diff --git a/README.md b/README.md index a0798269..5cfb6817 100644 --- a/README.md +++ b/README.md @@ -27,7 +27,8 @@ rule: meta: name: hash data with CRC32 namespace: data-manipulation/checksum/crc32 - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function examples: - 2D3EDC218A90F03089CC01715A9F047F:0x403CBD diff --git a/anti-analysis/anti-av/block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml b/anti-analysis/anti-av/block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml index 75a0f47c..0ff303f8 100644 --- a/anti-analysis/anti-av/block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml +++ b/anti-analysis/anti-av/block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml @@ -2,7 +2,8 @@ rule: meta: name: block operations on executable memory pages using Arbitrary Code Guard namespace: anti-analysis/anti-av - author: jakub.jozwiak@mandiant.com + authors: + - jakub.jozwiak@mandiant.com scope: basic block att&ck: - Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001] diff --git a/anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml b/anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml index 78fa5743..9c7ffc69 100644 --- a/anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml +++ b/anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml @@ -2,7 +2,8 @@ rule: meta: name: check for sandbox and av modules namespace: anti-analysis/anti-av - author: "@_re_fox" + authors: + - "@_re_fox" scope: basic block mbc: - Anti-Behavioral Analysis::Virtual Machine Detection [B0009] diff --git a/anti-analysis/anti-av/protect-spawned-processes-with-mitigation-policies.yml b/anti-analysis/anti-av/protect-spawned-processes-with-mitigation-policies.yml index 1d4d0cc6..e96604b2 100644 --- a/anti-analysis/anti-av/protect-spawned-processes-with-mitigation-policies.yml +++ b/anti-analysis/anti-av/protect-spawned-processes-with-mitigation-policies.yml @@ -2,7 +2,8 @@ rule: meta: name: protect spawned processes with mitigation policies namespace: anti-analysis/anti-av - author: jakub.jozwiak@mandiant.com + authors: + - jakub.jozwiak@mandiant.com scope: basic block att&ck: - Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001] diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml index 6ef949ea..217d5c1e 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml @@ -2,7 +2,8 @@ rule: meta: name: check for debugger via API namespace: anti-analysis/anti-debugging/debugger-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Anti-Behavioral Analysis::Debugger Detection::CheckRemoteDebuggerPresent [B0001.002] diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml index 0ca2668a..a053a173 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml @@ -2,7 +2,8 @@ rule: meta: name: check for hardware breakpoints namespace: anti-analysis/anti-debugging/debugger-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Anti-Behavioral Analysis::Debugger Detection::Hardware Breakpoints [B0001.005] diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml index 583c5f61..275d23cc 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml @@ -2,7 +2,8 @@ rule: meta: name: check for kernel debugger via shared user data structure namespace: anti-analysis/anti-debugging/debugger-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Anti-Behavioral Analysis::Debugger Detection [B0001] diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-outputdebugstring-error.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-outputdebugstring-error.yml index 589afa2c..1fd5dc6b 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-outputdebugstring-error.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-outputdebugstring-error.yml @@ -2,7 +2,8 @@ rule: meta: name: check for OutputDebugString error namespace: anti-analysis/anti-debugging/debugger-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block mbc: - Anti-Behavioral Analysis::Debugger Detection::OutputDebugString [B0001.016] diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml index 7fb2aa8d..ce30cc8c 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml @@ -2,7 +2,8 @@ rule: meta: name: check for PEB BeingDebugged flag namespace: anti-analysis/anti-debugging/debugger-detection - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: basic block mbc: - Anti-Behavioral Analysis::Debugger Detection::Process Environment Block BeingDebugged [B0001.035] diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml index 400c9f5b..cb373899 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml @@ -2,7 +2,8 @@ rule: meta: name: check for PEB NtGlobalFlag flag namespace: anti-analysis/anti-debugging/debugger-detection - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - Anti-Behavioral Analysis::Debugger Detection::Process Environment Block NtGlobalFlag [B0001.036] diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-protected-handle-exception.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-protected-handle-exception.yml index 1c83c4bd..18bc29b2 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-protected-handle-exception.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-protected-handle-exception.yml @@ -2,7 +2,8 @@ rule: meta: name: check for protected handle exception namespace: anti-analysis/anti-debugging/debugger-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Anti-Behavioral Analysis::Debugger Detection::SetHandleInformation [B0001.024] diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml index f3295602..3b69f3f6 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml @@ -2,7 +2,8 @@ rule: meta: name: check for software breakpoints namespace: anti-analysis/anti-debugging/debugger-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Anti-Behavioral Analysis::Debugger Detection::Software Breakpoints [B0001.025] diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml index e0894416..ea7651c5 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml @@ -2,7 +2,8 @@ rule: meta: name: check for time delay via GetTickCount namespace: anti-analysis/anti-debugging/debugger-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCount [B0001.032] diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml index 9116db66..fe952047 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml @@ -2,7 +2,8 @@ rule: meta: name: check for time delay via QueryPerformanceCounter namespace: anti-analysis/anti-debugging/debugger-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check QueryPerformanceCounter [B0001.033] diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml index e2e14a71..77068fe1 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml @@ -2,7 +2,8 @@ rule: meta: name: check for trap flag exception namespace: anti-analysis/anti-debugging/debugger-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block mbc: - Anti-Behavioral Analysis::Debugger Detection [B0001] diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-unexpected-memory-writes.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-unexpected-memory-writes.yml index 694025c2..e2bb60d8 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-for-unexpected-memory-writes.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-for-unexpected-memory-writes.yml @@ -2,7 +2,8 @@ rule: meta: name: check for unexpected memory writes namespace: anti-analysis/anti-debugging/debugger-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block mbc: - Anti-Behavioral Analysis::Debugger Detection::Memory Write Watching [B0001.010] diff --git a/anti-analysis/anti-debugging/debugger-detection/check-process-job-object.yml b/anti-analysis/anti-debugging/debugger-detection/check-process-job-object.yml index 32d86e71..7f143959 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-process-job-object.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-process-job-object.yml @@ -2,7 +2,8 @@ rule: meta: name: check process job object namespace: anti-analysis/anti-debugging/debugger-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Anti-Behavioral Analysis::Debugger Detection [B0001] diff --git a/anti-analysis/anti-debugging/debugger-detection/check-processdebugport.yml b/anti-analysis/anti-debugging/debugger-detection/check-processdebugport.yml index e2dfa580..fc1cbc38 100644 --- a/anti-analysis/anti-debugging/debugger-detection/check-processdebugport.yml +++ b/anti-analysis/anti-debugging/debugger-detection/check-processdebugport.yml @@ -2,7 +2,8 @@ rule: meta: name: check ProcessDebugPort namespace: anti-analysis/anti-debugging/debugger-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block mbc: - Anti-Behavioral Analysis::Debugger Detection::NtQueryInformationProcess [B0001.012] diff --git a/anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml b/anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml index 4013c6b7..857fedb5 100644 --- a/anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml +++ b/anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml @@ -2,7 +2,8 @@ rule: meta: name: execute anti-debugging instructions namespace: anti-analysis/anti-debugging/debugger-detection - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - Anti-Behavioral Analysis::Debugger Detection::Anti-debugging Instructions [B0001.034] diff --git a/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml b/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml index 08d9ee5e..cb00e9e1 100644 --- a/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml +++ b/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml @@ -2,7 +2,8 @@ rule: meta: name: 64-bit execution via heavens gate namespace: anti-analysis/anti-disasm - author: awillia2@cisco.com + authors: + - awillia2@cisco.com description: Looks for instructions related to executing 64-bit code from a 32-bit process (Heaven's Gate) scope: function mbc: diff --git a/anti-analysis/anti-disasm/contain-anti-disasm-techniques.yml b/anti-analysis/anti-disasm/contain-anti-disasm-techniques.yml index 8b3d18b7..e22ec11a 100644 --- a/anti-analysis/anti-disasm/contain-anti-disasm-techniques.yml +++ b/anti-analysis/anti-disasm/contain-anti-disasm-techniques.yml @@ -2,7 +2,8 @@ rule: meta: name: contain anti-disasm techniques namespace: anti-analysis/anti-disasm - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: file mbc: - Anti-Static Analysis::Disassembler Evasion [B0012] diff --git a/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml b/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml index 45a70f3e..7e3933f0 100644 --- a/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml +++ b/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml @@ -2,7 +2,8 @@ rule: meta: name: check if process is running under wine namespace: anti-analysis/anti-emulation/wine - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] diff --git a/anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs.yml b/anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs.yml index c23bcec4..d796d67a 100644 --- a/anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs.yml +++ b/anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs.yml @@ -2,7 +2,8 @@ rule: meta: name: clear Windows event logs namespace: anti-analysis/anti-forensic/clear-logs - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Defense Evasion::Indicator Removal on Host::Clear Windows Event Logs [T1070.001] diff --git a/anti-analysis/anti-forensic/crash-the-windows-event-logging-service.yml b/anti-analysis/anti-forensic/crash-the-windows-event-logging-service.yml index d7955fc1..41f4e9fb 100644 --- a/anti-analysis/anti-forensic/crash-the-windows-event-logging-service.yml +++ b/anti-analysis/anti-forensic/crash-the-windows-event-logging-service.yml @@ -2,7 +2,8 @@ rule: meta: name: crash the Windows event logging service namespace: anti-analysis/anti-forensic - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Defense Evasion::Impair Defenses::Disable Windows Event Logging [T1562.002] diff --git a/anti-analysis/anti-forensic/impersonate-file-version-information.yml b/anti-analysis/anti-forensic/impersonate-file-version-information.yml index 066a723e..adc82475 100644 --- a/anti-analysis/anti-forensic/impersonate-file-version-information.yml +++ b/anti-analysis/anti-forensic/impersonate-file-version-information.yml @@ -2,7 +2,8 @@ rule: meta: name: impersonate file version information namespace: anti-analysis/anti-forensic - author: awillia2@cisco.com + authors: + - awillia2@cisco.com description: Looks for Windows API calls associated with reading and then writing file version information of executables on disk. Malware can use these calls to overwrite its own version information with that of a legitimate executable on the system (for instance, explorer.exe) to make it appear to be a legitimate application. scope: function att&ck: diff --git a/anti-analysis/anti-forensic/patch-process-command-line.yml b/anti-analysis/anti-forensic/patch-process-command-line.yml index 599dd261..c9cef10f 100644 --- a/anti-analysis/anti-forensic/patch-process-command-line.yml +++ b/anti-analysis/anti-forensic/patch-process-command-line.yml @@ -2,7 +2,7 @@ rule: meta: name: patch process command line namespace: anti-analysis/anti-forensic - author: + authors: - william.ballenthin@mandiant.com - "@_re_fox" scope: function diff --git a/anti-analysis/anti-forensic/self-deletion/self-delete.yml b/anti-analysis/anti-forensic/self-deletion/self-delete.yml index 9b897fbf..9f330994 100644 --- a/anti-analysis/anti-forensic/self-deletion/self-delete.yml +++ b/anti-analysis/anti-forensic/self-deletion/self-delete.yml @@ -2,7 +2,8 @@ rule: meta: name: self delete namespace: anti-analysis/anti-forensic/self-deletion - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Defense Evasion::Indicator Removal on Host::File Deletion [T1070.004] diff --git a/anti-analysis/anti-forensic/spoof-parent-pid.yml b/anti-analysis/anti-forensic/spoof-parent-pid.yml index 156d1528..81e4cac3 100644 --- a/anti-analysis/anti-forensic/spoof-parent-pid.yml +++ b/anti-analysis/anti-forensic/spoof-parent-pid.yml @@ -3,7 +3,8 @@ rule: meta: name: spoof parent PID namespace: anti-analysis/anti-forensic - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Defense Evasion::Access Token Manipulation::Parent PID Spoofing [T1134.004] diff --git a/anti-analysis/anti-forensic/timestomp/timestomp-file.yml b/anti-analysis/anti-forensic/timestomp/timestomp-file.yml index 47a7947f..2c78882d 100644 --- a/anti-analysis/anti-forensic/timestomp/timestomp-file.yml +++ b/anti-analysis/anti-forensic/timestomp/timestomp-file.yml @@ -2,7 +2,8 @@ rule: meta: name: timestomp file namespace: anti-analysis/anti-forensic/timestomp - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Defense Evasion::Indicator Removal on Host::Timestomp [T1070.006] diff --git a/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml b/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml index c2b69506..62814398 100644 --- a/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml +++ b/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml @@ -2,7 +2,8 @@ rule: meta: name: check for microsoft office emulation namespace: anti-analysis/anti-vm/vm-detection - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] diff --git a/anti-analysis/anti-vm/vm-detection/check-for-sandbox-username.yml b/anti-analysis/anti-vm/vm-detection/check-for-sandbox-username.yml index 4743e082..b76262d5 100644 --- a/anti-analysis/anti-vm/vm-detection/check-for-sandbox-username.yml +++ b/anti-analysis/anti-vm/vm-detection/check-for-sandbox-username.yml @@ -2,7 +2,8 @@ rule: meta: name: check for sandbox username namespace: anti-analysis/anti-vm/vm-detection - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Defense Evasion::Virtualization/Sandbox Evasion [T1497] diff --git a/anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml b/anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml index d7df5554..1fe94837 100644 --- a/anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml +++ b/anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml @@ -2,7 +2,8 @@ rule: meta: name: check for unmoving mouse cursor namespace: anti-analysis/anti-vm/vm-detection - author: BitsOfBinary + authors: + - BitsOfBinary scope: function att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks [T1497.002] diff --git a/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml b/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml index 789c5df5..ff7f5834 100644 --- a/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml +++ b/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml @@ -2,7 +2,8 @@ rule: meta: name: check for windows sandbox via device namespace: anti-analysis/anti-vm/vm-detection - author: "@_re_fox" + authors: + - "@_re_fox" scope: basic block att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] diff --git a/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml b/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml index 0aee5cfa..26fd2d9c 100644 --- a/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml +++ b/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml @@ -2,7 +2,8 @@ rule: meta: name: check for windows sandbox via dns suffix namespace: anti-analysis/anti-vm/vm-detection - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] diff --git a/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-genuine-state.yml b/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-genuine-state.yml index 143738ec..05d0fce4 100644 --- a/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-genuine-state.yml +++ b/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-genuine-state.yml @@ -2,7 +2,8 @@ rule: meta: name: check for windows sandbox via genuine state namespace: anti-analysis/anti-vm/vm-detection - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] diff --git a/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-process-name.yml b/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-process-name.yml index 68f354b9..cd620d03 100644 --- a/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-process-name.yml +++ b/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-process-name.yml @@ -2,7 +2,8 @@ rule: meta: name: check for windows sandbox via process name namespace: anti-analysis/anti-vm/vm-detection - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] diff --git a/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-registry.yml b/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-registry.yml index f97724e7..0868f9b1 100644 --- a/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-registry.yml +++ b/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-registry.yml @@ -2,7 +2,8 @@ rule: meta: name: check for windows sandbox via registry namespace: anti-analysis/anti-vm/vm-detection - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] diff --git a/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-parallels.yml b/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-parallels.yml index 