Mike Hunhoff dda76eadde new/update rules using .NET ctor method (#626)

2022-10-13 08:36:31 -06:00

..

bootloader

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

cli

Update with dotnet capabilities (#590)

2022-07-07 15:22:39 -06:00

clipboard

Add new dotnet rules that capture capabilites typically found in backdoors. (#579)

2022-07-07 13:39:51 -06:00

console

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

driver

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

environment-variable

new/update .NET rules (#625)

2022-10-07 09:39:57 -06:00

file-system

new/update .NET rules (#625)

2022-10-07 09:39:57 -06:00

filter

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

firewall/modify

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

gui

Add dotnet rules having property features (#601)

2022-10-03 09:28:05 -06:00

hardware

Add dotnet rules having property features (#601)

2022-10-03 09:28:05 -06:00

log

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

mutex

new/update rules using .NET ctor method (#626)

2022-10-13 08:36:31 -06:00

network

Add dotnet rules having property features (#601)

2022-10-03 09:28:05 -06:00

os

Add dotnet rules having property features (#601)

2022-10-03 09:28:05 -06:00

process

new/update .NET rules (#625)

2022-10-07 09:39:57 -06:00

recycle-bin

Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""

2022-06-28 15:23:20 -06:00

registry

new/update .NET rules (#625)

2022-10-07 09:39:57 -06:00

service

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

session

Add dotnet rules having property features (#601)

2022-10-03 09:28:05 -06:00

software

Update get-installed-programs.yml (#584)

2022-07-05 09:52:52 +02:00

thread

new/update rules using .NET ctor method (#626)

2022-10-13 08:36:31 -06:00

uac/bypass

Improve UAC bypass rule based on sample in the wild (#616)

2022-09-09 13:20:41 +02:00

wmi

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00