Add capa rules create-thread-bypass-freeze.yml and check-thread-suspe…

…nd-count-exceeded.yml to nursery. (#912)

* Add rules

---------

Co-authored-by: Willi Ballenthin <wballenthin@google.com>

nursery/check-thread-suspend-count-exceeded.yml

@@ -0,0 +1,27 @@
+rule:
+  meta:
+    name: check thread suspend count exceeded
+    authors:
+      - ervinocampo@google.com
+    scopes:
+      static: file
+      dynamic: unsupported #requires mnemonic feature
+    att&ck:
+      - Defense Evasion::Debugger Evasion [T1622]
+    mbc:
+      - Anti-Behavioral Analysis::Debugger Detection [B0001]
+    references:
+      - https://secret.club/2021/01/04/thread-stuff.html
+      - https://research.checkpoint.com/2023/raspberry-robin-anti-evasion-how-to-exploit-analysis/
+  features:
+    - and:
+      - match: create thread bypassing process freeze
+      - function:
+        - and:
+          - or:
+            - api: ntdll.NtSuspendThread
+            - string: "NtSuspendThread"
+          - basic block:
+            - and:
+              - number: 0xc000004a = STATUS_SUSPEND_COUNT_EXCEEDED
+              - mnemonic: cmp

nursery/create-thread-bypassing-process-freeze.yml

@@ -0,0 +1,23 @@
+rule:
+  meta:
+    name: create thread bypassing process freeze
+    authors:
+      - ervinocampo@google.com
+    scopes:
+      static: basic block
+      dynamic: call
+    att&ck:
+      - Defense Evasion::Debugger Evasion [T1622]
+    mbc:
+      - Anti-Behavioral Analysis::Debugger Evasion [B0002]
+    references:
+      - https://secret.club/2021/01/04/thread-stuff.html
+      - https://research.checkpoint.com/2023/raspberry-robin-anti-evasion-how-to-exploit-analysis/
+      - https://www.pinvoke.dev/ntdll/ntcreatethreadex
+      - https://github.com/winsiderss/systeminformer/blob/master/phnt/include/ntpsapi.h
+  features:
+    - and:
+      - or:
+        - api: ntdll.NtCreateThreadEx
+        - string: "NtCreateThreadEx"
+      - number: 0x40 = Undocumented thread creation flag dubbed as THREAD_CREATE_FLAGS_BYPASS_PROCESS_FREEZE