82c9629d..33cd55c2 100644 --- a/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-parallels.yml +++ b/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-parallels.yml @@ -2,7 +2,8 @@ rule: meta: name: reference anti-VM strings targeting Parallels namespace: anti-analysis/anti-vm/vm-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: file att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] diff --git a/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-qemu.yml b/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-qemu.yml index 3a0d083b..20ef5927 100644 --- a/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-qemu.yml +++ b/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-qemu.yml @@ -2,7 +2,8 @@ rule: meta: name: reference anti-VM strings targeting Qemu namespace: anti-analysis/anti-vm/vm-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: file att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] diff --git a/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualbox.yml b/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualbox.yml index f11fd670..208f7fe5 100644 --- a/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualbox.yml +++ b/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualbox.yml @@ -2,7 +2,8 @@ rule: meta: name: reference anti-VM strings targeting VirtualBox namespace: anti-analysis/anti-vm/vm-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: file att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] diff --git a/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualpc.yml b/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualpc.yml index 306325eb..d5dfab88 100644 --- a/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualpc.yml +++ b/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualpc.yml @@ -2,7 +2,8 @@ rule: meta: name: reference anti-VM strings targeting VirtualPC namespace: anti-analysis/anti-vm/vm-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: file att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] diff --git a/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-vmware.yml b/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-vmware.yml index 70e9e006..71b42490 100644 --- a/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-vmware.yml +++ b/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-vmware.yml @@ -2,7 +2,7 @@ rule: meta: name: reference anti-VM strings targeting VMWare namespace: anti-analysis/anti-vm/vm-detection - author: + authors: - michael.hunhoff@mandiant.com - "@johnk3r" scope: file diff --git a/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-xen.yml b/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-xen.yml index d185c49a..04c9e58c 100644 --- a/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-xen.yml +++ b/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-xen.yml @@ -2,7 +2,8 @@ rule: meta: name: reference anti-VM strings targeting Xen namespace: anti-analysis/anti-vm/vm-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: file att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] diff --git a/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings.yml b/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings.yml index 4aea6884..b68d3f4b 100644 --- a/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings.yml +++ b/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings.yml @@ -2,7 +2,8 @@ rule: meta: name: reference anti-VM strings namespace: anti-analysis/anti-vm/vm-detection - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: file att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] diff --git a/anti-analysis/obfuscation/obfuscated-with-advobfuscator.yml b/anti-analysis/obfuscation/obfuscated-with-advobfuscator.yml index fd470123..547b7354 100644 --- a/anti-analysis/obfuscation/obfuscated-with-advobfuscator.yml +++ b/anti-analysis/obfuscation/obfuscated-with-advobfuscator.yml @@ -2,7 +2,8 @@ rule: meta: name: obfuscated with ADVobfuscator namespace: anti-analysis/obfuscation - author: jakub.jozwiak@mandiant.com + authors: + - jakub.jozwiak@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/anti-analysis/obfuscation/obfuscated-with-callobfuscator.yml b/anti-analysis/obfuscation/obfuscated-with-callobfuscator.yml index f920760a..f8f488f5 100644 --- a/anti-analysis/obfuscation/obfuscated-with-callobfuscator.yml +++ b/anti-analysis/obfuscation/obfuscated-with-callobfuscator.yml @@ -2,7 +2,8 @@ rule: meta: name: obfuscated with callobfuscator namespace: anti-analysis/obfuscation - author: johnk3r + authors: + - johnk3r scope: file att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml b/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml index 8ebba246..1e3a15b6 100644 --- a/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml +++ b/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml @@ -2,7 +2,8 @@ rule: meta: name: contain obfuscated stackstrings namespace: anti-analysis/obfuscation/string/stackstring - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: basic block att&ck: - Defense Evasion::Obfuscated Files or Information::Indicator Removal from Tools [T1027.005] diff --git a/anti-analysis/packer/amber/packed-with-amber.yml b/anti-analysis/packer/amber/packed-with-amber.yml index 685b8442..946dc2d7 100644 --- a/anti-analysis/packer/amber/packed-with-amber.yml +++ b/anti-analysis/packer/amber/packed-with-amber.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with amber namespace: anti-analysis/packer/amber - author: "john.gorman@mandiant.com" + authors: + - "john.gorman@mandiant.com" scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/anti-analysis/packer/aspack/packed-with-aspack.yml b/anti-analysis/packer/aspack/packed-with-aspack.yml index 5127df23..8b2bb84a 100644 --- a/anti-analysis/packer/aspack/packed-with-aspack.yml +++ b/anti-analysis/packer/aspack/packed-with-aspack.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with ASPack namespace: anti-analysis/packer/aspack - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/anti-analysis/packer/confuser/packed-with-confuser.yml b/anti-analysis/packer/confuser/packed-with-confuser.yml index 9f75be92..0dcbde77 100644 --- a/anti-analysis/packer/confuser/packed-with-confuser.yml +++ b/anti-analysis/packer/confuser/packed-with-confuser.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with Confuser namespace: anti-analysis/packer/confuser - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/anti-analysis/packer/generic/packed-with-generic-packer.yml b/anti-analysis/packer/generic/packed-with-generic-packer.yml index f679ab52..1a9258d7 100644 --- a/anti-analysis/packer/generic/packed-with-generic-packer.yml +++ b/anti-analysis/packer/generic/packed-with-generic-packer.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with generic packer namespace: anti-analysis/packer/generic - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/anti-analysis/packer/gopacker/packed-with-gopacker.yml b/anti-analysis/packer/gopacker/packed-with-gopacker.yml index c145329d..47bc95c6 100644 --- a/anti-analysis/packer/gopacker/packed-with-gopacker.yml +++ b/anti-analysis/packer/gopacker/packed-with-gopacker.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with GoPacker namespace: anti-analysis/packer/gopacker - author: jared.wilson@mandiant.com + authors: + - jared.wilson@mandiant.com description: The sample appears to be packed with GoPacker. scope: file att&ck: diff --git a/anti-analysis/packer/kkrunchy/packed-with-kkrunchy.yml b/anti-analysis/packer/kkrunchy/packed-with-kkrunchy.yml index a2036b3d..eabe63b7 100644 --- a/anti-analysis/packer/kkrunchy/packed-with-kkrunchy.yml +++ b/anti-analysis/packer/kkrunchy/packed-with-kkrunchy.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with kkrunchy namespace: anti-analysis/packer/kkrunchy - author: "@_re_fox" + authors: + - "@_re_fox" scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/anti-analysis/packer/nspack/packed-with-nspack.yml b/anti-analysis/packer/nspack/packed-with-nspack.yml index 575012f6..c6070a7a 100644 --- a/anti-analysis/packer/nspack/packed-with-nspack.yml +++ b/anti-analysis/packer/nspack/packed-with-nspack.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with nspack namespace: anti-analysis/packer/nspack - author: "@_re_fox" + authors: + - "@_re_fox" scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/anti-analysis/packer/pebundle/packed-with-pebundle.yml b/anti-analysis/packer/pebundle/packed-with-pebundle.yml index 1fdad30e..9da8d71a 100644 --- a/anti-analysis/packer/pebundle/packed-with-pebundle.yml +++ b/anti-analysis/packer/pebundle/packed-with-pebundle.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with pebundle namespace: anti-analysis/packer/pebundle - author: "@_re_fox" + authors: + - "@_re_fox" scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/anti-analysis/packer/pecompact/packed-with-pecompact.yml b/anti-analysis/packer/pecompact/packed-with-pecompact.yml index 683bb8e1..0aff3944 100644 --- a/anti-analysis/packer/pecompact/packed-with-pecompact.yml +++ b/anti-analysis/packer/pecompact/packed-with-pecompact.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with PECompact namespace: anti-analysis/packer/pecompact - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/anti-analysis/packer/pelocknt/packed-with-pelocknt.yml b/anti-analysis/packer/pelocknt/packed-with-pelocknt.yml index de79d571..9a037748 100644 --- a/anti-analysis/packer/pelocknt/packed-with-pelocknt.yml +++ b/anti-analysis/packer/pelocknt/packed-with-pelocknt.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with pelocknt namespace: anti-analysis/packer/pelocknt - author: "@_re_fox" + authors: + - "@_re_fox" scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/anti-analysis/packer/peshield/packed-with-peshield.yml b/anti-analysis/packer/peshield/packed-with-peshield.yml index c27b0d81..2a8ee5de 100644 --- a/anti-analysis/packer/peshield/packed-with-peshield.yml +++ b/anti-analysis/packer/peshield/packed-with-peshield.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with peshield namespace: anti-analysis/packer/peshield - author: "@_re_fox" + authors: + - "@_re_fox" scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/anti-analysis/packer/pespin/packed-with-pespin.yml b/anti-analysis/packer/pespin/packed-with-pespin.yml index 546c3f9f..9377a151 100644 --- a/anti-analysis/packer/pespin/packed-with-pespin.yml +++ b/anti-analysis/packer/pespin/packed-with-pespin.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with PESpin namespace: anti-analysis/packer/pespin - author: jakub.jozwiak@mandiant.com + authors: + - jakub.jozwiak@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/anti-analysis/packer/petite/packed-with-petite.yml b/anti-analysis/packer/petite/packed-with-petite.yml index ba3cacb7..82df3cc2 100644 --- a/anti-analysis/packer/petite/packed-with-petite.yml +++ b/anti-analysis/packer/petite/packed-with-petite.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with petite namespace: anti-analysis/packer/petite - author: "@_re_fox" + authors: + - "@_re_fox" scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/anti-analysis/packer/rlpack/packed-with-rlpack.yml b/anti-analysis/packer/rlpack/packed-with-rlpack.yml index a7500efe..b6cae30c 100644 --- a/anti-analysis/packer/rlpack/packed-with-rlpack.yml +++ b/anti-analysis/packer/rlpack/packed-with-rlpack.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with rlpack namespace: anti-analysis/packer/rlpack - author: "@_re_fox" + authors: + - "@_re_fox" scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/anti-analysis/packer/themida/packed-with-themida.yml b/anti-analysis/packer/themida/packed-with-themida.yml index 004aa589..5fb4e77d 100644 --- a/anti-analysis/packer/themida/packed-with-themida.yml +++ b/anti-analysis/packer/themida/packed-with-themida.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with Themida namespace: anti-analysis/packer/themida - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/anti-analysis/packer/upack/packed-with-upack.yml b/anti-analysis/packer/upack/packed-with-upack.yml index a2d938b3..e31c984b 100644 --- a/anti-analysis/packer/upack/packed-with-upack.yml +++ b/anti-analysis/packer/upack/packed-with-upack.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with upack namespace: anti-analysis/packer/upack - author: "@_re_fox" + authors: + - "@_re_fox" scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/anti-analysis/packer/upx/packed-with-upx.yml b/anti-analysis/packer/upx/packed-with-upx.yml index a54936f6..ee87c947 100644 --- a/anti-analysis/packer/upx/packed-with-upx.yml +++ b/anti-analysis/packer/upx/packed-with-upx.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with UPX namespace: anti-analysis/packer/upx - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/anti-analysis/packer/vmprotect/packed-with-vmprotect.yml b/anti-analysis/packer/vmprotect/packed-with-vmprotect.yml index c8385ebe..68ffb093 100644 --- a/anti-analysis/packer/vmprotect/packed-with-vmprotect.yml +++ b/anti-analysis/packer/vmprotect/packed-with-vmprotect.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with VMProtect namespace: anti-analysis/packer/vmprotect - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/anti-analysis/packer/y0da/packed-with-y0da-crypter.yml b/anti-analysis/packer/y0da/packed-with-y0da-crypter.yml index ea5c2f1c..af95dd95 100644 --- a/anti-analysis/packer/y0da/packed-with-y0da-crypter.yml +++ b/anti-analysis/packer/y0da/packed-with-y0da-crypter.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with y0da crypter namespace: anti-analysis/packer/y0da - author: "@_re_fox" + authors: + - "@_re_fox" scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/anti-analysis/reference-analysis-tools-strings.yml b/anti-analysis/reference-analysis-tools-strings.yml index b43f5620..87216576 100644 --- a/anti-analysis/reference-analysis-tools-strings.yml +++ b/anti-analysis/reference-analysis-tools-strings.yml @@ -2,7 +2,8 @@ rule: meta: name: reference analysis tools strings namespace: anti-analysis - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: file mbc: - Discovery::Analysis Tool Discovery::Process detection [B0013.001] diff --git a/c2/file-transfer/download-and-write-a-file.yml b/c2/file-transfer/download-and-write-a-file.yml index 91e5dda5..6c35a86e 100644 --- a/c2/file-transfer/download-and-write-a-file.yml +++ b/c2/file-transfer/download-and-write-a-file.yml @@ -3,7 +3,8 @@ rule: name: download and write a file namespace: c2/file-transfer maec/malware-category: downloader - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Command and Control::Ingress Tool Transfer [T1105] diff --git a/c2/file-transfer/write-and-execute-a-file.yml b/c2/file-transfer/write-and-execute-a-file.yml index 2b87de83..c9fd5167 100644 --- a/c2/file-transfer/write-and-execute-a-file.yml +++ b/c2/file-transfer/write-and-execute-a-file.yml @@ -3,7 +3,8 @@ rule: name: write and execute a file namespace: c2/file-transfer maec/malware-category: launcher - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - Execution::Install Additional Program [B0023] diff --git a/c2/shell/create-reverse-shell-on-linux.yml b/c2/shell/create-reverse-shell-on-linux.yml index 439923fa..5e1de9ca 100644 --- a/c2/shell/create-reverse-shell-on-linux.yml +++ b/c2/shell/create-reverse-shell-on-linux.yml @@ -2,7 +2,8 @@ rule: meta: name: create reverse shell on Linux namespace: c2/shell - author: joakim@intezer.com + authors: + - joakim@intezer.com scope: function att&ck: - Execution::Command and Scripting Interpreter::Unix Shell [T1059.004] diff --git a/c2/shell/create-reverse-shell.yml b/c2/shell/create-reverse-shell.yml index 8e566ba9..acc199a5 100644 --- a/c2/shell/create-reverse-shell.yml +++ b/c2/shell/create-reverse-shell.yml @@ -2,7 +2,8 @@ rule: meta: name: create reverse shell namespace: c2/shell - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Execution::Command and Scripting Interpreter::Windows Command Shell [T1059.003] diff --git a/c2/shell/execute-shell-command-and-capture-output.yml b/c2/shell/execute-shell-command-and-capture-output.yml index a7a48fba..80bf8066 100644 --- a/c2/shell/execute-shell-command-and-capture-output.yml +++ b/c2/shell/execute-shell-command-and-capture-output.yml @@ -2,7 +2,8 @@ rule: meta: name: execute shell command and capture output namespace: c2/shell - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: function att&ck: - Execution::Command and Scripting Interpreter::Windows Command Shell [T1059.003] diff --git a/c2/shell/execute-shell-command-received-from-socket-on-linux.yml b/c2/shell/execute-shell-command-received-from-socket-on-linux.yml index ba1d8719..10119e5a 100644 --- a/c2/shell/execute-shell-command-received-from-socket-on-linux.yml +++ b/c2/shell/execute-shell-command-received-from-socket-on-linux.yml @@ -2,7 +2,8 @@ rule: meta: name: execute shell command received from socket on Linux namespace: c2/shell - author: joakim@intezer.com + authors: + - joakim@intezer.com scope: function att&ck: - Execution::Command and Scripting Interpreter::Unix Shell [T1059.004] diff --git a/collection/acquire-credentials-from-windows-credential-manager.yml b/collection/acquire-credentials-from-windows-credential-manager.yml index 17bdb084..73777b3b 100644 --- a/collection/acquire-credentials-from-windows-credential-manager.yml +++ b/collection/acquire-credentials-from-windows-credential-manager.yml @@ -3,7 +3,8 @@ rule: meta: name: acquire credentials from Windows Credential Manager namespace: collection - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Credential Access::Credentials from Password Stores::Windows Credential Manager [T1555.004] diff --git a/collection/browser/gather-firefox-profile-information.yml b/collection/browser/gather-firefox-profile-information.yml index 0a28d989..8b74721b 100644 --- a/collection/browser/gather-firefox-profile-information.yml +++ b/collection/browser/gather-firefox-profile-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather firefox profile information namespace: collection/browser - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores::Credentials from Web Browsers [T1555.003] diff --git a/collection/credit-card/parse-credit-card-information.yml b/collection/credit-card/parse-credit-card-information.yml index 45d69791..201f7960 100644 --- a/collection/credit-card/parse-credit-card-information.yml +++ b/collection/credit-card/parse-credit-card-information.yml @@ -2,7 +2,8 @@ rule: meta: name: parse credit card information namespace: collection/credit-card - author: "@_re_fox" + authors: + - "@_re_fox" scope: function mbc: - Data::Check String [C0019] diff --git a/collection/database/sql/reference-sql-statements.yml b/collection/database/sql/reference-sql-statements.yml index 45cb0f82..303f7e95 100644 --- a/collection/database/sql/reference-sql-statements.yml +++ b/collection/database/sql/reference-sql-statements.yml @@ -2,7 +2,8 @@ rule: