 Willi Ballenthin
|
c1d20764ad
|
use "span of calls" scope (#973)
* use sequence scope instead of thread scope for "static: function" rules
* use sequence scope instead of thread scope for "static: basic block" rules
* make runtime linking rules more concise
* doc: describe sequence scope
* rename "sequence" scope to "span of calls" scope
* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/get-geographical-location.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/file-managers/gather-classicftp-information.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/wmi/reference-wmi-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/sql/reference-sql-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
---------
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
|
2025-01-29 10:27:13 +01:00 |
|
|
mr-tz
|
f344af3327
|
add android OS where applicable
|
2024-04-23 13:49:05 +02:00 |
|
|
mr-tz
|
e18704545a
|
fix call/thread scopes manually
|
2023-11-24 11:35:00 +01:00 |
|
|
mr-tz
|
784c9dca53
|
upgrade rules using updated script
|
2023-11-24 11:34:28 +01:00 |
|
|
Mike Hunhoff
|
dda76eadde
|
new/update rules using .NET ctor method (#626)
|
2022-10-13 08:36:31 -06:00 |
|
|
Anushka Virgaonkar
|
95dc5eb27f
|
Add new dotnet rules that capture capabilites typically found in backdoors. (#579)
|
2022-07-07 13:39:51 -06:00 |
|
|
Willi Ballenthin
|
88c9c786ca
|
*: use meta.authors everywhere
|
2022-05-26 11:56:31 -06:00 |
|
|
Moritz Raabe
|
25938ca10c
|
change to mandiant.com
|
2021-09-28 12:21:11 +02:00 |
|
|
William Ballenthin
|
f6b9564332
|
*: fix ntdll/ntoskrnl lints
|
2021-08-26 17:52:24 -06:00 |
|
|
William Ballenthin
|
ea3ea14c22
|
minor reorg linux rules and logic
ref #442
|
2021-08-25 15:31:51 -06:00 |
|
|
Joakim Kennedy
|
765e182553
|
A set of rules for Linux ELFs
|
2021-08-04 15:47:00 +01:00 |
|
|
Moritz Raabe
|
0eddb61a9c
|
rule updates
|
2021-01-29 13:27:29 +01:00 |
|
|
0x534a
|
8c93d205a8
|
Improve injection detection and some refactoring of existing rules
|
2021-01-28 14:47:31 +01:00 |
|
|
Moritz Raabe
|
387334a603
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
|
Michael Hunhoff
|
e721348144
|
PR change requests
|
2021-01-07 13:06:35 -07:00 |
|
|
Michael Hunhoff
|
cab448c6f6
|
new rules and rule updates from B5F85C26D7AA5A1FB4AF5821B6B5AB9B
|
2020-12-31 08:44:23 -07:00 |
|
|
Desiree Beck
|
c5d24c671a
|
added mbc mappings in the host-interaction namespace
|
2020-12-16 15:30:06 -05:00 |
|
|
Michael Hunhoff
|
ae901da3a4
|
adding new rules to nursery, updating create-thread.yml
|
2020-09-17 13:35:41 -06:00 |
|
|
William Ballenthin
|
7b4f4d10fb
|
rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better
|
2020-06-21 17:54:01 -06:00 |
|
|
William Ballenthin
|
5f57dbdbc9
|
rules: reorganize rule names, namespaces, and ATT&CK mappings
|
2020-06-21 17:25:43 -06:00 |
|