21 Commits

Author	SHA1	Message	Date
Yacine Elhamer	0aea484e04	updated rules	2023-08-21 19:14:45 +02:00
Yacine Elhamer	c4cdd9bae7	fix improper scope for rules containing a subscope in and	2023-08-21 14:27:45 +02:00
Yacine Elhamer	a55d769da8	fix author quoting	2023-08-21 09:10:33 +02:00
Yacine Elhamer	8d851f3343	updated rules	2023-08-20 15:39:29 +02:00
Yacine Elhamer	e937af1ee6	initial commit	2023-08-17 10:41:11 +02:00
Mike Hunhoff	dda76eadde	new/update rules using .NET ctor method (#626)	2022-10-13 08:36:31 -06:00
Anushka Virgaonkar	95dc5eb27f	Add new dotnet rules that capture capabilites typically found in backdoors. (#579)	2022-07-07 13:39:51 -06:00
Willi Ballenthin	88c9c786ca	*: use meta.authors everywhere	2022-05-26 11:56:31 -06:00
Moritz Raabe	25938ca10c	change to mandiant.com	2021-09-28 12:21:11 +02:00
William Ballenthin	f6b9564332	*: fix ntdll/ntoskrnl lints	2021-08-26 17:52:24 -06:00
William Ballenthin	ea3ea14c22	minor reorg linux rules and logic ... ref #442	2021-08-25 15:31:51 -06:00
Joakim Kennedy	765e182553	A set of rules for Linux ELFs	2021-08-04 15:47:00 +01:00
Moritz Raabe	0eddb61a9c	rule updates	2021-01-29 13:27:29 +01:00
0x534a	8c93d205a8	Improve injection detection and some refactoring of existing rules	2021-01-28 14:47:31 +01:00
Moritz Raabe	387334a603	reformated using capafmt	2021-01-27 15:30:59 +01:00
Michael Hunhoff	e721348144	PR change requests	2021-01-07 13:06:35 -07:00
Michael Hunhoff	cab448c6f6	new rules and rule updates from B5F85C26D7AA5A1FB4AF5821B6B5AB9B	2020-12-31 08:44:23 -07:00
Desiree Beck	c5d24c671a	added mbc mappings in the host-interaction namespace	2020-12-16 15:30:06 -05:00
Michael Hunhoff	ae901da3a4	adding new rules to nursery, updating create-thread.yml	2020-09-17 13:35:41 -06:00
William Ballenthin	7b4f4d10fb	rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better	2020-06-21 17:54:01 -06:00
William Ballenthin	5f57dbdbc9	rules: reorganize rule names, namespaces, and ATT&CK mappings	2020-06-21 17:25:43 -06:00