meta: name: reference SQL statements namespace: collection/database/sql - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function att&ck: - Collection::Data from Information Repositories [T1213] diff --git a/collection/database/wmi/reference-wmi-statements.yml b/collection/database/wmi/reference-wmi-statements.yml index d6d01bbf..6db0b12a 100644 --- a/collection/database/wmi/reference-wmi-statements.yml +++ b/collection/database/wmi/reference-wmi-statements.yml @@ -2,7 +2,8 @@ rule: meta: name: reference WMI statements namespace: collection/database/wmi - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Collection::Data from Information Repositories [T1213] diff --git a/collection/file-managers/gather-3d-ftp-information.yml b/collection/file-managers/gather-3d-ftp-information.yml index 15666af4..1b263751 100644 --- a/collection/file-managers/gather-3d-ftp-information.yml +++ b/collection/file-managers/gather-3d-ftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather 3d-ftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-alftp-information.yml b/collection/file-managers/gather-alftp-information.yml index 20175f4d..0464e22b 100644 --- a/collection/file-managers/gather-alftp-information.yml +++ b/collection/file-managers/gather-alftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather alftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-bitkinex-information.yml b/collection/file-managers/gather-bitkinex-information.yml index 4f62dae7..f714b513 100644 --- a/collection/file-managers/gather-bitkinex-information.yml +++ b/collection/file-managers/gather-bitkinex-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather bitkinex information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-blazeftp-information.yml b/collection/file-managers/gather-blazeftp-information.yml index ca5f8378..900a14e0 100644 --- a/collection/file-managers/gather-blazeftp-information.yml +++ b/collection/file-managers/gather-blazeftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather blazeftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-bulletproof-ftp-information.yml b/collection/file-managers/gather-bulletproof-ftp-information.yml index 65e87d08..ddc4d2ac 100644 --- a/collection/file-managers/gather-bulletproof-ftp-information.yml +++ b/collection/file-managers/gather-bulletproof-ftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather bulletproof-ftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-classicftp-information.yml b/collection/file-managers/gather-classicftp-information.yml index d49c9638..bea23c3d 100644 --- a/collection/file-managers/gather-classicftp-information.yml +++ b/collection/file-managers/gather-classicftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather classicftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-coreftp-information.yml b/collection/file-managers/gather-coreftp-information.yml index 1851ca89..11882724 100644 --- a/collection/file-managers/gather-coreftp-information.yml +++ b/collection/file-managers/gather-coreftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather coreftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-cuteftp-information.yml b/collection/file-managers/gather-cuteftp-information.yml index 28610619..6bdb13fc 100644 --- a/collection/file-managers/gather-cuteftp-information.yml +++ b/collection/file-managers/gather-cuteftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather cuteftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-cyberduck-information.yml b/collection/file-managers/gather-cyberduck-information.yml index d8eb7ddb..9e2473e2 100644 --- a/collection/file-managers/gather-cyberduck-information.yml +++ b/collection/file-managers/gather-cyberduck-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather cyberduck information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-direct-ftp-information.yml b/collection/file-managers/gather-direct-ftp-information.yml index 4feffe17..bee5d1f7 100644 --- a/collection/file-managers/gather-direct-ftp-information.yml +++ b/collection/file-managers/gather-direct-ftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather direct-ftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-directory-opus-information.yml b/collection/file-managers/gather-directory-opus-information.yml index 9be6fff0..6310f16d 100644 --- a/collection/file-managers/gather-directory-opus-information.yml +++ b/collection/file-managers/gather-directory-opus-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather directory-opus information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-expandrive-information.yml b/collection/file-managers/gather-expandrive-information.yml index bd03b604..cadd077f 100644 --- a/collection/file-managers/gather-expandrive-information.yml +++ b/collection/file-managers/gather-expandrive-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather expandrive information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-faststone-browser-information.yml b/collection/file-managers/gather-faststone-browser-information.yml index 14f9bcb5..de98c2bf 100644 --- a/collection/file-managers/gather-faststone-browser-information.yml +++ b/collection/file-managers/gather-faststone-browser-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather faststone-browser information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-fasttrack-ftp-information.yml b/collection/file-managers/gather-fasttrack-ftp-information.yml index 27cff899..3f699652 100644 --- a/collection/file-managers/gather-fasttrack-ftp-information.yml +++ b/collection/file-managers/gather-fasttrack-ftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather fasttrack-ftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-ffftp-information.yml b/collection/file-managers/gather-ffftp-information.yml index a0251813..d6082f49 100644 --- a/collection/file-managers/gather-ffftp-information.yml +++ b/collection/file-managers/gather-ffftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather ffftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-filezilla-information.yml b/collection/file-managers/gather-filezilla-information.yml index df077c24..6409b3aa 100644 --- a/collection/file-managers/gather-filezilla-information.yml +++ b/collection/file-managers/gather-filezilla-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather filezilla information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-flashfxp-information.yml b/collection/file-managers/gather-flashfxp-information.yml index 7b78824f..3f82c5a9 100644 --- a/collection/file-managers/gather-flashfxp-information.yml +++ b/collection/file-managers/gather-flashfxp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather flashfxp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-fling-ftp-information.yml b/collection/file-managers/gather-fling-ftp-information.yml index 57867347..266ea83a 100644 --- a/collection/file-managers/gather-fling-ftp-information.yml +++ b/collection/file-managers/gather-fling-ftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather fling-ftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-freshftp-information.yml b/collection/file-managers/gather-freshftp-information.yml index 463e57cd..b77c089c 100644 --- a/collection/file-managers/gather-freshftp-information.yml +++ b/collection/file-managers/gather-freshftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather freshftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-frigate3-information.yml b/collection/file-managers/gather-frigate3-information.yml index 702c5339..742233bf 100644 --- a/collection/file-managers/gather-frigate3-information.yml +++ b/collection/file-managers/gather-frigate3-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather frigate3 information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-ftp-commander-information.yml b/collection/file-managers/gather-ftp-commander-information.yml index bc649620..7bd8bc5e 100644 --- a/collection/file-managers/gather-ftp-commander-information.yml +++ b/collection/file-managers/gather-ftp-commander-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather ftp-commander information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-ftp-explorer-information.yml b/collection/file-managers/gather-ftp-explorer-information.yml index 31d1bb25..96d06dbd 100644 --- a/collection/file-managers/gather-ftp-explorer-information.yml +++ b/collection/file-managers/gather-ftp-explorer-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather ftp-explorer information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-ftp-voyager-information.yml b/collection/file-managers/gather-ftp-voyager-information.yml index 7d7ad7ce..e8c1405d 100644 --- a/collection/file-managers/gather-ftp-voyager-information.yml +++ b/collection/file-managers/gather-ftp-voyager-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather ftp-voyager information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-ftpgetter-information.yml b/collection/file-managers/gather-ftpgetter-information.yml index 7faee72d..3c439334 100644 --- a/collection/file-managers/gather-ftpgetter-information.yml +++ b/collection/file-managers/gather-ftpgetter-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather ftpgetter information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-ftpinfo-information.yml b/collection/file-managers/gather-ftpinfo-information.yml index 01258e23..0008e9e3 100644 --- a/collection/file-managers/gather-ftpinfo-information.yml +++ b/collection/file-managers/gather-ftpinfo-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather ftpinfo information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-ftpnow-information.yml b/collection/file-managers/gather-ftpnow-information.yml index 43b6e190..d2b21bcb 100644 --- a/collection/file-managers/gather-ftpnow-information.yml +++ b/collection/file-managers/gather-ftpnow-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather ftpnow information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-ftprush-information.yml b/collection/file-managers/gather-ftprush-information.yml index d36dbfd2..117a9e80 100644 --- a/collection/file-managers/gather-ftprush-information.yml +++ b/collection/file-managers/gather-ftprush-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather ftprush information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-ftpshell-information.yml b/collection/file-managers/gather-ftpshell-information.yml index a372bd09..136a8e5f 100644 --- a/collection/file-managers/gather-ftpshell-information.yml +++ b/collection/file-managers/gather-ftpshell-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather ftpshell information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-global-downloader-information.yml b/collection/file-managers/gather-global-downloader-information.yml index 5e7193ca..9ed4df52 100644 --- a/collection/file-managers/gather-global-downloader-information.yml +++ b/collection/file-managers/gather-global-downloader-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather global-downloader information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-goftp-information.yml b/collection/file-managers/gather-goftp-information.yml index f248e2c9..3462abb3 100644 --- a/collection/file-managers/gather-goftp-information.yml +++ b/collection/file-managers/gather-goftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather goftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-leapftp-information.yml b/collection/file-managers/gather-leapftp-information.yml index 6510387a..92d69628 100644 --- a/collection/file-managers/gather-leapftp-information.yml +++ b/collection/file-managers/gather-leapftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather leapftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-netdrive-information.yml b/collection/file-managers/gather-netdrive-information.yml index 07437192..1b875e13 100644 --- a/collection/file-managers/gather-netdrive-information.yml +++ b/collection/file-managers/gather-netdrive-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather netdrive information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-nexusfile-information.yml b/collection/file-managers/gather-nexusfile-information.yml index b21eae93..06254cc5 100644 --- a/collection/file-managers/gather-nexusfile-information.yml +++ b/collection/file-managers/gather-nexusfile-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather nexusfile information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-nova-ftp-information.yml b/collection/file-managers/gather-nova-ftp-information.yml index 221e928c..09d81b66 100644 --- a/collection/file-managers/gather-nova-ftp-information.yml +++ b/collection/file-managers/gather-nova-ftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather nova-ftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-robo-ftp-information.yml b/collection/file-managers/gather-robo-ftp-information.yml index c61841ce..74fb146e 100644 --- a/collection/file-managers/gather-robo-ftp-information.yml +++ b/collection/file-managers/gather-robo-ftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather robo-ftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-securefx-information.yml b/collection/file-managers/gather-securefx-information.yml index 47a60fe0..59463104 100644 --- a/collection/file-managers/gather-securefx-information.yml +++ b/collection/file-managers/gather-securefx-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather securefx information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-smart-ftp-information.yml b/collection/file-managers/gather-smart-ftp-information.yml index 1f1b831f..dff32f4a 100644 --- a/collection/file-managers/gather-smart-ftp-information.yml +++ b/collection/file-managers/gather-smart-ftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather smart-ftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-softx-ftp-information.yml b/collection/file-managers/gather-softx-ftp-information.yml index 7793ddef..22c507a9 100644 --- a/collection/file-managers/gather-softx-ftp-information.yml +++ b/collection/file-managers/gather-softx-ftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather softx-ftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-southriver-webdrive-information.yml b/collection/file-managers/gather-southriver-webdrive-information.yml index fbd1a339..5197b090 100644 --- a/collection/file-managers/gather-southriver-webdrive-information.yml +++ b/collection/file-managers/gather-southriver-webdrive-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather southriver-webdrive information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-staff-ftp-information.yml b/collection/file-managers/gather-staff-ftp-information.yml index 738e2c7e..6ee5de75 100644 --- a/collection/file-managers/gather-staff-ftp-information.yml +++ b/collection/file-managers/gather-staff-ftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather staff-ftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-total-commander-information.yml b/collection/file-managers/gather-total-commander-information.yml index 09694bcf..e2256187 100644 --- a/collection/file-managers/gather-total-commander-information.yml +++ b/collection/file-managers/gather-total-commander-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather total-commander information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-turbo-ftp-information.yml b/collection/file-managers/gather-turbo-ftp-information.yml index 9b98066f..1c9b8473 100644 --- a/collection/file-managers/gather-turbo-ftp-information.yml +++ b/collection/file-managers/gather-turbo-ftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather turbo-ftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-ultrafxp-information.yml b/collection/file-managers/gather-ultrafxp-information.yml index ec3b746b..dc0e57cd 100644 --- a/collection/file-managers/gather-ultrafxp-information.yml +++ b/collection/file-managers/gather-ultrafxp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather ultrafxp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-winscp-information.yml b/collection/file-managers/gather-winscp-information.yml index d5c2af21..81152c90 100644 --- a/collection/file-managers/gather-winscp-information.yml +++ b/collection/file-managers/gather-winscp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather winscp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-winzip-information.yml b/collection/file-managers/gather-winzip-information.yml index 0cb80a05..59f79aad 100644 --- a/collection/file-managers/gather-winzip-information.yml +++ b/collection/file-managers/gather-winzip-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather winzip information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-wise-ftp-information.yml b/collection/file-managers/gather-wise-ftp-information.yml index bf5e437e..2d80d333 100644 --- a/collection/file-managers/gather-wise-ftp-information.yml +++ b/collection/file-managers/gather-wise-ftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather wise-ftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-ws-ftp-information.yml b/collection/file-managers/gather-ws-ftp-information.yml index 560891b5..ce2c27b3 100644 --- a/collection/file-managers/gather-ws-ftp-information.yml +++ b/collection/file-managers/gather-ws-ftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather ws-ftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/file-managers/gather-xftp-information.yml b/collection/file-managers/gather-xftp-information.yml index 3d0f4cc8..484a2794 100644 --- a/collection/file-managers/gather-xftp-information.yml +++ b/collection/file-managers/gather-xftp-information.yml @@ -2,7 +2,8 @@ rule: meta: name: gather xftp information namespace: collection/file-managers - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Credential Access::Credentials from Password Stores [T1555] diff --git a/collection/get-current-user-on-linux.yml b/collection/get-current-user-on-linux.yml index bd56fe94..bae1449a 100644 --- a/collection/get-current-user-on-linux.yml +++ b/collection/get-current-user-on-linux.yml @@ -2,7 +2,8 @@ rule: meta: name: get current user on Linux namespace: collection - author: joakim@intezer.com + authors: + - joakim@intezer.com scope: function att&ck: - Discovery::System Owner/User Discovery [T1033] diff --git a/collection/get-geographical-location.yml b/collection/get-geographical-location.yml index 154bcb71..61eb1f85 100644 --- a/collection/get-geographical-location.yml +++ b/collection/get-geographical-location.yml @@ -3,7 +3,8 @@ rule: meta: name: get geographical location namespace: collection - author: moritz.raabe + authors: + - moritz.raabe scope: function att&ck: - Discovery::System Location Discovery [T1614] diff --git a/collection/group-policy/discover-group-policy-via-gpresult.yml b/collection/group-policy/discover-group-policy-via-gpresult.yml index 44c1f82b..867cfe5b 