admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,201 Commits 5 Branches 42 Tags
e5f56c84500372cf12ad06eeb841c3da1663be2a
Commit Graph

33 Commits

Author SHA1 Message Date
Willi Ballenthin 88c9c786ca *: use meta.authors everywhere 2022-05-26 11:56:31 -06:00
William Ballenthin fe1aa57334 fix lint problems 2021-10-22 13:42:00 -06:00
William Ballenthin e13beb6c0e add persist via isapi extension 
closes #478
 2021-10-22 13:02:09 -06:00
William Ballenthin ef00959f0b add persist via IIS module 
ref #478
 2021-10-22 13:01:46 -06:00
Moritz Raabe 25938ca10c change to mandiant.com 2021-09-28 12:21:11 +02:00
William Ballenthin ea3ea14c22 minor reorg linux rules and logic 
ref #442
 2021-08-25 15:31:51 -06:00
Joakim Kennedy 78fbf5f3c5 Fix linting errors 2021-08-05 15:35:27 +01:00
Joakim Kennedy 765e182553 A set of rules for Linux ELFs 2021-08-04 15:47:00 +01:00
Moritz c24ab23bc1 ATT&CK v9 updates (#341) 
* update rules

* add example

* update namespace and move

* add rule

* remove HKCU

* update rules

* update rule
 2021-05-06 20:06:24 +02:00
William Ballenthin 0e0d882ad3 lint 2021-05-01 10:20:00 -06:00
William Ballenthin d8847fa0e6 add appinit/disable code signature enforcement 2021-05-01 10:08:27 -06:00
William Ballenthin e139b36c2e appinit: add reference to enable/disable reg key 2021-05-01 10:05:54 -06:00
Moritz Raabe 387334a603 reformated using capafmt 2021-01-27 15:30:59 +01:00
William Ballenthin f8a3de9367 update attack mappings 2021-01-02 11:46:20 -07:00
0x534a 8d54ac8fa3 Make escaping consistent 2020-12-23 23:38:37 +01:00
0x534a 13a4bf1946 Consolidated setting of registry value with reg.exe command in set-registry-value.yml 2020-12-23 22:42:59 +01:00
0x534a 13e454aeba Make the linter happy 2020-12-22 16:33:13 +01:00
0x534a 7d550ecdf5 Fix logic of registry command detection and clean up 2020-12-22 16:30:08 +01:00
sja f0c2087ab5 Fixed format of att&ck string 2020-12-21 18:18:17 +01:00
sja 5d1f5f1244 Add detection by command line to AppInit_DLLs 2020-12-21 17:51:10 +01:00
sja fa4b0ab19e Changed example hashes from sha256 to md5 2020-12-21 17:35:33 +01:00
sja 2ac93f8cd2 Enhancement of persistence rules 2020-12-21 17:18:58 +01:00
re-fox 7bbaaa250b Update persist-via-run-registry-key.yml 2020-10-05 11:08:35 -04:00
Moritz Raabe 5a67716572 fix att&ck 2020-10-01 10:57:44 +02:00
William Ballenthin 1c39bd8349 graduate rules that pass the linter 2020-07-23 17:30:37 -06:00
William Ballenthin 5488530055 fix ATT&CK categories 
closes #25
 2020-07-03 09:14:14 -06:00
William Ballenthin 54cfb05bd0 rules: address comments in #14 2020-06-26 17:45:56 -06:00
William Ballenthin 0482c936fb rules: fix ATT&CK and MBC tags 2020-06-21 17:57:25 -06:00
William Ballenthin 7b4f4d10fb rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better 2020-06-21 17:54:01 -06:00
William Ballenthin 5f57dbdbc9 rules: reorganize rule names, namespaces, and ATT&CK mappings 2020-06-21 17:25:43 -06:00
William Ballenthin e9ad899b0f rules: add trailing newline to end of each file 2020-06-21 15:50:42 -06:00
William Ballenthin 69507875b0 rules: reformat all rules using capafmt 2020-06-21 15:47:02 -06:00
William Ballenthin eaae0e89a7 import existing rules, forgetting about 938 prior commits 2020-06-18 07:27:35 -06:00