Mike Hunhoff ff9db74425 update create-process-suspended to include DEBUG_ONLY_THIS_PROCESS (#978)

2025-01-07 13:02:37 -07:00

..

bootloader

fix call/thread scopes manually

2023-11-24 11:35:00 +01:00

cli

fix call/thread scopes manually

2023-11-24 11:35:00 +01:00

clipboard

fix scopes for rules with subscopes 2

2023-11-24 11:35:03 +01:00

console

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

driver

add rule for driver major function ID (#939)

2024-09-30 14:05:20 +02:00

environment-variable

fix call/thread scopes manually

2023-11-24 11:35:00 +01:00

file-system

change scope to call for atomic operations

2024-10-31 13:30:21 +01:00

filter

fix call/thread scopes manually

2023-11-24 11:35:00 +01:00

firewall/modify

Add access-firewall-policy-via-inetfwpolicy2.yml and access-firewall-rule-properties-via-inetfwrule.yml

2024-09-24 15:50:55 +08:00

gui

Merge pull request #908 from mandiant/fix/dependency-scopes

2024-06-14 11:01:35 +02:00

hardware

Move from nursery and update get-system-firmware-table.yml

2024-09-05 18:35:46 +02:00

log

update linux/android rules and reduce fps for intel-specific rules (#927)

2024-08-16 12:57:08 -06:00

memory

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

mutex

add android OS where applicable

2024-04-23 13:49:05 +02:00

network

Add delete-network-filter-via-wfp-api.yml and enumerate-network-filters-via-wfp-api.yml (#930)

2024-09-16 14:43:28 +02:00

os

Add rule for detecting hiding shutdown actions (#935)

2024-09-26 14:25:02 +02:00

process

update create-process-suspended to include DEBUG_ONLY_THIS_PROCESS (#978)

2025-01-07 13:02:37 -07:00

recycle-bin

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

registry

change scope to call for atomic operations

2024-10-31 13:30:21 +01:00

service

fix some dynamic unsupported rules

2023-11-24 11:35:05 +01:00

session

add android OS where applicable

2024-04-23 13:49:05 +02:00

software

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

thread

add android OS where applicable

2024-04-23 13:49:05 +02:00

uac/bypass

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

wmi

move WMI persistence rule to WMI usage detection rule

2024-11-22 16:12:11 +01:00