6 Commits

Author	SHA1	Message	Date
Still / Azaka	7269873b0c	Add rules for detecting donut-related features (#997) ... * Initial additions for detecting donut features Signed-off-by: Still Hsu <dev@stillu.cc> * Lint rules Signed-off-by: Still Hsu <dev@stillu.cc> * Update ATT&CK for donut rule Signed-off-by: Still Hsu <dev@stillu.cc> * Fix comment for dynamic scope on donut loader Signed-off-by: Still Hsu <dev@stillu.cc> * Require at least one donut function match for donut rule Signed-off-by: Still Hsu <dev@stillu.cc> * Add offset for examples Signed-off-by: Still Hsu <dev@stillu.cc> * Add indirect call for IAssembly matching Signed-off-by: Still Hsu <dev@stillu.cc> * Match known vtable offsets for assembly loading * Remove loop matching --------- Signed-off-by: Still Hsu <dev@stillu.cc>	2025-03-21 10:15:28 -06:00
Mike Hunhoff	75c16e4b14	remove redundant matches for dynamic scope (#987) ... * remove redundant matches for dynamic scope * fix lints * fix lints * tighten scopes	2025-02-04 09:32:24 +01:00
mr-tz	e18704545a	fix call/thread scopes manually	2023-11-24 11:35:00 +01:00
mr-tz	784c9dca53	upgrade rules using updated script	2023-11-24 11:34:28 +01:00
JJ	23cfa23626	Merge execute-dotnet-assembly-via-clr-host.yml with load-windows-common-language-runtime.yml and promote load-windows-common-language-runtime.yml (#797)	2023-10-09 11:59:52 -06:00
Blas	75d5170065	Create execute-dotnet-assembly-via-clr-host.yml (#688)	2023-02-06 10:12:02 -07:00