6e501e8151
rules: convert inline comments to descriptions
...
closes #1
2021-05-18 10:45:41 -06:00
0f28d4a763
capafmt
2021-04-13 09:49:02 -06:00
f1b450edf0
update ATT&CK and MBC mappings
...
thanks to Regina Elwell @ FireEye and @evandrix
closes #316
2021-04-13 09:37:10 -06:00
e0cefa438d
update translate-characteristic-into-permission.yml
...
- rename it to `inspect section memory permissions` and add a
description so it is clear what it is meant.
- use the `3 or more` feature to improve the rule. Note that `optional`
doesn't behave as you may expect for this feature. Use `and` to ensure
`optional` behaves as we want.
2021-03-29 11:04:42 +02:00
e46c667bdb
add translate-characteristic-into-permission.yml
...
Identify translation of PE characteristics into permissions. It could be
used in reflective dll injection to replicate the permissions of the
dll mapped in memory.
2021-03-25 19:37:39 +01:00
be2c552cff
add load-code/pe/inject-dll-reflectively.yml
...
Identify reflective dll injection using `copy PE sections` and `rebuild
import table`.
References:
- https://0x00sec.org/t/reflective-dll-injection/3080
- https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection
2021-03-25 19:37:29 +01:00
b7aa190381
add load-code/pe/parse-pe-exports.yml
...
Identify parsing PE export data, used when writing your own
`GetProcAddress()` implementation.
reference: Practical Malware Analysis, Chapter 19
f
2021-03-25 19:34:47 +01:00
684f817111
add load-code/pe/rebuild-import-table.yml
...
Identify rebuilding of import table, used in reflective-dll-injection.
References:
- https://0x00sec.org/t/reflective-dll-injection/3080
- https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection
2021-03-25 19:34:47 +01:00
02915b3ade
add load-code/pe/enumerate-pe-sections.yml
...
Identify copying of PE sections, used in reflective-dll-injection.
References:
- https://0x00sec.org/t/reflective-dll-injection/3080
- https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection
2021-03-25 19:34:31 +01:00
873ed713e8
rule updates based on PMA labs
...
see #296
2021-03-22 09:45:56 +01:00
750e164a41
removing ntdll requirement from function features exported by both ntdll and ntoskrnl
2021-02-16 18:28:05 -07:00
30d6da2362
new rule and some tweaks
2020-10-06 18:28:38 +02:00
7b4f4d10fb
rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better
2020-06-21 17:54:01 -06:00
5f57dbdbc9
rules: reorganize rule names, namespaces, and ATT&CK mappings
2020-06-21 17:25:43 -06:00
William Ballenthin