 Elad Levi
|
4e6fc23354
|
Update manipulate-boot-configuration.yml (#1026)
|
2025-03-16 09:15:10 -06:00 |
|
|
Willi Ballenthin
|
c1d20764ad
|
use "span of calls" scope (#973)
* use sequence scope instead of thread scope for "static: function" rules
* use sequence scope instead of thread scope for "static: basic block" rules
* make runtime linking rules more concise
* doc: describe sequence scope
* rename "sequence" scope to "span of calls" scope
* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/get-geographical-location.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/file-managers/gather-classicftp-information.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/wmi/reference-wmi-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/sql/reference-sql-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
---------
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
|
2025-01-29 10:27:13 +01:00 |
|
|
mr-tz
|
e18704545a
|
fix call/thread scopes manually
|
2023-11-24 11:35:00 +01:00 |
|
|
mr-tz
|
784c9dca53
|
upgrade rules using updated script
|
2023-11-24 11:34:28 +01:00 |
|
|
jtothej
|
39fa528601
|
Add get-uefi-variable.yml and set-uefi-variable.yml
|
2023-08-02 18:21:12 +08:00 |
|
|
Willi Ballenthin
|
88c9c786ca
|
*: use meta.authors everywhere
|
2022-05-26 11:56:31 -06:00 |
|
|
Willi Ballenthin
|
abe6402a55
|
manipulate safe mode programs: restrict to windows
|
2021-10-25 12:47:43 -06:00 |
|
|
William Ballenthin
|
4b37c32a33
|
add manipulate safe mode programs
|
2021-10-22 12:34:58 -06:00 |
|
|
Moritz Raabe
|
25938ca10c
|
change to mandiant.com
|
2021-09-28 12:21:11 +02:00 |
|
|
William Ballenthin
|
ea3ea14c22
|
minor reorg linux rules and logic
ref #442
|
2021-08-25 15:31:51 -06:00 |
|
|
Moritz Raabe
|
b340a6229c
|
address optional blocks
|
2021-05-05 17:25:07 +02:00 |
|
|
Willi Ballenthin
|
27cb12a9ad
|
manipulate boot config: case insensitive ini section names
|
2021-05-04 07:42:35 -06:00 |
|
|
William Ballenthin
|
65827c8e02
|
capafmt
|
2021-05-01 10:21:56 -06:00 |
|
|
William Ballenthin
|
0e0d882ad3
|
lint
|
2021-05-01 10:20:00 -06:00 |
|
|
William Ballenthin
|
ccab1ab5b4
|
add bootloader/manipulate-boot-configuration
|
2021-05-01 10:07:42 -06:00 |
|
|
William Ballenthin
|
b6b9407f62
|
add bootloader/disable-code-signing
|
2021-05-01 10:07:27 -06:00 |
|