Skip to content
yararules.org
Menu

YARA · Samir Bousseaden (YaraHunts)

SBOUSSEADEN_Infinityhook

Infinityhook is a legit research PoC to hook NT Syscalls bypassing PatchGuard

GenericSamir Bousseaden (YaraHunts)No licence (all rights reserved)Compiles with YARA-X (with warnings)
Author
SBousseaden
Date
2020-09-07
Modified
2020-07-10
Score / Quality
75 / 73

What this rule detects

Infinityhook is a legit research PoC to hook NT Syscalls bypassing PatchGuard

Targets: Windows PE.

It defines 4 patterns (1 text, 3 hex, 0 regex).

YARA-X says: warning[text_as_hex]: hex pattern could be written as text literal

Summary generated from the rule's metadata and condition.

Rule source

Rule text not reproduced

This rule comes from Samir Bousseaden (YaraHunts), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:

View the rule on GitHubOpen the repository

References

Licence & attribution

Author: SBousseaden

Source repository: Samir Bousseaden (YaraHunts) @ 71b27a2a7c

Licence: No licence (all rights reserved) (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 82f4eef2-fca7-58b1-a85c-3c237f523740

Tags:FILE

Related rules