100644 --- a/collection/group-policy/discover-group-policy-via-gpresult.yml +++ b/collection/group-policy/discover-group-policy-via-gpresult.yml @@ -2,7 +2,8 @@ rule: meta: name: discover Group Policy via gpresult namespace: collection/group-policy - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function att&ck: - Discovery::Group Policy Discovery [T1615] diff --git a/collection/keylog/log-keystrokes-via-application-hook.yml b/collection/keylog/log-keystrokes-via-application-hook.yml index 00628e0c..9f47b93a 100644 --- a/collection/keylog/log-keystrokes-via-application-hook.yml +++ b/collection/keylog/log-keystrokes-via-application-hook.yml @@ -2,7 +2,8 @@ rule: meta: name: log keystrokes via application hook namespace: collection/keylog - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Collection::Input Capture::Keylogging [T1056.001] diff --git a/collection/keylog/log-keystrokes-via-polling.yml b/collection/keylog/log-keystrokes-via-polling.yml index 612a2f1a..3c1b6b95 100644 --- a/collection/keylog/log-keystrokes-via-polling.yml +++ b/collection/keylog/log-keystrokes-via-polling.yml @@ -2,7 +2,8 @@ rule: meta: name: log keystrokes via polling namespace: collection/keylog - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Collection::Input Capture::Keylogging [T1056.001] diff --git a/collection/keylog/log-keystrokes.yml b/collection/keylog/log-keystrokes.yml index 11783f4a..0853e2dd 100644 --- a/collection/keylog/log-keystrokes.yml +++ b/collection/keylog/log-keystrokes.yml @@ -2,7 +2,8 @@ rule: meta: name: log keystrokes namespace: collection/keylog - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Collection::Input Capture::Keylogging [T1056.001] diff --git a/collection/microphone/capture-microphone-audio.yml b/collection/microphone/capture-microphone-audio.yml index f823e058..b826e9b9 100644 --- a/collection/microphone/capture-microphone-audio.yml +++ b/collection/microphone/capture-microphone-audio.yml @@ -2,7 +2,8 @@ rule: meta: name: capture microphone audio namespace: collection/microphone - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Collection::Audio Capture [T1123] diff --git a/collection/network/capture-network-configuration-via-ipconfig.yml b/collection/network/capture-network-configuration-via-ipconfig.yml index abf0dc04..ee6c87ac 100644 --- a/collection/network/capture-network-configuration-via-ipconfig.yml +++ b/collection/network/capture-network-configuration-via-ipconfig.yml @@ -2,7 +2,8 @@ rule: meta: name: capture network configuration via ipconfig namespace: collection/network - author: "@_re_fox" + authors: + - "@_re_fox" scope: basic block att&ck: - Discovery::System Network Configuration Discovery [T1016] diff --git a/collection/network/capture-public-ip.yml b/collection/network/capture-public-ip.yml index 2d95fa8e..5c00ad6b 100644 --- a/collection/network/capture-public-ip.yml +++ b/collection/network/capture-public-ip.yml @@ -2,7 +2,8 @@ rule: meta: name: capture public ip namespace: collection/network - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Discovery::System Network Configuration Discovery [T1016] diff --git a/collection/network/get-domain-trust-relationships.yml b/collection/network/get-domain-trust-relationships.yml index 715a6a9c..d57f9802 100644 --- a/collection/network/get-domain-trust-relationships.yml +++ b/collection/network/get-domain-trust-relationships.yml @@ -2,7 +2,8 @@ rule: meta: name: get domain trust relationships namespace: collection/network - author: johnk3r + authors: + - johnk3r scope: function att&ck: - Discovery::Domain Trust Discovery [T1482] diff --git a/collection/network/get-mac-address-on-windows.yml b/collection/network/get-mac-address-on-windows.yml index f3fc5d32..63a2c4de 100644 --- a/collection/network/get-mac-address-on-windows.yml +++ b/collection/network/get-mac-address-on-windows.yml @@ -2,7 +2,7 @@ rule: meta: name: get MAC address on Windows namespace: collection/network - author: + authors: - moritz.raabe@mandiant.com scope: function att&ck: diff --git a/collection/password-manager/steal-keepass-passwords-using-keefarce.yml b/collection/password-manager/steal-keepass-passwords-using-keefarce.yml index 483b7de2..e3f0bb49 100644 --- a/collection/password-manager/steal-keepass-passwords-using-keefarce.yml +++ b/collection/password-manager/steal-keepass-passwords-using-keefarce.yml @@ -2,7 +2,8 @@ rule: meta: name: steal KeePass passwords using KeeFarce namespace: collection/password-manager - author: "@Ana06" + authors: + - "@Ana06" scope: file att&ck: - Credential Access::Credentials from Password Stores::Password Managers [T1555.005] diff --git a/collection/screenshot/capture-screenshot.yml b/collection/screenshot/capture-screenshot.yml index 1242d67b..5155eea9 100644 --- a/collection/screenshot/capture-screenshot.yml +++ b/collection/screenshot/capture-screenshot.yml @@ -2,7 +2,7 @@ rule: meta: name: capture screenshot namespace: collection/screenshot - author: + authors: - moritz.raabe@mandiant.com - "@_re_fox" - michael.hunhoff@mandiant.com diff --git a/collection/webcam/capture-webcam-image.yml b/collection/webcam/capture-webcam-image.yml index 43590fb5..173baa0b 100644 --- a/collection/webcam/capture-webcam-image.yml +++ b/collection/webcam/capture-webcam-image.yml @@ -2,7 +2,8 @@ rule: meta: name: capture webcam image namespace: collection/webcam - author: johnk3r + authors: + - johnk3r scope: function att&ck: - Collection::Video Capture [T1125] diff --git a/communication/dns/reference-dns-over-https-endpoints.yml b/communication/dns/reference-dns-over-https-endpoints.yml index 718fa659..1a82e4f4 100644 --- a/communication/dns/reference-dns-over-https-endpoints.yml +++ b/communication/dns/reference-dns-over-https-endpoints.yml @@ -2,7 +2,8 @@ rule: meta: name: reference DNS over HTTPS endpoints namespace: communication/dns - author: markus.neis@swisscom.com / @markus_neis + authors: + - markus.neis@swisscom.com / @markus_neis scope: file mbc: - Communication::DNS Communication::Server Connect [C0011.002] diff --git a/communication/ftp/send/send-file-using-ftp-via-wininet.yml b/communication/ftp/send/send-file-using-ftp-via-wininet.yml index b56cf67a..1fb7f5ad 100644 --- a/communication/ftp/send/send-file-using-ftp-via-wininet.yml +++ b/communication/ftp/send/send-file-using-ftp-via-wininet.yml @@ -2,7 +2,8 @@ rule: meta: name: send file using FTP via wininet namespace: communication/ftp/send - author: michael.hunhof@mandiant.com + authors: + - michael.hunhof@mandiant.com scope: function mbc: - Communication::FTP Communication::Send File [C0004.001] diff --git a/communication/http/client/check-http-status-code.yml b/communication/http/client/check-http-status-code.yml index 335b5200..c02e4ca8 100644 --- a/communication/http/client/check-http-status-code.yml +++ b/communication/http/client/check-http-status-code.yml @@ -2,7 +2,8 @@ rule: meta: name: check HTTP status code namespace: communication/http/client - author: "@mr-tz" + authors: + - "@mr-tz" scope: function mbc: - Communication::HTTP Communication::Read Header [C0002.014] diff --git a/communication/http/client/connect-to-http-server.yml b/communication/http/client/connect-to-http-server.yml index 912777f4..a679d89e 100644 --- a/communication/http/client/connect-to-http-server.yml +++ b/communication/http/client/connect-to-http-server.yml @@ -2,7 +2,8 @@ rule: meta: name: connect to HTTP server namespace: communication/http/client - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Communication::HTTP Communication::Connect to Server [C0002.009] diff --git a/communication/http/client/connect-to-url.yml b/communication/http/client/connect-to-url.yml index cf27924d..076d063b 100644 --- a/communication/http/client/connect-to-url.yml +++ b/communication/http/client/connect-to-url.yml @@ -2,7 +2,8 @@ rule: meta: name: connect to URL namespace: communication/http/client - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Communication::HTTP Communication::Open URL [C0002.004] diff --git a/communication/http/client/create-bits-job.yml b/communication/http/client/create-bits-job.yml index f9edc049..beb9c9bd 100644 --- a/communication/http/client/create-bits-job.yml +++ b/communication/http/client/create-bits-job.yml @@ -3,7 +3,8 @@ rule: meta: name: create BITS job namespace: communication/http/client - author: "@mr-tz" + authors: + - "@mr-tz" description: BITS jobs can be used to download data or achieve persistence (via SetNotifyCmdLine) scope: function att&ck: diff --git a/communication/http/client/create-http-request.yml b/communication/http/client/create-http-request.yml index d178f236..70396a06 100644 --- a/communication/http/client/create-http-request.yml +++ b/communication/http/client/create-http-request.yml @@ -2,7 +2,8 @@ rule: meta: name: create HTTP request namespace: communication/http/client - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Communication::HTTP Communication::Create Request [C0002.012] diff --git a/communication/http/client/decompress-http-response-via-iencodingfilterfactory.yml b/communication/http/client/decompress-http-response-via-iencodingfilterfactory.yml index 22ad455b..4d50aba6 100644 --- a/communication/http/client/decompress-http-response-via-iencodingfilterfactory.yml +++ b/communication/http/client/decompress-http-response-via-iencodingfilterfactory.yml @@ -2,7 +2,8 @@ rule: meta: name: decompress HTTP response via IEncodingFilterFactory namespace: communication/http/client - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: function mbc: - Communication::HTTP Communication::Get Response [C0002.017] diff --git a/communication/http/client/download-url.yml b/communication/http/client/download-url.yml index 4e4dcbcf..b0a7099a 100644 --- a/communication/http/client/download-url.yml +++ b/communication/http/client/download-url.yml @@ -2,7 +2,7 @@ rule: meta: name: download URL namespace: communication/http/client - author: + authors: - matthew.williams@mandiant.com - michael.hunhoff@mandiant.com scope: function diff --git a/communication/http/client/extract-http-body.yml b/communication/http/client/extract-http-body.yml index 9f00732f..25b03b4a 100644 --- a/communication/http/client/extract-http-body.yml +++ b/communication/http/client/extract-http-body.yml @@ -2,7 +2,8 @@ rule: meta: name: extract HTTP body namespace: communication/http/client - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: function mbc: - Communication::HTTP Communication::Extract Body [C0002.011] diff --git a/communication/http/client/get-http-document-via-iwebbrowser2.yml b/communication/http/client/get-http-document-via-iwebbrowser2.yml index 02d36017..14a26ac7 100644 --- a/communication/http/client/get-http-document-via-iwebbrowser2.yml +++ b/communication/http/client/get-http-document-via-iwebbrowser2.yml @@ -2,7 +2,8 @@ rule: meta: name: get HTTP document via IWebBrowser2 namespace: communication/http/client - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: function mbc: - Communication::HTTP Communication::Get Response [C0002.017] diff --git a/communication/http/client/get-http-response-content-encoding.yml b/communication/http/client/get-http-response-content-encoding.yml index de1fd72f..0dd996d5 100644 --- a/communication/http/client/get-http-response-content-encoding.yml +++ b/communication/http/client/get-http-response-content-encoding.yml @@ -2,7 +2,8 @@ rule: meta: name: get HTTP response content encoding namespace: communication/http/client - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: basic block mbc: - Communication::HTTP Communication::Get Response [C0002.017] diff --git a/communication/http/client/prepare-http-request.yml b/communication/http/client/prepare-http-request.yml index fa6a29d5..904ab80e 100644 --- a/communication/http/client/prepare-http-request.yml +++ b/communication/http/client/prepare-http-request.yml @@ -2,7 +2,8 @@ rule: meta: name: prepare HTTP request namespace: communication/http/client - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Communication::HTTP Communication::Create Request [C0002.012] diff --git a/communication/http/client/read-data-from-internet.yml b/communication/http/client/read-data-from-internet.yml index 35ff17dd..517da948 100644 --- a/communication/http/client/read-data-from-internet.yml +++ b/communication/http/client/read-data-from-internet.yml @@ -2,7 +2,8 @@ rule: meta: name: read data from Internet namespace: communication/http/client - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Communication::HTTP Communication::Get Response [C0002.017] diff --git a/communication/http/client/receive-http-response.yml b/communication/http/client/receive-http-response.yml index 6cf5927b..933b5593 100644 --- a/communication/http/client/receive-http-response.yml +++ b/communication/http/client/receive-http-response.yml @@ -2,7 +2,8 @@ rule: meta: name: receive HTTP response namespace: communication/http/client - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Communication::HTTP Communication::Get Response [C0002.017] diff --git a/communication/http/client/send-file-via-http.yml b/communication/http/client/send-file-via-http.yml index 60d63a08..c6038f8a 100644 --- a/communication/http/client/send-file-via-http.yml +++ b/communication/http/client/send-file-via-http.yml @@ -2,7 +2,8 @@ rule: meta: name: send file via HTTP namespace: communication/http/client - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: basic block mbc: - Communication::HTTP Communication::Send Data [C0002.005] diff --git a/communication/http/client/send-http-request.yml b/communication/http/client/send-http-request.yml index 3dd41261..301b0f8d 100644 --- a/communication/http/client/send-http-request.yml +++ b/communication/http/client/send-http-request.yml @@ -2,7 +2,8 @@ rule: meta: name: send HTTP request namespace: communication/http/client - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - Communication::HTTP Communication::Send Request [C0002.003] diff --git a/communication/http/initialize-iwebbrowser2.yml b/communication/http/initialize-iwebbrowser2.yml index 8aaac3c4..03c5ecfe 100644 --- a/communication/http/initialize-iwebbrowser2.yml +++ b/communication/http/initialize-iwebbrowser2.yml @@ -2,7 +2,8 @@ rule: meta: name: initialize IWebBrowser2 namespace: communication/http - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: basic block mbc: - Communication::HTTP Communication::IWebBrowser [C0002.010] diff --git a/communication/http/initialize-winhttp-library.yml b/communication/http/initialize-winhttp-library.yml index 702f6870..a58b6d9f 100644 --- a/communication/http/initialize-winhttp-library.yml +++ b/communication/http/initialize-winhttp-library.yml @@ -2,7 +2,8 @@ rule: meta: name: initialize WinHTTP library namespace: communication/http - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Communication::HTTP Communication::WinHTTP [C0002.008] diff --git a/communication/http/read-http-header.yml b/communication/http/read-http-header.yml index 755aeaa2..6dd67c63 100644 --- a/communication/http/read-http-header.yml +++ b/communication/http/read-http-header.yml @@ -2,7 +2,8 @@ rule: meta: name: read HTTP header namespace: communication/http - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Communication::HTTP Communication::Read Header [C0002.014] diff --git a/communication/http/server/receive-http-request.yml b/communication/http/server/receive-http-request.yml index 4ad27279..40495772 100644 --- a/communication/http/server/receive-http-request.yml +++ b/communication/http/server/receive-http-request.yml @@ -2,7 +2,8 @@ rule: meta: name: receive HTTP request namespace: communication/http/server - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Communication::HTTP Communication::Receive Request [C0002.015] diff --git a/communication/http/server/send-http-response.yml b/communication/http/server/send-http-response.yml index a6615894..14495c4b 100644 --- a/communication/http/server/send-http-response.yml +++ b/communication/http/server/send-http-response.yml @@ -2,7 +2,8 @@ rule: meta: name: send HTTP response namespace: communication/http/server - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Communication::HTTP Communication::Send Response [C0002.016] diff --git a/communication/http/server/start-http-server.yml b/communication/http/server/start-http-server.yml index bd796cd4..fd1e17f1 100644 --- a/communication/http/server/start-http-server.yml +++ b/communication/http/server/start-http-server.yml @@ -2,7 +2,8 @@ rule: meta: name: start HTTP server namespace: communication/http/server - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Communication::HTTP Communication::Start Server [C0002.018] diff --git a/communication/http/set-http-header.yml b/communication/http/set-http-header.yml index 32eddb3a..4bba7245 100644 --- a/communication/http/set-http-header.yml +++ b/communication/http/set-http-header.yml @@ -2,7 +2,8 @@ rule: meta: name: set HTTP header namespace: communication/http - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Communication::HTTP Communication::Set Header [C0002.013] diff --git a/communication/icmp/send-icmp-echo-request.yml b/communication/icmp/send-icmp-echo-request.yml index 83c1247c..b8dbf761 100644 --- a/communication/icmp/send-icmp-echo-request.yml +++ b/communication/icmp/send-icmp-echo-request.yml @@ -2,7 +2,8 @@ rule: meta: name: send ICMP echo request namespace: communication/icmp - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Communication::ICMP Communication::Echo Request [C0014.002] diff --git a/communication/named-pipe/connect/connect-pipe.yml b/communication/named-pipe/connect/connect-pipe.yml index 18a65bc3..1c9f0f4a 100644 --- a/communication/named-pipe/connect/connect-pipe.yml +++ b/communication/named-pipe/connect/connect-pipe.yml @@ -2,7 +2,7 @@ rule: meta: name: connect pipe namespace: communication/named-pipe/connect - author: + authors: - moritz.raabe@mandiant.com - michael.hunhoff@mandiant.com scope: function diff --git a/communication/named-pipe/create/create-pipe.yml b/communication/named-pipe/create/create-pipe.yml index 1395ecc6..20bdda55 100644 --- a/communication/named-pipe/create/create-pipe.yml +++ b/communication/named-pipe/create/create-pipe.yml @@ -2,7 +2,8 @@ rule: meta: name: create pipe namespace: communication/named-pipe/create - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - Communication::Interprocess Communication::Create Pipe [C0003.001] diff --git a/communication/named-pipe/create/create-two-anonymous-pipes.yml b/communication/named-pipe/create/create-two-anonymous-pipes.yml index 8e7030ab..42ec62a2 100644 --- a/communication/named-pipe/create/create-two-anonymous-pipes.yml +++ b/communication/named-pipe/create/create-two-anonymous-pipes.yml @@ -2,7 +2,8 @@ rule: meta: name: create two anonymous pipes namespace: communication/named-pipe/create - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: function mbc: - Communication::Interprocess Communication::Create Pipe [C0003.001] diff --git a/communication/named-pipe/read/read-pipe.yml b/communication/named-pipe/read/read-pipe.yml index 03aa7c7c..21e7e0cc 100644 --- a/communication/named-pipe/read/read-pipe.yml +++ b/communication/named-pipe/read/read-pipe.yml @@ -2,7 +2,7 @@ rule: meta: name: read pipe namespace: communication/named-pipe/read - author: + authors: - moritz.raabe@mandiant.com - michael.hunhoff@mandiant.com description: PeekNamedPipe isn't required to read from a pipe; however, pipes are often utilized to capture the output of a cmd.exe process. In a multi-thread instance, a new thread is created that calls PeekNamedPipe and ReadFile to obtain the command output. diff --git a/communication/named-pipe/write/write-pipe.yml b/communication/named-pipe/write/write-pipe.yml index 6823479f..60a179e6 100644 --- a/communication/named-pipe/write/write-pipe.yml +++ b/communication/named-pipe/write/write-pipe.yml @@ -2,7 +2,7 @@ rule: meta: name: write pipe namespace: communication/named-pipe/write - author: + authors: - moritz.raabe@mandiant.com - michael.hunhoff@mandiant.com scope: function diff --git a/communication/receive-data.yml b/communication/receive-data.yml index e8431b38..c914b56b 100644 --- a/communication/receive-data.yml +++ b/communication/receive-data.yml @@ -2,7 +2,8 @@ rule: meta: name: receive data namespace: communication - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com description: all known techniques for receiving data from a potential C2 server scope: function mbc: diff --git a/communication/send-data.yml b/communication/send-data.yml index a2841e55..05ec9fd4 100644 --- a/communication/send-data.yml +++ b/communication/send-data.yml @@ -2,7 +2,7 @@ rule: meta: name: send data namespace: communication - author: + authors: - william.ballenthin@mandiant.com - joakim@intezer.com description: all known techniques for sending data to a potential C2 server diff --git a/communication/socket/get-socket-status.yml b/communication/socket/get-socket-status.yml index 69a497e1..01f849fd 100644 --- a/communication/socket/get-socket-status.yml +++ b/communication/socket/get-socket-status.yml @@ -2,7 +2,8 @@ rule: meta: name: get socket status namespace: communication/socket - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::System Network Configuration Discovery [T1016] diff --git a/communication/socket/initialize-winsock-library.yml b/communication/socket/initialize-winsock-library.yml index 169a702e..31e3b46c 100644 --- a/communication/socket/initialize-winsock-library.yml +++ b/communication/socket/initialize-winsock-library.yml @@ -2,7 +2,8 @@ rule: meta: name: initialize Winsock library namespace: communication/socket - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Communication::Socket Communication::Initialize Winsock Library [C0001.009] diff --git a/communication/socket/receive/receive-data-on-socket.yml b/communication/socket/receive/receive-data-on-socket.yml index 82e51077..d7baefb5 100644 --- a/communication/socket/receive/receive-data-on-socket.yml +++ b/communication/socket/receive/receive-data-on-socket.yml @@ -2,7 +2,7 @@ rule: meta: name: receive data on socket namespace: communication/socket/receive - author: + authors: - moritz.raabe@mandiant.com - joakim@intezer.com scope: function diff --git a/communication/socket/send/send-data-on-socket.yml b/communication/socket/send/send-data-on-socket.yml index 079d9f6e..ac570e23 100644 --- a/communication/socket/send/send-data-on-socket.yml +++ b/communication/socket/send/send-data-on-socket.yml @@ -2,7 +2,7 @@ rule: meta: name: send data on socket namespace: communication/socket/send - author: + authors: - moritz.raabe@mandiant.com - joakim@intezer.com scope: function diff --git a/communication/socket/set-socket-configuration.yml b/communication/socket/set-socket-configuration.yml index b7d7d053..624f5a7f 100644 --- a/communication/socket/set-socket-configuration.yml +++ b/communication/socket/set-socket-configuration.yml @@ -2,7 +2,8 @@ rule: meta: name: set socket configuration namespace: communication/socket - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Communication::Socket Communication::Set Socket Config [C0001.001] diff --git a/communication/socket/tcp/connect-tcp-socket.yml b/communication/socket/tcp/connect-tcp-socket.yml index 53c87f74..17e597e6 100644 --- a/communication/socket/tcp/connect-tcp-socket.yml +++ b/communication/socket/tcp/connect-tcp-socket.yml @@ -2,7 +2,7 @@ rule: meta: name: connect TCP socket namespace: communication/socket/tcp - author: + authors: - moritz.raabe@mandiant.com - joakim@intezer.com scope: function diff --git a/communication/socket/tcp/create-tcp-socket.yml b/communication/socket/tcp/create-tcp-socket.yml index 11957e03..d49262b8 100644 --- a/communication/socket/tcp/create-tcp-socket.yml +++ b/communication/socket/tcp/create-tcp-socket.yml @@ -2,7 +2,7 @@ rule: meta: name: create TCP socket namespace: communication/socket/tcp - author: + authors: - william.ballenthin@mandiant.com - joakim@intezer.com scope: basic block diff --git a/communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml b/communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml index 1414c2b7..ecc45bfc 100644 --- a/communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml +++ b/communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml @@ -2,7 +2,8 @@ rule: meta: name: obtain TransmitPackets callback function via WSAIoctl namespace: communication/socket/tcp/send - author: jonathan.lepore@mandiant.com + authors: + - jonathan.lepore@mandiant.com description: The TransmitPackets function transmits in-memory data or file data over a connected socket. The TransmitPackets function uses the operating system cache manager to retrieve file data, locking memory for the minimum time required to transmit and resulting in efficient, high-performance transmission. scope: function mbc: diff --git a/communication/socket/tcp/send/send-tcp-data-via-wfp-api.yml b/communication/socket/tcp/send/send-tcp-data-via-wfp-api.yml index a109a3db..9ee59420 100644 --- a/communication/socket/tcp/send/send-tcp-data-via-wfp-api.yml +++ b/communication/socket/tcp/send/send-tcp-data-via-wfp-api.yml @@ -2,7 +2,8 @@ rule: meta: name: send TCP data via WFP API namespace: communication/socket/tcp/send - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Communication::Socket Communication::Send TCP Data [C0001.014] diff --git a/communication/socket/udp/send/create-udp-socket.yml b/communication/socket/udp/send/create-udp-socket.yml index 7bfa08ae..14e9a7ef 100644 --- a/communication/socket/udp/send/create-udp-socket.yml +++ b/communication/socket/udp/send/create-udp-socket.yml @@ -2,7 +2,7 @@ rule: meta: name: create UDP socket namespace: communication/socket/udp/send - author: + authors: - moritz.raabe@mandiant.com - joakim@intezer.com scope: basic block diff --git a/communication/tcp/client/act-as-tcp-client.yml b/communication/tcp/client/act-as-tcp-client.yml index 3d3f6622..c8ab187b 100644 --- a/communication/tcp/client/act-as-tcp-client.yml +++ b/communication/tcp/client/act-as-tcp-client.yml @@ -2,7 +2,8 @@ rule: meta: name: act as TCP client namespace: communication/tcp/client - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function mbc: - Communication::Socket Communication::TCP Client [C0001.008] diff --git a/communication/tcp/serve/start-tcp-server.yml b/communication/tcp/serve/start-tcp-server.yml index ed00b251..10415122 100644 --- a/communication/tcp/serve/start-tcp-server.yml +++ b/communication/tcp/serve/start-tcp-server.yml @@ -2,7 +2,8 @@ rule: meta: name: start TCP server namespace: communication/tcp/serve - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function mbc: - Communication::Socket Communication::Start TCP Server [C0001.005] diff --git a/compiler/autohotkey/compiled-with-autohotkey.yml b/compiler/autohotkey/compiled-with-autohotkey.yml index 699ed665..a4f1a683 100644 --- a/compiler/autohotkey/compiled-with-autohotkey.yml +++ b/compiler/autohotkey/compiled-with-autohotkey.yml @@ -2,7 +2,8 @@ rule: meta: name: compiled with AutoHotKey namespace: compiler/autohotkey - author: awillia2@cisco.com + authors: + - awillia2@cisco.com scope: file att&ck: - Execution::Command and Scripting Interpreter [T1059] diff --git a/compiler/autoit/compiled-with-autoit.yml b/compiler/autoit/compiled-with-autoit.yml index ed8f3379..24b0c1a2 100644 --- a/compiler/autoit/compiled-with-autoit.yml +++ b/compiler/autoit/compiled-with-autoit.yml @@ -2,7 +2,8 @@ rule: meta: name: compiled with AutoIt namespace: compiler/autoit - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Execution::Command and Scripting Interpreter [T1059] diff --git a/compiler/d/compiled-with-dmd.yml b/compiler/d/compiled-with-dmd.yml index 9c89c6d0..af7a01ff 100644 --- a/compiler/d/compiled-with-dmd.yml +++ b/compiler/d/compiled-with-dmd.yml @@ -2,7 +2,8 @@ rule: meta: name: compiled with dmd namespace: compiler/d - author: "@_re_fox" + authors: + - "@_re_fox" scope: file references: - https://github.com/dlang/dmd diff --git a/compiler/delphi/compiled-with-borland-delphi.yml b/compiler/delphi/compiled-with-borland-delphi.yml index 67aeb281..c76a2872 100644 --- a/compiler/delphi/compiled-with-borland-delphi.yml +++ b/compiler/delphi/compiled-with-borland-delphi.yml @@ -2,7 +2,8 @@ rule: meta: name: compiled with Borland Delphi namespace: compiler/delphi - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file examples: - 4BDD67FF852C221112337FECD0681EAC diff --git a/compiler/exe4j/compiled-with-exe4j.yml b/compiler/exe4j/compiled-with-exe4j.yml index 33561761..a193fd0e 100644 --- a/compiler/exe4j/compiled-with-exe4j.yml +++ b/compiler/exe4j/compiled-with-exe4j.yml @@ -2,7 +2,8 @@ rule: meta: name: compiled with exe4j namespace: compiler/exe4j - author: johnk3r + authors: + - johnk3r scope: file examples: - 6b25f1e754ef486bbb28a66d46bababe:0x404EDE diff --git a/compiler/go/compiled-with-go.yml b/compiler/go/compiled-with-go.yml index c2919245..5e35e9f7 100644 --- a/compiler/go/compiled-with-go.yml +++ b/compiler/go/compiled-with-go.yml @@ -2,7 +2,8 @@ rule: meta: name: compiled with Go namespace: compiler/go - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: file examples: - 49a34cfbeed733c24392c9217ef46bb6 diff --git a/compiler/mingw/compiled-with-mingw-for-windows.yml b/compiler/mingw/compiled-with-mingw-for-windows.yml index 326d3cd6..34f67762 100644 --- a/compiler/mingw/compiled-with-mingw-for-windows.yml +++ b/compiler/mingw/compiled-with-mingw-for-windows.yml @@ -2,7 +2,8 @@ rule: meta: name: compiled with MinGW for Windows namespace: compiler/mingw - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file examples: - 5b3968b47eb16a1cb88525e3b565eab1 diff --git a/compiler/nim/compiled-with-nim.yml b/compiler/nim/compiled-with-nim.yml index cb13d49b..bd82dbe6 100644 --- a/compiler/nim/compiled-with-nim.yml +++ b/compiler/nim/compiled-with-nim.yml @@ -2,7 +2,8 @@ rule: meta: name: compiled with Nim namespace: compiler/nim - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: file examples: - 580c37831fe98a254eb6c61c692c70d8.exe_ diff --git a/compiler/perl2exe/compiled-with-perl2exe.yml b/compiler/perl2exe/compiled-with-perl2exe.yml index baff5c74..3900292c 100644 --- a/compiler/perl2exe/compiled-with-perl2exe.yml +++ b/compiler/perl2exe/compiled-with-perl2exe.yml @@ -2,7 +2,8 @@ rule: meta: name: compiled with perl2exe namespace: compiler/perl2exe - author: "@_re_fox" + authors: + - "@_re_fox" scope: function examples: - 873275ce8bf88ef66e9fa0c74b5c2a1e:0x4011C9 diff --git a/compiler/ps2exe/compiled-with-ps2exe.yml b/compiler/ps2exe/compiled-with-ps2exe.yml index 37a8c595..23fa49fa 100644 --- a/compiler/ps2exe/compiled-with-ps2exe.yml +++ b/compiler/ps2exe/compiled-with-ps2exe.yml @@ -2,7 +2,8 @@ rule: meta: name: compiled with ps2exe namespace: compiler/ps2exe - author: "@_re_fox" + authors: + - "@_re_fox" scope: file references: - https://github.com/ikarstein/ps2exe diff --git a/compiler/py2exe/compiled-with-py2exe.yml b/compiler/py2exe/compiled-with-py2exe.yml index ec59faf6..88debc2f 100644 --- a/compiler/py2exe/compiled-with-py2exe.yml +++ b/compiler/py2exe/compiled-with-py2exe.yml @@ -2,7 +2,8 @@ rule: meta: name: compiled with py2exe namespace: compiler/py2exe - author: "@_re_fox" + authors: + - "@_re_fox" scope: basic block examples: - ed888dc2f04f5eac83d6d14088d002de:0x40194A diff --git a/compiler/pyarmor/compiled-with-pyarmor.yml b/compiler/pyarmor/compiled-with-pyarmor.yml index d803d6f2..5f174c80 100644 --- a/compiler/pyarmor/compiled-with-pyarmor.yml +++ b/compiler/pyarmor/compiled-with-pyarmor.yml @@ -2,7 +2,8 @@ rule: meta: name: compiled with pyarmor namespace: compiler/pyarmor - author: "@stvemillertime, @itreallynick" + authors: + - "@stvemillertime, @itreallynick" scope: file att&ck: - Execution::Command and Scripting Interpreter::Python [T1059.006] diff --git a/compiler/rust/compiled-with-rust.yml b/compiler/rust/compiled-with-rust.yml index 0760c85d..89f362a8 100644 --- a/compiler/rust/compiled-with-rust.yml +++ b/compiler/rust/compiled-with-rust.yml @@ -2,7 +2,8 @@ rule: meta: name: compiled with rust namespace: compiler/rust - author: "@_re_fox" + authors: + - "@_re_fox" scope: function examples: - c3341b7dfbb9d43bca8c812e07b4299f:0x45F490 diff --git a/compiler/v/compiled-with-v.yml b/compiler/v/compiled-with-v.yml index 8b45e930..b7df07d4 100644 --- a/compiler/v/compiled-with-v.yml +++ b/compiler/v/compiled-with-v.yml @@ -2,7 +2,8 @@ rule: meta: name: compiled with V namespace: compiler/v - author: jakub.jozwiak@mandiant.com + authors: + - jakub.jozwiak@mandiant.com scope: file references: - https://vlang.io diff --git a/compiler/vb/compiled-from-visual-basic.yml b/compiler/vb/compiled-from-visual-basic.yml index 5173f2f3..75077783 100644 --- a/compiler/vb/compiled-from-visual-basic.yml +++ b/compiler/vb/compiled-from-visual-basic.yml @@ -2,7 +2,8 @@ rule: meta: name: compiled from Visual Basic namespace: compiler/vb - author: "@williballenthin" + authors: + - "@williballenthin" scope: file examples: - 9bca6b99e7981208af4c7925b96fb9cf diff --git a/compiler/zig/compiled-with-zig.yml b/compiler/zig/compiled-with-zig.yml index d7b34312..3ff240ef 100644 --- a/compiler/zig/compiled-with-zig.yml +++ b/compiler/zig/compiled-with-zig.yml @@ -2,7 +2,8 @@ rule: meta: name: compiled with Zig namespace: compiler/zig - author: jakub.jozwiak@mandiant.com + authors: + - jakub.jozwiak@mandiant.com scope: file references: - https://ziglang.org diff --git a/data-manipulation/checksum/adler32/compute-adler32-checksum.yml b/data-manipulation/checksum/adler32/compute-adler32-checksum.yml index 574a137c..0104a93d 100644 --- a/data-manipulation/checksum/adler32/compute-adler32-checksum.yml +++ b/data-manipulation/checksum/adler32/compute-adler32-checksum.yml @@ -2,7 +2,8 @@ rule: meta: name: compute adler32 checksum namespace: data-manipulation/checksum/adler32 - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: function mbc: - Data::Checksum::Adler [C0032.005] diff --git a/data-manipulation/checksum/crc32/hash-data-with-crc32.yml b/data-manipulation/checksum/crc32/hash-data-with-crc32.yml index 64c8fe95..4f42f462 100644 --- a/data-manipulation/checksum/crc32/hash-data-with-crc32.yml +++ b/data-manipulation/checksum/crc32/hash-data-with-crc32.yml @@ -2,7 +2,8 @@ rule: meta: name: hash data with CRC32 namespace: data-manipulation/checksum/crc32 - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - Data::Checksum::CRC32 [C0032.001] diff --git a/data-manipulation/checksum/luhn/validate-payment-card-number-using-luhn-algorithm.yml b/data-manipulation/checksum/luhn/validate-payment-card-number-using-luhn-algorithm.yml index d56326de..494d9bf1 100644 --- a/data-manipulation/checksum/luhn/validate-payment-card-number-using-luhn-algorithm.yml +++ b/data-manipulation/checksum/luhn/validate-payment-card-number-using-luhn-algorithm.yml @@ -2,7 +2,8 @@ rule: meta: name: validate payment card number using luhn algorithm namespace: data-manipulation/checksum/luhn - author: "@_re_fox" + authors: + - "@_re_fox" scope: function mbc: - Data::Checksum::Luhn [C0032.002] diff --git a/data-manipulation/compression/compress-data-via-winapi.yml b/data-manipulation/compression/compress-data-via-winapi.yml index 00644fd2..be953f26 100644 --- a/data-manipulation/compression/compress-data-via-winapi.yml +++ b/data-manipulation/compression/compress-data-via-winapi.yml @@ -2,7 +2,8 @@ rule: meta: name: compress data via WinAPI namespace: data-manipulation/compression - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Collection::Archive Collected Data::Archive via Library [T1560.002] diff --git a/data-manipulation/compression/decompress-data-using-aplib.yml b/data-manipulation/compression/decompress-data-using-aplib.yml index d23ae4ac..f01f24fd 100644 --- a/data-manipulation/compression/decompress-data-using-aplib.yml +++ b/data-manipulation/compression/decompress-data-using-aplib.yml @@ -2,7 +2,7 @@ rule: meta: name: decompress data using aPLib namespace: data-manipulation/compression - author: + authors: - "@r3c0nst (Frank Boldewin)" - moritz.raabe@mandiant.com - cdong49@gatech.edu diff --git a/data-manipulation/compression/decompress-data-using-quicklz.yml b/data-manipulation/compression/decompress-data-using-quicklz.yml index e6af40cf..a9cb92cd 100644 --- a/data-manipulation/compression/decompress-data-using-quicklz.yml +++ b/data-manipulation/compression/decompress-data-using-quicklz.yml @@ -2,7 +2,8 @@ rule: meta: name: decompress data using QuickLZ namespace: data-manipulation/compression - author: david@edeca.net + authors: + - david@edeca.net description: detects the inner decompression loop from QuickLZ scope: function mbc: diff --git a/data-manipulation/compression/decompress-data-using-ucl.yml b/data-manipulation/compression/decompress-data-using-ucl.yml index 198c944f..02461623 100644 --- a/data-manipulation/compression/decompress-data-using-ucl.yml +++ b/data-manipulation/compression/decompress-data-using-ucl.yml @@ -2,7 +2,8 @@ rule: meta: name: decompress data using UCL namespace: data-manipulation/compression - author: jakub.jozwiak@mandiant.com + authors: + - jakub.jozwiak@mandiant.com scope: function mbc: - Data::Decompress Data [C0025] diff --git a/data-manipulation/compression/decompress-data-via-iencodingfilterfactory.yml b/data-manipulation/compression/decompress-data-via-iencodingfilterfactory.yml index 02a03c83..e12a2d6e 100644 --- a/data-manipulation/compression/decompress-data-via-iencodingfilterfactory.yml +++ b/data-manipulation/compression/decompress-data-via-iencodingfilterfactory.yml @@ -2,7 +2,8 @@ rule: meta: name: decompress data via IEncodingFilterFactory namespace: data-manipulation/compression - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: function mbc: - Data::Decompress Data::IEncodingFilterFactory [C0025.002] diff --git a/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml b/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml index 9dbd0cf6..586185a4 100644 --- a/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml +++ b/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml @@ -2,7 +2,8 @@ rule: meta: name: decode data using Base64 via dword translation table namespace: data-manipulation/encoding/base64 - author: gilbert.elliot@mandiant.com + authors: + - gilbert.elliot@mandiant.