rule:
meta:
name: send data on socket
namespace: communication/socket/send
authors:
- moritz.raabe@mandiant.com
- joakim@intezer.com
- anushka.virgaonkar@mandiant.com
scopes:
static: function
dynamic: call
mbc:
- Communication::Socket Communication::Send Data [C0001.007]
examples:
- Practical Malware Analysis Lab 01-01.dll_:0x10001010
features:
- or:
- api: send
- api: ws2_32.send
- api: ws2_32.#19 = send
- api: ws2_32.sendto
- api: ws2_32.#20 = sendto
- api: ws2_32.WSASend
- api: ws2_32.#76 = WSASend
- api: ws2_32.WSASendMsg
- api: ws2_32.WSASendTo
- api: ws2_32.#78 = WSASendTo
- api: System.Net.Sockets.Socket::Send
- api: System.Net.Sockets.Socket::SendAsync
- api: System.Net.Sockets.Socket::SendTo
- api: System.Net.Sockets.Socket::SendToAsync
- api: System.Net.Sockets.UdpClient::Send
last edited: 2024-04-23 12:20:28