Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

improve TCP/UDP socket creation matching #964

Open
mike-hunhoff opened this issue Nov 20, 2024 · 0 comments
Open

improve TCP/UDP socket creation matching #964

mike-hunhoff opened this issue Nov 20, 2024 · 0 comments
Labels

Comments

@mike-hunhoff
Copy link
Collaborator

Add additional check for parameter argument of 0.

https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-socket

If a value of 0 is specified, the caller does not wish to specify a protocol and the service provider will choose the protocol to use.

https://man7.org/linux/man-pages/man2/socket.2.html

The protocol specifies a particular protocol to be used with the
socket. Normally only a single protocol exists to support a
particular socket type within a given protocol family, in which
case protocol can be specified as 0.

https://github.com/mandiant/capa-rules/blob/e50d824553ae8d7168ac2d1f7b5540a93f944e28/communication/socket/udp/send/create-udp-socket.yml
https://github.com/mandiant/capa-rules/blob/e50d824553ae8d7168ac2d1f7b5540a93f944e28/communication/socket/tcp/create-tcp-socket.yml

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant