rules: add QUIC / msquic detection rule#1108
rules: add QUIC / msquic detection rule#1108AdityaSkhorne wants to merge 4 commits intomandiant:masterfrom
Conversation
| @@ -0,0 +1,34 @@ | |||
| rule: | |||
| meta: | |||
| name: detect usage of msquic (QUIC) APIs | |||
There was a problem hiding this comment.
please review the rule name documentation and modify accordingly.
| scopes: | ||
| static: function |
There was a problem hiding this comment.
please review the scopes section of the meta block documentation and modify accordingly.
| mbc: | ||
| - Communication::Network Communication::QUIC Client/Server [C0005.001] | ||
| examples: | ||
| - 05be49819139a3fdcdbddbdefd298398779521f3d68daa25275cc77508e42310.exe:0x401000 |
There was a problem hiding this comment.
please review the examples section of the meta block documentation and modify accordingly.
| - string: msquic | ||
| - string: msquic.dll | ||
| - string: quiche | ||
| - string: ngtcp2 | ||
| - string: "quic-go" |
There was a problem hiding this comment.
please review the file string and substring documentation and modify accordingly. Also, provide descriptions for each string to help readers understand their purpose and relevance to the rule detection.
| scopes: | ||
| static: function | ||
| mbc: | ||
| - Communication::Network Communication::QUIC Client/Server [C0005.001] |
There was a problem hiding this comment.
I don't see this listed in MBC. Can you provide a direct reference or update to the correct behaviour?
|
@AdityaSkhorne bump |
2 participants
Summary
Adds a focused rule to detect usage of QUIC-related APIs and libraries, with emphasis on Microsoft msquic and other QUIC implementations.
Changes
Why
QUIC is increasingly used in modern network stacks and can be abused by malware for covert C2 and data exfiltration. Covering msquic and other QUIC libs improves capa's ability to surface these behaviors.
Testing
Author: adityashankarkhorne@gmail.com
Note on provenance:
This contribution was created with assistance from an AI tool (ChatGPT). I reviewed and edited the content and confirm I have the right to submit it under the project's license. I accept responsibility for the submission and its licensing.