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encoding/base64/decode-data-using-base64-via-winapi.yml b/data-manipulation/encoding/base64/decode-data-using-base64-via-winapi.yml index 40841c5d..da46668e 100644 --- a/data-manipulation/encoding/base64/decode-data-using-base64-via-winapi.yml +++ b/data-manipulation/encoding/base64/decode-data-using-base64-via-winapi.yml @@ -2,7 +2,8 @@ rule: meta: name: decode data using Base64 via WinAPI namespace: data-manipulation/encoding/base64 - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Defense Evasion::Deobfuscate/Decode Files or Information [T1140] diff --git a/data-manipulation/encoding/base64/encode-data-using-base64-via-winapi.yml b/data-manipulation/encoding/base64/encode-data-using-base64-via-winapi.yml index 503d2abf..e35c3832 100644 --- a/data-manipulation/encoding/base64/encode-data-using-base64-via-winapi.yml +++ b/data-manipulation/encoding/base64/encode-data-using-base64-via-winapi.yml @@ -2,7 +2,8 @@ rule: meta: name: encode data using Base64 via WinAPI namespace: data-manipulation/encoding/base64 - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: basic block att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encoding/base64/encode-data-using-base64.yml b/data-manipulation/encoding/base64/encode-data-using-base64.yml index c65ca6c9..0e192a92 100644 --- a/data-manipulation/encoding/base64/encode-data-using-base64.yml +++ b/data-manipulation/encoding/base64/encode-data-using-base64.yml @@ -2,7 +2,8 @@ rule: meta: name: encode data using Base64 namespace: data-manipulation/encoding/base64 - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encoding/base64/reference-base64-string.yml b/data-manipulation/encoding/base64/reference-base64-string.yml index f9d31b61..7713d1df 100644 --- a/data-manipulation/encoding/base64/reference-base64-string.yml +++ b/data-manipulation/encoding/base64/reference-base64-string.yml @@ -2,7 +2,8 @@ rule: meta: name: reference Base64 string namespace: data-manipulation/encoding/base64 - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encoding/xor/encode-data-using-xor.yml b/data-manipulation/encoding/xor/encode-data-using-xor.yml index 6945cb95..b96be141 100644 --- a/data-manipulation/encoding/xor/encode-data-using-xor.yml +++ b/data-manipulation/encoding/xor/encode-data-using-xor.yml @@ -2,7 +2,8 @@ rule: meta: name: encode data using XOR namespace: data-manipulation/encoding/xor - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: basic block att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/aes/decrypt-data-using-aes-via-x86-extensions.yml b/data-manipulation/encryption/aes/decrypt-data-using-aes-via-x86-extensions.yml index 60264f8d..f2c0164f 100644 --- a/data-manipulation/encryption/aes/decrypt-data-using-aes-via-x86-extensions.yml +++ b/data-manipulation/encryption/aes/decrypt-data-using-aes-via-x86-extensions.yml @@ -2,7 +2,8 @@ rule: meta: name: decrypt data using AES via x86 extensions namespace: data-manipulation/encryption/aes - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Defense Evasion::Deobfuscate/Decode Files or Information [T1140] diff --git a/data-manipulation/encryption/aes/encrypt-data-using-aes-via-net.yml b/data-manipulation/encryption/aes/encrypt-data-using-aes-via-net.yml index 95869601..28f3fcf2 100644 --- a/data-manipulation/encryption/aes/encrypt-data-using-aes-via-net.yml +++ b/data-manipulation/encryption/aes/encrypt-data-using-aes-via-net.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using AES via .NET namespace: data-manipulation/encryption/aes - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/aes/encrypt-data-using-aes-via-winapi.yml b/data-manipulation/encryption/aes/encrypt-data-using-aes-via-winapi.yml index 2f0d4667..e62b8e60 100644 --- a/data-manipulation/encryption/aes/encrypt-data-using-aes-via-winapi.yml +++ b/data-manipulation/encryption/aes/encrypt-data-using-aes-via-winapi.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using AES via WinAPI namespace: data-manipulation/encryption/aes - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/aes/manually-build-aes-constants.yml b/data-manipulation/encryption/aes/manually-build-aes-constants.yml index bc751f6a..61b74ebd 100644 --- a/data-manipulation/encryption/aes/manually-build-aes-constants.yml +++ b/data-manipulation/encryption/aes/manually-build-aes-constants.yml @@ -2,7 +2,8 @@ rule: meta: name: manually build AES constants namespace: data-manipulation/encryption/aes - author: huynh.t.nhan@gmail.com + authors: + - huynh.t.nhan@gmail.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml b/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml index 920984ea..1ae18757 100644 --- a/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml +++ b/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using blowfish namespace: data-manipulation/encryption/blowfish - author: "@_re_fox" + authors: + - "@_re_fox" scope: basic block att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml b/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml index a6e0755c..8456f1b0 100644 --- a/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml +++ b/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using Camellia namespace: data-manipulation/encryption/camellia - author: '@_re_fox' + authors: + - '@_re_fox' scope: basic block att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/create-new-key-via-cryptacquirecontext.yml b/data-manipulation/encryption/create-new-key-via-cryptacquirecontext.yml index a18d5d5f..665a815e 100644 --- a/data-manipulation/encryption/create-new-key-via-cryptacquirecontext.yml +++ b/data-manipulation/encryption/create-new-key-via-cryptacquirecontext.yml @@ -2,7 +2,8 @@ rule: meta: name: create new key via CryptAcquireContext namespace: data-manipulation/encryption - author: chuong.dong@mandiant.com + authors: + - chuong.dong@mandiant.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml b/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml index 569708a1..4e5207b9 100644 --- a/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml +++ b/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using DES via WinAPI namespace: data-manipulation/encryption/des - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/des/encrypt-data-using-des.yml b/data-manipulation/encryption/des/encrypt-data-using-des.yml index beb7bb87..9a37b39c 100644 --- a/data-manipulation/encryption/des/encrypt-data-using-des.yml +++ b/data-manipulation/encryption/des/encrypt-data-using-des.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using DES namespace: data-manipulation/encryption/des - author: "@_re_fox" + authors: + - "@_re_fox" scope: basic block att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/dpapi/encrypt-data-using-dpapi.yml b/data-manipulation/encryption/dpapi/encrypt-data-using-dpapi.yml index b1727923..af77b881 100644 --- a/data-manipulation/encryption/dpapi/encrypt-data-using-dpapi.yml +++ b/data-manipulation/encryption/dpapi/encrypt-data-using-dpapi.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using DPAPI namespace: data-manipulation/encryption/dpapi - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/elliptic-curve/encrypt-data-using-curve25519.yml b/data-manipulation/encryption/elliptic-curve/encrypt-data-using-curve25519.yml index bc24b8e3..f5a03409 100644 --- a/data-manipulation/encryption/elliptic-curve/encrypt-data-using-curve25519.yml +++ b/data-manipulation/encryption/elliptic-curve/encrypt-data-using-curve25519.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using Curve25519 namespace: data-manipulation/encryption/elliptic-curve - author: dimiter.andonov@mandiant.com + authors: + - dimiter.andonov@mandiant.com scope: basic block att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml b/data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml index 7be0046a..97c8afb8 100644 --- a/data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml +++ b/data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using memfrob from glibc namespace: data-manipulation/encryption - author: zander.work@mandiant.com + authors: + - zander.work@mandiant.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/encrypt-or-decrypt-via-wincrypt.yml b/data-manipulation/encryption/encrypt-or-decrypt-via-wincrypt.yml index e24cb9c9..744a16ab 100644 --- a/data-manipulation/encryption/encrypt-or-decrypt-via-wincrypt.yml +++ b/data-manipulation/encryption/encrypt-or-decrypt-via-wincrypt.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt or decrypt via WinCrypt namespace: data-manipulation/encryption - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/get-outbound-credentials-handle-via-credssp.yml b/data-manipulation/encryption/get-outbound-credentials-handle-via-credssp.yml index 5cb3d28a..1eb5145b 100644 --- a/data-manipulation/encryption/get-outbound-credentials-handle-via-credssp.yml +++ b/data-manipulation/encryption/get-outbound-credentials-handle-via-credssp.yml @@ -2,7 +2,8 @@ rule: meta: name: get outbound credentials handle via CredSSP namespace: data-manipulation/encryption - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: basic block att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml b/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml index a98ad302..d079f522 100755 --- a/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml +++ b/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml @@ -3,7 +3,8 @@ rule: meta: name: encrypt data using HC-128 via WolfSSL namespace: data-manipulation/encryption/hc-128 - author: blaine.stancill@mandiant.com + authors: + - blaine.stancill@mandiant.com scope: basic block att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml b/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml index 1f88e88f..bdcdcdd7 100644 --- a/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml +++ b/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using HC-128 namespace: data-manipulation/encryption/hc-128 - author: awillia2@cisco.com + authors: + - awillia2@cisco.com description: Looks for instruction mnemonics associated with initialization of the HC-128 stream cipher scope: basic block att&ck: diff --git a/data-manipulation/encryption/import-public-key.yml b/data-manipulation/encryption/import-public-key.yml index 244ebf83..6bf44a53 100644 --- a/data-manipulation/encryption/import-public-key.yml +++ b/data-manipulation/encryption/import-public-key.yml @@ -2,7 +2,8 @@ rule: meta: name: import public key namespace: data-manipulation/encryption - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function mbc: - Cryptography::Encryption Key::Import Public Key [C0028.001] diff --git a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml index 606d172d..7ad1f126 100644 --- a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml +++ b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using RC4 KSA namespace: data-manipulation/encryption/rc4 - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml index c1b465de..8ed7f586 100644 --- a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml +++ b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using RC4 PRGA namespace: data-manipulation/encryption/rc4 - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-winapi.yml b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-winapi.yml index 0e2fead5..c1354f46 100644 --- a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-winapi.yml +++ b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-winapi.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using RC4 via WinAPI namespace: data-manipulation/encryption/rc4 - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-with-custom-key-via-winapi.yml b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-with-custom-key-via-winapi.yml index efd3f5cf..7dfc2422 100755 --- a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-with-custom-key-via-winapi.yml +++ b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-with-custom-key-via-winapi.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using RC4 with custom key via WinAPI namespace: data-manipulation/encryption/rc4 - author: blaine.stancill@mandiant.com + authors: + - blaine.stancill@mandiant.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/rc6/encrypt-data-using-rc6.yml b/data-manipulation/encryption/rc6/encrypt-data-using-rc6.yml index 661b1054..bebc4ed3 100644 --- a/data-manipulation/encryption/rc6/encrypt-data-using-rc6.yml +++ b/data-manipulation/encryption/rc6/encrypt-data-using-rc6.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using RC6 namespace: data-manipulation/encryption/rc6 - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/rsa/reference-public-rsa-key.yml b/data-manipulation/encryption/rsa/reference-public-rsa-key.yml index be91f0ef..9a289515 100644 --- a/data-manipulation/encryption/rsa/reference-public-rsa-key.yml +++ b/data-manipulation/encryption/rsa/reference-public-rsa-key.yml @@ -2,7 +2,8 @@ rule: meta: name: reference public RSA key namespace: data-manipulation/encryption/rsa - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - Cryptography::Encryption Key [C0028] diff --git a/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml b/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml index c953ab15..eb1763e7 100644 --- a/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml +++ b/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using skipjack namespace: data-manipulation/encryption/skipjack - author: "@_re_fox" + authors: + - "@_re_fox" scope: basic block att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml b/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml index 1a065ac9..86cefbe7 100644 --- a/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml +++ b/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using Sosemanuk namespace: data-manipulation/encryption/sosemanuk - author: awillia2@cisco.com + authors: + - awillia2@cisco.com description: Looks for cryptographic constants associated with the Sosemanuk stream cipher scope: basic block att&ck: diff --git a/data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml b/data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml index 1a7d6fa3..4ee2c821 100644 --- a/data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml +++ b/data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using twofish namespace: data-manipulation/encryption/twofish - author: "@_re_fox" + authors: + - "@_re_fox" scope: basic block att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/encryption/vest/encrypt-data-using-vest.yml b/data-manipulation/encryption/vest/encrypt-data-using-vest.yml index 6fb3ad89..ceda4cfb 100644 --- a/data-manipulation/encryption/vest/encrypt-data-using-vest.yml +++ b/data-manipulation/encryption/vest/encrypt-data-using-vest.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using vest namespace: data-manipulation/encryption/vest - author: "@_re_fox" + authors: + - "@_re_fox" scope: basic block att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/data-manipulation/hashing/djb2/hash-data-using-djb2.yml b/data-manipulation/hashing/djb2/hash-data-using-djb2.yml index 6afb7a0a..bf472fd7 100644 --- a/data-manipulation/hashing/djb2/hash-data-using-djb2.yml +++ b/data-manipulation/hashing/djb2/hash-data-using-djb2.yml @@ -2,7 +2,8 @@ rule: meta: name: hash data using djb2 namespace: data-manipulation/hashing/djb2 - author: awillia2@cisco.com + authors: + - awillia2@cisco.com scope: function mbc: - Data::Non-Cryptographic Hash [C0030] diff --git a/data-manipulation/hashing/fnv/hash-data-using-fnv.yml b/data-manipulation/hashing/fnv/hash-data-using-fnv.yml index eb8d7030..300d337f 100644 --- a/data-manipulation/hashing/fnv/hash-data-using-fnv.yml +++ b/data-manipulation/hashing/fnv/hash-data-using-fnv.yml @@ -2,7 +2,7 @@ rule: meta: name: hash data using fnv namespace: data-manipulation/hashing/fnv - author: + authors: - moritz.raabe@mandiant.com - "@_re_fox" - michael.hunhoff@mandiant.com diff --git a/data-manipulation/hashing/hash-data-via-wincrypt.yml b/data-manipulation/hashing/hash-data-via-wincrypt.yml index c41b9cc8..ae8572c5 100644 --- a/data-manipulation/hashing/hash-data-via-wincrypt.yml +++ b/data-manipulation/hashing/hash-data-via-wincrypt.yml @@ -2,7 +2,8 @@ rule: meta: name: hash data via WinCrypt namespace: data-manipulation/hashing - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Cryptography::Cryptographic Hash [C0029] diff --git a/data-manipulation/hashing/md5/hash-data-with-md5.yml b/data-manipulation/hashing/md5/hash-data-with-md5.yml index e7084636..4dcc5cd7 100644 --- a/data-manipulation/hashing/md5/hash-data-with-md5.yml +++ b/data-manipulation/hashing/md5/hash-data-with-md5.yml @@ -2,7 +2,8 @@ rule: meta: name: hash data with MD5 namespace: data-manipulation/hashing/md5 - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - Cryptography::Cryptographic Hash::MD5 [C0029.001] diff --git a/data-manipulation/hashing/murmur/hash-data-using-murmur3.yml b/data-manipulation/hashing/murmur/hash-data-using-murmur3.yml index de4fb82e..e09796ec 100644 --- a/data-manipulation/hashing/murmur/hash-data-using-murmur3.yml +++ b/data-manipulation/hashing/murmur/hash-data-using-murmur3.yml @@ -2,7 +2,8 @@ rule: meta: name: hash data using murmur3 namespace: data-manipulation/hashing/murmur - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function mbc: - Data::Non-Cryptographic Hash::MurmurHash [C0030.001] diff --git a/data-manipulation/hashing/sha1/hash-data-using-sha1.yml b/data-manipulation/hashing/sha1/hash-data-using-sha1.yml index ee498fb5..3d3431a9 100644 --- a/data-manipulation/hashing/sha1/hash-data-using-sha1.yml +++ b/data-manipulation/hashing/sha1/hash-data-using-sha1.yml @@ -2,7 +2,8 @@ rule: meta: name: hash data using SHA1 namespace: data-manipulation/hashing/sha1 - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - Cryptography::Cryptographic Hash::SHA1 [C0029.002] diff --git a/data-manipulation/hashing/sha224/hash-data-using-sha224.yml b/data-manipulation/hashing/sha224/hash-data-using-sha224.yml index c7b487b9..e7e70363 100644 --- a/data-manipulation/hashing/sha224/hash-data-using-sha224.yml +++ b/data-manipulation/hashing/sha224/hash-data-using-sha224.yml @@ -2,7 +2,8 @@ rule: meta: name: hash data using SHA224 namespace: data-manipulation/hashing/sha224 - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - Cryptography::Cryptographic Hash::SHA224 [C0029.004] diff --git a/data-manipulation/hashing/sha256/hash-data-using-sha256.yml b/data-manipulation/hashing/sha256/hash-data-using-sha256.yml