udm ldrcallenclave udm context
Targets use of LdrCallEnclave from Python or a user-writable loader following executable-memory allocation. The UDM rule retains principal and target context for correlation.
YARA-L

Targets use of LdrCallEnclave from Python or a user-writable loader following executable-memory allocation. The UDM rule retains principal and target context for correlation.

Already have an account?