admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
d33bc13fbaa9b99081300a0e3b2fee2dc13072bc
mandiant-capa-rules/nursery
T
History
William Ballenthin 0b04c942b3 graduate import public key
2020-07-28 15:07:48 -06:00
..
access-the-windows-event-log.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
acquire-debug-privileges.yml
acquire debug privs: add optional match for modify access privs
2020-07-28 10:23:24 -06:00
bypass-uac-via-icmluautil.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
bypass-uac-via-scheduled-task-environment-variable.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
connect-network-resource.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
create-shortcut-via-ishelllink.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
debug-build.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
decrypt-data-via-sspi.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
empty-the-recycle-bin.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
encode-data-using-base64-via-winapi.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
encrypt-data-using-salsa20-or-chacha.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
encrypt-data-via-sspi.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
enumerate-browser-history.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
enumerate-disk-volumes.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
enumerate-graphical-windows.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
enumerate-threads.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
get-client-handle-via-schannel.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
get-comspec-environment-variable.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
get-file-size.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
get-file-version-info.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
get-inbound-credentials-handle-via-credssp.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
get-installed-programs.yml
Change characteristic syntax in rules
2020-07-01 19:19:49 +02:00
get-mac-address.yml
fix rules as documented in #49
2020-07-24 15:49:52 -06:00
get-networking-parameters.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
get-outbound-credentials-handle-via-credssp.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
get-proxy.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
get-remote-cert-context-via-schannel.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
get-routing-table.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
get-service-handle.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
get-session-information.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
get-token-membership.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
hash-data-using-crc32b.yml
Change characteristic syntax in rules
2020-07-01 19:19:49 +02:00
hash-data-using-md4.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
hash-data-using-murmur2.yml
add murmur hash constants
2020-07-09 16:05:46 -06:00
hash-data-using-sha1-via-wincrypt.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
hash-data-with-md5.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
initialize-hashing-via-wincrypt.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
inject-apc.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
linked-against-c-regex-library.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
make-an-http-request-with-a-cookie.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
mine-cryptocurrency.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
move-file.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
packaged-as-a-nsis-installer.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
packaged-as-a-wise-installer.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
packaged-as-an-installshield-installer.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
read-and-send-data-from-client-to-server.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
read-file-via-mapping.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
read-process-memory.yml
read-process-memory: fix handle
2020-07-22 12:53:42 -06:00
read-raw-disk-data.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
receive-and-write-data-from-server-to-client.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
reference-aes-constants.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
reference-processor-manufacturer-constants.yml
Move 'reference processor manufacturer constants' to nursery
2020-07-27 15:15:16 +02:00
reference-screen-saver-executable.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
reference-startup-folder.yml
fix ATT&CK categories
2020-07-03 09:14:14 -06:00
reference-the-vmware-io-port.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
run-powershell-expression.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
search-for-credit-card-data.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
send-http-request-with-host-header.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
set-global-application-hook.yml
fix rules as documented in #49
2020-07-24 15:49:52 -06:00
spawn-thread-to-rwx-shellcode.yml
rules: address comments in #14
2020-06-26 17:45:56 -06:00
terminate-process-by-name.yml
add a couple new rules derived from Cl0p ransomware
2020-07-27 15:48:11 -06:00