19 Commits

Author	SHA1	Message	Date
Yacine Elhamer	d20a7e0a48	add elaborative comment	2023-08-29 21:32:37 +02:00
Yacine Elhamer	d5f05f4e88	initial commit	2023-08-29 21:23:55 +02:00
Yacine Elhamer	5b73ddcd24	manual pass	2023-08-22 09:40:13 +02:00
Yacine Elhamer	a55d769da8	fix author quoting	2023-08-21 09:10:33 +02:00
Yacine Elhamer	8d851f3343	updated rules	2023-08-20 15:39:29 +02:00
Yacine Elhamer	e937af1ee6	initial commit	2023-08-17 10:41:11 +02:00
Moritz	f81d04729a	specify offset operand to reduce FPs (#716) ... * specify offset operand to reduce FPs * add instruction specifics	2023-03-01 16:08:17 +01:00
Willi Ballenthin	57e1732f5c	Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors"" ... This reverts commit d43a6ee544.	2022-06-28 15:23:20 -06:00
Willi Ballenthin	88c9c786ca	*: use meta.authors everywhere	2022-05-26 11:56:31 -06:00
William Ballenthin	d43a6ee544	Revert "Merge pull request #548 from mandiant/feature-remove-flavors" ... This reverts commit bc28847dd9, reversing changes made to 82308c4109.	2022-04-27 06:23:36 -06:00
Willi Ballenthin	904bf3ef00	*: remove /x32 and /x64 flavors and use instruction scope	2022-04-05 12:25:14 -06:00
Willi Ballenthin	ba5dbc40f3	parse PE header: be much more strict	2021-10-26 16:09:20 -06:00
Moritz Raabe	25938ca10c	change to mandiant.com	2021-09-28 12:21:11 +02:00
Joakim Kennedy	5678afad06	Fix some FPs in ELF files by adding os requirement	2021-08-26 11:40:35 +01:00
Moritz Raabe	d81e757728	adding rules based on more PMA labs	2021-06-30 23:38:17 +02:00
Moritz Raabe	873ed713e8	rule updates based on PMA labs ... see #296	2021-03-22 09:45:56 +01:00
Moritz Raabe	30d6da2362	new rule and some tweaks	2020-10-06 18:28:38 +02:00
William Ballenthin	7b4f4d10fb	rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better	2020-06-21 17:54:01 -06:00
William Ballenthin	5f57dbdbc9	rules: reorganize rule names, namespaces, and ATT&CK mappings	2020-06-21 17:25:43 -06:00