Moritz 3e8792dcfd Adjusted rules for the ELF BEACON sample shared by Intezer (#654) ...

* Created rules for the ELF BEACON sample shared by Intezer
* removing rule that sometimes hits and sometimes doesn't

Co-authored-by: Alyssa Rahman <alyssa.rahman@mandiant.com>

2023-01-09 14:37:51 +01:00

..

allocate-memory.yml

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

allocate-rw-memory.yml

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

calculate-modulo-256-via-x86-assembly.yml

Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""

2022-06-28 15:23:20 -06:00

contain-loop.yml

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

contain-pusha-popa-sequence.yml

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

create-or-open-file.yml

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

create-or-open-registry-key.yml

improve rules that often match (#655)

2023-01-09 14:07:53 +01:00

delay-execution.yml

Adjusted rules for the ELF BEACON sample shared by Intezer (#654)

2023-01-09 14:37:51 +01:00

duplicate-stdin-and-stdout.yml

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

get-service-handle.yml

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

open-process.yml

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

open-thread.yml

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00

peb-access.yml

Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""

2022-06-28 15:23:20 -06:00

validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml

Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""

2022-06-28 15:23:20 -06:00

validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml

Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""

2022-06-28 15:23:20 -06:00

write-process-memory.yml

*: use meta.authors everywhere

2022-05-26 11:56:31 -06:00