Willi Ballenthin 5941a484b5 add section access/map rules (#681) ...

* add section access/map rules

closes #4

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

2023-02-02 09:11:46 +01:00

..

allocate-memory.yml

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

allocate-rw-memory.yml

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

calculate-modulo-256-via-x86-assembly.yml

Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""

2022-06-28 15:23:20 -06:00

contain-loop.yml

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

contain-pusha-popa-sequence.yml

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

create-or-open-file.yml

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

create-or-open-registry-key.yml

improve rules that often match (#655)

2023-01-09 14:07:53 +01:00

create-or-open-section-object.yml

add section access/map rules (#681)

2023-02-02 09:11:46 +01:00

delay-execution.yml

Adjusted rules for the ELF BEACON sample shared by Intezer (#654)

2023-01-09 14:37:51 +01:00

duplicate-stdin-and-stdout.yml

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

get-os-version.yml

add library rule and new api

2023-01-13 12:31:03 +01:00

get-service-handle.yml

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

open-process.yml

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

open-thread.yml

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

peb-access.yml

Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""

2022-06-28 15:23:20 -06:00

validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml

Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""

2022-06-28 15:23:20 -06:00

validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml

Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""

2022-06-28 15:23:20 -06:00

write-process-memory.yml

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00