 mike-hunhoff
|
281eec1c60
|
Merge pull request #403 from fireeye/new/20210602
adding create-process-memory-minidump.yml
|
2021-06-10 08:42:19 -06:00 |
|
|
Michael Hunhoff
|
2c8d54b611
|
graduate create-process-memory-minidump.yml
|
2021-06-10 08:35:25 -06:00 |
|
|
William Ballenthin
|
e6e16d7b85
|
graduate "acquire debug privileges"
|
2021-06-04 11:56:44 -06:00 |
|
|
William Ballenthin
|
913cebdb38
|
Merge branch 'master' into fix-1
|
2021-05-18 10:48:06 -06:00 |
|
|
William Ballenthin
|
6e501e8151
|
rules: convert inline comments to descriptions
closes #1
|
2021-05-18 10:45:41 -06:00 |
|
|
Moritz
|
c24ab23bc1
|
ATT&CK v9 updates (#341)
* update rules
* add example
* update namespace and move
* add rule
* remove HKCU
* update rules
* update rule
|
2021-05-06 20:06:24 +02:00 |
|
|
Moritz
|
62f28b55fe
|
Update terminate-process.yml
|
2021-04-27 08:19:05 +02:00 |
|
|
Andrew
|
8a513b280b
|
Add rules from Egregor ransomware DLL
|
2021-04-26 11:56:25 -04:00 |
|
|
mike-hunhoff
|
eb8221d9ad
|
Merge pull request #305 from fireeye/enfore-string-format
enforce string formatting
|
2021-03-25 12:36:51 -06:00 |
|
|
Michael Hunhoff
|
20e1b8fd4c
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
|
Moritz Raabe
|
77b737fcf0
|
rule tweaks based on PMA Lab 03-02.dll
see #296
|
2021-03-22 19:05:08 +01:00 |
|
|
Michael Hunhoff
|
750e164a41
|
removing ntdll requirement from function features exported by both ntdll and ntoskrnl
|
2021-02-16 18:28:05 -07:00 |
|
|
Moritz Raabe
|
7ee2c63e83
|
capafmted rules
|
2021-01-28 17:26:25 +01:00 |
|
|
0x534a
|
cf84ebe7d3
|
Fixes rule logic of inject-thread.yml to also match allocation of RW memory
|
2021-01-28 16:46:20 +01:00 |
|
|
0x534a
|
bfd063c8ab
|
Fixes rule logic of inject-thread.yml to also match allocation of RW memory
|
2021-01-28 16:38:56 +01:00 |
|
|
0x534a
|
29fbeec36a
|
Adjusts test file of hijack-thread-execution.yml, resolves conflict in inject-thread.yml and removes articles from rules
|
2021-01-28 15:28:53 +01:00 |
|
|
0x534a
|
8c93d205a8
|
Improve injection detection and some refactoring of existing rules
|
2021-01-28 14:47:31 +01:00 |
|
|
William Ballenthin
|
f1f0b4a1b6
|
merge
|
2021-01-02 11:06:53 -07:00 |
|
|
William Ballenthin
|
d99c02aca7
|
update ATT&CK mappings
|
2021-01-02 11:06:02 -07:00 |
|
|
Desiree Beck
|
499308b3e9
|
update based on comments
|
2020-12-16 16:33:22 -05:00 |
|
|
Desiree Beck
|
c5d24c671a
|
added mbc mappings in the host-interaction namespace
|
2020-12-16 15:30:06 -05:00 |
|
|
re-fox
|
edb3e1290d
|
Update and rename nursery/inject-apc.yml to host-interaction/process/inject/inject-apc.yml
|
2020-12-11 13:51:26 -05:00 |
|
|
Michael Hunhoff
|
d569817bdf
|
adding new rules for Gh0st
|
2020-12-02 08:14:20 -07:00 |
|
|
re-fox
|
7d3ab51ab0
|
Create terminate-process-via-fastfail.yml
|
2020-10-05 12:14:27 -04:00 |
|
|
Michael Hunhoff
|
febacd30b0
|
PR changes additional
|
2020-08-27 09:45:06 -06:00 |
|
|
Michael Hunhoff
|
2c59aaf16b
|
PR fixes
|
2020-08-26 16:07:09 -06:00 |
|
|
Michael Hunhoff
|
6ccc9a736f
|
fresh rules from al-khaser project
|
2020-08-13 09:39:42 -06:00 |
|
|
Michael Hunhoff
|
9320b70185
|
adding new rules for sample with MD5 hash 03B236B23B1EC37C663527C1F53AF3FE
|
2020-07-30 17:33:13 -06:00 |
|
|
William Ballenthin
|
1c39bd8349
|
graduate rules that pass the linter
|
2020-07-23 17:30:37 -06:00 |
|
|
William Ballenthin
|
54cfb05bd0
|
rules: address comments in #14
|
2020-06-26 17:45:56 -06:00 |
|
|
William Ballenthin
|
7b4f4d10fb
|
rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better
|
2020-06-21 17:54:01 -06:00 |
|
|
William Ballenthin
|
5f57dbdbc9
|
rules: reorganize rule names, namespaces, and ATT&CK mappings
|
2020-06-21 17:25:43 -06:00 |
|