fix 'set-system-properties' for 'install driver'

mandiant · Feb 14, 2024 · a67e2f3 · a67e2f3
1 parent acc7fab
commit a67e2f3
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 17 deletions.
diff --git a/host-interaction/driver/install-driver.yml b/host-interaction/driver/install-driver.yml
@@ -13,7 +13,14 @@ rule:
       - Hardware::Install Driver [C0037]
     examples:
       - af60700383b75727f5256a0000c1476f:0x1127E
+    references:
+      - https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/set.htm
   features:
     - or:
       - api: ntdll.NtLoadDriver
       - api: ZwLoadDriver
+      - and:
+        - number: 38 = SystemLoadAndCallImage
+        - or:
+          - api: NtSetSystemInformation
+          - api: ZwSetSystemInformation
diff --git a/nursery/set-system-properties.yml b/nursery/set-system-properties.yml