From 0eddb61a9c19e17135af89922f8d993095081ae1 Mon Sep 17 00:00:00 2001 From: Moritz Raabe Date: Fri, 29 Jan 2021 13:23:43 +0100 Subject: [PATCH] rule updates --- .../encryption/camellia/encrypt-data-using-camellia.yml | 2 +- .../encryption/hc-128/encrypt-data-using-hc-128.yml | 2 +- .../encryption/sosemanuk/encrypt-data-using-sosemanuk.yml | 2 +- host-interaction/thread/create/create-thread.yml | 1 + 4 files changed, 4 insertions(+), 3 deletions(-) diff --git a/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml b/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml index ddbb942f..d2c7e5e2 100644 --- a/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml +++ b/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml @@ -1,6 +1,6 @@ rule: meta: - name: encrypt-data-using-camellia + name: encrypt data using camellia namespace: data-manipulation/encryption/camellia author: '@_re_fox' scope: basic block diff --git a/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml b/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml index 6dd90432..82976953 100644 --- a/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml +++ b/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml @@ -1,6 +1,6 @@ rule: meta: - name: encrypt-data-using-hc-128 + name: encrypt data using hc 128 namespace: data-manipulation/encryption/hc-128 author: '@recvfrom' description: Looks for instruction mnemonics associated with initialization of the HC-128 stream cipher diff --git a/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml b/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml index 1f4cd567..6800a707 100644 --- a/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml +++ b/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml @@ -1,6 +1,6 @@ rule: meta: - name: encrypt-data-using-sosemanuk + name: encrypt data using sosemanuk namespace: data-manipulation/encryption/sosemanuk author: '@recvfrom' description: Looks for cryptographic constants associated with the Sosemanuk stream cipher diff --git a/host-interaction/thread/create/create-thread.yml b/host-interaction/thread/create/create-thread.yml index f1016b91..9966ab42 100644 --- a/host-interaction/thread/create/create-thread.yml +++ b/host-interaction/thread/create/create-thread.yml @@ -20,6 +20,7 @@ rule: - api: SHCreateThread - api: SHCreateThreadWithHandle - api: kernel32.CreateRemoteThread + - api: kernel32.CreateRemoteThreadEx - api: ntdll.RtlCreateUserThread - api: ntdll.NtCreateThread - api: ntdll.NtCreateThreadEx