20c46c64c8
Merge pull request #562 from ryantxu1/master
...
Update Mappings for MBC (part 8)
2022-06-03 11:15:49 -06:00
92eef819bb
Update Mappings for MBC (part 8)
2022-06-03 09:43:39 -05:00
88c9c786ca
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
49ac35dbe7
Update rules to use a list item instead of a string value for references.
2022-05-11 10:39:42 -04:00
d43a6ee544
Revert "Merge pull request #548 from mandiant/feature-remove-flavors"
...
This reverts commit bc28847dd982308c4109
2022-04-27 06:23:36 -06:00
904bf3ef00
*: remove /x32 and /x64 flavors and use instruction scope
2022-04-05 12:25:14 -06:00
cae4aa28ae
Issue #539 : Sample manually build AES/Rijndael boxes
2022-03-14 14:01:07 -05:00
ee10f6eaa4
add linux requirement
2021-10-24 18:13:50 -04:00
0d83ae971c
Add glibc memfrob rule
2021-10-23 03:40:55 -04:00
25938ca10c
change to mandiant.com
2021-09-28 12:21:11 +02:00
b2f28af082
update reference link and change comments to descriptions
2021-08-24 12:29:42 -04:00
92d4dd931d
udpate comment
2021-08-24 12:21:38 -04:00
8ee20678aa
udpate email
2021-08-24 12:21:00 -04:00
18804adef9
add rule for WolfSSL HC-128 encryption algorithm
2021-08-24 12:19:34 -04:00
656de6b7bd
create new key via CryptAcquireContext: tweak DLL name for CryptAcquireContext
2021-08-18 15:12:21 -06:00
e97867d227
Fix api and remove example
2021-07-19 13:55:57 -07:00
30b68fda00
Add rule for CryptAcquireContext CRYPT_NEWKEYSET
2021-07-19 12:32:51 -07:00
5b9f0f0787
graduate "get outbound credentials handle via CredSSP"
2021-06-08 10:08:42 -06:00
fbafd732e7
Update rule metadata for rules written by @recvfrom
...
Mostly just changes @recvfrom to awillia2@cisco.com , but
also updates the descriptions in a few places to be
more precise (I don't think I initially realized that
`api` has function scope and is for API calls whereas
`import` has file level scope and is just for the import)
2021-06-06 23:30:34 -04:00
554ffb2139
encrypt aes via x86: remove example and move to nursery
2021-05-18 13:37:40 -06:00
6e501e8151
rules: convert inline comments to descriptions
...
closes #1
2021-05-18 10:45:41 -06:00
8cde760ec4
graduate EC rule
2021-04-09 11:24:47 +02:00
20e1b8fd4c
enforce string formatting with double quotes + escaped special characters
2021-03-24 14:14:38 -06:00
7d1642122a
Update rules number badge
2021-03-22 08:40:59 +00:00
0af8107a7e
Hopefully fixed linting issues...
2021-03-18 14:12:46 -04:00
90926404a2
Updated references
2021-03-18 14:10:05 -04:00
aadc07cfe3
Update data-manipulation/encryption/rc4/encrypt-data-using-rc4-with-custom-key-via-winapi.yml
...
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
2021-03-18 14:06:03 -04:00
87fc31cca0
Removed trailing line
2021-03-18 13:59:23 -04:00
f59d5a921b
Updated line endings
2021-03-18 13:50:49 -04:00
ec8ef5ca86
Ran through formatter
2021-03-18 13:25:33 -04:00
a2f283cf2a
Fixed line ending
2021-03-18 13:11:24 -04:00
862061610f
Adding rule encrypt-data-using-rc4-with-custom-key-via-winapi.yml
2021-03-18 13:07:30 -04:00
710aa78a47
Create encrypt-data-using-vest.yml
2021-02-06 20:56:00 -05:00
53c73780d5
Apply suggestions from code review
...
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
2021-01-29 19:59:13 +01:00
0eddb61a9c
rule updates
2021-01-29 13:27:29 +01:00
387334a603
reformated using capafmt
2021-01-27 15:30:59 +01:00
a0f10b4cf2
add mappings
2020-10-19 14:04:15 -04:00
33ae14eb53
use new description syntax
2020-09-30 17:48:02 +02:00
cbdc13886d
Implement encrypt-data-using-hc-128 review feedback
...
Add MITRE ATT&CK metadata and graduate from the nursery
2020-09-21 11:25:20 -04:00
1fcec06e7e
comment out description blocks for statements
...
discussed in #312
2020-09-14 11:53:01 +02:00
a2a23e9cae
Update encrypt-data-using-sosemanuk per feedback
...
Also look for IMUL 0x54655307 and ROL 7
2020-09-03 14:42:50 -04:00
6173c3ad75
Fix #117 - Add encrypt-data-using-sosemanuk
...
Fixes #117
2020-09-03 14:16:46 -04:00
53f0b9e3e1
Update example offset in encrypt-data-using-camellia
2020-08-28 17:13:22 -04:00
408d8c9aa6
Fix #105 - Update encrypt-data-using-camellia
...
Updates encrypt-data-using-camellia so that it works with
112f9f0e8d349858a80dd8c14190e620
2020-08-28 14:01:36 -04:00
e995189224
add new rules
2020-08-27 10:38:59 +02:00
108e3b09ab
Merge pull request #94 from fireeye/update/rc4-algorithms
...
improve RC4 rules
2020-08-11 15:03:37 -06:00
433b32c1b0
improve RC4 rules
...
closes #91
2020-08-11 16:07:08 +02:00
290cdad5a8
Update encrypt-data-using-twofish.yml
2020-08-04 10:07:07 -04:00
47dc412d67
Create encrypt-data-using-twofish.yml
2020-08-03 21:40:22 -04:00
64764d075b
Create encrypt-data-using-blowfish.yml
2020-08-03 15:05:02 -04:00
Willi Ballenthin