diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml index 9a18af75..fb28c1b6 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml @@ -6,6 +6,7 @@ rule: - michael.hunhoff@mandiant.com scopes: static: function + dynamic: unspecified mbc: - Anti-Behavioral Analysis::Debugger Detection::Hardware Breakpoints [B0001.005] references: diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml index f8e80283..f70f0bfa 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml @@ -6,6 +6,7 @@ rule: - michael.hunhoff@mandiant.com scopes: static: function + dynamic: unspecified mbc: - Anti-Behavioral Analysis::Debugger Detection [B0001] references: diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml index 2e13b5eb..a1b46c44 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml @@ -6,6 +6,7 @@ rule: - moritz.raabe@mandiant.com scopes: static: basic block + dynamic: unspecified mbc: - Anti-Behavioral Analysis::Debugger Detection::Process Environment Block BeingDebugged [B0001.035] references: diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml index 6eefed3d..604d8ee4 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml @@ -6,6 +6,7 @@ rule: - moritz.raabe@mandiant.com scopes: static: function + dynamic: unspecified mbc: - Anti-Behavioral Analysis::Debugger Detection::Process Environment Block NtGlobalFlag [B0001.036] references: diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml index d383e94e..6409b06b 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml @@ -6,6 +6,7 @@ rule: - michael.hunhoff@mandiant.com scopes: static: function + dynamic: unspecified mbc: - Anti-Behavioral Analysis::Debugger Detection::Software Breakpoints [B0001.025] references: diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml index b643ca2d..6a401818 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml @@ -6,6 +6,7 @@ rule: - michael.hunhoff@mandiant.com scopes: static: function + dynamic: unspecified mbc: - Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCount [B0001.032] examples: diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml index f4e637c6..7f1f9add 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml @@ -6,6 +6,7 @@ rule: - michael.hunhoff@mandiant.com scopes: static: basic block + dynamic: unspecified mbc: - Anti-Behavioral Analysis::Debugger Detection [B0001] references: diff --git a/anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml b/anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml index 1fe66b51..c9270aea 100644 --- a/anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml +++ b/anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml @@ -6,6 +6,7 @@ rule: - moritz.raabe@mandiant.com scopes: static: function + dynamic: unspecified mbc: - Anti-Behavioral Analysis::Debugger Detection::Anti-debugging Instructions [B0001.034] examples: diff --git a/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml b/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml index b894bd4f..8a45ff3e 100644 --- a/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml +++ b/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml @@ -7,6 +7,7 @@ rule: description: Looks for instructions related to executing 64-bit code from a 32-bit process (Heaven's Gate) scopes: static: function + dynamic: unspecified mbc: - Defense Evasion::Disable or Evade Security Tools::Heavens Gate [F0004.008] references: diff --git a/anti-analysis/anti-forensic/patch-process-command-line.yml b/anti-analysis/anti-forensic/patch-process-command-line.yml index 5617c518..1f9da45b 100644 --- a/anti-analysis/anti-forensic/patch-process-command-line.yml +++ b/anti-analysis/anti-forensic/patch-process-command-line.yml @@ -7,6 +7,7 @@ rule: - "@_re_fox" scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Process Injection [T1055] mbc: diff --git a/anti-analysis/anti-forensic/self-deletion/self-delete.yml b/anti-analysis/anti-forensic/self-deletion/self-delete.yml index f563b9b7..278d0fa9 100644 --- a/anti-analysis/anti-forensic/self-deletion/self-delete.yml +++ b/anti-analysis/anti-forensic/self-deletion/self-delete.yml @@ -7,6 +7,7 @@ rule: - "@mr-tz" scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Indicator Removal::File Deletion [T1070.004] mbc: diff --git a/anti-analysis/anti-vm/vm-detection/check-for-foreground-window-switch.yml b/anti-analysis/anti-vm/vm-detection/check-for-foreground-window-switch.yml index 74b0d82d..a88a0f37 100644 --- a/anti-analysis/anti-vm/vm-detection/check-for-foreground-window-switch.yml +++ b/anti-analysis/anti-vm/vm-detection/check-for-foreground-window-switch.yml @@ -7,6 +7,7 @@ rule: description: Detect usage of GetForegroundWindow and Sleep APIs to check if there is any foreground window switch. Typically, sandboxes do not switch the foreground window like a user would in a normal environment. scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks [T1497.002] references: diff --git a/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml b/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml index b957a97a..fb7196fc 100644 --- a/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml +++ b/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml @@ -6,6 +6,7 @@ rule: - "@_re_fox" scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] mbc: diff --git a/anti-analysis/obfuscation/obfuscated-with-callobfuscator.yml b/anti-analysis/obfuscation/obfuscated-with-callobfuscator.yml index 4695bc82..5a16faf5 100644 --- a/anti-analysis/obfuscation/obfuscated-with-callobfuscator.yml +++ b/anti-analysis/obfuscation/obfuscated-with-callobfuscator.yml @@ -6,6 +6,7 @@ rule: - johnk3r scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml b/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml index e90562f9..1b72305b 100644 --- a/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml +++ b/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml @@ -6,6 +6,7 @@ rule: - moritz.raabe@mandiant.com scopes: static: basic block + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Indicator Removal from Tools [T1027.005] mbc: diff --git a/anti-analysis/packer/confuser/packed-with-confuser.yml b/anti-analysis/packer/confuser/packed-with-confuser.yml index 864bbf5c..b9fc5e46 100644 --- a/anti-analysis/packer/confuser/packed-with-confuser.yml +++ b/anti-analysis/packer/confuser/packed-with-confuser.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/anti-analysis/packer/generic/packed-with-generic-packer.yml b/anti-analysis/packer/generic/packed-with-generic-packer.yml index 4f4bd522..5ec44580 100644 --- a/anti-analysis/packer/generic/packed-with-generic-packer.yml +++ b/anti-analysis/packer/generic/packed-with-generic-packer.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/anti-analysis/packer/kkrunchy/packed-with-kkrunchy.yml b/anti-analysis/packer/kkrunchy/packed-with-kkrunchy.yml index 5dc34686..494c9604 100644 --- a/anti-analysis/packer/kkrunchy/packed-with-kkrunchy.yml +++ b/anti-analysis/packer/kkrunchy/packed-with-kkrunchy.yml @@ -6,6 +6,7 @@ rule: - "@_re_fox" scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/anti-analysis/packer/nspack/packed-with-nspack.yml b/anti-analysis/packer/nspack/packed-with-nspack.yml index 8ca6d98f..f9a36399 100644 --- a/anti-analysis/packer/nspack/packed-with-nspack.yml +++ b/anti-analysis/packer/nspack/packed-with-nspack.yml @@ -6,6 +6,7 @@ rule: - "@_re_fox" scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/anti-analysis/packer/pebundle/packed-with-pebundle.yml b/anti-analysis/packer/pebundle/packed-with-pebundle.yml index d995c7de..12af0688 100644 --- a/anti-analysis/packer/pebundle/packed-with-pebundle.yml +++ b/anti-analysis/packer/pebundle/packed-with-pebundle.yml @@ -6,6 +6,7 @@ rule: - "@_re_fox" scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/anti-analysis/packer/pecompact/packed-with-pecompact.yml b/anti-analysis/packer/pecompact/packed-with-pecompact.yml index 851f42c6..d7b56d05 100644 --- a/anti-analysis/packer/pecompact/packed-with-pecompact.yml +++ b/anti-analysis/packer/pecompact/packed-with-pecompact.