admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
mandiant-capa-rules/exploitation
T
History
zdw@ e6df480758 add first set of exploit detection rules (#1046) 
* add ntoskrnl.exe loading rule

* fix name

* add explicit os

* add suspicious ntquerysysteinformation detections

* ntfscontrolfile wip

* fix ntfscontrolfile rule

* rename ntquerysysinfo rule

* add ntoskrnl gadgets rule

* make descs more generic

* refactor rules to exploitation namespace

* add caveat to ntfscontrolfile rule

* tweak rule names

* tweak ntfscontrolfile name
2025-05-22 12:53:30 -06:00
..
enumeration
add first set of exploit detection rules (#1046)
2025-05-22 12:53:30 -06:00
gadgets
add first set of exploit detection rules (#1046)
2025-05-22 12:53:30 -06:00
spraying
add first set of exploit detection rules (#1046)
2025-05-22 12:53:30 -06:00