88c9c786ca
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
d43a6ee544
Revert "Merge pull request #548 from mandiant/feature-remove-flavors"
...
This reverts commit bc28847dd982308c4109
2022-04-27 06:23:36 -06:00
ccf3f8fb5f
luhn no lookup table: cleanup logic
2022-04-05 17:15:22 -06:00
904bf3ef00
*: remove /x32 and /x64 flavors and use instruction scope
2022-04-05 12:25:14 -06:00
c80f59be8e
Update lib/open-thread.yml
...
Co-authored-by: Moritz <mr-tz@users.noreply.github.com >
2021-11-24 11:53:05 -05:00
e190179ffd
Merge pull request #1 from MBCProject/ryan-patches1
...
Update patch-process-command-line.yml
2021-11-22 11:27:15 -05:00
25938ca10c
change to mandiant.com
2021-09-28 12:21:11 +02:00
0114138ae4
More detailed mappings
2021-08-31 11:34:09 -05:00
ea3ea14c22
minor reorg linux rules and logic
...
ref #442
2021-08-25 15:31:51 -06:00
b4e040dc50
preliminary mapping
2021-08-23 14:11:00 -05:00
78fbf5f3c5
Fix linting errors
2021-08-05 15:35:27 +01:00
765e182553
A set of rules for Linux ELFs
2021-08-04 15:47:00 +01:00
4d96b6986c
graduate "get service handle"
2021-06-08 10:18:07 -06:00
1fd04d639f
Update validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml
2021-03-03 22:19:45 -05:00
750e164a41
removing ntdll requirement from function features exported by both ntdll and ntoskrnl
2021-02-16 18:28:05 -07:00
7ee2c63e83
capafmted rules
2021-01-28 17:26:25 +01:00
29fbeec36a
Adjusts test file of hijack-thread-execution.yml, resolves conflict in inject-thread.yml and removes articles from rules
2021-01-28 15:28:53 +01:00
8c93d205a8
Improve injection detection and some refactoring of existing rules
2021-01-28 14:47:31 +01:00
387334a603
reformated using capafmt
2021-01-27 15:30:59 +01:00
9037d901be
mappings for lib namespace
2021-01-21 15:27:59 -05:00
e721348144
PR change requests
2021-01-07 13:06:35 -07:00
cab448c6f6
new rules and rule updates from B5F85C26D7AA5A1FB4AF5821B6B5AB9B
2020-12-31 08:44:23 -07:00
824bb5148a
find pusha popa sequences
2020-11-23 18:54:49 +01:00
18d9c7668d
Update and rename validate-credit-card-number-using-luhn-algorithm-with-no-lookup-table.yml to validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml
2020-11-16 10:17:52 -05:00
0e9cdd759c
Update and rename validate-credit-card-number-using-luhn-algorithm-with-lookup-table.yml to validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml
2020-11-16 10:17:19 -05:00
33ae14eb53
use new description syntax
2020-09-30 17:48:02 +02:00
1fcec06e7e
comment out description blocks for statements
...
discussed in #312
2020-09-14 11:53:01 +02:00
6ccc9a736f
fresh rules from al-khaser project
2020-08-13 09:39:42 -06:00
39b0128967
Add files via upload
2020-08-10 12:13:39 -04:00
b878effef7
fix rules as documented in #49
2020-07-24 15:49:52 -06:00
a8621978cf
change tight loop scope to function
2020-07-06 12:36:21 +02:00
25f1157db0
Change characteristic syntax in rules
...
Get rid of `true` in characteristic as it is implicit.
The changes are the result of executing the following commands:
```
find . -type f -exec sed -i.bak "s/\(.*\)characteristic(\(.*\)): true/\1characteristic: \2/g" {} \;
find . -name "*.bak" -type f -delete
```
2020-07-01 19:19:49 +02:00
973cb6b1d2
lib rules: remove namespaces
2020-06-29 06:14:59 -06:00
54cfb05bd0
rules: address comments in #14
2020-06-26 17:45:56 -06:00
5f57dbdbc9
rules: reorganize rule names, namespaces, and ATT&CK mappings
2020-06-21 17:25:43 -06:00
c80380b8d6
rules: reformat with consistent lib and references order
2020-06-21 16:26:28 -06:00
e9ad899b0f
rules: add trailing newline to end of each file
2020-06-21 15:50:42 -06:00
69507875b0
rules: reformat all rules using capafmt
2020-06-21 15:47:02 -06:00
eaae0e89a7
import existing rules, forgetting about 938 prior commits
2020-06-18 07:27:35 -06:00
Willi Ballenthin