upgrade rules using updated script

2026-06-08 15:41:20 +00:00 · 2023-10-25 16:01:12 +02:00
parent e0d5e95a82
commit 784c9dca53
847 changed files with 2541 additions and 847 deletions
@@ -6,7 +6,9 @@ rule:
      - ervin.ocampo@mandiant.com
      - jakub.jozwiak@mandiant.com
    description: Detect usage of various WinAPI functions that accept callback functions as parameters in order to execute arbitrary shellcode
-    scope: function
+    scopes:
+      static: function
+      dynamic: thread
    att&ck:
      - Defense Evasion::Reflective Code Loading [T1620]
    mbc: