Skip to content

Commit e9c698d

Browse files
itxsamad1itxsamad1
committed
Add PPID spoof PoC test sample for capa-rules #1167
Minimal Windows PE exercising InitializeProcThreadAttributeList, UpdateProcThreadAttribute(PROC_THREAD_ATTRIBUTE_PARENT_PROCESS), and CreateProcessA with EXTENDED_STARTUPINFO_PRESENT.
1 parent ffd2206 commit e9c698d

2 files changed

‎6538c46d9632ec5f7407de7918723c048e12e1f6883d1029d136da4a56d3c23a.exe_‎

57 KB
Binary file not shown.

‎7fc295b013cf773eb71e3de24944a7ca1e876846137cb6c6a758a26bbc1ce4f5.exe_‎

-73.5 KB
Binary file not shown.

0 commit comments

Comments
 (0)