Merge pull request #917 from mandiant/fix/dotnet

dotnet: improve dotnet invoke-dotnet-assembly-method.yml
mandiant · Aug 2, 2024 · 764537f · 764537f
2 parents e63c454 + 6342716
commit 764537f
Showing 1 changed file with 10 additions and 8 deletions.
diff --git a/nursery/invoke-dotnet-assembly-method.yml b/nursery/invoke-dotnet-assembly-method.yml
@@ -4,25 +4,27 @@ rule:
     namespace: load-code/dotnet
     authors:
       - anushka.virgaonkar@mandiant.com
+      - mehunhoff@google.com
     scopes:
       static: function
-      dynamic: thread
+      dynamic: call
     att&ck:
       - Defense Evasion::Reflective Code Loading [T1620]
   features:
     - and:
-      - or:
-        - api: System.Reflection.Assembly::GetType
-        - api: System.Reflection.Assembly::GetTypes
-        - api: System.Object::GetType
-      - or:
+      - format: dotnet
+      - optional:
+        - api: System.Reflection.Module::GetMethod
+        - api: System.Reflection.Module::GetMethodImpl
+        - api: System.Reflection.Module::GetMethods
+        - api: System.Reflection.Module::ResolveMethod
         - api: System.Type::GetMethod
         - api: System.Type::GetMethodImpl
         - api: System.Type::GetMethods
       - or:
         - api: System.Delegate::DynamicInvoke
         - api: System.Delegate::DynamicInvokeImpl
-        - api: System.Reflection.MethodBase::Invoke
         - api: System.Type::InvokeMember
-        - api: System.Reflection.ConstructorInfo::Invoke
         - api: System.Reflection.MethodInfo::Invoke
+        - api: System.Reflection.MethodBase::Invoke
+        - api: System.Reflection.ConstructorInfo::Invoke