05ee3df679
update scope syntax
2023-10-17 11:34:31 +00:00
9cb8848b03
Merge branch 'master' into dynamic-syntax
2023-10-17 10:29:30 +00:00
b33f95c9ca
set state tcp connection ( #829 )
...
* Add rule
---------
Co-authored-by: Willi Ballenthin <wballenthin@google.com >
2023-10-06 17:19:47 +02:00
5b73ddcd24
manual pass
2023-08-22 09:40:13 +02:00
0aea484e04
updated rules
2023-08-21 19:14:45 +02:00
c4cdd9bae7
fix improper scope for rules containing a subscope in and
2023-08-21 14:27:45 +02:00
a55d769da8
fix author quoting
2023-08-21 09:10:33 +02:00
8d851f3343
updated rules
2023-08-20 15:39:29 +02:00
850909bd82
update
2023-08-17 11:07:02 +02:00
e937af1ee6
initial commit
2023-08-17 10:41:11 +02:00
abf75509fa
DNS and crypto rule tweaks ( #713 )
...
* update rule
2023-02-27 09:59:21 +01:00
63a4c6d5db
improve .NET detections incl. sockets, files, directories ( #708 )
2023-02-23 09:45:49 +01:00
c046b59a74
add new and update existing .NET rules ( #639 )
2023-01-03 07:58:11 -07:00
1fbee15a3c
Add dotnet rules having property features ( #601 )
2022-10-03 09:28:05 -06:00
dcc2e74c84
Update with dotnet capabilities ( #590 )
2022-07-07 15:22:39 -06:00
57e1732f5c
Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""
...
This reverts commit d43a6ee544
2022-06-28 15:23:20 -06:00
88c9c786ca
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
d43a6ee544
Revert "Merge pull request #548 from mandiant/feature-remove-flavors"
...
This reverts commit bc28847dd982308c4109
2022-04-27 06:23:36 -06:00
904bf3ef00
*: remove /x32 and /x64 flavors and use instruction scope
2022-04-05 12:25:14 -06:00
4f4914d572
Fix Mitre Att&ck technique naming
2022-01-22 16:59:27 +01:00
bedfba7abe
enumerate domain computers via LDAP: add references to COM GUIDs
2021-10-22 11:08:40 -06:00
25938ca10c
change to mandiant.com
2021-09-28 12:21:11 +02:00
ea3ea14c22
minor reorg linux rules and logic
...
ref #442
2021-08-25 15:31:51 -06:00
6f582bd395
Merge pull request #442 from TcM1911/linux-rules
...
A set of rules for Linux ELFs
2021-08-25 14:33:25 -06:00
0ef69c4fbd
*: use substring features rather than unreadable regexes
...
closes #450
2021-08-24 12:47:26 -06:00
78fbf5f3c5
Fix linting errors
2021-08-05 15:35:27 +01:00
765e182553
A set of rules for Linux ELFs
2021-08-04 15:47:00 +01:00
cbc1098993
register-network-filter-via-wfp-api: fix ATT&CK mapping
...
closes #424
2021-07-12 21:08:09 -06:00
fbafd732e7
Update rule metadata for rules written by @recvfrom
...
Mostly just changes @recvfrom to awillia2@cisco.com , but
also updates the descriptions in a few places to be
more precise (I don't think I initially realized that
`api` has function scope and is for API calls whereas
`import` has file level scope and is just for the import)
2021-06-06 23:30:34 -04:00
0603577a7d
Add enumerate-domain-computers-via-LDAP
2021-06-06 10:12:06 -04:00
27a08abcfa
Add get-domain-controller-name
2021-06-06 10:10:51 -04:00
a18ea071ba
adding new rules for keylogging, HTTP comms, network collection
2021-05-26 14:58:20 -06:00
e4734454c2
adding check-internet-connectivity-via-wininet.yml
2021-05-07 15:37:47 -06:00
8a513b280b
Add rules from Egregor ransomware DLL
2021-04-26 11:56:25 -04:00
842c864471
Update resolve-dns.yml
2021-02-12 21:53:44 -03:00
88b87c672c
Update resolve-dns.yml
2021-02-12 10:29:53 -03:00
581a28645a
Update resolve-dns.yml
...
https://github.com/fireeye/capa-rules/issues/239
2021-02-11 20:52:52 -03:00
f8a3de9367
update attack mappings
2021-01-02 11:46:20 -07:00
c5d24c671a
added mbc mappings in the host-interaction namespace
2020-12-16 15:30:06 -05:00
c7839894a0
Fix #115
...
See #115 for explanation of the issue
2020-09-02 12:17:01 -04:00
b878effef7
fix rules as documented in #49
2020-07-24 15:49:52 -06:00
0d77564785
merge
2020-06-26 17:47:37 -06:00
54cfb05bd0
rules: address comments in #14
2020-06-26 17:45:56 -06:00
7b4f4d10fb
rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better
2020-06-21 17:54:01 -06:00
5f57dbdbc9
rules: reorganize rule names, namespaces, and ATT&CK mappings
2020-06-21 17:25:43 -06:00
Willi Ballenthin