4d96b6986c
graduate "get service handle"
2021-06-08 10:18:07 -06:00
1fd04d639f
Update validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml
2021-03-03 22:19:45 -05:00
750e164a41
removing ntdll requirement from function features exported by both ntdll and ntoskrnl
2021-02-16 18:28:05 -07:00
7ee2c63e83
capafmted rules
2021-01-28 17:26:25 +01:00
29fbeec36a
Adjusts test file of hijack-thread-execution.yml, resolves conflict in inject-thread.yml and removes articles from rules
2021-01-28 15:28:53 +01:00
8c93d205a8
Improve injection detection and some refactoring of existing rules
2021-01-28 14:47:31 +01:00
387334a603
reformated using capafmt
2021-01-27 15:30:59 +01:00
9037d901be
mappings for lib namespace
2021-01-21 15:27:59 -05:00
e721348144
PR change requests
2021-01-07 13:06:35 -07:00
cab448c6f6
new rules and rule updates from B5F85C26D7AA5A1FB4AF5821B6B5AB9B
2020-12-31 08:44:23 -07:00
824bb5148a
find pusha popa sequences
2020-11-23 18:54:49 +01:00
18d9c7668d
Update and rename validate-credit-card-number-using-luhn-algorithm-with-no-lookup-table.yml to validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml
2020-11-16 10:17:52 -05:00
0e9cdd759c
Update and rename validate-credit-card-number-using-luhn-algorithm-with-lookup-table.yml to validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml
2020-11-16 10:17:19 -05:00
33ae14eb53
use new description syntax
2020-09-30 17:48:02 +02:00
1fcec06e7e
comment out description blocks for statements
...
discussed in #312
2020-09-14 11:53:01 +02:00
6ccc9a736f
fresh rules from al-khaser project
2020-08-13 09:39:42 -06:00
39b0128967
Add files via upload
2020-08-10 12:13:39 -04:00
b878effef7
fix rules as documented in #49
2020-07-24 15:49:52 -06:00
a8621978cf
change tight loop scope to function
2020-07-06 12:36:21 +02:00
25f1157db0
Change characteristic syntax in rules
...
Get rid of `true` in characteristic as it is implicit.
The changes are the result of executing the following commands:
```
find . -type f -exec sed -i.bak "s/\(.*\)characteristic(\(.*\)): true/\1characteristic: \2/g" {} \;
find . -name "*.bak" -type f -delete
```
2020-07-01 19:19:49 +02:00
973cb6b1d2
lib rules: remove namespaces
2020-06-29 06:14:59 -06:00
54cfb05bd0
rules: address comments in #14
2020-06-26 17:45:56 -06:00
5f57dbdbc9
rules: reorganize rule names, namespaces, and ATT&CK mappings
2020-06-21 17:25:43 -06:00
c80380b8d6
rules: reformat with consistent lib and references order
2020-06-21 16:26:28 -06:00
e9ad899b0f
rules: add trailing newline to end of each file
2020-06-21 15:50:42 -06:00
69507875b0
rules: reformat all rules using capafmt
2020-06-21 15:47:02 -06:00
eaae0e89a7
import existing rules, forgetting about 938 prior commits
2020-06-18 07:27:35 -06:00
William Ballenthin