Rename architecture-specific rules and update rule names inside YAML files

anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml

@@ -15,5 +15,5 @@ rule:
       - Practical Malware Analysis Lab 16-01.exe_:0x403530
   features:
     - and:
-      - match: PEB access
+      - match: PEB access via x86 assembly
       - offset: 2 = PEB.BeingDebugged

anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml → anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: check for PEB NtGlobalFlag flag
+    name: check for PEB NtGlobalFlag flag via x86 assembly
     namespace: anti-analysis/anti-debugging/debugger-detection
     authors:
       - moritz.raabe@mandiant.com
@@ -18,7 +18,7 @@ rule:
     - and:
       - basic block:
         - and:
-          - match: PEB access
+          - match: PEB access via x86 assembly
           - or:
             - and:
               - arch: i386

anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml → anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: check for trap flag exception
+    name: check for trap flag exception via x86 assembly
     namespace: anti-analysis/anti-debugging/debugger-detection
     authors:
       - michael.hunhoff@mandiant.com

anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml → anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: execute anti-debugging instructions
+    name: execute anti-debugging instructions via x86 assembly
     namespace: anti-analysis/anti-debugging/debugger-detection
     authors:
       - moritz.raabe@mandiant.com

anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml → anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: 64-bit execution via heavens gate
+    name: 64-bit execution via heavens gate via x86 assembly
     namespace: anti-analysis/anti-disasm
     authors:
       - awillia2@cisco.com

anti-analysis/anti-disasm/contain-anti-disasm-techniques.yml

@@ -13,4 +13,4 @@ rule:
       - a5c70086b3bc4fe64f4e7a0aa452e620
   features:
     - or:
-      - count(match(contain pusha popa sequence)): 10 or more
+      - count(match(contain pusha popa sequence via x86 assembly)): 10 or more

anti-analysis/packer/generic/packed-with-generic-packer.yml

@@ -23,4 +23,4 @@ rule:
         - mnemonic: popad  # vivisect
       - characteristic: cross section flow
       - not:
-        - match: contain pusha popa sequence
+        - match: contain pusha popa sequence via x86 assembly

communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml → communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: obtain TransmitPackets callback function via WSAIoctl
+    name: obtain TransmitPackets callback function via WSAIoctl via x86 assembly
     namespace: communication/socket/tcp/send
     authors:
       - jonathan.lepore@mandiant.com

data-manipulation/checksum/adler32/compute-adler32-checksum.yml → data-manipulation/checksum/adler32/compute-adler32-checksum-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: compute adler32 checksum
+    name: compute adler32 checksum via x86 assembly
     namespace: data-manipulation/checksum/adler32
     authors:
       - matthew.williams@mandiant.com

data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml → data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: encrypt data using RC4 KSA
+    name: encrypt data using RC4 KSA via x86 assembly
     namespace: data-manipulation/encryption/rc4
     authors:
       - moritz.raabe@mandiant.com

data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml → data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: encrypt data using RC4 PRGA
+    name: encrypt data using RC4 PRGA via x86 assembly
     namespace: data-manipulation/encryption/rc4
     authors:
       - moritz.raabe@mandiant.com

data-manipulation/encryption/rsa/encrypt-data-using-rsa-via-embedded-library.yml → data-manipulation/encryption/rsa/encrypt-data-using-rsa-via-embedded-library-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: encrypt data using RSA via embedded library
+    name: encrypt data using RSA via embedded library via x86 assembly
     namespace: data-manipulation/encryption/rsa
     authors:
       - "Ana06"

host-interaction/hardware/cpu/get-number-of-processors.yml → host-interaction/hardware/cpu/get-number-of-processors-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: get number of processors
+    name: get number of processors via x86 assembly
     namespace: host-interaction/hardware/cpu
     authors:
       - michael.hunhoff@mandiant.com
@@ -17,7 +17,7 @@ rule:
   features:
     - or:
       - and:
-        - match: PEB access
+        - match: PEB access via x86 assembly
         - or:
           - and:
             - arch: i386

host-interaction/process/create/create-process-on-linux.yml

@@ -20,7 +20,7 @@ rule:
       - or:
         - api: execve
         - and:
-          - match: execute syscall
+          - match: execute syscall via x86 assembly
           - arch: aarch64
           - number: 0xdd = execve
         - api: execl

host-interaction/process/get-process-filename.yml → host-interaction/process/get-process-filename-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: get process filename
+    name: get process filename via x86 assembly
     namespace: host-interaction/process
     authors:
       - matthew.williams@mandiant.com

host-interaction/process/get-process-heap-flags.yml → host-interaction/process/get-process-heap-flags-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: get process heap flags
+    name: get process heap flags via x86 assembly
     namespace: host-interaction/process
     authors:
       - michael.hunhoff@mandiant.com
@@ -15,7 +15,7 @@ rule:
       - al-khaser_x86.exe_:0x425470
   features:
     - and:
-      - match: PEB access
+      - match: PEB access via x86 assembly
       - or:
         - and:
           - arch: i386

