 Yacine Elhamer
|
d20a7e0a48
|
add elaborative comment
|
2023-08-29 21:32:37 +02:00 |
|
|
Yacine Elhamer
|
d5f05f4e88
|
initial commit
|
2023-08-29 21:23:55 +02:00 |
|
|
Yacine Elhamer
|
5b73ddcd24
|
manual pass
|
2023-08-22 09:40:13 +02:00 |
|
|
Yacine Elhamer
|
0aea484e04
|
updated rules
|
2023-08-21 19:14:45 +02:00 |
|
|
Yacine Elhamer
|
c4cdd9bae7
|
fix improper scope for rules containing a subscope in and
|
2023-08-21 14:27:45 +02:00 |
|
|
Yacine Elhamer
|
a55d769da8
|
fix author quoting
|
2023-08-21 09:10:33 +02:00 |
|
|
Yacine Elhamer
|
8d851f3343
|
updated rules
|
2023-08-20 15:39:29 +02:00 |
|
|
Yacine Elhamer
|
e937af1ee6
|
initial commit
|
2023-08-17 10:41:11 +02:00 |
|
|
ryan
|
153d4c0d2c
|
Update Mappings for MBC
|
2023-06-21 10:45:01 -04:00 |
|
|
Blas
|
b7a95a37f7
|
Rule for zlib inflate/deflate (#695)
* Create compress-data-via-zlib-inflate-or-deflate.yml
|
2023-02-15 11:56:28 +01:00 |
|
|
Moritz
|
613536dd1d
|
LZO compression / decompression rules continued (#677)
* Add rule for lzo compression
* Add matching decompression rule
---------
Co-authored-by: David Cannings <david.cannings@pwc.com>
|
2023-02-01 15:12:45 +01:00 |
|
|
Willi Ballenthin
|
57e1732f5c
|
Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""
This reverts commit d43a6ee544.
|
2022-06-28 15:23:20 -06:00 |
|
|
Willi Ballenthin
|
88c9c786ca
|
*: use meta.authors everywhere
|
2022-05-26 11:56:31 -06:00 |
|
|
William Ballenthin
|
d43a6ee544
|
Revert "Merge pull request #548 from mandiant/feature-remove-flavors"
This reverts commit bc28847dd9, reversing
changes made to 82308c4109.
|
2022-04-27 06:23:36 -06:00 |
|
|
Willi Ballenthin
|
904bf3ef00
|
*: remove /x32 and /x64 flavors and use instruction scope
|
2022-04-05 12:25:14 -06:00 |
|
|
jtothej
|
7d08c3648f
|
Add decompress-data-using-ucl.yml
|
2021-12-03 14:26:13 +08:00 |
|
|
Desiree Beck
|
e190179ffd
|
Merge pull request #1 from MBCProject/ryan-patches1
Update patch-process-command-line.yml
|
2021-11-22 11:27:15 -05:00 |
|
|
Willi Ballenthin
|
0b5def9556
|
decompress data using aplib: add further features
|
2021-11-03 11:07:44 -06:00 |
|
|
Chuong Dong
|
0b744d89f8
|
fix format
|
2021-10-28 11:52:41 +07:00 |
|
|
Chuong Dong
|
de0fad852a
|
change aPLib to detect BlackMatter's v3.0 decompression
|
2021-10-28 11:34:51 +07:00 |
|
|
William Ballenthin
|
345614c629
|
decompress data using aplib: remove missing example
|
2021-10-15 14:25:33 -06:00 |
|
|
Moritz Raabe
|
25938ca10c
|
change to mandiant.com
|
2021-09-28 12:21:11 +02:00 |
|
|
Ryan Xu
|
0114138ae4
|
More detailed mappings
|
2021-08-31 11:34:09 -05:00 |
|
|
Ryan Xu
|
b4e040dc50
|
preliminary mapping
|
2021-08-23 14:11:00 -05:00 |
|
|
William Ballenthin
|
6e501e8151
|
rules: convert inline comments to descriptions
closes #1
|
2021-05-18 10:45:41 -06:00 |
|
|
Moritz Raabe
|
30db0cddb8
|
add rules from fboldewin
Co-authored-by: Frank Boldewin <frank.boldewin@gmx.de>
|
2021-04-09 11:24:47 +02:00 |
|
|
Michael Hunhoff
|
20e1b8fd4c
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
|
Moritz Raabe
|
387334a603
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
|
Desiree Beck
|
33817fdd83
|
update micro objective name: data manipulation to data
|
2020-12-12 12:18:47 -05:00 |
|
|
Desiree Beck
|
a0f10b4cf2
|
add mappings
|
2020-10-19 14:04:15 -04:00 |
|
|
Moritz Raabe
|
33ae14eb53
|
use new description syntax
|
2020-09-30 17:48:02 +02:00 |
|
|
Moritz Raabe
|
1fcec06e7e
|
comment out description blocks for statements
discussed in #312
|
2020-09-14 11:53:01 +02:00 |
|
|
David Cannings
|
e5786a1bd7
|
Graduate rule
|
2020-09-02 19:12:29 +01:00 |
|
|
0ssigeno
|
8dd3821274
|
fixed key, and added x32 and x64 flavours
|
2020-08-20 10:22:00 +02:00 |
|
|
William Ballenthin
|
7b4f4d10fb
|
rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better
|
2020-06-21 17:54:01 -06:00 |
|
|
William Ballenthin
|
5f57dbdbc9
|
rules: reorganize rule names, namespaces, and ATT&CK mappings
|
2020-06-21 17:25:43 -06:00 |
|
|
William Ballenthin
|
7f5fb71a5d
|
rules: use meta.references over meta.reference
closes #13
|
2020-06-21 16:41:18 -06:00 |
|
|
William Ballenthin
|
e9ad899b0f
|
rules: add trailing newline to end of each file
|
2020-06-21 15:50:42 -06:00 |
|
|
William Ballenthin
|
69507875b0
|
rules: reformat all rules using capafmt
|
2020-06-21 15:47:02 -06:00 |
|
|
William Ballenthin
|
eaae0e89a7
|
import existing rules, forgetting about 938 prior commits
|
2020-06-18 07:27:35 -06:00 |
|