Mike Hunhoff c002c5cd96 remove FPs from allocate-or-change-rwx-memory.yml (#1027)

2025-03-18 08:01:36 -06:00

..

allocate-or-change-rwx-memory.yml

remove FPs from allocate-or-change-rwx-memory.yml (#1027)

2025-03-18 08:01:36 -06:00

allocate-user-process-rwx-memory.yml

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

attach-user-process-memory.yml

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

free-user-process-memory.yml

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

hijack-thread-execution.yml

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

inject-apc.yml

additional APIs to remove FNs for inject apc

2025-02-20 15:08:04 -07:00

inject-dll.yml

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

inject-pe.yml

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

inject-shellcode-using-a-file-mapping-object.yml

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

inject-shellcode-using-extra-window-memory.yml

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

inject-shellcode-using-window-subclass-procedure.yml

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

inject-thread.yml

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

process-ghostly-hollowing.yml

Ghostly Hollowing process injection rule (#865)

2024-01-23 10:55:34 +01:00

use-process-doppelgänging.yml

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

use-process-replacement.yml

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00