2 Commits

Author SHA1 Message Date
Devarjya 2a55a30478 Refine Speck detection using variant-specific rotation constants (#1115) 2026-02-17 14:18:46 -07:00
Still / Azaka 7269873b0c Add rules for detecting donut-related features (#997)
* Initial additions for detecting donut features

Signed-off-by: Still Hsu <dev@stillu.cc>

* Lint rules

Signed-off-by: Still Hsu <dev@stillu.cc>

* Update ATT&CK for donut rule

Signed-off-by: Still Hsu <dev@stillu.cc>

* Fix comment for dynamic scope on donut loader

Signed-off-by: Still Hsu <dev@stillu.cc>

* Require at least one donut function match for donut rule

Signed-off-by: Still Hsu <dev@stillu.cc>

* Add offset for examples

Signed-off-by: Still Hsu <dev@stillu.cc>

* Add indirect call for IAssembly matching

Signed-off-by: Still Hsu <dev@stillu.cc>

* Match known vtable offsets for assembly loading

* Remove loop matching

---------

Signed-off-by: Still Hsu <dev@stillu.cc>
2025-03-21 10:15:28 -06:00