Still / Azaka 7269873b0c Add rules for detecting donut-related features (#997) ...

* Initial additions for detecting donut features

Signed-off-by: Still Hsu <dev@stillu.cc>

* Lint rules

Signed-off-by: Still Hsu <dev@stillu.cc>

* Update ATT&CK for donut rule

Signed-off-by: Still Hsu <dev@stillu.cc>

* Fix comment for dynamic scope on donut loader

Signed-off-by: Still Hsu <dev@stillu.cc>

* Require at least one donut function match for donut rule

Signed-off-by: Still Hsu <dev@stillu.cc>

* Add offset for examples

Signed-off-by: Still Hsu <dev@stillu.cc>

* Add indirect call for IAssembly matching

Signed-off-by: Still Hsu <dev@stillu.cc>

* Match known vtable offsets for assembly loading

* Remove loop matching

---------

Signed-off-by: Still Hsu <dev@stillu.cc>

2025-03-21 10:15:28 -06:00

..

load-assembly-via-iassembly.yml

Add rules for detecting donut-related features (#997)

2025-03-21 10:15:28 -06:00

load-windows-common-language-runtime.yml

remove redundant matches for dynamic scope (#987)

2025-02-04 09:32:24 +01:00