Confuserex_Packer_Jan24
Suspicious / huntingCod3nym detection-rules· Jonathan Peters· 2024-01-09
COD3NYM_SUSP_NET_Shellcode_Loader_Indicators_Jan24
Suspicious / huntingCod3nym detection-rules· Jonathan Peters· 2024-01-11
COD3NYM_SUSP_OBF_NET_Reactor_Indicators_Jan24
Suspicious / huntingCod3nym detection-rules· Jonathan Peters· 2024-01-09
COD3NYM_SUSP_OBF_NET_Reactor_Native_Stub_Jan24
Suspicious / huntingCod3nym detection-rules· Jonathan Peters· 2024-01-05
COD3NYM_MAL_NET_Limecrypter_Runpe_Jan24
MalwareCod3nym detection-rules· Jonathan Peters· 2024-01-16
COD3NYM_MAL_NET_Niximports_Loader_Jan24
MalwareCod3nym detection-rules· Jonathan Peters· 2024-01-12
COD3NYM_DOTNET_Singlefilehost_Bundled_App
GenericCod3nym detection-rules· Jonathan Peters· 2024-01-02