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/anti-analysis/packer/pelocknt/packed-with-pelocknt.yml b/anti-analysis/packer/pelocknt/packed-with-pelocknt.yml index b8baf759..32bea5dd 100644 --- a/anti-analysis/packer/pelocknt/packed-with-pelocknt.yml +++ b/anti-analysis/packer/pelocknt/packed-with-pelocknt.yml @@ -6,6 +6,7 @@ rule: - "@_re_fox" scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/anti-analysis/packer/pespin/packed-with-pespin.yml b/anti-analysis/packer/pespin/packed-with-pespin.yml index eb5f9eb6..a345bfa1 100644 --- a/anti-analysis/packer/pespin/packed-with-pespin.yml +++ b/anti-analysis/packer/pespin/packed-with-pespin.yml @@ -6,6 +6,7 @@ rule: - jakub.jozwiak@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/anti-analysis/packer/petite/packed-with-petite.yml b/anti-analysis/packer/petite/packed-with-petite.yml index 335bf439..ee1f5f59 100644 --- a/anti-analysis/packer/petite/packed-with-petite.yml +++ b/anti-analysis/packer/petite/packed-with-petite.yml @@ -6,6 +6,7 @@ rule: - "@_re_fox" scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/anti-analysis/packer/rlpack/packed-with-rlpack.yml b/anti-analysis/packer/rlpack/packed-with-rlpack.yml index 1f8ef6ef..7c192d7f 100644 --- a/anti-analysis/packer/rlpack/packed-with-rlpack.yml +++ b/anti-analysis/packer/rlpack/packed-with-rlpack.yml @@ -6,6 +6,7 @@ rule: - "@_re_fox" scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/anti-analysis/packer/themida/packed-with-themida.yml b/anti-analysis/packer/themida/packed-with-themida.yml index 703c8ffc..2c82f56c 100644 --- a/anti-analysis/packer/themida/packed-with-themida.yml +++ b/anti-analysis/packer/themida/packed-with-themida.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/anti-analysis/packer/y0da/packed-with-y0da-crypter.yml b/anti-analysis/packer/y0da/packed-with-y0da-crypter.yml index 194f57db..6747e4af 100644 --- a/anti-analysis/packer/y0da/packed-with-y0da-crypter.yml +++ b/anti-analysis/packer/y0da/packed-with-y0da-crypter.yml @@ -6,6 +6,7 @@ rule: - "@_re_fox" scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/collection/credit-card/parse-credit-card-information.yml b/collection/credit-card/parse-credit-card-information.yml index 4b8269a2..5c0dc9be 100644 --- a/collection/credit-card/parse-credit-card-information.yml +++ b/collection/credit-card/parse-credit-card-information.yml @@ -6,6 +6,7 @@ rule: - "@_re_fox" scopes: static: function + dynamic: unspecified mbc: - Data::Check String [C0019] examples: diff --git a/collection/screenshot/capture-screenshot-via-keybd-event.yml b/collection/screenshot/capture-screenshot-via-keybd-event.yml index 5f67f6a8..a3a6e025 100644 --- a/collection/screenshot/capture-screenshot-via-keybd-event.yml +++ b/collection/screenshot/capture-screenshot-via-keybd-event.yml @@ -6,6 +6,7 @@ rule: - "@_re_fox" scopes: static: function + dynamic: unspecified att&ck: - Collection::Screen Capture [T1113] mbc: diff --git a/communication/http/client/check-http-status-code.yml b/communication/http/client/check-http-status-code.yml index 5b78e60f..02fb2cfa 100644 --- a/communication/http/client/check-http-status-code.yml +++ b/communication/http/client/check-http-status-code.yml @@ -6,6 +6,7 @@ rule: - "@mr-tz" scopes: static: function + dynamic: unspecified mbc: - Communication::HTTP Communication::Read Header [C0002.014] examples: diff --git a/communication/http/client/create-bits-job.yml b/communication/http/client/create-bits-job.yml index b800c4b2..5b2e083b 100644 --- a/communication/http/client/create-bits-job.yml +++ b/communication/http/client/create-bits-job.yml @@ -8,6 +8,7 @@ rule: description: BITS jobs can be used to download data or achieve persistence (via SetNotifyCmdLine) scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::BITS Jobs [T1197] - Persistence::BITS Jobs [T1197] diff --git a/communication/http/client/extract-http-body.yml b/communication/http/client/extract-http-body.yml index 5761377b..81172ea5 100644 --- a/communication/http/client/extract-http-body.yml +++ b/communication/http/client/extract-http-body.yml @@ -6,6 +6,7 @@ rule: - matthew.williams@mandiant.com scopes: static: function + dynamic: unspecified mbc: - Communication::HTTP Communication::Extract Body [C0002.011] references: diff --git a/communication/http/client/get-http-document-via-iwebbrowser2.yml b/communication/http/client/get-http-document-via-iwebbrowser2.yml index 698ac33a..ff8fdfb9 100644 --- a/communication/http/client/get-http-document-via-iwebbrowser2.yml +++ b/communication/http/client/get-http-document-via-iwebbrowser2.yml @@ -6,6 +6,7 @@ rule: - matthew.williams@mandiant.com scopes: static: function + dynamic: unspecified mbc: - Communication::HTTP Communication::Get Response [C0002.017] - Communication::HTTP Communication::IWebBrowser [C0002.010] diff --git a/communication/http/initialize-iwebbrowser2.yml b/communication/http/initialize-iwebbrowser2.yml index 567c2420..63a95812 100644 --- a/communication/http/initialize-iwebbrowser2.yml +++ b/communication/http/initialize-iwebbrowser2.yml @@ -6,6 +6,7 @@ rule: - matthew.williams@mandiant.com scopes: static: basic block + dynamic: unspecified mbc: - Communication::HTTP Communication::IWebBrowser [C0002.010] references: diff --git a/communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml b/communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml index f1745edd..776d88e6 100644 --- a/communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml +++ b/communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml @@ -7,6 +7,7 @@ rule: description: The TransmitPackets function transmits in-memory data or file data over a connected socket. The TransmitPackets function uses the operating system cache manager to retrieve file data, locking memory for the minimum time required to transmit and resulting in efficient, high-performance transmission. scopes: static: function + dynamic: unspecified mbc: - Communication::Socket Communication::Send TCP Data [C0001.014] references: diff --git a/compiler/d/compiled-with-dmd.yml b/compiler/d/compiled-with-dmd.yml index 1aadb496..8a3b54f2 100644 --- a/compiler/d/compiled-with-dmd.yml +++ b/compiler/d/compiled-with-dmd.yml @@ -6,6 +6,7 @@ rule: - "@_re_fox" scopes: static: file + dynamic: unspecified references: - https://github.com/dlang/dmd examples: diff --git a/compiler/vb/compiled-from-visual-basic.yml b/compiler/vb/compiled-from-visual-basic.yml index c5d6abe8..ffca0817 100644 --- a/compiler/vb/compiled-from-visual-basic.yml +++ b/compiler/vb/compiled-from-visual-basic.yml @@ -6,6 +6,7 @@ rule: - "@williballenthin" scopes: static: file + dynamic: unspecified examples: - 9bca6b99e7981208af4c7925b96fb9cf features: diff --git a/data-manipulation/checksum/adler32/compute-adler32-checksum.yml b/data-manipulation/checksum/adler32/compute-adler32-checksum.yml index 365d70d9..4539d8ab 100644 --- a/data-manipulation/checksum/adler32/compute-adler32-checksum.yml +++ b/data-manipulation/checksum/adler32/compute-adler32-checksum.yml @@ -6,6 +6,7 @@ rule: - matthew.williams@mandiant.com scopes: static: function + dynamic: unspecified mbc: - Data::Checksum::Adler [C0032.005] references: diff --git a/data-manipulation/compression/compress-data-via-zlib-inflate-or-deflate.yml b/data-manipulation/compression/compress-data-via-zlib-inflate-or-deflate.yml index 43950a0e..08672bba 100644 --- a/data-manipulation/compression/compress-data-via-zlib-inflate-or-deflate.yml +++ b/data-manipulation/compression/compress-data-via-zlib-inflate-or-deflate.yml @@ -7,6 +7,7 @@ rule: - blas.kojusner@mandiant.com scopes: static: function + dynamic: unspecified mbc: - Data::Compress Data [C0024] references: diff --git a/data-manipulation/compression/decompress-data-using-aplib.yml b/data-manipulation/compression/decompress-data-using-aplib.yml index 8d032e09..e8819e3f 100644 --- a/data-manipulation/compression/decompress-data-using-aplib.yml +++ b/data-manipulation/compression/decompress-data-using-aplib.yml @@ -9,6 +9,7 @@ rule: description: detects decompression function of library aPLib scopes: static: function + dynamic: unspecified mbc: - Data::Decompress Data::aPLib [C0025.003] references: diff --git a/data-manipulation/compression/decompress-data-using-lzo.yml b/data-manipulation/compression/decompress-data-using-lzo.yml