bd29ed4563
fix: escape + and / in Base64 string regex, add URL-safe variant
2026-03-05 00:09:35 +05:30
d4e89f9194
remove example and move to nursery
2024-08-16 13:47:03 +02:00
0e2500fa8a
Add Base64 VBMI lookup table detection ( #918 )
...
* Initial commit
Signed-off-by: Still Hsu <dev@stillu.cc >
* Replace sample with a smaller one
* Change sample to official compiled exe
* Add function address for match
---------
Signed-off-by: Still Hsu <dev@stillu.cc >
2024-08-07 11:31:25 +02:00
5430889902
update scopes
2023-11-24 11:51:37 +01:00
e18704545a
fix call/thread scopes manually
2023-11-24 11:35:00 +01:00
784c9dca53
upgrade rules using updated script
2023-11-24 11:34:28 +01:00
6ad4499b49
Add encode-data-using-add-xor-sub-operations.yml ( #800 )
...
* Add encode-data-using-add-xor-sub-operations.yml
---------
Co-authored-by: Moritz <mr-tz@users.noreply.github.com >
2023-11-22 14:10:11 +01:00
74121881ec
Update encode-data-using-base64-via-winapi.yml ( #845 )
...
* Update encode-data-using-base64-via-winapi.yml
* Update decode-data-using-base64-via-winapi.yml
2023-11-17 16:27:28 -07:00
7cc3bb46aa
Update decode-data-using-base64-via-dword-translation-table.yml
2023-07-30 15:22:48 +02:00
04c77aedce
Update decode-data-using-base64-via-dword-translation-table.yml
2023-07-30 15:09:13 +02:00
d57a618076
Update decode-data-using-base64-via-dword-translation-table.yml
...
fixed hash
2023-07-30 14:59:38 +02:00
aa2da89c34
Update decode-data-using-base64-via-dword-translation-table.yml
...
additional translation tables
2023-07-28 19:51:54 +02:00
96a1abddca
new/update .NET rules ( #625 )
2022-10-07 09:39:57 -06:00
95dc5eb27f
Add new dotnet rules that capture capabilites typically found in backdoors. ( #579 )
2022-07-07 13:39:51 -06:00
88c9c786ca
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
25938ca10c
change to mandiant.com
2021-09-28 12:21:11 +02:00
a5721b1698
graduate "encode data using Base64 via WinAPI"
2021-06-04 12:21:34 -06:00
d32aa59842
graduate "decode data using Base64 via WinAPI"
2021-06-04 12:18:30 -06:00
612cc74841
Added rule for Base64 decoding per 9efa86b43b4367bcdc1591aee59bda25 ( #397 )
...
* Added rule for Base64 decoding per 9efa86b43b4367bcdc1591aee59bda25
* Update data-manipulation/encoding/base64/decode-data-using-base64.yml
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* Update data-manipulation/encoding/base64/decode-data-using-base64.yml
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* updated file name
Co-authored-by: Gil Elliot <gilbert.elliot@10-h14cjg5m-33o.fireeye.com >
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
2021-05-26 09:31:11 +02:00
6e501e8151
rules: convert inline comments to descriptions
...
closes #1
2021-05-18 10:45:41 -06:00
f1b450edf0
update ATT&CK and MBC mappings
...
thanks to Regina Elwell @ FireEye and @evandrix
closes #316
2021-04-13 09:37:10 -06:00
20e1b8fd4c
enforce string formatting with double quotes + escaped special characters
2021-03-24 14:14:38 -06:00
33817fdd83
update micro objective name: data manipulation to data
2020-12-12 12:18:47 -05:00
a0f10b4cf2
add mappings
2020-10-19 14:04:15 -04:00
25f1157db0
Change characteristic syntax in rules
...
Get rid of `true` in characteristic as it is implicit.
The changes are the result of executing the following commands:
```
find . -type f -exec sed -i.bak "s/\(.*\)characteristic(\(.*\)): true/\1characteristic: \2/g" {} \;
find . -name "*.bak" -type f -delete
```
2020-07-01 19:19:49 +02:00
54cfb05bd0
rules: address comments in #14
2020-06-26 17:45:56 -06:00
7b4f4d10fb
rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better
2020-06-21 17:54:01 -06:00
5f57dbdbc9
rules: reorganize rule names, namespaces, and ATT&CK mappings
2020-06-21 17:25:43 -06:00
Aditya Pandey