capa-rules
capa-rules copied to clipboard
padded
Rule name
padded
Summary
Detect files which contain padding with extraneous data such as zeros or random bytes. Sometimes used to evade antivirus engines that will not scan files above a set size limit.
Detecting zeros is easy, but not random bytes. One idea is to detect random paddings by looking for an unusual amount of zeros with regular expressions.
Possible test samples
Publicly available samples that may contain the capability this rule should detect (MD5 hashes):
- 3a71311ac69f26e478e2d80541e9a412 (capa is not able to run on this sample at the moment, this is caused by a bug on vivisect: https://github.com/vivisect/vivisect/issues/391)
References
Links or references to additional information on the capability (can also be included in the rule):
- https://attack.mitre.org/techniques/T1027/001/
Namespace
Proposed namespace: anti-analysis/padding
. More details in https://github.com/fireeye/capa-rules/blob/master/doc/format.md#rule-namespace
att&ck
aka.mitre.att&ck.t1027.001
for PE files compare PE size via header values vs. file size
This likely requires (a) new feature(s).