index e388b9c7..9965d805 100644 --- a/data-manipulation/compression/decompress-data-using-lzo.yml +++ b/data-manipulation/compression/decompress-data-using-lzo.yml @@ -8,6 +8,7 @@ rule: description: detects the decompression routine from LZO scopes: static: function + dynamic: unspecified mbc: - Data::Decompress Data [C0025] references: diff --git a/data-manipulation/compression/decompress-data-using-ucl.yml b/data-manipulation/compression/decompress-data-using-ucl.yml index 53bba7f0..164830c1 100644 --- a/data-manipulation/compression/decompress-data-using-ucl.yml +++ b/data-manipulation/compression/decompress-data-using-ucl.yml @@ -6,6 +6,7 @@ rule: - jakub.jozwiak@mandiant.com scopes: static: function + dynamic: unspecified mbc: - Data::Decompress Data [C0025] references: diff --git a/data-manipulation/compression/decompress-data-via-iencodingfilterfactory.yml b/data-manipulation/compression/decompress-data-via-iencodingfilterfactory.yml index db901234..03156c71 100644 --- a/data-manipulation/compression/decompress-data-via-iencodingfilterfactory.yml +++ b/data-manipulation/compression/decompress-data-via-iencodingfilterfactory.yml @@ -6,6 +6,7 @@ rule: - matthew.williams@mandiant.com scopes: static: function + dynamic: unspecified mbc: - Data::Decompress Data::IEncodingFilterFactory [C0025.002] references: diff --git a/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml b/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml index 61ac8aef..2f90293c 100644 --- a/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml +++ b/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml @@ -7,6 +7,7 @@ rule: - sara.rincon@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/data-manipulation/encoding/xor/encode-data-using-xor.yml b/data-manipulation/encoding/xor/encode-data-using-xor.yml index 5a5074d2..39938b34 100644 --- a/data-manipulation/encoding/xor/encode-data-using-xor.yml +++ b/data-manipulation/encoding/xor/encode-data-using-xor.yml @@ -6,6 +6,7 @@ rule: - moritz.raabe@mandiant.com scopes: static: basic block + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/data-manipulation/encryption/aes/decrypt-data-using-aes-via-x86-extensions.yml b/data-manipulation/encryption/aes/decrypt-data-using-aes-via-x86-extensions.yml index 229d3dca..9a6898f8 100644 --- a/data-manipulation/encryption/aes/decrypt-data-using-aes-via-x86-extensions.yml +++ b/data-manipulation/encryption/aes/decrypt-data-using-aes-via-x86-extensions.yml @@ -6,6 +6,7 @@ rule: - moritz.raabe@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Deobfuscate/Decode Files or Information [T1140] mbc: diff --git a/data-manipulation/encryption/aes/encrypt-data-using-aes-mixcolumns-step.yml b/data-manipulation/encryption/aes/encrypt-data-using-aes-mixcolumns-step.yml index 0e1320b5..d4863add 100644 --- a/data-manipulation/encryption/aes/encrypt-data-using-aes-mixcolumns-step.yml +++ b/data-manipulation/encryption/aes/encrypt-data-using-aes-mixcolumns-step.yml @@ -7,6 +7,7 @@ rule: - "@mr-tz" scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/data-manipulation/encryption/aes/encrypt-data-using-aes-via-dotnet.yml b/data-manipulation/encryption/aes/encrypt-data-using-aes-via-dotnet.yml index 0ffe39e4..3eac791f 100644 --- a/data-manipulation/encryption/aes/encrypt-data-using-aes-via-dotnet.yml +++ b/data-manipulation/encryption/aes/encrypt-data-using-aes-via-dotnet.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/data-manipulation/encryption/aes/manually-build-aes-constants.yml b/data-manipulation/encryption/aes/manually-build-aes-constants.yml index dcc35fcd..0ef20ca7 100644 --- a/data-manipulation/encryption/aes/manually-build-aes-constants.yml +++ b/data-manipulation/encryption/aes/manually-build-aes-constants.yml @@ -6,6 +6,7 @@ rule: - huynh.t.nhan@gmail.com scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/data-manipulation/encryption/des/encrypt-data-using-des.yml b/data-manipulation/encryption/des/encrypt-data-using-des.yml index a7486a61..15a03bde 100644 --- a/data-manipulation/encryption/des/encrypt-data-using-des.yml +++ b/data-manipulation/encryption/des/encrypt-data-using-des.yml @@ -7,6 +7,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: basic block + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/data-manipulation/encryption/elliptic-curve/encrypt-data-using-curve25519.yml b/data-manipulation/encryption/elliptic-curve/encrypt-data-using-curve25519.yml index 0bd8ef27..6cc51f3b 100644 --- a/data-manipulation/encryption/elliptic-curve/encrypt-data-using-curve25519.yml +++ b/data-manipulation/encryption/elliptic-curve/encrypt-data-using-curve25519.yml @@ -7,6 +7,7 @@ rule: description: Targets code that enforces Curve25519's secret key restrictions. The specification states "The legitimate users are assumed to generate independent uniform random secret keys. A user can, for example, generate 32 uniform random bytes, clear bits 0, 1, 2 of the first byte, clear bit 7 of the last byte, and set bit 6 of the last byte." scopes: static: basic block + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] examples: diff --git a/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml b/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml index f759022f..abf5ba42 100755 --- a/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml +++ b/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml @@ -7,6 +7,7 @@ rule: - blaine.stancill@mandiant.com scopes: static: basic block + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml b/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml index 0015356e..1d00f2bc 100644 --- a/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml +++ b/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml @@ -7,6 +7,7 @@ rule: description: Looks for instruction mnemonics associated with initialization of the HC-128 stream cipher scopes: static: basic block + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml index 0476495a..a0ff7301 100644 --- a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml +++ b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml @@ -6,6 +6,7 @@ rule: - moritz.raabe@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml index 12de840c..b9d2736e 100644 --- a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml +++ b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml @@ -6,6 +6,7 @@ rule: - moritz.raabe@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-with-custom-key-via-winapi.yml b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-with-custom-key-via-winapi.yml index e1ba2710..01933b91 100755 --- a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-with-custom-key-via-winapi.yml +++ b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-with-custom-key-via-winapi.yml @@ -6,6 +6,7 @@ rule: - blaine.stancill@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml b/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml index 9f1406ba..939631ce 100644 --- a/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml +++ b/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml @@ -6,6 +6,7 @@ rule: - "@_re_fox" scopes: static: basic block + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml b/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml index 06696b73..dddf5701 100644 --- a/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml +++ b/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml @@ -7,6 +7,7 @@ rule: description: Looks for cryptographic constants associated with the Sosemanuk stream cipher scopes: static: basic block + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/data-manipulation/encryption/tea/decrypt-data-using-tea.yml b/data-manipulation/encryption/tea/decrypt-data-using-tea.yml index d1171f00..c47484c5 100755 --- a/data-manipulation/encryption/tea/decrypt-data-using-tea.yml +++ b/data-manipulation/encryption/tea/decrypt-data-using-tea.yml @@ -7,6 +7,7 @@ rule: - raymond.leong@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/data-manipulation/encryption/tea/encrypt-data-using-tea.yml b/data-manipulation/encryption/tea/encrypt-data-using-tea.yml index 147274a9..004e0bdf 100755 --- a/data-manipulation/encryption/tea/encrypt-data-using-tea.yml +++ b/data-manipulation/encryption/tea/encrypt-data-using-tea.yml @@ -7,6 +7,7 @@ rule: - raymond.leong@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml b/data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml index c6c6047e..c595dd21 100644 --- a/data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml +++ b/data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml @@ -6,6 +6,7 @@ rule: - "@_re_fox" scopes: static: basic block + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/data-manipulation/encryption/vest/encrypt-data-using-vest.yml b/data-manipulation/encryption/vest/encrypt-data-using-vest.yml index b05fd630..7047f06e 100644 --- a/data-manipulation/encryption/vest/encrypt-data-using-vest.yml +++ b/data-manipulation/encryption/vest/encrypt-data-using-vest.yml @@ -6,6 +6,7 @@ rule: - "@_re_fox" scopes: static: basic block + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/data-manipulation/encryption/xtea/encrypt-data-using-xtea.yml b/data-manipulation/encryption/xtea/encrypt-data-using-xtea.yml index 14f85ee1..d51bcc0a 100755 --- a/data-manipulation/encryption/xtea/encrypt-data-using-xtea.yml +++ b/data-manipulation/encryption/xtea/encrypt-data-using-xtea.yml @@ -6,6 +6,7 @@ rule: - raymond.leong@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/data-manipulation/encryption/xxtea/encrypt-data-using-xxtea.yml b/data-manipulation/encryption/xxtea/encrypt-data-using-xxtea.yml index 9cf3e5a2..31bba220 100755 --- a/data-manipulation/encryption/xxtea/encrypt-data-using-xxtea.yml +++ b/data-manipulation/encryption/xxtea/encrypt-data-using-xxtea.yml @@ -6,6 +6,7 @@ rule: - raymond.leong@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/data-manipulation/hashing/djb2/hash-data-using-djb2.yml b/data-manipulation/hashing/djb2/hash-data-using-djb2.yml index 96073bf4..f54f47bc 100644 --- a/data-manipulation/hashing/djb2/hash-data-using-djb2.yml +++ b/data-manipulation/hashing/djb2/hash-data-using-djb2.yml @@ -7,6 +7,7 @@ rule: - still@teamt5.org scopes: static: function + dynamic: unspecified mbc: - Data::Non-Cryptographic Hash::djb2 [C0030.006] references: diff --git a/data-manipulation/hashing/fnv/hash-data-using-fnv.yml b/data-manipulation/hashing/fnv/hash-data-using-fnv.yml index 76e178df..785d303f 100644 --- a/data-manipulation/hashing/fnv/hash-data-using-fnv.yml +++ b/data-manipulation/hashing/fnv/hash-data-using-fnv.yml @@ -9,6 +9,7 @@ rule: description: can be any Fowler-Noll-Vo (FNV) hash variant, including FNV-1, FNV-1a, FNV-0 scopes: static: function + dynamic: unspecified mbc: - Data::Non-Cryptographic Hash::FNV [C0030.005] references: diff --git a/data-manipulation/hashing/tiger/hash-data-using-tiger.yml b/data-manipulation/hashing/tiger/hash-data-using-tiger.yml index cc0155d3..8a1c0c91 100644 --- a/data-manipulation/hashing/tiger/hash-data-using-tiger.yml +++ b/data-manipulation/hashing/tiger/hash-data-using-tiger.yml @@ -6,6 +6,7 @@ rule: - "@_re_fox" scopes: static: basic block + dynamic: unspecified mbc: - Cryptography::Cryptographic Hash::Tiger [C0029.005] examples: diff --git a/data-manipulation/hmac/authenticate-hmac.yml b/data-manipulation/hmac/authenticate-hmac.yml index e3e6a478..7d2fa46a 100644 --- a/data-manipulation/hmac/authenticate-hmac.yml +++ b/data-manipulation/hmac/authenticate-hmac.yml @@ -6,6 +6,7 @@ rule: - moritz.raabe@mandiant.com scopes: static: function + dynamic: unspecified mbc: - Cryptography::Hashed Message Authentication Code [C0061] references: diff --git a/executable/pe/export/forwarded-export.yml b/executable/pe/export/forwarded-export.yml index 15d44de9..29ce58de 100644 --- a/executable/pe/export/forwarded-export.yml +++ b/executable/pe/export/forwarded-export.yml @@ -6,6 +6,7 @@ rule: - ronnie.salomonsen@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Execution::Shared Modules [T1129] examples: diff --git a/executable/pe/section/tls/contain-a-thread-local-storage-tls-section.yml b/executable/pe/section/tls/contain-a-thread-local-storage-tls-section.yml index 5a70c1bc..aac58d59 100644 --- a/executable/pe/section/tls/contain-a-thread-local-storage-tls-section.yml +++ b/executable/pe/section/tls/contain-a-thread-local-storage-tls-section.yml @@ -6,6 +6,7 @@ rule: - michael.hunhoff@mandiant.com scopes: static: file + dynamic: unspecified examples: - Practical Malware Analysis Lab 16-02.exe_ features: diff --git a/host-interaction/driver/disable-driver-code-integrity.yml b/host-interaction/driver/disable-driver-code-integrity.yml index e85b642e..b7561264 100644 --- a/host-interaction/driver/disable-driver-code-integrity.yml +++ b/host-interaction/driver/disable-driver-code-integrity.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001] mbc: diff --git a/host-interaction/file-system/files/list/enumerate-files-recursively.yml b/host-interaction/file-system/files/list/enumerate-files-recursively.yml index 31e1f969..22dface0 100644 --- a/host-interaction/file-system/files/list/enumerate-files-recursively.yml +++ b/host-interaction/file-system/files/list/enumerate-files-recursively.yml @@ -7,6 +7,7 @@ rule: - anushka.virgaonkar@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Discovery::File and Directory Discovery [T1083] mbc: diff --git a/host-interaction/firewall/modify/access-firewall-settings-via-inetfwmgr.yml b/host-interaction/firewall/modify/access-firewall-settings-via-inetfwmgr.yml index d50566e5..693b960d 100644 --- a/host-interaction/firewall/modify/access-firewall-settings-via-inetfwmgr.yml +++ b/host-interaction/firewall/modify/access-firewall-settings-via-inetfwmgr.yml @@ -6,6 +6,7 @@ rule: - moritz.raabe@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Discovery::Software Discovery::Security Software Discovery [T1518.001] - Defense Evasion::Impair Defenses::Disable or Modify System Firewall [T1562.004] diff --git a/host-interaction/hardware/enumerate-devices-by-category.yml b/host-interaction/hardware/enumerate-devices-by-category.yml index aee1c65d..92f563c1 100644 --- a/host-interaction/hardware/enumerate-devices-by-category.yml +++ b/host-interaction/hardware/enumerate-devices-by-category.yml @@ -6,6 +6,7 @@ rule: - "@mr-tz" scopes: static: function + dynamic: unspecified references: - https://learn.microsoft.com/en-us/windows/win32/api/strmif/nf-strmif-icreatedevenum-createclassenumerator examples: diff --git a/host-interaction/hardware/storage/enumerate-disk-properties.yml b/host-interaction/hardware/storage/enumerate-disk-properties.yml index 5a266d74..d488452f 100644 --- a/host-interaction/hardware/storage/enumerate-disk-properties.yml +++ b/host-interaction/hardware/storage/enumerate-disk-properties.yml @@ -6,6 +6,7 @@ rule: - michael.hunhoff@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Discovery::System Information Discovery [T1082] references: diff --git a/host-interaction/memory/create-new-application-domain-in-dotnet.yml b/host-interaction/memory/create-new-application-domain-in-dotnet.yml index b90e2666..26cffe90 100644 --- a/host-interaction/memory/create-new-application-domain-in-dotnet.yml +++ b/host-interaction/memory/create-new-application-domain-in-dotnet.yml @@ -6,6 +6,7 @@ rule: - jakub.jozwiak@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Persistence::Hijack Execution Flow [T1574] references: diff --git a/host-interaction/os/version/check-os-version.yml b/host-interaction/os/version/check-os-version.yml index a38f853a..6ece107f 100644 --- a/host-interaction/os/version/check-os-version.yml +++ b/host-interaction/os/version/check-os-version.yml @@ -7,6 +7,7 @@ rule: - johnk3r scopes: static: function + dynamic: unspecified att&ck: - Discovery::System Information Discovery [T1082] mbc: diff --git a/host-interaction/process/inject/inject-pe.yml b/host-interaction/process/inject/inject-pe.yml index 424993fa..c455c7f3 100644 --- a/host-interaction/process/inject/inject-pe.yml +++ b/host-interaction/process/inject/inject-pe.yml @@ -6,6 +6,7 @@ rule: - 0x534a@mailbox.org scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Process Injection::Portable Executable Injection [T1055.002] - Defense Evasion::Reflective Code Loading [T1620] diff --git a/host-interaction/recycle-bin/empty-recycle-bin-quietly.yml b/host-interaction/recycle-bin/empty-recycle-bin-quietly.yml index 5bedcaab..b6e1b813 100644 --- a/host-interaction/recycle-bin/empty-recycle-bin-quietly.yml +++ b/host-interaction/recycle-bin/empty-recycle-bin-quietly.yml @@ -6,6 +6,7 @@ rule: - matthew.williams@mandiant.com scopes: static: basic block + dynamic: unspecified att&ck: - Defense Evasion::Indicator Removal [T1070] references: diff --git a/host-interaction/software/get-installed-programs.yml b/host-interaction/software/get-installed-programs.yml index 4c38021d..c8469696 100644 --- a/host-interaction/software/get-installed-programs.yml +++ b/host-interaction/software/get-installed-programs.yml @@ -7,6 +7,7 @@ rule: - "@_re_fox" scopes: static: function + dynamic: unspecified att&ck: - Discovery::Software Discovery [T1518] examples: diff --git a/host-interaction/uac/bypass/bypass-uac-via-icmluautil.yml b/host-interaction/uac/bypass/bypass-uac-via-icmluautil.yml index f1bf54f3..ed11306b 100644 --- a/host-interaction/uac/bypass/bypass-uac-via-icmluautil.yml +++ b/host-interaction/uac/bypass/bypass-uac-via-icmluautil.yml @@ -6,6 +6,7 @@ rule: - anamaria.martinezgom@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Abuse Elevation Control Mechanism::Bypass User Account Control [T1548.002] references: diff --git a/host-interaction/uac/bypass/bypass-uac-via-rpc.yml b/host-interaction/uac/bypass/bypass-uac-via-rpc.yml index 215f3da5..7da2cb9a 100644 --- a/host-interaction/uac/bypass/bypass-uac-via-rpc.yml +++ b/host-interaction/uac/bypass/bypass-uac-via-rpc.yml @@ -7,6 +7,7 @@ rule: - david@edeca.net scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Abuse Elevation Control Mechanism::Bypass User Account Control [T1548.002] references: diff --git a/host-interaction/wmi/connect-to-wmi-namespace-via-wbemlocator.yml b/host-interaction/wmi/connect-to-wmi-namespace-via-wbemlocator.yml index a2124b40..dd334fb2 100644 --- a/host-interaction/wmi/connect-to-wmi-namespace-via-wbemlocator.yml +++ b/host-interaction/wmi/connect-to-wmi-namespace-via-wbemlocator.yml @@ -7,6 +7,7 @@ rule: - michael.hunhoff@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Execution::Windows Management Instrumentation [T1047] examples: diff --git a/lib/calculate-modulo-256-via-x86-assembly.yml b/lib/calculate-modulo-256-via-x86-assembly.yml index 869bf134..1e25b0b2 100644 --- a/lib/calculate-modulo-256-via-x86-assembly.yml +++ b/lib/calculate-modulo-256-via-x86-assembly.yml @@ -6,6 +6,7 @@ rule: lib: 'true' scopes: static: instruction + dynamic: unspecified mbc: - Data::Modulo [C0058] examples: diff --git a/lib/contain-loop.yml b/lib/contain-loop.yml index 50f166cc..99db55a7 100644 --- a/lib/contain-loop.yml +++ b/lib/contain-loop.yml @@ -6,6 +6,7 @@ rule: lib: 'true' scopes: static: function + dynamic: unspecified examples: - 08AC667C65D36D6542917655571E61C8:0x406EAA features: diff --git a/lib/contain-pusha-popa-sequence.yml b/lib/contain-pusha-popa-sequence.yml index c936d850..e3da806e 100644 --- a/lib/contain-pusha-popa-sequence.yml +++ b/lib/contain-pusha-popa-sequence.yml @@ -6,6 +6,7 @@ rule: lib: 'true' scopes: static: function + dynamic: unspecified examples: - a5c70086b3bc4fe64f4e7a0aa452e620:0x35007200 features: diff --git a/lib/peb-access.yml b/lib/peb-access.yml index 4757449b..ca201e5d 100644 --- a/lib/peb-access.yml +++ b/lib/peb-access.yml @@ -6,6 +6,7 @@ rule: lib: 'true' scopes: static: basic block + dynamic: unspecified mbc: - Anti-Behavioral Analysis::Debugger Detection::Process Environment Block [B0001.019] references: diff --git a/lib/validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml b/lib/validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml index bc690c97..298a4aa2 100644 --- a/lib/validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml +++ b/lib/validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml @@ -6,6 +6,7 @@ rule: lib: 'true' scopes: static: function + dynamic: unspecified mbc: - Data::Checksum::Luhn [C0032.002] examples: diff --git a/lib/validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml b/lib/validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml index 40f5007b..3ed7d1ea 100644 --- a/lib/validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml +++ b/lib/validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml @@ -6,6 +6,7 @@ rule: lib: 'true' scopes: static: function + dynamic: unspecified mbc: - Data::Checksum::Luhn [C0032.002] examples: diff --git a/linking/runtime-linking/access-peb-ldr_data.yml b/linking/runtime-linking/access-peb-ldr_data.yml index 29e03dbb..943bad58 100644 --- a/linking/runtime-linking/access-peb-ldr_data.yml +++ b/linking/runtime-linking/access-peb-ldr_data.yml @@ -6,6 +6,7 @@ rule: - moritz.raabe@mandiant.com scopes: static: basic block + dynamic: unspecified att&ck: - Execution::Shared Modules [T1129] references: diff --git a/linking/runtime-linking/get-kernel32-base-address.yml b/linking/runtime-linking/get-kernel32-base-address.yml index ecb3962a..9fc776d1 100644 --- a/linking/runtime-linking/get-kernel32-base-address.yml +++ b/linking/runtime-linking/get-kernel32-base-address.yml @@ -6,6 +6,7 @@ rule: - moritz.raabe@mandiant.com scopes: static: basic block + dynamic: unspecified att&ck: - Execution::Shared Modules [T1129] references: diff --git a/linking/runtime-linking/get-ntdll-base-address.yml b/linking/runtime-linking/get-ntdll-base-address.yml index b151eae6..f4c1d1a4 100644 --- a/linking/runtime-linking/get-ntdll-base-address.yml +++ b/linking/runtime-linking/get-ntdll-base-address.yml @@ -6,6 +6,7 @@ rule: - moritz.raabe@mandiant.com scopes: static: basic block + dynamic: unspecified att&ck: - Execution::Shared Modules [T1129] references: diff --git a/linking/static/msdetours/linked-against-microsoft-detours.yml b/linking/static/msdetours/linked-against-microsoft-detours.yml index 5b1efef0..545687f3 100644 --- a/linking/static/msdetours/linked-against-microsoft-detours.yml +++ b/linking/static/msdetours/linked-against-microsoft-detours.yml @@ -6,6 +6,7 @@ rule: - moritz.raabe@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Hijack Execution Flow [T1574] references: diff --git a/load-code/dotnet/execute-dotnet-assembly-via-clr-host.yml b/load-code/dotnet/execute-dotnet-assembly-via-clr-host.yml index ad6573f1..43ad39bc 100644 --- a/load-code/dotnet/execute-dotnet-assembly-via-clr-host.yml +++ b/load-code/dotnet/execute-dotnet-assembly-via-clr-host.yml @@ -8,6 +8,7 @@ rule: description: may be used to evade hooks or hinder analysis scopes: static: function + dynamic: unspecified references: - https://github.com/TheWover/donut/blob/master/DonutTest/rundotnet.cpp examples: diff --git a/load-code/execute-vbscript-javascript-or-jscript-in-memory.yml b/load-code/execute-vbscript-javascript-or-jscript-in-memory.yml index 52a44fa5..7d81a0df 100644 --- a/load-code/execute-vbscript-javascript-or-jscript-in-memory.yml +++ b/load-code/execute-vbscript-javascript-or-jscript-in-memory.yml @@ -8,6 +8,7 @@ rule: description: the sample may execute 32-bit VBScript, JavaScript, or JScript (32-bit) scopes: static: function + dynamic: unspecified references: - https://gist.github.com/odzhan/d18145b9538a3653be2f9a580b53b063 examples: diff --git a/load-code/pe/enumerate-pe-sections.yml b/load-code/pe/enumerate-pe-sections.yml index e4a6869d..96c0c0f7 100644 --- a/load-code/pe/enumerate-pe-sections.yml +++ b/load-code/pe/enumerate-pe-sections.yml @@ -7,6 +7,7 @@ rule: - "@mr-tz" scopes: static: function + dynamic: unspecified mbc: - Discovery::Code Discovery::Enumerate PE Sections [B0046.001] references: diff --git a/load-code/pe/inject-dll-reflectively.yml b/load-code/pe/inject-dll-reflectively.yml index 3f6589d4..11c78444 100644 --- a/load-code/pe/inject-dll-reflectively.yml +++ b/load-code/pe/inject-dll-reflectively.yml @@ -6,6 +6,7 @@ rule: - "@Ana06" scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Process Injection::Dynamic-link Library Injection [T1055.001] - Defense Evasion::Reflective Code Loading [T1620] diff --git a/load-code/pe/parse-pe-header.yml b/load-code/pe/parse-pe-header.yml index 7d586728..e082fda9 100644 --- a/load-code/pe/parse-pe-header.yml +++ b/load-code/pe/parse-pe-header.yml @@ -6,6 +6,7 @@ rule: - moritz.raabe@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Execution::Shared Modules [T1129] examples: diff --git a/load-code/pe/rebuild-import-table.yml b/load-code/pe/rebuild-import-table.yml index a116c6d6..9620246c 100644 --- a/load-code/pe/rebuild-import-table.yml +++ b/load-code/pe/rebuild-import-table.yml @@ -6,6 +6,7 @@ rule: - "@Ana06" scopes: static: function + dynamic: unspecified mbc: - Defense Evasion::Hijack Execution Flow::Import Address Table Hooking [F0015.003] references: diff --git a/load-code/pe/resolve-function-by-parsing-pe-exports.yml b/load-code/pe/resolve-function-by-parsing-pe-exports.yml index 3100d100..ce5cec4c 100755 --- a/load-code/pe/resolve-function-by-parsing-pe-exports.yml +++ b/load-code/pe/resolve-function-by-parsing-pe-exports.yml @@ -6,6 +6,7 @@ rule: - sara-rn scopes: static: function + dynamic: unspecified examples: - 73CE04892E5F39EC82B00C02FC04C70F:0x406BA1 features: diff --git a/nursery/authenticate-data-with-md5-mac.yml b/nursery/authenticate-data-with-md5-mac.yml index 19c1aa66..722159dd 100644 --- a/nursery/authenticate-data-with-md5-mac.yml +++ b/nursery/authenticate-data-with-md5-mac.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: function + dynamic: unspecified mbc: - Cryptography::Cryptographic Hash::MD5 [C0029.001] references: diff --git a/nursery/check-for-minimum-number-of-windows-on-screen.yml b/nursery/check-for-minimum-number-of-windows-on-screen.yml index f1dfe9fa..3f0a1faf 100644 --- a/nursery/check-for-minimum-number-of-windows-on-screen.yml +++ b/nursery/check-for-minimum-number-of-windows-on-screen.yml @@ -6,6 +6,7 @@ rule: - echernofsky@google.com scopes: static: basic block + dynamic: unspecified att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] references: diff --git a/nursery/check-for-vm-using-instruction-vpcext.yml b/nursery/check-for-vm-using-instruction-vpcext.yml index 36e0e7f2..0e0c247e 100644 --- a/nursery/check-for-vm-using-instruction-vpcext.yml +++ b/nursery/check-for-vm-using-instruction-vpcext.yml @@ -8,6 +8,7 @@ rule: description: Detects virtualization using VPCEXT (visual property container extender) instruction. Execution of this instruction will cause an illegal instruction exception outside of a virtual environment otherwise return 0 scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Virtualization/Sandbox Evasion [T1497] mbc: diff --git a/nursery/check-thread-yield-allowed.yml b/nursery/check-thread-yield-allowed.yml index 89c05d89..9965591e 100644 --- a/nursery/check-thread-yield-allowed.yml +++ b/nursery/check-thread-yield-allowed.yml @@ -6,6 +6,7 @@ rule: - michael.hunhoff@mandiant.com scopes: static: function + dynamic: unspecified mbc: - Anti-Behavioral Analysis::Debugger Detection::NtYieldExecution/SwitchToThread [B0001.015] references: diff --git a/nursery/compiled-with-exescript.yml b/nursery/compiled-with-exescript.yml index c7785a9a..9e442173 100644 --- a/nursery/compiled-with-exescript.yml +++ b/nursery/compiled-with-exescript.yml @@ -6,6 +6,7 @@ rule: - jonathanlepore@google.com scopes: static: file + dynamic: unspecified references: - https://www.hide-folder.com/overview/hf_7.html features: diff --git a/nursery/covertly-decode-and-write-data-to-windows-directory-using-indirect-calls.yml b/nursery/covertly-decode-and-write-data-to-windows-directory-using-indirect-calls.yml index c58d6e15..b91b5f59 100644 --- a/nursery/covertly-decode-and-write-data-to-windows-directory-using-indirect-calls.yml +++ b/nursery/covertly-decode-and-write-data-to-windows-directory-using-indirect-calls.yml @@ -6,6 +6,7 @@ rule: - dan.kelly@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/nursery/encrypt-data-using-aes-via-x86-extensions.yml b/nursery/encrypt-data-using-aes-via-x86-extensions.yml index 26630226..af4e2ad0 100644 --- a/nursery/encrypt-data-using-aes-via-x86-extensions.yml +++ b/nursery/encrypt-data-using-aes-via-x86-extensions.yml @@ -6,6 +6,7 @@ rule: - moritz.raabe@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/nursery/encrypt-data-using-aes.yml b/nursery/encrypt-data-using-aes.yml index 61e1dae2..03f4150e 100644 --- a/nursery/encrypt-data-using-aes.yml +++ b/nursery/encrypt-data-using-aes.yml @@ -8,6 +8,7 @@ rule: - Ivan Kwiatkowski (@JusticeRage) scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/nursery/encrypt-data-using-fakem-cipher.yml b/nursery/encrypt-data-using-fakem-cipher.yml index ed9b95b2..ae8193db 100644 --- a/nursery/encrypt-data-using-fakem-cipher.yml +++ b/nursery/encrypt-data-using-fakem-cipher.yml @@ -8,6 +8,7 @@ rule: description: Detect custom encryption cipher used by FAKEM malware family scopes: static: basic block + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/nursery/encrypt-data-using-openssl-dsa.yml b/nursery/encrypt-data-using-openssl-dsa.yml index 9ddac22d..9faf2396 100644 --- a/nursery/encrypt-data-using-openssl-dsa.yml +++ b/nursery/encrypt-data-using-openssl-dsa.yml @@ -6,6 +6,7 @@ rule: - Ana06 scopes: static: function + dynamic: unspecified references: - https://github.com/openssl/openssl/blob/fdc5043d58900663b493147298e64f11353b35fe/crypto/objects/obj_dat.h features: diff --git a/nursery/encrypt-data-using-openssl-ecdsa.yml b/nursery/encrypt-data-using-openssl-ecdsa.yml index 780ac9be..341ba949 100644 --- a/nursery/encrypt-data-using-openssl-ecdsa.yml +++ b/nursery/encrypt-data-using-openssl-ecdsa.yml @@ -6,6 +6,7 @@ rule: - Ana06 scopes: static: function + dynamic: unspecified references: - https://github.com/openssl/openssl/blob/fdc5043d58900663b493147298e64f11353b35fe/crypto/objects/obj_dat.h features: diff --git a/nursery/encrypt-data-using-openssl-rsa.yml b/nursery/encrypt-data-using-openssl-rsa.yml index 22b04bcb..41286e45 100644 --- a/nursery/encrypt-data-using-openssl-rsa.yml +++ b/nursery/encrypt-data-using-openssl-rsa.yml @@ -6,6 +6,7 @@ rule: - Ana06 scopes: static: function + dynamic: unspecified mbc: - Cryptography::Encrypt Data::RSA [C0027.011] references: diff --git a/nursery/execute-shellcode-via-indirect-call.yml b/nursery/execute-shellcode-via-indirect-call.yml index 472e9ea1..80dba90b 100644 --- a/nursery/execute-shellcode-via-indirect-call.yml +++ b/nursery/execute-shellcode-via-indirect-call.yml @@ -6,6 +6,7 @@ rule: - ronnie.salomonsen@mandiant.com scopes: static: function + dynamic: unspecified mbc: - Memory::Allocate Memory [C0007] features: diff --git a/nursery/execute-syscall-instruction.yml b/nursery/execute-syscall-instruction.yml index b5e7b50e..16b0d001 100644 --- a/nursery/execute-syscall-instruction.yml +++ b/nursery/execute-syscall-instruction.yml @@ -8,6 +8,7 @@ rule: description: may be used to evade hooks or hinder analysis scopes: static: basic block + dynamic: unspecified references: - https://github.com/j00ru/windows-syscalls features: diff --git a/nursery/generate-random-numbers-using-the-delphi-lcg.yml b/nursery/generate-random-numbers-using-the-delphi-lcg.yml index 585e8602..ea4aa5df 100644 --- a/nursery/generate-random-numbers-using-the-delphi-lcg.yml +++ b/nursery/generate-random-numbers-using-the-delphi-lcg.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: basic block + dynamic: unspecified mbc: - Cryptography::Generate Pseudo-random Sequence [C0021] references: diff --git a/nursery/get-os-version-in-dotnet.yml b/nursery/get-os-version-in-dotnet.yml index b412503e..a4ef8682 100644 --- a/nursery/get-os-version-in-dotnet.yml +++ b/nursery/get-os-version-in-dotnet.yml @@ -6,6 +6,7 @@ rule: - michael.hunhoff@mandiant.com scopes: static: basic block + dynamic: unspecified att&ck: - Discovery::System Information Discovery [T1082] features: diff --git a/nursery/hash-data-using-aphash.yml b/nursery/hash-data-using-aphash.yml index 7b0da93e..1e6e6aa9 100644 --- a/nursery/hash-data-using-aphash.yml +++ b/nursery/hash-data-using-aphash.yml @@ -6,6 +6,7 @@ rule: - "@_re_fox" scopes: static: function + dynamic: unspecified mbc: - Data::Non-Cryptographic Hash [C0030] references: diff --git a/nursery/hash-data-using-jshash.yml b/nursery/hash-data-using-jshash.yml index c479d672..caabc227 100644 --- a/nursery/hash-data-using-jshash.yml +++ b/nursery/hash-data-using-jshash.yml @@ -6,6 +6,7 @@ rule: - "@_re_fox" scopes: static: function + dynamic: unspecified mbc: - Data::Non-Cryptographic Hash [C0030] references: diff --git a/nursery/hash-data-using-murmur2.yml b/nursery/hash-data-using-murmur2.yml index 5ae2b0cd..1482d02b 100644 --- a/nursery/hash-data-using-murmur2.yml +++ b/nursery/hash-data-using-murmur2.