c88979a1bc
fmt
2023-10-17 12:28:12 +00:00
796b5b3a22
readd file
2023-10-17 11:40:57 +00:00
05ee3df679
update scope syntax
2023-10-17 11:34:31 +00:00
9cb8848b03
Merge branch 'master' into dynamic-syntax
2023-10-17 10:29:30 +00:00
b778d25292
Update allocate-memory.yml
2023-10-11 12:08:01 +02:00
a39a2c0b52
Merge branch 'master' into update-alloc-rules
2023-10-11 12:03:42 +02:00
1be6720131
add runtime resolved functions
2023-10-11 11:54:50 +02:00
7ddf609ebc
update example
2023-10-11 11:33:20 +02:00
5f223ea5ce
rename rules
2023-10-11 11:17:13 +02:00
ed791c9b17
separate allocate and change memory protection
2023-10-11 11:14:14 +02:00
f971df9ab2
Update allocate-memory.yml
2023-09-09 19:22:13 +02:00
d20a7e0a48
add elaborative comment
2023-08-29 21:32:37 +02:00
d5f05f4e88
initial commit
2023-08-29 21:23:55 +02:00
5b73ddcd24
manual pass
2023-08-22 09:40:13 +02:00
0aea484e04
updated rules
2023-08-21 19:14:45 +02:00
c4cdd9bae7
fix improper scope for rules containing a subscope in and
2023-08-21 14:27:45 +02:00
a55d769da8
fix author quoting
2023-08-21 09:10:33 +02:00
8d851f3343
updated rules
2023-08-20 15:39:29 +02:00
850909bd82
update
2023-08-17 11:07:02 +02:00
e937af1ee6
initial commit
2023-08-17 10:41:11 +02:00
dfdd5d8fc0
Update get-os-version.yml
2023-07-22 19:33:09 +08:00
83d4e3bc02
add import
2023-07-02 16:23:04 +02:00
a8e9c6cfd0
add LZ* functions
2023-06-04 12:16:30 +02:00
5941a484b5
add section access/map rules ( #681 )
...
* add section access/map rules
closes #4
---------
Co-authored-by: Moritz <mr-tz@users.noreply.github.com >
2023-02-02 09:11:46 +01:00
5914e4a4ac
add library rule and new api
2023-01-13 12:31:03 +01:00
3e8792dcfd
Adjusted rules for the ELF BEACON sample shared by Intezer ( #654 )
...
* Created rules for the ELF BEACON sample shared by Intezer
* removing rule that sometimes hits and sometimes doesn't
Co-authored-by: Alyssa Rahman <alyssa.rahman@mandiant.com >
2023-01-09 14:37:51 +01:00
b48fcd5dd8
improve rules that often match ( #655 )
...
* improve rules that often match
2023-01-09 14:07:53 +01:00
57e1732f5c
Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""
...
This reverts commit d43a6ee544
2022-06-28 15:23:20 -06:00
88c9c786ca
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
d43a6ee544
Revert "Merge pull request #548 from mandiant/feature-remove-flavors"
...
This reverts commit bc28847dd982308c4109
2022-04-27 06:23:36 -06:00
ccf3f8fb5f
luhn no lookup table: cleanup logic
2022-04-05 17:15:22 -06:00
904bf3ef00
*: remove /x32 and /x64 flavors and use instruction scope
2022-04-05 12:25:14 -06:00
c80f59be8e
Update lib/open-thread.yml
...
Co-authored-by: Moritz <mr-tz@users.noreply.github.com >
2021-11-24 11:53:05 -05:00
e190179ffd
Merge pull request #1 from MBCProject/ryan-patches1
...
Update patch-process-command-line.yml
2021-11-22 11:27:15 -05:00
25938ca10c
change to mandiant.com
2021-09-28 12:21:11 +02:00
0114138ae4
More detailed mappings
2021-08-31 11:34:09 -05:00
ea3ea14c22
minor reorg linux rules and logic
...
ref #442
2021-08-25 15:31:51 -06:00
b4e040dc50
preliminary mapping
2021-08-23 14:11:00 -05:00
78fbf5f3c5
Fix linting errors
2021-08-05 15:35:27 +01:00
765e182553
A set of rules for Linux ELFs
2021-08-04 15:47:00 +01:00
4d96b6986c
graduate "get service handle"
2021-06-08 10:18:07 -06:00
1fd04d639f
Update validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml
2021-03-03 22:19:45 -05:00
750e164a41
removing ntdll requirement from function features exported by both ntdll and ntoskrnl
2021-02-16 18:28:05 -07:00
7ee2c63e83
capafmted rules
2021-01-28 17:26:25 +01:00
29fbeec36a
Adjusts test file of hijack-thread-execution.yml, resolves conflict in inject-thread.yml and removes articles from rules
2021-01-28 15:28:53 +01:00
8c93d205a8
Improve injection detection and some refactoring of existing rules
2021-01-28 14:47:31 +01:00
387334a603
reformated using capafmt
2021-01-27 15:30:59 +01:00
9037d901be
mappings for lib namespace
2021-01-21 15:27:59 -05:00
e721348144
PR change requests
2021-01-07 13:06:35 -07:00
cab448c6f6
new rules and rule updates from B5F85C26D7AA5A1FB4AF5821B6B5AB9B
2020-12-31 08:44:23 -07:00
Willi Ballenthin