Methodology_Mutation_StackPush_Windows_Pipe_Functions

YARA detection rule by Stairwell · MIT

Searching for PE files with mutations of odd, rare, or interesting string equities. Here we look for strings from common PE strings, DLLs and functions in type 2 stack strings form, where the string pushed onto the stack 4 bytes at a time using PUSH 0x68, appearing in reverse four byte chunk order, where the PUSH which shows up as an ASCII letter h.

rule Methodology_Mutation_StackPush_Windows_Pipe_Functions {
  meta:
    author = "Stairwell"
    description = "Searching for PE files with mutations of odd, rare, or interesting string equities. Here we look for strings from common PE strings, DLLs and functions in type 2 stack strings form, where the string pushed onto the stack 4 bytes at a time using PUSH 0x68, appearing in reverse four byte chunk order, where the PUSH which shows up as an ASCII letter h."
  strings:
    $CallNamedPipe_stackpush = "hehdPiphNamehCall" nocase
    $ConnectNamedPipe_stackpush = "hPipehamedhectNhConn" nocase
    $CreateNamedPipe_stackpush = "hipehmedPhteNahCrea" nocase
    $CreatePipe_stackpush = "hpehtePihCrea" nocase
    $DisconnectNamedPipe_stackpush = "hipehmedPhctNahonnehDisc" nocase
    $GetNamedPipeClientComputerName_stackpush = "hmeherNahmputhntCohCliehPipehamedhGetN" nocase
    $GetNamedPipeClientProcessId_stackpush = "hsIdhoceshntPrhCliehPipehamedhGetN" nocase
    $GetNamedPipeClientSessionId_stackpush = "hnIdhssiohntSehCliehPipehamedhGetN" nocase
    $GetNamedPipeHandleState_stackpush = "hatehleSthHandhPipehamedhGetN" nocase
    $GetNamedPipeInfo_stackpush = "hInfohPipehamedhGetN" nocase
    $GetNamedPipeServerProcessId_stackpush = "hsIdhocesherPrhServhPipehamedhGetN" nocase
    $GetNamedPipeServerSessionId_stackpush = "hnIdhssioherSehServhPipehamedhGetN" nocase
    $PeekNamedPipe_stackpush = "hehdPiphNamehPeek" nocase
    $SetNamedPipeHandleState_stackpush = "hatehleSthHandhPipehamedhSetN" nocase
    $TransactNamedPipe_stackpush = "hehdPiphNamehsacthTran" nocase
    $WaitNamedPipe_stackpush = "hehdPiphNamehWait" nocase
  condition:
    filesize < 15MB and uint16be(0) == 0x4d5a and 1 of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

a9a7f9c3-e27c-41d8-9768-81fae2398e80

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion