 mike-hunhoff
|
9880da1f98
|
Merge pull request #209 from johnk3r/master
Create get-enumeration-function.yml
|
2021-01-05 08:48:14 -07:00 |
|
|
johnk3r
|
539ad95248
|
Delete enumerate-graphical-windows.yml
#31
|
2021-01-05 09:39:51 -03:00 |
|
|
johnk3r
|
6180321f51
|
Update enumerate-gui-resources.yml
|
2021-01-05 09:35:12 -03:00 |
|
|
Capa Bot
|
f406ba8448
|
Update rules number badge
|
2021-01-04 12:51:18 +00:00 |
|
|
Moritz
|
4329cf72ee
|
Merge pull request #207 from 0x534a/0x534a-improve-persistence-detection
Improve persistence detection
|
2021-01-04 13:50:56 +01:00 |
|
|
johnk3r
|
a8ae2e2cd9
|
Update enumerate-gui-resources.yml
|
2020-12-30 22:33:16 -03:00 |
|
|
johnk3r
|
4e1c15bb86
|
Update enumerate-gui-resources.yml
|
2020-12-30 22:33:08 -03:00 |
|
|
johnk3r
|
bce0530dc8
|
Delete get-operation-system-version.yml
|
2020-12-30 22:28:11 -03:00 |
|
|
johnk3r
|
fdf3afe7f6
|
Create get-operation-system-version.yml
https://github.com/fireeye/capa-rules/issues/28
|
2020-12-30 22:23:34 -03:00 |
|
|
johnk3r
|
c12233d5ae
|
Update and rename enumerate-GUI-resources.yml to enumerate-gui-resources.yml
|
2020-12-30 18:59:11 -03:00 |
|
|
johnk3r
|
08b5124069
|
Rename host-interaction/gui/window/..enumerate GUI resources.yml to host-interaction/gui/enumerate-GUI-resources.yml
|
2020-12-30 18:57:57 -03:00 |
|
|
johnk3r
|
e0748e5db2
|
Rename enumerate GUI resources.yml to ..enumerate GUI resources.yml
|
2020-12-30 18:56:26 -03:00 |
|
|
johnk3r
|
c9ca55d4a1
|
Update enumerate GUI resources.yml
|
2020-12-30 18:54:57 -03:00 |
|
|
johnk3r
|
5ec67552d9
|
Update and rename get-enumeration-functions.yml to enumerate GUI resources.yml
|
2020-12-30 18:54:24 -03:00 |
|
|
johnk3r
|
332e5e2489
|
Rename get-enumeration-function.yml to get-enumeration-functions.yml
|
2020-12-29 21:53:33 -03:00 |
|
|
johnk3r
|
642ccf0cc4
|
Create get-enumeration-function.yml
|
2020-12-29 21:40:36 -03:00 |
|
|
0x534a
|
8d54ac8fa3
|
Make escaping consistent
|
2020-12-23 23:38:37 +01:00 |
|
|
0x534a
|
13a4bf1946
|
Consolidated setting of registry value with reg.exe command in set-registry-value.yml
|
2020-12-23 22:42:59 +01:00 |
|
|
Capa Bot
|
112105d95a
|
Update rules number badge
|
2020-12-23 12:44:05 +00:00 |
|
|
Moritz
|
3a6124a11d
|
Merge pull request #206 from johnk3r/master
Rule: Domain Trust Discovery and new IP checking domain
|
2020-12-23 13:43:48 +01:00 |
|
|
Willi Ballenthin
|
598fd10a91
|
Merge pull request #208 from fireeye/fix/fp-anti-vm
disable cpuid feature for now
|
2020-12-22 10:16:11 -07:00 |
|
|
0x534a
|
13e454aeba
|
Make the linter happy
|
2020-12-22 16:33:13 +01:00 |
|
|
0x534a
|
7d550ecdf5
|
Fix logic of registry command detection and clean up
|
2020-12-22 16:30:08 +01:00 |
|
|
Moritz Raabe
|
89bc5ec26b
|
disable cpuid feature for now