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: instruction + dynamic: unspecified references: - https://github.com/abrandoned/murmur2/blob/master/MurmurHash2.c features: diff --git a/nursery/hash-data-using-rshash.yml b/nursery/hash-data-using-rshash.yml index d5307b94..dc459da6 100644 --- a/nursery/hash-data-using-rshash.yml +++ b/nursery/hash-data-using-rshash.yml @@ -6,6 +6,7 @@ rule: - "@_re_fox" scopes: static: function + dynamic: unspecified mbc: - Data::Non-Cryptographic Hash [C0030] references: diff --git a/nursery/hash-data-using-whirlpool.yml b/nursery/hash-data-using-whirlpool.yml index 2a509b6b..71bf879a 100644 --- a/nursery/hash-data-using-whirlpool.yml +++ b/nursery/hash-data-using-whirlpool.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: function + dynamic: unspecified mbc: - Cryptography::Cryptographic Hash [C0029] references: diff --git a/nursery/hooked-by-api-override.yml b/nursery/hooked-by-api-override.yml index d3cbbcf3..080e05cb 100644 --- a/nursery/hooked-by-api-override.yml +++ b/nursery/hooked-by-api-override.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified references: - https://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/ - http://jacquelin.potier.free.fr/winapioverride32/ diff --git a/nursery/implement-com-dll.yml b/nursery/implement-com-dll.yml index 487f5cef..5984dc6c 100644 --- a/nursery/implement-com-dll.yml +++ b/nursery/implement-com-dll.yml @@ -6,6 +6,7 @@ rule: - moritz.raabe@mandiant.com scopes: static: file + dynamic: unspecified references: - https://learn.microsoft.com/en-us/windows/win32/api/combaseapi/nf-combaseapi-dllgetclassobject features: diff --git a/nursery/log-keystrokes-via-raw-input-data.yml b/nursery/log-keystrokes-via-raw-input-data.yml index 39d8db77..9e8af606 100644 --- a/nursery/log-keystrokes-via-raw-input-data.yml +++ b/nursery/log-keystrokes-via-raw-input-data.yml @@ -7,6 +7,7 @@ rule: - michael.hunhoff@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Collection::Input Capture::Keylogging [T1056.001] features: diff --git a/nursery/obfuscated-with-koivm.yml b/nursery/obfuscated-with-koivm.yml index d9cf85d2..8ac0cd90 100644 --- a/nursery/obfuscated-with-koivm.yml +++ b/nursery/obfuscated-with-koivm.yml @@ -6,6 +6,7 @@ rule: - michael.hunhoff@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: diff --git a/nursery/packaged-as-a-createinstall-installer.yml b/nursery/packaged-as-a-createinstall-installer.yml index 761271cc..19073134 100644 --- a/nursery/packaged-as-a-createinstall-installer.yml +++ b/nursery/packaged-as-a-createinstall-installer.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified references: - https://www.createinstall.com/ - https://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/ diff --git a/nursery/packaged-as-a-pintool.yml b/nursery/packaged-as-a-pintool.yml index 76426f19..5cd1ee93 100644 --- a/nursery/packaged-as-a-pintool.yml +++ b/nursery/packaged-as-a-pintool.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified references: - https://software.intel.com/content/www/us/en/develop/articles/pin-a-dynamic-binary-instrumentation-tool.html - https://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/ diff --git a/nursery/packaged-as-a-winzip-self-extracting-archive.yml b/nursery/packaged-as-a-winzip-self-extracting-archive.yml index 3f314648..76e7383e 100644 --- a/nursery/packaged-as-a-winzip-self-extracting-archive.yml +++ b/nursery/packaged-as-a-winzip-self-extracting-archive.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified references: - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/ features: diff --git a/nursery/packed-with-ccg.yml b/nursery/packed-with-ccg.yml index db37547e..2812db51 100644 --- a/nursery/packed-with-ccg.yml +++ b/nursery/packed-with-ccg.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/packed-with-crunch.yml b/nursery/packed-with-crunch.yml index e9f9af4f..16c900b4 100644 --- a/nursery/packed-with-crunch.yml +++ b/nursery/packed-with-crunch.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/packed-with-dragon-armor.yml b/nursery/packed-with-dragon-armor.yml index 8908e836..f5e83946 100644 --- a/nursery/packed-with-dragon-armor.yml +++ b/nursery/packed-with-dragon-armor.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/packed-with-enigma.yml b/nursery/packed-with-enigma.yml index 722843d5..9d7bf8d0 100644 --- a/nursery/packed-with-enigma.yml +++ b/nursery/packed-with-enigma.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/packed-with-epack.yml b/nursery/packed-with-epack.yml index ab3e66b0..89b5dfbb 100644 --- a/nursery/packed-with-epack.yml +++ b/nursery/packed-with-epack.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/packed-with-maskpe.yml b/nursery/packed-with-maskpe.yml index 694bd65a..aeab920a 100644 --- a/nursery/packed-with-maskpe.yml +++ b/nursery/packed-with-maskpe.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/packed-with-mew.yml b/nursery/packed-with-mew.yml index 459d7847..f6fb221e 100644 --- a/nursery/packed-with-mew.yml +++ b/nursery/packed-with-mew.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/packed-with-mpress.yml b/nursery/packed-with-mpress.yml index 0c5c75a2..c026163e 100644 --- a/nursery/packed-with-mpress.yml +++ b/nursery/packed-with-mpress.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/packed-with-neolite.yml b/nursery/packed-with-neolite.yml index 2033c336..285499fa 100644 --- a/nursery/packed-with-neolite.yml +++ b/nursery/packed-with-neolite.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/packed-with-pepack.yml b/nursery/packed-with-pepack.yml index 746e816e..f15cd086 100644 --- a/nursery/packed-with-pepack.yml +++ b/nursery/packed-with-pepack.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/packed-with-perplex.yml b/nursery/packed-with-perplex.yml index 5c276fb3..03c33e8c 100644 --- a/nursery/packed-with-perplex.yml +++ b/nursery/packed-with-perplex.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/packed-with-procrypt.yml b/nursery/packed-with-procrypt.yml index fd347b7d..147bcf97 100644 --- a/nursery/packed-with-procrypt.yml +++ b/nursery/packed-with-procrypt.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/packed-with-rpcrypt.yml b/nursery/packed-with-rpcrypt.yml index bd770eb0..2a0b46f3 100644 --- a/nursery/packed-with-rpcrypt.yml +++ b/nursery/packed-with-rpcrypt.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/packed-with-seausfx.yml b/nursery/packed-with-seausfx.yml index 5b3312f1..b93a0c91 100644 --- a/nursery/packed-with-seausfx.yml +++ b/nursery/packed-with-seausfx.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/packed-with-shrinker.yml b/nursery/packed-with-shrinker.yml index ed204d67..0ca7a95f 100644 --- a/nursery/packed-with-shrinker.yml +++ b/nursery/packed-with-shrinker.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/packed-with-simple-pack.yml b/nursery/packed-with-simple-pack.yml index 1f6f7a3e..5156c12c 100644 --- a/nursery/packed-with-simple-pack.yml +++ b/nursery/packed-with-simple-pack.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/packed-with-starforce.yml b/nursery/packed-with-starforce.yml index 0444c3ad..1e512376 100644 --- a/nursery/packed-with-starforce.yml +++ b/nursery/packed-with-starforce.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/packed-with-svkp.yml b/nursery/packed-with-svkp.yml index a0932517..b5eed994 100644 --- a/nursery/packed-with-svkp.yml +++ b/nursery/packed-with-svkp.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/packed-with-tsuloader.yml b/nursery/packed-with-tsuloader.yml index 396fe351..bacdce08 100644 --- a/nursery/packed-with-tsuloader.yml +++ b/nursery/packed-with-tsuloader.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/packed-with-vprotect.yml b/nursery/packed-with-vprotect.yml index 27b280b0..a949a0f5 100644 --- a/nursery/packed-with-vprotect.yml +++ b/nursery/packed-with-vprotect.