e5f56c8450
Update hash-data-with-crc32.yml
2022-06-24 09:44:12 +02:00
20c46c64c8
Merge pull request #562 from ryantxu1/master
...
Update Mappings for MBC (part 8)
2022-06-03 11:15:49 -06:00
92eef819bb
Update Mappings for MBC (part 8)
2022-06-03 09:43:39 -05:00
88c9c786ca
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
49ac35dbe7
Update rules to use a list item instead of a string value for references.
2022-05-11 10:39:42 -04:00
d43a6ee544
Revert "Merge pull request #548 from mandiant/feature-remove-flavors"
...
This reverts commit bc28847dd982308c4109
2022-04-27 06:23:36 -06:00
c14431d50d
crc: fix logic
2022-04-05 15:18:33 -06:00
202c60cd5a
fix adler logic
2022-04-05 15:01:15 -06:00
904bf3ef00
*: remove /x32 and /x64 flavors and use instruction scope
2022-04-05 12:25:14 -06:00
cae4aa28ae
Issue #539 : Sample manually build AES/Rijndael boxes
2022-03-14 14:01:07 -05:00
7d08c3648f
Add decompress-data-using-ucl.yml
2021-12-03 14:26:13 +08:00
e190179ffd
Merge pull request #1 from MBCProject/ryan-patches1
...
Update patch-process-command-line.yml
2021-11-22 11:27:15 -05:00
0b5def9556
decompress data using aplib: add further features
2021-11-03 11:07:44 -06:00
0b744d89f8
fix format
2021-10-28 11:52:41 +07:00
de0fad852a
change aPLib to detect BlackMatter's v3.0 decompression
2021-10-28 11:34:51 +07:00
ee10f6eaa4
add linux requirement
2021-10-24 18:13:50 -04:00
0d83ae971c
Add glibc memfrob rule
2021-10-23 03:40:55 -04:00
345614c629
decompress data using aplib: remove missing example
2021-10-15 14:25:33 -06:00
25938ca10c
change to mandiant.com
2021-09-28 12:21:11 +02:00
0114138ae4
More detailed mappings
2021-08-31 11:34:09 -05:00
b2f28af082
update reference link and change comments to descriptions
2021-08-24 12:29:42 -04:00
92d4dd931d
udpate comment
2021-08-24 12:21:38 -04:00
8ee20678aa
udpate email
2021-08-24 12:21:00 -04:00
18804adef9
add rule for WolfSSL HC-128 encryption algorithm
2021-08-24 12:19:34 -04:00
b4e040dc50
preliminary mapping
2021-08-23 14:11:00 -05:00
0131138d4e
Update authenticate-hmac.yml
2021-08-23 11:10:36 -05:00
c008eede1a
Update authenticate-hmac.yml
2021-08-23 11:09:34 -05:00
656de6b7bd
create new key via CryptAcquireContext: tweak DLL name for CryptAcquireContext
2021-08-18 15:12:21 -06:00
e97867d227
Fix api and remove example
2021-07-19 13:55:57 -07:00
30b68fda00
Add rule for CryptAcquireContext CRYPT_NEWKEYSET
2021-07-19 12:32:51 -07:00
d35347d66a
md5: fix optional constants
2021-06-08 11:14:09 -06:00
cb9d886940
graduate "hash data with MD5"
2021-06-08 11:02:18 -06:00
5b9f0f0787
graduate "get outbound credentials handle via CredSSP"
2021-06-08 10:08:42 -06:00
2f1ea8a088
Merge pull request #408 from recvfrom/get-domain-controller-name
...
Add get-domain-controller-name and enumerate-domain-computers-via-LDAP
2021-06-07 09:44:25 +02:00
fbafd732e7
Update rule metadata for rules written by @recvfrom
...
Mostly just changes @recvfrom to awillia2@cisco.com , but
also updates the descriptions in a few places to be
more precise (I don't think I initially realized that
`api` has function scope and is for API calls whereas
`import` has file level scope and is just for the import)
2021-06-06 23:30:34 -04:00
a5721b1698
graduate "encode data using Base64 via WinAPI"
2021-06-04 12:21:34 -06:00
d32aa59842
graduate "decode data using Base64 via WinAPI"
2021-06-04 12:18:30 -06:00
6173d62014
graduate "authenticate HMAC"
2021-06-04 12:01:15 -06:00
612cc74841
Added rule for Base64 decoding per 9efa86b43b4367bcdc1591aee59bda25 ( #397 )
...
* Added rule for Base64 decoding per 9efa86b43b4367bcdc1591aee59bda25
* Update data-manipulation/encoding/base64/decode-data-using-base64.yml
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* Update data-manipulation/encoding/base64/decode-data-using-base64.yml
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
* updated file name
Co-authored-by: Gil Elliot <gilbert.elliot@10-h14cjg5m-33o.fireeye.com >
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
2021-05-26 09:31:11 +02:00
54d422b085
Add hash-data-using-djb2
...
The djb2 hash function was recently observed being used by
Gamaredon for Windows API function hashing, so this commit
adds hash-data-using-djb2 to look for a commonly referenced
djb2 implementation
2021-05-22 23:34:40 -04:00
554ffb2139
encrypt aes via x86: remove example and move to nursery
2021-05-18 13:37:40 -06:00
913cebdb38
Merge branch 'master' into fix-1
2021-05-18 10:48:06 -06:00
624fa5e980
remove single child statements
2021-05-19 18:12:09 +02:00
6e501e8151
rules: convert inline comments to descriptions
...
closes #1
2021-05-18 10:45:41 -06:00
3a565c6ffd
fix URLs & formatting
2021-05-12 12:52:06 +02:00
f1b450edf0
update ATT&CK and MBC mappings
...
thanks to Regina Elwell @ FireEye and @evandrix
closes #316
2021-04-13 09:37:10 -06:00
8cde760ec4
graduate EC rule
2021-04-09 11:24:47 +02:00
30db0cddb8
add rules from fboldewin
...
Co-authored-by: Frank Boldewin <frank.boldewin@gmx.de >
2021-04-09 11:24:47 +02:00
eb8221d9ad
Merge pull request #305 from fireeye/enfore-string-format
...
enforce string formatting
2021-03-25 12:36:51 -06:00
c0216c9e60
hash-data-using-fnv: removing arch requirement from number constants
2021-03-24 14:36:13 -06:00
Moritz