Devarjya 2a55a30478 Refine Speck detection using variant-specific rotation constants (#1115)

2026-02-17 14:18:46 -07:00

..

aes

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

blowfish

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

camellia

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

chaskey

Add rules for detecting donut-related features (#997)

2025-03-21 10:15:28 -06:00

des

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

dpapi

remove redundant matches for dynamic scope (#987)

2025-02-04 09:32:24 +01:00

elliptic-curve

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

hc-128

Update HC-128 (variation used in Winnti malware)

2024-07-25 12:26:53 +09:00

hc-256

add encrypt-data-using-hc-256 (#1097)

2026-01-06 10:01:44 -07:00

rc4

remove redundant matches for dynamic scope (#987)

2025-02-04 09:32:24 +01:00

rc6

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

rsa

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

skipjack

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

sosemanuk

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

speck

Refine Speck detection using variant-specific rotation constants (#1115)

2026-02-17 14:18:46 -07:00

tea

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

twofish

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

vest

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

xtea

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

xxtea

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

create-new-key-via-cryptacquirecontext.yml

tighten scopes

2024-10-25 08:28:16 +00:00

encrypt-data-using-memfrob-from-glibc.yml

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

encrypt-or-decrypt-via-wincrypt.yml

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

get-outbound-credentials-handle-via-credssp.yml

fix call/thread scopes manually

2023-11-24 11:35:00 +01:00

import-public-key.yml

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

use-bigint-function.yml

New rules: RSA & bigint (#982)

2025-01-21 11:36:04 -07:00