d20a7e0a48
add elaborative comment
2023-08-29 21:32:37 +02:00
d5f05f4e88
initial commit
2023-08-29 21:23:55 +02:00
5b73ddcd24
manual pass
2023-08-22 09:40:13 +02:00
0aea484e04
updated rules
2023-08-21 19:14:45 +02:00
c4cdd9bae7
fix improper scope for rules containing a subscope in and
2023-08-21 14:27:45 +02:00
a55d769da8
fix author quoting
2023-08-21 09:10:33 +02:00
8d851f3343
updated rules
2023-08-20 15:39:29 +02:00
850909bd82
update
2023-08-17 11:07:02 +02:00
e937af1ee6
initial commit
2023-08-17 10:41:11 +02:00
7cc3bb46aa
Update decode-data-using-base64-via-dword-translation-table.yml
2023-07-30 15:22:48 +02:00
04c77aedce
Update decode-data-using-base64-via-dword-translation-table.yml
2023-07-30 15:09:13 +02:00
d57a618076
Update decode-data-using-base64-via-dword-translation-table.yml
...
fixed hash
2023-07-30 14:59:38 +02:00
aa2da89c34
Update decode-data-using-base64-via-dword-translation-table.yml
...
additional translation tables
2023-07-28 19:51:54 +02:00
96a1abddca
new/update .NET rules ( #625 )
2022-10-07 09:39:57 -06:00
95dc5eb27f
Add new dotnet rules that capture capabilites typically found in backdoors. ( #579 )
2022-07-07 13:39:51 -06:00
88c9c786ca
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
25938ca10c
change to mandiant.com
2021-09-28 12:21:11 +02:00
a5721b1698
graduate "encode data using Base64 via WinAPI"
2021-06-04 12:21:34 -06:00
d32aa59842
graduate "decode data using Base64 via WinAPI"
2021-06-04 12:18:30 -06:00
612cc74841
Added rule for Base64 decoding per 9efa86b43b4367bcdc1591aee59bda25 ( #397 )
...
* Added rule for Base64 decoding per 9efa86b43b4367bcdc1591aee59bda25
* Update data-manipulation/encoding/base64/decode-data-using-base64.yml
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* Update data-manipulation/encoding/base64/decode-data-using-base64.yml
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* updated file name
Co-authored-by: Gil Elliot <gilbert.elliot@10-h14cjg5m-33o.fireeye.com >
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
2021-05-26 09:31:11 +02:00
6e501e8151
rules: convert inline comments to descriptions
...
closes #1
2021-05-18 10:45:41 -06:00
f1b450edf0
update ATT&CK and MBC mappings
...
thanks to Regina Elwell @ FireEye and @evandrix
closes #316
2021-04-13 09:37:10 -06:00
20e1b8fd4c
enforce string formatting with double quotes + escaped special characters
2021-03-24 14:14:38 -06:00
33817fdd83
update micro objective name: data manipulation to data
2020-12-12 12:18:47 -05:00
a0f10b4cf2
add mappings
2020-10-19 14:04:15 -04:00
25f1157db0
Change characteristic syntax in rules
...
Get rid of `true` in characteristic as it is implicit.
The changes are the result of executing the following commands:
```
find . -type f -exec sed -i.bak "s/\(.*\)characteristic(\(.*\)): true/\1characteristic: \2/g" {} \;
find . -name "*.bak" -type f -delete
```
2020-07-01 19:19:49 +02:00
54cfb05bd0
rules: address comments in #14
2020-06-26 17:45:56 -06:00
7b4f4d10fb
rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better
2020-06-21 17:54:01 -06:00
5f57dbdbc9
rules: reorganize rule names, namespaces, and ATT&CK mappings
2020-06-21 17:25:43 -06:00
Yacine Elhamer