Skip to content

Instantly share code, notes, and snippets.

@williballenthin

williballenthin/DotnetStartupHook.yar

Last active January 4, 2023 08:23
Download ZIP

Revisions

  1. williballenthin revised this gist Jan 4, 2023. 1 changed file with 15 additions and 0 deletions.
    15 changes: 15 additions & 0 deletions Nuitka.yar
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,15 @@
    rule Nuitka {
    meta:
    description = "Python code compiled and packaged with Nuitka"
    author = "William Ballenthin <william.ballenthin@mandiant.com>"
    strings:
    // https://github.com/Nuitka/Nuitka/blob/f87667fec2748a735834fc699daa20cedfb8f2c7/nuitka/build/static_src/InspectPatcher.c#L218
    $a1 = "nuitka_types_patch"
    // https://github.com/Nuitka/Nuitka/blob/f87667fec2748a735834fc699daa20cedfb8f2c7/nuitka/build/static_src/MetaPathBasedLoader.c#L1173
    $a2 = "O:is_package"
    // https://github.com/Nuitka/Nuitka/blob/f87667fec2748a735834fc699daa20cedfb8f2c7/nuitka/build/static_src/HelpersConstantsBlob.c#L1229
    $a3 = "Error, corrupted constants object"
    condition:
    uint16(0) == 0x5A4D
    and all of them
    }
  2. williballenthin created this gist Jan 3, 2023.
    14 changes: 14 additions & 0 deletions DotnetStartupHook.yar
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,14 @@
    import "dotnet"

    rule DotnetStartupHook {
    meta:
    description = "might be a .NET startup hook module"
    author = "William Ballenthin <william.ballenthin@mandiant.com>"
    strings:
    $a1 = "StartupHook"
    $a2 = "Initialize"
    condition:
    uint16(0) == 0x5A4D
    and dotnet.is_dotnet
    and all of them
    }