host-interaction/process/get-process-heap-force-flags.yml → host-interaction/process/get-process-heap-force-flags-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: get process heap force flags
+    name: get process heap force flags via x86 assembly
     namespace: host-interaction/process
     authors:
       - michael.hunhoff@mandiant.com
@@ -15,7 +15,7 @@ rule:
       - al-khaser_x86.exe_:0x425470
   features:
     - and:
-      - match: PEB access
+      - match: PEB access via x86 assembly
       - or:
         - and:
           - arch: i386

lib/contain-pusha-popa-sequence.yml → lib/contain-pusha-popa-sequence-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: contain pusha popa sequence
+    name: contain pusha popa sequence via x86 assembly
     authors:
       - moritz.raabe@mandiant.com
     lib: true

lib/get-os-version.yml

@@ -21,7 +21,7 @@ rule:
       - api: RtlGetNtVersionNumbers
       - api: GetProductInfo
       - and:
-        - match: PEB access
+        - match: PEB access via x86 assembly
         - or:
           - and:
             - arch: i386

lib/peb-access.yml → lib/peb-access-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: PEB access
+    name: PEB access via x86 assembly
     authors:
       - michael.hunhoff@mandiant.com
     lib: true

linking/runtime-linking/access-peb-ldr_data.yml → linking/runtime-linking/access-peb-ldr_data-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: access PEB ldr_data
+    name: access PEB ldr_data via x86 assembly
     namespace: linking/runtime-linking
     authors:
       - moritz.raabe@mandiant.com
@@ -20,7 +20,7 @@ rule:
         - arch: i386
         - description: x32
 
-        - match: PEB access
+        - match: PEB access via x86 assembly
 
         # x86 Windows uses fs:0 to access the TIB which contains SEH information at offset 0
         # checking for fs:0 and a (possibly unrelated) number or offset often results in false positives
@@ -37,7 +37,7 @@ rule:
         - arch: amd64
         - description: x64
 
-        - match: PEB access
+        - match: PEB access via x86 assembly
 
         - offset: 0x18 = PEB.LDR_DATA
 

linking/runtime-linking/get-kernel32-base-address.yml → linking/runtime-linking/get-kernel32-base-address-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: get kernel32 base address
+    name: get kernel32 base address via x86 assembly
     namespace: linking/runtime-linking
     authors:
       - moritz.raabe@mandiant.com
@@ -17,7 +17,7 @@ rule:
   features:
     - and:
       # PEB -> PEB.Ldr -> PEB_LDR_DATA.InLoadOrderModuleList.Flink
-      - match: access PEB ldr_data
+      - match: access PEB ldr_data via x86 assembly
       # -> current module -> ntdll
       - count(offset(0)): 2
       # -> kernel32 -> LDR_DATA_TABLE_ENTRY.DllBase

linking/runtime-linking/get-ntdll-base-address.yml → linking/runtime-linking/get-ntdll-base-address-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: get ntdll base address
+    name: get ntdll base address via x86 assembly
     namespace: linking/runtime-linking
     authors:
       - moritz.raabe@mandiant.com
@@ -17,7 +17,7 @@ rule:
   features:
     - and:
       # PEB -> PEB.Ldr -> PEB_LDR_DATA.InLoadOrderModuleList.Flink
-      - match: access PEB ldr_data
+      - match: access PEB ldr_data via x86 assembly
       # -> current module
       - count(offset(0)): 1
       # -> ntdll -> LDR_DATA_TABLE_ENTRY.DllBase

nursery/execute-syscall.yml → nursery/execute-syscall-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: execute syscall
+    name: execute syscall via x86 assembly
     namespace: anti-analysis
     authors:
       - "@kulinacs"

nursery/get-ntoskrnl-base-address.yml → nursery/get-ntoskrnl-base-address-via-x86-assembly.yml

@@ -1,9 +1,10 @@
 rule:
   meta:
-    name: get ntoskrnl base address
+    name: get ntoskrnl base address via x86 assembly
     namespace: linking/runtime-linking
     authors:
       - "@mr-tz"
+      - "@akh7177"
     scopes:
       static: function
       dynamic: unsupported  # requires offset features
@@ -19,9 +20,10 @@ rule:
           - description: returns RTL_PROCESS_MODULES structure
           - number: 0xB = SystemModuleInformation
           - match: get system information on Windows
-      - and:
-        - arch: i386
-        - offset: 0xC = RTL_PROCESS_MODULES.Modules[0].ImageBase
-      - and:
-        - arch: amd64
-        - offset: 0x18 = RTL_PROCESS_MODULES.Modules[0].ImageBase
+      - or:
+        - and:
+          - arch: i386
+          - offset: 0xC = RTL_PROCESS_MODULES.Modules[0].ImageBase
+        - and:
+          - arch: amd64
+          - offset: 0x18 = RTL_PROCESS_MODULES.Modules[0].ImageBase

nursery/hook-routines-via-dlsym-rtld_next.yml → nursery/hook-routines-via-dlsym-rtld_next-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: hook routines via dlsym RTLD_NEXT
+    name: hook routines via dlsym RTLD_NEXT via x86 assembly
     namespace: linking/hooking
     authors:
       - william.ballenthin@mandiant.com

nursery/reference-processor-manufacturer-constants.yml → nursery/reference-processor-manufacturer-constants-via-x86-assembly.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: reference processor manufacturer constants
+    name: reference processor manufacturer constants via x86 assembly
     namespace: anti-analysis/anti-vm/vm-detection
     authors:
       - matthew.williams@mandiant.com