|
2020-12-22 14:26:40 +01:00 |
|
|
Capa Bot
|
672d85fff0
|
Update rules number badge
|
2020-12-22 13:17:13 +00:00 |
|
|
Moritz
|
8b4dd575bf
|
Merge pull request #200 from fireeye/new-rules-20201215
communication and runtime linking
|
2020-12-22 14:16:56 +01:00 |
|
|
johnk3r
|
9e8713d35b
|
Update get-domain-trust-relationships.yml
Improvement
|
2020-12-22 10:07:01 -03:00 |
|
|
johnk3r
|
122c0857dc
|
Update get-domain-trust-relationships.yml
|
2020-12-21 21:58:19 -03:00 |
|
|
johnk3r
|
f630df173e
|
Rename domain-trust.yml to get-domain-trust-relationships.yml
|
2020-12-21 21:56:08 -03:00 |
|
|
johnk3r
|
6f75b0db2e
|
Update domain-trust.yml
|
2020-12-21 21:49:19 -03:00 |
|
|
sja
|
f0c2087ab5
|
Fixed format of att&ck string
|
2020-12-21 18:18:17 +01:00 |
|
|
sja
|
5d1f5f1244
|
Add detection by command line to AppInit_DLLs
|
2020-12-21 17:51:10 +01:00 |
|
|
sja
|
fa4b0ab19e
|
Changed example hashes from sha256 to md5
|
2020-12-21 17:35:33 +01:00 |
|
|
sja
|
2ac93f8cd2
|
Enhancement of persistence rules
|
2020-12-21 17:18:58 +01:00 |
|
|
johnk3r
|
64df49cf9a
|
Update capture-public-ip.yml
Add new check IP
|
2020-12-20 22:36:41 -03:00 |
|
|
johnk3r
|
624196a365
|
Create domain-trust.yml
#174
|
2020-12-20 22:25:49 -03:00 |
|
|
Capa Bot
|
b2f83a5edf
|
Update rules number badge
|
2020-12-17 17:14:21 +00:00 |
|
|
Moritz
|
11d360f286
|
Merge pull request #204 from re-fox/master
Merging FNV hash rules
|
2020-12-17 18:14:03 +01:00 |
|
|
Willi Ballenthin
|
c901e32029
|
Merge pull request #202 from dzbeck/mbc-updates-p4
update mappings for mbc (part 4)
|
2020-12-17 10:11:40 -07:00 |
|
|
re-fox
|
4c878c41ad
|
Update hash-data-using-fnv.yml
|
2020-12-17 11:05:22 -05:00 |
|
|
re-fox
|
c1ad8e7d0c
|
Update hash-data-using-fnv.yml
|
2020-12-17 10:32:26 -05:00 |
|
|
re-fox
|
f93c2cb928
|
Update and rename hash-data-using-fnv-1.yml to hash-data-using-fnv.yml
|
2020-12-17 10:28:15 -05:00 |
|
|
re-fox
|
bbd75ca439
|
Delete hash-data-using-fnv.yml
|
2020-12-17 10:11:49 -05:00 |
|
|
Desiree Beck
|
3339dd6b68
|
Merge branch 'master' of https://github.com/fireeye/capa-rules into mbc-updates-p4
|
2020-12-16 17:27:50 -05:00 |
|
|
Desiree Beck
|
499308b3e9
|
update based on comments
|
2020-12-16 16:33:22 -05:00 |
|
|
Capa Bot
|
e3c5f4c4d7
|
Update rules number badge
|
2020-12-16 20:47:13 +00:00 |
|
|
Willi Ballenthin
|
118019ae02
|
Merge pull request #201 from fireeye/re-fox-patch-2
Create hash-data-using-fnv-1.yml
|
2020-12-16 13:46:58 -07:00 |
|
|
Desiree Beck
|
4e884a3e76
|
added mbc mapping in impact namespace
|
2020-12-16 15:34:52 -05:00 |
|
|
re-fox
|
19abc2ef09
|
Update hash-data-using-fnv-1.yml
|
2020-12-16 15:34:15 -05:00 |
|
|
Desiree Beck
|
c5d24c671a
|
added mbc mappings in the host-interaction namespace
|
2020-12-16 15:30:06 -05:00 |
|