Commit Graph

15 Commits

Author SHA1 Message Date
Moritz Raabe 25938ca10c change to mandiant.com 2021-09-28 12:21:11 +02:00
Andrew fbafd732e7 Update rule metadata for rules written by @recvfrom
Mostly just changes @recvfrom to awillia2@cisco.com, but
also updates the descriptions in a few places to be
more precise (I don't think I initially realized that
`api` has function scope and is for API calls whereas
`import` has file level scope and is just for the import)
2021-06-06 23:30:34 -04:00
Andrew 64e7452ae7 Add packaged-as-an-inno-setup-installer
Add packaged-as-an-inno-setup-installer which looks for simple strings
associated with Inno Setup installers.  These strings appear to be
present in installers produced using at least Inno Setup version 3
through the latest (Inno Setup version 6).
2021-05-23 22:54:04 -04:00
Willi Ballenthin b21ca8d120 embedded pe: via strings
closes #319
2021-04-14 12:34:57 -06:00
mike-hunhoff eb8221d9ad Merge pull request #305 from fireeye/enfore-string-format
enforce string formatting
2021-03-25 12:36:51 -06:00
Michael Hunhoff 20e1b8fd4c enforce string formatting with double quotes + escaped special characters 2021-03-24 14:14:38 -06:00
Moritz Raabe 6c9f83dd7f merge duplicate rules 2021-03-22 18:42:54 +01:00
Andrew 12ff221b68 Add packaged-as-an-iexpress-self-extracting-archive 2021-03-21 22:25:21 -04:00
Michael Hunhoff 750e164a41 removing ntdll requirement from function features exported by both ntdll and ntoskrnl 2021-02-16 18:28:05 -07:00
Desiree Beck 5d285c5651 mappings for additions to namespaces 2021-01-21 15:29:06 -05:00
Desiree Beck 490bc34a05 add method to pe area 2020-10-19 14:01:02 -04:00
William Ballenthin 4350ffad33 fix rule paths thanks to linter 2020-07-23 11:58:23 -06:00
William Ballenthin 54cfb05bd0 rules: address comments in #14 2020-06-26 17:45:56 -06:00
William Ballenthin 7b4f4d10fb rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better 2020-06-21 17:54:01 -06:00
William Ballenthin 5f57dbdbc9 rules: reorganize rule names, namespaces, and ATT&CK mappings 2020-06-21 17:25:43 -06:00