Add rule unhook-a-dll.yml

[jtothej]

Add rule unhook-a-dll.yml

[mr-tz]

the reference talks about overwriting ntdll's .text section to remove hooks, should we adjust the rule name and logic to that specific usage?

[jtothej]

I initially created the rule specifically for NTDLL but then decided to make it more generic. Most likely NTDLL will be the unhooking target in most samples anyway but I wanted to match also on less common DLLs. If you think the rule is too broad I'll change it to its initial form.

[mr-tz]

hm, I think it shouldn't result in many FPs and if so, we can fine tune it
for when we do come back to it later, can you please add this comment to the rule?

[mr-tz]

and how about renaming to better reflect what's captured here, e.g. overwrite DLL .text section to remove hooks or similar?

[jtothej]

Thanks for suggestions! Updated the rule in 3a03215

[mr-tz]

add GetModuleHandleEx?

[jtothej]

Added in 3a03215

[mr-tz]

hm, I think it shouldn't result in many FPs and if so, we can fine tune it
for when we do come back to it later, can you please add this comment to the rule?

[mr-tz]

and how about renaming to better reflect what's captured here, e.g. overwrite DLL .text section to remove hooks or similar?

[mr-tz]

great, thank you very much!