Willi Ballenthin 3366b282f9 Merge pull request #43 from re-fox/master ...

Adding QueryWorkingSet from psapi to be used in ReadProcessMemory rule and second NtQuerySystemInformation rule.

2020-07-22 12:44:33 -06:00

..

access-the-windows-event-log.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

bypass-uac-via-icmluautil.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

bypass-uac-via-scheduled-task-environment-variable.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

check-for-unmoving-mouse-cursor.yml

Moved to nursery

2020-07-18 21:26:47 +01:00

connect-network-resource.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

create-shortcut-via-ishelllink.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

debug-build.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

decrypt-data-via-sspi.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

empty-the-recycle-bin.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

encode-data-using-base64-via-winapi.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

encrypt-data-using-salsa20-or-chacha.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

encrypt-data-via-sspi.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

enumerate-browser-history.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

enumerate-disk-volumes.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

enumerate-graphical-windows.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

enumerate-processes-via-ntquerysysteminformation.yml

Create enumerate-processes-via-ntquerysysteminformation.yml

2020-07-17 16:34:07 -04:00

enumerate-threads.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

get-client-handle-via-schannel.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

get-comspec-environment-variable.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

get-file-size.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

get-file-version-info.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

get-inbound-credentials-handle-via-credssp.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

get-installed-programs.yml

Change characteristic syntax in rules

2020-07-01 19:19:49 +02:00

get-networking-parameters.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

get-outbound-credentials-handle-via-credssp.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

get-proxy.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

get-remote-cert-context-via-schannel.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

get-routing-table.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

get-service-handle.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

get-session-information.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

get-startup-folder.yml

fix ATT&CK categories

2020-07-03 09:14:14 -06:00

get-token-membership.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

hash-data-using-crc32b.yml

Change characteristic syntax in rules

2020-07-01 19:19:49 +02:00

hash-data-using-md4.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

hash-data-using-murmur2.yml

add murmur hash constants

2020-07-09 16:05:46 -06:00

hash-data-using-murmur3.yml

add murmur hash constants

2020-07-09 16:05:46 -06:00

hash-data-using-sha1-via-wincrypt.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

hash-data-with-md5.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

initialize-hashing-via-wincrypt.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

inject-apc.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

linked-against-c-regex-library.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

make-an-http-request-with-a-cookie.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

mine-cryptocurrency.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

move-file.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

packaged-as-a-nsis-installer.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

packaged-as-a-wise-installer.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

packaged-as-an-installshield-installer.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

read-and-send-data-from-client-to-server.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

read-file-via-mapping.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

read-process-memory.yml

Update read-process-memory

2020-07-17 14:58:38 -04:00

read-raw-disk-data.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

receive-and-write-data-from-server-to-client.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

reference-aes-constants.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

reference-screen-saver-executable.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

reference-startup-folder.yml

fix ATT&CK categories

2020-07-03 09:14:14 -06:00

reference-the-vmware-io-port.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

run-powershell-expression.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

search-for-credit-card-data.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

send-http-request-with-host-header.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

spawn-thread-to-rwx-shellcode.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00