From 68c27105bb6b19a59ca8b4e2d828b155a5ae812b Mon Sep 17 00:00:00 2001 From: kevross33 Date: Wed, 8 Jul 2026 16:02:53 +0100 Subject: [PATCH] Update buffer data retrieval logic Refactor buffer data retrieval to include 'PostData'. --- modules/signatures/windows/network_c2_etherhiding.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/signatures/windows/network_c2_etherhiding.py b/modules/signatures/windows/network_c2_etherhiding.py index 0f3eafe8..5bb5f242 100644 --- a/modules/signatures/windows/network_c2_etherhiding.py +++ b/modules/signatures/windows/network_c2_etherhiding.py @@ -50,9 +50,8 @@ def on_call(self, call, process): # Dynamically grab the payload regardless of which networking API was used buffer_data = ( self.get_argument(call, "buffer") - or self.get_argument(call, "lpBuffer") - or self.get_argument(call, "lpOptional") or self.get_argument(call, "Buffer") + or self.get_argument(call, "Optional") or self.get_argument(call, "PostData") )