sara-rn 4f27bfe758 Ghostly Hollowing process injection rule (#865) ...

* ghostly hollowing process injection rule

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

2024-01-23 10:55:34 +01:00

..

allocate-or-change-rwx-memory.yml

fix scopes for rules with subscopes 2

2023-11-24 11:35:03 +01:00

allocate-user-process-rwx-memory.yml

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

attach-user-process-memory.yml

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

free-user-process-memory.yml

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

hijack-thread-execution.yml

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

inject-apc.yml

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

inject-dll.yml

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

inject-pe.yml

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

inject-shellcode-using-a-file-mapping-object.yml

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

inject-shellcode-using-extra-window-memory.yml

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

inject-shellcode-using-window-subclass-procedure.yml

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

inject-thread.yml

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

process-ghostly-hollowing.yml

Ghostly Hollowing process injection rule (#865)

2024-01-23 10:55:34 +01:00

use-process-doppelgänging.yml

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

use-process-replacement.yml

upgrade rules using updated script

2023-11-24 11:34:28 +01:00