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/packed-with-wwpack.yml b/nursery/packed-with-wwpack.yml index 8da6e10b..b9d0563f 100644 --- a/nursery/packed-with-wwpack.yml +++ b/nursery/packed-with-wwpack.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: diff --git a/nursery/rebuilt-by-imprec.yml b/nursery/rebuilt-by-imprec.yml index 19d1c089..b3c721e1 100644 --- a/nursery/rebuilt-by-imprec.yml +++ b/nursery/rebuilt-by-imprec.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified references: - https://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/ features: diff --git a/nursery/reference-aes-constants.yml b/nursery/reference-aes-constants.yml index f90b9b06..bbc794e3 100644 --- a/nursery/reference-aes-constants.yml +++ b/nursery/reference-aes-constants.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] features: diff --git a/nursery/reference-processor-manufacturer-constants.yml b/nursery/reference-processor-manufacturer-constants.yml index 31db255d..fd26cc56 100644 --- a/nursery/reference-processor-manufacturer-constants.yml +++ b/nursery/reference-processor-manufacturer-constants.yml @@ -6,6 +6,7 @@ rule: - matthew.williams@mandiant.com scopes: static: basic block + dynamic: unspecified att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] mbc: diff --git a/nursery/reference-the-vmware-io-port.yml b/nursery/reference-the-vmware-io-port.yml index ae9916e1..a22c2309 100644 --- a/nursery/reference-the-vmware-io-port.yml +++ b/nursery/reference-the-vmware-io-port.yml @@ -6,6 +6,7 @@ rule: - matthew.williams@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] mbc: diff --git a/nursery/schedule-task-via-itaskservice.yml b/nursery/schedule-task-via-itaskservice.yml index 3e96f9e9..d42a4138 100644 --- a/nursery/schedule-task-via-itaskservice.yml +++ b/nursery/schedule-task-via-itaskservice.yml @@ -6,6 +6,7 @@ rule: - michael.hunhoff@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Persistence::Scheduled Task/Job::Scheduled Task [T1053.005] features: diff --git a/persistence/act-as-dhcp-server-callout-dll.yml b/persistence/act-as-dhcp-server-callout-dll.yml index 1b179fb0..efc6105e 100644 --- a/persistence/act-as-dhcp-server-callout-dll.yml +++ b/persistence/act-as-dhcp-server-callout-dll.yml @@ -6,6 +6,7 @@ rule: - jakub.jozwiak@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Persistence::Server Software Component [T1505] references: diff --git a/persistence/act-as-dns-server-plugin-dll.yml b/persistence/act-as-dns-server-plugin-dll.yml index 54666dc2..2cbeab9a 100644 --- a/persistence/act-as-dns-server-plugin-dll.yml +++ b/persistence/act-as-dns-server-plugin-dll.yml @@ -6,6 +6,7 @@ rule: - jakub.jozwiak@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Persistence::Server Software Component [T1505] references: diff --git a/persistence/authentication-process/act-as-credential-manager-dll.yml b/persistence/authentication-process/act-as-credential-manager-dll.yml index dc1cb314..1d03aee3 100644 --- a/persistence/authentication-process/act-as-credential-manager-dll.yml +++ b/persistence/authentication-process/act-as-credential-manager-dll.yml @@ -6,6 +6,7 @@ rule: - jakub.jozwiak@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Persistence::Modify Authentication Process::Network Provider DLL [T1556.008] examples: diff --git a/persistence/authentication-process/act-as-password-filter-dll.yml b/persistence/authentication-process/act-as-password-filter-dll.yml index d7f5be1e..28be2d76 100644 --- a/persistence/authentication-process/act-as-password-filter-dll.yml +++ b/persistence/authentication-process/act-as-password-filter-dll.yml @@ -6,6 +6,7 @@ rule: - jakub.jozwiak@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Persistence::Modify Authentication Process::Password Filter DLL [T1556.002] examples: diff --git a/persistence/authentication-process/act-as-security-support-provider-dll.yml b/persistence/authentication-process/act-as-security-support-provider-dll.yml index 685bab71..c6492af8 100644 --- a/persistence/authentication-process/act-as-security-support-provider-dll.yml +++ b/persistence/authentication-process/act-as-security-support-provider-dll.yml @@ -6,6 +6,7 @@ rule: - jakub.jozwiak@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Persistence::Boot or Logon Autostart Execution::Security Support Provider [T1547.005] references: diff --git a/persistence/authentication-process/act-as-subauthentication-package-dll.yml b/persistence/authentication-process/act-as-subauthentication-package-dll.yml index 595a5c75..624a2872 100644 --- a/persistence/authentication-process/act-as-subauthentication-package-dll.yml +++ b/persistence/authentication-process/act-as-subauthentication-package-dll.yml @@ -6,6 +6,7 @@ rule: - jakub.jozwiak@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Persistence::Boot or Logon Autostart Execution::Authentication Package [T1547.002] references: diff --git a/persistence/create-shortcut-via-ishelllink.yml b/persistence/create-shortcut-via-ishelllink.yml index 8aed92eb..7547502c 100644 --- a/persistence/create-shortcut-via-ishelllink.yml +++ b/persistence/create-shortcut-via-ishelllink.yml @@ -6,6 +6,7 @@ rule: - matthew.williams@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Persistence::Boot or Logon Autostart Execution::Shortcut Modification [T1547.009] references: diff --git a/persistence/iis/persist-via-isapi-extension.yml b/persistence/iis/persist-via-isapi-extension.yml index 2c583288..117c1235 100644 --- a/persistence/iis/persist-via-isapi-extension.yml +++ b/persistence/iis/persist-via-isapi-extension.yml @@ -7,6 +7,7 @@ rule: description: Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. scopes: static: file + dynamic: unspecified att&ck: - Persistence::Server Software Component::IIS Components [T1505.004] examples: diff --git a/persistence/office/act-as-excel-xll-add-in.yml b/persistence/office/act-as-excel-xll-add-in.yml index b69e7261..434a45d1 100644 --- a/persistence/office/act-as-excel-xll-add-in.yml +++ b/persistence/office/act-as-excel-xll-add-in.yml @@ -6,6 +6,7 @@ rule: - jakub.jozwiak@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Persistence::Office Application Startup::Add-ins [T1137.006] references: diff --git a/persistence/office/act-as-office-com-add-in.yml b/persistence/office/act-as-office-com-add-in.yml index 3a666ed9..1965222a 100644 --- a/persistence/office/act-as-office-com-add-in.yml +++ b/persistence/office/act-as-office-com-add-in.yml @@ -6,6 +6,7 @@ rule: - jakub.jozwiak@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Persistence::Office Application Startup::Add-ins [T1137.006] references: diff --git a/persistence/office/act-as-word-wll-add-in.yml b/persistence/office/act-as-word-wll-add-in.yml index 9a0ccd62..d977fe32 100644 --- a/persistence/office/act-as-word-wll-add-in.yml +++ b/persistence/office/act-as-word-wll-add-in.yml @@ -6,6 +6,7 @@ rule: - jakub.jozwiak@mandiant.com scopes: static: file + dynamic: unspecified att&ck: - Persistence::Office Application Startup::Add-ins [T1137.006] references: diff --git a/persistence/scheduled-tasks/schedule-task-via-itaskscheduler.yml b/persistence/scheduled-tasks/schedule-task-via-itaskscheduler.yml index a894e84b..2e15f99f 100644 --- a/persistence/scheduled-tasks/schedule-task-via-itaskscheduler.yml +++ b/persistence/scheduled-tasks/schedule-task-via-itaskscheduler.yml @@ -6,6 +6,7 @@ rule: - moritz.raabe@mandiant.com scopes: static: function + dynamic: unspecified att&ck: - Persistence::Scheduled Task/Job::Scheduled Task [T1053.005] examples: diff --git a/runtime/dotnet/execute-via-dotnet-startup-hook.yml b/runtime/dotnet/execute-via-dotnet-startup-hook.yml index b2d9c30c..f4d0bae5 100644 --- a/runtime/dotnet/execute-via-dotnet-startup-hook.yml +++ b/runtime/dotnet/execute-via-dotnet-startup-hook.yml @@ -6,6 +6,7 @@ rule: - william.ballenthin@mandiant.com scopes: static: file + dynamic: unspecified references: - https://rastamouse.me/net-startup-hooks/ - https://github.com/dotnet/runtime/blob/main/docs/design/features/host-startup-hook.md