index 7547e7dd..e1b1f556 100644 --- a/data-manipulation/hashing/sha256/hash-data-using-sha256.yml +++ b/data-manipulation/hashing/sha256/hash-data-using-sha256.yml @@ -2,7 +2,8 @@ rule: meta: name: hash data using SHA256 namespace: data-manipulation/hashing/sha256 - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - Cryptography::Cryptographic Hash::SHA256 [C0029.003] diff --git a/data-manipulation/hashing/tiger/hash-data-using-tiger.yml b/data-manipulation/hashing/tiger/hash-data-using-tiger.yml index f60e7d2e..8be819bb 100644 --- a/data-manipulation/hashing/tiger/hash-data-using-tiger.yml +++ b/data-manipulation/hashing/tiger/hash-data-using-tiger.yml @@ -2,7 +2,8 @@ rule: meta: name: hash data using tiger namespace: data-manipulation/hashing/tiger - author: "@_re_fox" + authors: + - "@_re_fox" scope: basic block mbc: - Cryptography::Cryptographic Hash::Tiger [C0029.005] diff --git a/data-manipulation/hmac/authenticate-hmac.yml b/data-manipulation/hmac/authenticate-hmac.yml index c396ba8a..8956e104 100644 --- a/data-manipulation/hmac/authenticate-hmac.yml +++ b/data-manipulation/hmac/authenticate-hmac.yml @@ -2,7 +2,8 @@ rule: meta: name: authenticate HMAC namespace: data-manipulation/hmac - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - Cryptography::Hashed Message Authentication Code [C0061] diff --git a/data-manipulation/prng/generate-random-numbers-via-winapi.yml b/data-manipulation/prng/generate-random-numbers-via-winapi.yml index cb6e7e8c..13670595 100644 --- a/data-manipulation/prng/generate-random-numbers-via-winapi.yml +++ b/data-manipulation/prng/generate-random-numbers-via-winapi.yml @@ -2,7 +2,7 @@ rule: meta: name: generate random numbers via WinAPI namespace: data-manipulation/prng - author: + authors: - michael.hunhoff@mandiant.com - johnk3r scope: function diff --git a/data-manipulation/prng/mersenne/generate-random-numbers-using-a-mersenne-twister.yml b/data-manipulation/prng/mersenne/generate-random-numbers-using-a-mersenne-twister.yml index 59832f4e..3d8d7b16 100644 --- a/data-manipulation/prng/mersenne/generate-random-numbers-using-a-mersenne-twister.yml +++ b/data-manipulation/prng/mersenne/generate-random-numbers-using-a-mersenne-twister.yml @@ -2,7 +2,8 @@ rule: meta: name: generate random numbers using a Mersenne Twister namespace: data-manipulation/prng/mersenne - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - Cryptography::Generate Pseudo-random Sequence::Mersenne Twister [C0021.005] diff --git a/doc/format.md b/doc/format.md index 1b061fd2..e5852953 100644 --- a/doc/format.md +++ b/doc/format.md @@ -12,7 +12,8 @@ rule: meta: name: hash data with CRC32 namespace: data-manipulation/checksum/crc32 - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function examples: - 2D3EDC218A90F03089CC01715A9F047F:0x403CBD @@ -92,7 +93,8 @@ Here's an example: meta: name: packed with UPX namespace: anti-analysis/packer/upx - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com description: the sample appears to be packed with UPX scope: file att&ck: diff --git a/executable/installer/iexpress/packaged-as-an-iexpress-self-extracting-archive.yml b/executable/installer/iexpress/packaged-as-an-iexpress-self-extracting-archive.yml index 8d2dc7d3..5d47d583 100644 --- a/executable/installer/iexpress/packaged-as-an-iexpress-self-extracting-archive.yml +++ b/executable/installer/iexpress/packaged-as-an-iexpress-self-extracting-archive.yml @@ -2,7 +2,8 @@ rule: meta: name: packaged as an IExpress self-extracting archive namespace: executable/installer/iexpress - author: awillia2@cisco.com + authors: + - awillia2@cisco.com scope: file references: - https://en.wikipedia.org/wiki/IExpress diff --git a/executable/installer/inno-setup/packaged-as-an-inno-setup-installer.yml b/executable/installer/inno-setup/packaged-as-an-inno-setup-installer.yml index 62e05564..dd7a3e22 100644 --- a/executable/installer/inno-setup/packaged-as-an-inno-setup-installer.yml +++ b/executable/installer/inno-setup/packaged-as-an-inno-setup-installer.yml @@ -2,7 +2,8 @@ rule: meta: name: packaged as an Inno Setup installer namespace: executable/installer/inno-setup - author: awillia2@cisco.com + authors: + - awillia2@cisco.com scope: file references: - https://jrsoftware.org/isinfo.php diff --git a/executable/pe/pdb/contains-pdb-path.yml b/executable/pe/pdb/contains-pdb-path.yml index f97baebf..38d7d72f 100644 --- a/executable/pe/pdb/contains-pdb-path.yml +++ b/executable/pe/pdb/contains-pdb-path.yml @@ -2,7 +2,8 @@ rule: meta: name: contains PDB path namespace: executable/pe/pdb - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: file examples: - 464EF2CA59782CE697BC329713698CCC # level32.exe diff --git a/executable/pe/section/rsrc/contain-a-resource-rsrc-section.yml b/executable/pe/section/rsrc/contain-a-resource-rsrc-section.yml index dbc4cb64..c68d4052 100644 --- a/executable/pe/section/rsrc/contain-a-resource-rsrc-section.yml +++ b/executable/pe/section/rsrc/contain-a-resource-rsrc-section.yml @@ -2,7 +2,8 @@ rule: meta: name: contain a resource (.rsrc) section namespace: executable/pe/section/rsrc - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: file examples: - A933A1A402775CFA94B6BEE0963F4B46:0x41fd25 diff --git a/executable/pe/section/tls/contain-a-thread-local-storage-tls-section.yml b/executable/pe/section/tls/contain-a-thread-local-storage-tls-section.yml index cc7430e8..b6688552 100644 --- a/executable/pe/section/tls/contain-a-thread-local-storage-tls-section.yml +++ b/executable/pe/section/tls/contain-a-thread-local-storage-tls-section.yml @@ -2,7 +2,8 @@ rule: meta: name: contain a thread local storage (.tls) section namespace: executable/pe/section/tls - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: file examples: - Practical Malware Analysis Lab 16-02.exe_ diff --git a/executable/resource/extract-resource-via-kernel32-functions.yml b/executable/resource/extract-resource-via-kernel32-functions.yml index 48ab15ff..ae1b605a 100644 --- a/executable/resource/extract-resource-via-kernel32-functions.yml +++ b/executable/resource/extract-resource-via-kernel32-functions.yml @@ -2,7 +2,8 @@ rule: meta: name: extract resource via kernel32 functions namespace: executable/resource - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function examples: - BF88E1BD4A3BDE10B419A622278F1FF7:0x401000 diff --git a/executable/subfile/pe/contain-an-embedded-pe-file.yml b/executable/subfile/pe/contain-an-embedded-pe-file.yml index d6f88b54..72760f0e 100644 --- a/executable/subfile/pe/contain-an-embedded-pe-file.yml +++ b/executable/subfile/pe/contain-an-embedded-pe-file.yml @@ -2,7 +2,8 @@ rule: meta: name: contain an embedded PE file namespace: executable/subfile/pe - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: file mbc: - Execution::Install Additional Program [B0023] diff --git a/host-interaction/bootloader/disable-code-signing.yml b/host-interaction/bootloader/disable-code-signing.yml index 3532379e..28d8ff52 100644 --- a/host-interaction/bootloader/disable-code-signing.yml +++ b/host-interaction/bootloader/disable-code-signing.yml @@ -2,7 +2,8 @@ rule: meta: name: disable code signing namespace: host-interaction/bootloader - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function att&ck: - Defense Evasion::Subvert Trust Controls::Code Signing Policy Modification [T1553.006] diff --git a/host-interaction/bootloader/manipulate-boot-configuration.yml b/host-interaction/bootloader/manipulate-boot-configuration.yml index ccbd67ae..60b1409b 100644 --- a/host-interaction/bootloader/manipulate-boot-configuration.yml +++ b/host-interaction/bootloader/manipulate-boot-configuration.yml @@ -2,7 +2,8 @@ rule: meta: name: manipulate boot configuration namespace: host-interaction/bootloader - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function references: - https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/bcdedit-command-line-options diff --git a/host-interaction/bootloader/manipulate-safe-mode-programs.yml b/host-interaction/bootloader/manipulate-safe-mode-programs.yml index 7a76fdbb..150ff9b1 100644 --- a/host-interaction/bootloader/manipulate-safe-mode-programs.yml +++ b/host-interaction/bootloader/manipulate-safe-mode-programs.yml @@ -2,7 +2,8 @@ rule: meta: name: manipulate safe mode programs namespace: host-interaction/bootloader - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function att&ck: - Defense Evasion::Impair Defenses::Safe Mode Boot [T1562.009] diff --git a/host-interaction/cli/accept-command-line-arguments.yml b/host-interaction/cli/accept-command-line-arguments.yml index e87f0812..e0f153c1 100644 --- a/host-interaction/cli/accept-command-line-arguments.yml +++ b/host-interaction/cli/accept-command-line-arguments.yml @@ -2,7 +2,8 @@ rule: meta: name: accept command line arguments namespace: host-interaction/cli - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Execution::Command and Scripting Interpreter [T1059] diff --git a/host-interaction/cli/resolve-path-using-msvcrt.yml b/host-interaction/cli/resolve-path-using-msvcrt.yml index ff7287bd..90e700fe 100644 --- a/host-interaction/cli/resolve-path-using-msvcrt.yml +++ b/host-interaction/cli/resolve-path-using-msvcrt.yml @@ -2,7 +2,8 @@ rule: meta: name: resolve path using msvcrt namespace: host-interaction/cli - author: "@_re_fox" + authors: + - "@_re_fox" scope: basic block att&ck: - Discovery::File and Directory Discovery [T1083] diff --git a/host-interaction/clipboard/open-clipboard.yml b/host-interaction/clipboard/open-clipboard.yml index 6b3517bf..b973bf6e 100644 --- a/host-interaction/clipboard/open-clipboard.yml +++ b/host-interaction/clipboard/open-clipboard.yml @@ -2,7 +2,8 @@ rule: meta: name: open clipboard namespace: host-interaction/clipboard - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Collection::Clipboard Data [T1115] diff --git a/host-interaction/clipboard/read-clipboard-data.yml b/host-interaction/clipboard/read-clipboard-data.yml index 9aff144d..76f9b738 100644 --- a/host-interaction/clipboard/read-clipboard-data.yml +++ b/host-interaction/clipboard/read-clipboard-data.yml @@ -2,7 +2,8 @@ rule: meta: name: read clipboard data namespace: host-interaction/clipboard - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Collection::Clipboard Data [T1115] diff --git a/host-interaction/clipboard/replace-clipboard-data.yml b/host-interaction/clipboard/replace-clipboard-data.yml index 6368434f..3b2bb793 100644 --- a/host-interaction/clipboard/replace-clipboard-data.yml +++ b/host-interaction/clipboard/replace-clipboard-data.yml @@ -2,7 +2,8 @@ rule: meta: name: replace clipboard data namespace: host-interaction/clipboard - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Impact::Clipboard Modification [E1510] diff --git a/host-interaction/clipboard/write-clipboard-data.yml b/host-interaction/clipboard/write-clipboard-data.yml index c20b483e..cff4f744 100644 --- a/host-interaction/clipboard/write-clipboard-data.yml +++ b/host-interaction/clipboard/write-clipboard-data.yml @@ -2,7 +2,8 @@ rule: meta: name: write clipboard data namespace: host-interaction/clipboard - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Impact::Clipboard Modification [E1510] diff --git a/host-interaction/console/manipulate-console.yml b/host-interaction/console/manipulate-console.yml index 8e21328f..93c0fa83 100644 --- a/host-interaction/console/manipulate-console.yml +++ b/host-interaction/console/manipulate-console.yml @@ -2,7 +2,8 @@ rule: meta: name: manipulate console namespace: host-interaction/console - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function mbc: - Operating System::Console [C0033] diff --git a/host-interaction/driver/create-device-object.yml b/host-interaction/driver/create-device-object.yml index 5b4d0f84..5f5c82a0 100644 --- a/host-interaction/driver/create-device-object.yml +++ b/host-interaction/driver/create-device-object.yml @@ -2,7 +2,8 @@ rule: meta: name: create device object namespace: host-interaction/driver - author: "@mr-tz" + authors: + - "@mr-tz" scope: function examples: - Practical Malware Analysis Lab 10-03.sys_:0x00010706 diff --git a/host-interaction/driver/disable-driver-code-integrity.yml b/host-interaction/driver/disable-driver-code-integrity.yml index c8124b5d..05948e6e 100644 --- a/host-interaction/driver/disable-driver-code-integrity.yml +++ b/host-interaction/driver/disable-driver-code-integrity.yml @@ -2,7 +2,8 @@ rule: meta: name: disable driver code integrity namespace: host-interaction/driver - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function att&ck: - Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001] diff --git a/host-interaction/driver/install-driver.yml b/host-interaction/driver/install-driver.yml index 2c4d1f4f..a7a7f5e0 100644 --- a/host-interaction/driver/install-driver.yml +++ b/host-interaction/driver/install-driver.yml @@ -2,7 +2,8 @@ rule: meta: name: install driver namespace: host-interaction/driver - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: basic block att&ck: - Persistence::Create or Modify System Process::Windows Service [T1543.003] diff --git a/host-interaction/driver/interact-with-driver-via-control-codes.yml b/host-interaction/driver/interact-with-driver-via-control-codes.yml index 0deceb3a..d54015a5 100644 --- a/host-interaction/driver/interact-with-driver-via-control-codes.yml +++ b/host-interaction/driver/interact-with-driver-via-control-codes.yml @@ -2,7 +2,8 @@ rule: meta: name: interact with driver via control codes namespace: host-interaction/driver - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Execution::System Services::Service Execution [T1569.002] diff --git a/host-interaction/environment-variable/get-comspec-environment-variable.yml b/host-interaction/environment-variable/get-comspec-environment-variable.yml index e175b7c2..cfd446fb 100644 --- a/host-interaction/environment-variable/get-comspec-environment-variable.yml +++ b/host-interaction/environment-variable/get-comspec-environment-variable.yml @@ -2,7 +2,8 @@ rule: meta: name: get COMSPEC environment variable namespace: host-interaction/environment-variable - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: function att&ck: - Discovery::System Information Discovery [T1082] diff --git a/host-interaction/environment-variable/query-environment-variable.yml b/host-interaction/environment-variable/query-environment-variable.yml index 46797de2..48392ae1 100644 --- a/host-interaction/environment-variable/query-environment-variable.yml +++ b/host-interaction/environment-variable/query-environment-variable.yml @@ -2,7 +2,7 @@ rule: meta: name: query environment variable namespace: host-interaction/environment-variable - author: + authors: - michael.hunhoff@mandiant.com - "@_re_fox" scope: function diff --git a/host-interaction/environment-variable/set-environment-variable.yml b/host-interaction/environment-variable/set-environment-variable.yml index 8eb10cdf..c244af7b 100644 --- a/host-interaction/environment-variable/set-environment-variable.yml +++ b/host-interaction/environment-variable/set-environment-variable.yml @@ -2,7 +2,8 @@ rule: meta: name: set environment variable namespace: host-interaction/environment-variable - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Operating System::Environment Variable::Set Variable [C0034.001] diff --git a/host-interaction/file-system/bypass-mark-of-the-web.yml b/host-interaction/file-system/bypass-mark-of-the-web.yml index 9ab18aa2..0f5c40f9 100644 --- a/host-interaction/file-system/bypass-mark-of-the-web.yml +++ b/host-interaction/file-system/bypass-mark-of-the-web.yml @@ -2,7 +2,8 @@ rule: meta: name: bypass Mark of the Web namespace: host-interaction/file-system - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function att&ck: - Defense Evasion::Subvert Trust Controls::Mark-of-the-Web Bypass [T1553.005] diff --git a/host-interaction/file-system/change-file-permission-on-linux.yml b/host-interaction/file-system/change-file-permission-on-linux.yml index 0acb9aa2..872badff 100644 --- a/host-interaction/file-system/change-file-permission-on-linux.yml +++ b/host-interaction/file-system/change-file-permission-on-linux.yml @@ -2,7 +2,8 @@ rule: meta: name: change file permission on Linux namespace: host-interaction/file-system - author: joakim@intezer.com + authors: + - joakim@intezer.com scope: basic block mbc: - File System::Set File Attributes [C0050] diff --git a/host-interaction/file-system/copy/copy-file.yml b/host-interaction/file-system/copy/copy-file.yml index ed06fd26..01e1a161 100644 --- a/host-interaction/file-system/copy/copy-file.yml +++ b/host-interaction/file-system/copy/copy-file.yml @@ -2,7 +2,8 @@ rule: meta: name: copy file namespace: host-interaction/file-system/copy - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - File System::Copy File [C0045] diff --git a/host-interaction/file-system/create/create-directory.yml b/host-interaction/file-system/create/create-directory.yml index 08cb9f8f..aa7543ca 100644 --- a/host-interaction/file-system/create/create-directory.yml +++ b/host-interaction/file-system/create/create-directory.yml @@ -2,7 +2,8 @@ rule: meta: name: create directory namespace: host-interaction/file-system/create - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - File System::Create Directory [C0046] diff --git a/host-interaction/file-system/delete/delete-directory.yml b/host-interaction/file-system/delete/delete-directory.yml index f5f75f64..8adc79be 100644 --- a/host-interaction/file-system/delete/delete-directory.yml +++ b/host-interaction/file-system/delete/delete-directory.yml @@ -2,7 +2,8 @@ rule: meta: name: delete directory namespace: host-interaction/file-system/delete - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - File System::Delete Directory [C0048] diff --git a/host-interaction/file-system/delete/delete-file.yml b/host-interaction/file-system/delete/delete-file.yml index 6d7e5793..99c0d2e2 100644 --- a/host-interaction/file-system/delete/delete-file.yml +++ b/host-interaction/file-system/delete/delete-file.yml @@ -2,7 +2,8 @@ rule: meta: name: delete file namespace: host-interaction/file-system/delete - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - File System::Delete File [C0047] diff --git a/host-interaction/file-system/exists/check-if-file-exists.yml b/host-interaction/file-system/exists/check-if-file-exists.yml index 416e765f..943281cf 100644 --- a/host-interaction/file-system/exists/check-if-file-exists.yml +++ b/host-interaction/file-system/exists/check-if-file-exists.yml @@ -2,7 +2,8 @@ rule: meta: name: check if file exists namespace: host-interaction/file-system/exists - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Discovery::File and Directory Discovery [T1083] diff --git a/host-interaction/file-system/files/list/enumerate-files-on-linux.yml b/host-interaction/file-system/files/list/enumerate-files-on-linux.yml index 42087468..36970863 100644 --- a/host-interaction/file-system/files/list/enumerate-files-on-linux.yml +++ b/host-interaction/file-system/files/list/enumerate-files-on-linux.yml @@ -2,7 +2,8 @@ rule: meta: name: enumerate files on Linux namespace: host-interaction/file-system/files/list - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function att&ck: - Discovery::File and Directory Discovery [T1083] diff --git a/host-interaction/file-system/files/list/enumerate-files-recursively.yml b/host-interaction/file-system/files/list/enumerate-files-recursively.yml index f591b2db..8a30f134 100644 --- a/host-interaction/file-system/files/list/enumerate-files-recursively.yml +++ b/host-interaction/file-system/files/list/enumerate-files-recursively.yml @@ -2,7 +2,8 @@ rule: meta: name: enumerate files recursively namespace: host-interaction/file-system/files/list - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Discovery::File and Directory Discovery [T1083] diff --git a/host-interaction/file-system/files/list/enumerate-files-via-kernel32-functions.yml b/host-interaction/file-system/files/list/enumerate-files-via-kernel32-functions.yml index d09ffb27..d3d69c0f 100644 --- a/host-interaction/file-system/files/list/enumerate-files-via-kernel32-functions.yml +++ b/host-interaction/file-system/files/list/enumerate-files-via-kernel32-functions.yml @@ -2,7 +2,8 @@ rule: meta: name: enumerate files via kernel32 functions namespace: host-interaction/file-system/files/list - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Discovery::File and Directory Discovery [T1083] diff --git a/host-interaction/file-system/files/list/enumerate-files-via-ntdll-functions.yml b/host-interaction/file-system/files/list/enumerate-files-via-ntdll-functions.yml index 5bed5a8d..c3250c3a 100644 --- a/host-interaction/file-system/files/list/enumerate-files-via-ntdll-functions.yml +++ b/host-interaction/file-system/files/list/enumerate-files-via-ntdll-functions.yml @@ -2,7 +2,8 @@ rule: meta: name: enumerate files via ntdll functions namespace: host-interaction/file-system/files/list - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Discovery::File and Directory Discovery [T1083] diff --git a/host-interaction/file-system/get-common-file-path.yml b/host-interaction/file-system/get-common-file-path.yml index 77513fdd..519ea94e 100644 --- a/host-interaction/file-system/get-common-file-path.yml +++ b/host-interaction/file-system/get-common-file-path.yml @@ -2,7 +2,8 @@ rule: meta: name: get common file path namespace: host-interaction/file-system - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Discovery::File and Directory Discovery [T1083] diff --git a/host-interaction/file-system/get-file-system-object-information.yml b/host-interaction/file-system/get-file-system-object-information.yml index d9008663..a5a9d5a5 100644 --- a/host-interaction/file-system/get-file-system-object-information.yml +++ b/host-interaction/file-system/get-file-system-object-information.yml @@ -2,7 +2,8 @@ rule: meta: name: get file system object information namespace: host-interaction/file-system - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Discovery::File and Directory Discovery [T1083] diff --git a/host-interaction/file-system/get-program-files-directory.yml b/host-interaction/file-system/get-program-files-directory.yml index 107a71d6..88dfead3 100644 --- a/host-interaction/file-system/get-program-files-directory.yml +++ b/host-interaction/file-system/get-program-files-directory.yml @@ -2,7 +2,8 @@ rule: meta: name: get Program Files directory namespace: host-interaction/file-system - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: basic block att&ck: - Discovery::File and Directory Discovery [T1083] diff --git a/host-interaction/file-system/meta/get-file-attributes.yml b/host-interaction/file-system/meta/get-file-attributes.yml index 514f8ff5..6782b88c 100644 --- a/host-interaction/file-system/meta/get-file-attributes.yml +++ b/host-interaction/file-system/meta/get-file-attributes.yml @@ -2,7 +2,8 @@ rule: meta: name: get file attributes namespace: host-interaction/file-system/meta - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block mbc: - File System::Get File Attributes [C0049] diff --git a/host-interaction/file-system/meta/get-file-size.yml b/host-interaction/file-system/meta/get-file-size.yml index 2b18305c..d650a23b 100644 --- a/host-interaction/file-system/meta/get-file-size.yml +++ b/host-interaction/file-system/meta/get-file-size.yml @@ -2,7 +2,8 @@ rule: meta: name: get file size namespace: host-interaction/file-system/meta - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::File and Directory Discovery [T1083] diff --git a/host-interaction/file-system/meta/get-file-version-info.yml b/host-interaction/file-system/meta/get-file-version-info.yml index ed208d6b..3f5d93ab 100644 --- a/host-interaction/file-system/meta/get-file-version-info.yml +++ b/host-interaction/file-system/meta/get-file-version-info.yml @@ -2,7 +2,8 @@ rule: meta: name: get file version info namespace: host-interaction/file-system/meta - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::File and Directory Discovery [T1083] diff --git a/host-interaction/file-system/meta/set-file-attributes.yml b/host-interaction/file-system/meta/set-file-attributes.yml index c8f646c1..d6c4abd2 100644 --- a/host-interaction/file-system/meta/set-file-attributes.yml +++ b/host-interaction/file-system/meta/set-file-attributes.yml @@ -2,7 +2,7 @@ rule: meta: name: set file attributes namespace: host-interaction/file-system/meta - author: + authors: - moritz.raabe@mandiant.com - michael.hunhoff@mandiant.com scope: basic block diff --git a/host-interaction/file-system/move/move-file.yml b/host-interaction/file-system/move/move-file.yml index 20ec282c..69b1749f 100644 --- a/host-interaction/file-system/move/move-file.yml +++ b/host-interaction/file-system/move/move-file.yml @@ -2,7 +2,8 @@ rule: meta: name: move file namespace: host-interaction/file-system/move - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - File System::Move File [C0063] diff --git a/host-interaction/file-system/read/read-file-on-linux.yml b/host-interaction/file-system/read/read-file-on-linux.yml index 18b1e9cb..6b1db96b 100644 --- a/host-interaction/file-system/read/read-file-on-linux.yml +++ b/host-interaction/file-system/read/read-file-on-linux.yml @@ -2,7 +2,7 @@ rule: meta: name: read file on Linux namespace: host-interaction/file-system/read - author: + authors: - joakim@intezer.com scope: function mbc: diff --git a/host-interaction/file-system/read/read-file-on-windows.yml b/host-interaction/file-system/read/read-file-on-windows.yml index 6992c1ce..c1af7dba 100644 --- a/host-interaction/file-system/read/read-file-on-windows.yml +++ b/host-interaction/file-system/read/read-file-on-windows.yml @@ -2,7 +2,7 @@ rule: meta: name: read file on Windows namespace: host-interaction/file-system/read - author: + authors: - moritz.raabe@mandiant.com scope: function mbc: diff --git a/host-interaction/file-system/read/read-file-via-mapping.yml b/host-interaction/file-system/read/read-file-via-mapping.yml index 7f932bc3..d7aea180 100644 --- a/host-interaction/file-system/read/read-file-via-mapping.yml +++ b/host-interaction/file-system/read/read-file-via-mapping.yml @@ -2,7 +2,8 @@ rule: meta: name: read file via mapping namespace: host-interaction/file-system/read - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - File System::Read File [C0051] diff --git a/host-interaction/file-system/read/read-ini-file.yml b/host-interaction/file-system/read/read-ini-file.yml index c1f71910..3de512a2 100644 --- a/host-interaction/file-system/read/read-ini-file.yml +++ b/host-interaction/file-system/read/read-ini-file.yml @@ -2,7 +2,7 @@ rule: meta: name: read .ini file namespace: host-interaction/file-system/read - author: + authors: - "@_re_fox" - michael.hunhoff@mandiant.com scope: function diff --git a/host-interaction/file-system/read/read-virtual-disk.yml b/host-interaction/file-system/read/read-virtual-disk.yml index 00021610..b1e72d21 100644 --- a/host-interaction/file-system/read/read-virtual-disk.yml +++ b/host-interaction/file-system/read/read-virtual-disk.yml @@ -2,7 +2,8 @@ rule: meta: name: read virtual disk namespace: host-interaction/file-system/read - author: "@_re_fox" + authors: + - "@_re_fox" scope: function mbc: - File System::Read Virtual Disk [C0056] diff --git a/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml b/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml index 8716d315..67c13e02 100644 --- a/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml +++ b/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml @@ -2,7 +2,8 @@ rule: meta: name: bypass Windows File Protection namespace: host-interaction/file-system/windows-file-protection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Defense Evasion::Disable or Evade Security Tools::Bypass Windows File Protection [F0004.007] diff --git a/host-interaction/file-system/write/write-file-on-linux.yml b/host-interaction/file-system/write/write-file-on-linux.yml index a2752219..ea501c4a 100644 --- a/host-interaction/file-system/write/write-file-on-linux.yml +++ b/host-interaction/file-system/write/write-file-on-linux.yml @@ -2,7 +2,7 @@ rule: meta: name: write file on Linux namespace: host-interaction/file-system/write - author: + authors: - joakim@intezer.com scope: function mbc: diff --git a/host-interaction/file-system/write/write-file-on-windows.yml b/host-interaction/file-system/write/write-file-on-windows.yml index 50941d17..b3916538 100644 --- a/host-interaction/file-system/write/write-file-on-windows.yml +++ b/host-interaction/file-system/write/write-file-on-windows.yml @@ -2,7 +2,7 @@ rule: meta: name: write file on Windows namespace: host-interaction/file-system/write - author: + authors: - william.ballenthin@mandiant.com scope: function mbc: diff --git a/host-interaction/filter/register-minifilter-driver.yml b/host-interaction/filter/register-minifilter-driver.yml index f1ca57cf..71e80fc7 100644 --- a/host-interaction/filter/register-minifilter-driver.yml +++ b/host-interaction/filter/register-minifilter-driver.yml @@ -2,7 +2,8 @@ rule: meta: name: register minifilter driver namespace: host-interaction/filter - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block mbc: - Hardware::Install Driver::Minifilter [C0037.001] diff --git a/host-interaction/filter/start-minifilter-driver.yml b/host-interaction/filter/start-minifilter-driver.yml index 4cbbe3e8..b62e44c0 100644 --- a/host-interaction/filter/start-minifilter-driver.yml +++ b/host-interaction/filter/start-minifilter-driver.yml @@ -2,7 +2,8 @@ rule: meta: name: start minifilter driver namespace: host-interaction/filter - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block mbc: - Hardware::Load Driver::Minifilter [C0023.001] diff --git a/host-interaction/firewall/modify/access-firewall-settings-via-inetfwmgr.yml b/host-interaction/firewall/modify/access-firewall-settings-via-inetfwmgr.yml index b4bf72a5..56976b9d 100644 --- a/host-interaction/firewall/modify/access-firewall-settings-via-inetfwmgr.yml +++ b/host-interaction/firewall/modify/access-firewall-settings-via-inetfwmgr.yml @@ -2,7 +2,8 @@ rule: meta: name: access firewall settings via INetFwMgr namespace: host-interaction/firewall/modify - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Discovery::Software Discovery::Security Software Discovery [T1518.001] diff --git a/host-interaction/gui/console/set-console-window-title.yml b/host-interaction/gui/console/set-console-window-title.yml index ad1ed416..c89d7fe3 100644 --- a/host-interaction/gui/console/set-console-window-title.yml +++ b/host-interaction/gui/console/set-console-window-title.yml @@ -2,7 +2,8 @@ rule: meta: name: set console window title namespace: host-interaction/gui/console - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Operating System::Console [C0033] diff --git a/host-interaction/gui/enumerate-gui-resources.yml b/host-interaction/gui/enumerate-gui-resources.yml index 743511b9..282bfbd6 100644 --- a/host-interaction/gui/enumerate-gui-resources.yml +++ b/host-interaction/gui/enumerate-gui-resources.yml @@ -2,7 +2,8 @@ rule: meta: name: enumerate gui resources namespace: host-interaction/gui - author: johnk3r + authors: + - johnk3r scope: function att&ck: - Discovery::Application Window Discovery [T1010] diff --git a/host-interaction/gui/logon/references-logon-banner.yml b/host-interaction/gui/logon/references-logon-banner.yml index 00e8b767..3f6114e7 100644 --- a/host-interaction/gui/logon/references-logon-banner.yml +++ b/host-interaction/gui/logon/references-logon-banner.yml @@ -2,7 +2,8 @@ rule: meta: name: references logon banner namespace: host-interaction/gui/logon - author: "@_re_fox" + authors: + - "@_re_fox" scope: basic block examples: - c3341b7dfbb9d43bca8c812e07b4299f:0x4066FC diff --git a/host-interaction/gui/session/lock/lock-the-desktop.yml b/host-interaction/gui/session/lock/lock-the-desktop.yml index d7a8f5db..a9343b93 100644 --- a/host-interaction/gui/session/lock/lock-the-desktop.yml +++ b/host-interaction/gui/session/lock/lock-the-desktop.yml @@ -2,7 +2,8 @@ rule: meta: name: lock the desktop namespace: host-interaction/gui/session/lock - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Impact::Endpoint Denial of Service [T1499] diff --git a/host-interaction/gui/session/wallpaper/change-the-wallpaper.yml b/host-interaction/gui/session/wallpaper/change-the-wallpaper.yml index fe6aa2d3..ebe0dc9a 100644 --- a/host-interaction/gui/session/wallpaper/change-the-wallpaper.yml +++ b/host-interaction/gui/session/wallpaper/change-the-wallpaper.yml @@ -2,7 +2,8 @@ rule: meta: name: change the wallpaper namespace: host-interaction/gui/session - author: "@_re_fox" + authors: + - "@_re_fox" scope: basic block mbc: - Operating System::Wallpaper [C0035] diff --git a/host-interaction/gui/set-application-hook.yml b/host-interaction/gui/set-application-hook.yml index 75a53150..530a8ab9 100644 --- a/host-interaction/gui/set-application-hook.yml +++ b/host-interaction/gui/set-application-hook.yml @@ -2,7 +2,8 @@ rule: meta: name: set application hook namespace: host-interaction/gui - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function examples: - Practical Malware Analysis Lab 12-03.exe_:0x401000 diff --git a/host-interaction/gui/taskbar/find/find-taskbar.yml b/host-interaction/gui/taskbar/find/find-taskbar.yml index 0c6d451c..324f02f8 100644 --- a/host-interaction/gui/taskbar/find/find-taskbar.yml +++ b/host-interaction/gui/taskbar/find/find-taskbar.yml @@ -2,7 +2,8 @@ rule: meta: name: find taskbar namespace: host-interaction/gui/taskbar/find - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - Discovery::Taskbar Discovery [B0043] diff --git a/host-interaction/gui/taskbar/hide/hide-the-windows-taskbar.yml b/host-interaction/gui/taskbar/hide/hide-the-windows-taskbar.yml index afce5b75..5e670e5b 100644 --- a/host-interaction/gui/taskbar/hide/hide-the-windows-taskbar.yml +++ b/host-interaction/gui/taskbar/hide/hide-the-windows-taskbar.yml @@ -2,7 +2,8 @@ rule: meta: name: hide the Windows taskbar namespace: host-interaction/gui/taskbar/hide - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Defense Evasion::Hide Artifacts [T1564] diff --git a/host-interaction/gui/window/find/find-graphical-window.yml b/host-interaction/gui/window/find/find-graphical-window.yml index 4d410f46..7113a1bc 100644 --- a/host-interaction/gui/window/find/find-graphical-window.yml +++ b/host-interaction/gui/window/find/find-graphical-window.yml @@ -2,7 +2,8 @@ rule: meta: name: find graphical window namespace: host-interaction/gui/window/find - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Discovery::Application Window Discovery [T1010] diff --git a/host-interaction/gui/window/get-text/get-graphical-window-text.yml b/host-interaction/gui/window/get-text/get-graphical-window-text.yml index 527bfc3c..203d6610 100644 --- a/host-interaction/gui/window/get-text/get-graphical-window-text.yml +++ b/host-interaction/gui/window/get-text/get-graphical-window-text.yml @@ -2,7 +2,8 @@ rule: meta: name: get graphical window text namespace: host-interaction/gui/window/get-text - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - Discovery::Application Window Discovery::Window Text [E1010.m01] diff --git a/host-interaction/gui/window/hide/hide-graphical-window.yml b/host-interaction/gui/window/hide/hide-graphical-window.yml index 90c36a23..da4ae933 100644 --- a/host-interaction/gui/window/hide/hide-graphical-window.yml +++ b/host-interaction/gui/window/hide/hide-graphical-window.yml @@ -2,7 +2,8 @@ rule: meta: name: hide graphical window namespace: host-interaction/gui/window/hide - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Defense Evasion::Hide Artifacts::Hidden Window [T1564.003] diff --git a/host-interaction/hardware/cdrom/manipulate-cd-rom-drive.yml b/host-interaction/hardware/cdrom/manipulate-cd-rom-drive.yml index 0d990716..e1239ce6 100644 --- a/host-interaction/hardware/cdrom/manipulate-cd-rom-drive.yml +++ b/host-interaction/hardware/cdrom/manipulate-cd-rom-drive.yml @@ -2,7 +2,8 @@ rule: meta: name: manipulate CD-ROM drive namespace: host-interaction/hardware/cdrom - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Impact::Modify Hardware::CDROM [B0042.001] diff --git a/host-interaction/hardware/cpu/get-cpu-information.yml b/host-interaction/hardware/cpu/get-cpu-information.yml index d2d7205b..5704b98f 100644 --- a/host-interaction/hardware/cpu/get-cpu-information.yml +++ b/host-interaction/hardware/cpu/get-cpu-information.yml @@ -2,7 +2,7 @@ rule: meta: name: get CPU information namespace: host-interaction/hardware/cpu - author: + authors: - moritz.raabe@mandiant.com - joakim@intezer.com scope: function diff --git a/host-interaction/hardware/cpu/get-number-of-processor-cores.yml b/host-interaction/hardware/cpu/get-number-of-processor-cores.yml index 2e72d3a3..b8762020 100644 --- a/host-interaction/hardware/cpu/get-number-of-processor-cores.yml +++ b/host-interaction/hardware/cpu/get-number-of-processor-cores.yml @@ -2,7 +2,8 @@ rule: meta: name: get number of processor cores namespace: host-interaction/hardware/cpu - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::System Information Discovery [T1082] diff --git a/host-interaction/hardware/cpu/get-number-of-processors.yml b/host-interaction/hardware/cpu/get-number-of-processors.yml index 4b3895fd..9a9c5398 100644 --- a/host-interaction/hardware/cpu/get-number-of-processors.yml +++ b/host-interaction/hardware/cpu/get-number-of-processors.yml @@ -2,7 +2,8 @@ rule: meta: name: get number of processors namespace: host-interaction/hardware/cpu - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::System Information Discovery [T1082] diff --git a/host-interaction/hardware/keyboard/get-keyboard-layout.yml b/host-interaction/hardware/keyboard/get-keyboard-layout.yml index 8c2f18a6..5bbc2102 100644 --- a/host-interaction/hardware/keyboard/get-keyboard-layout.yml +++ b/host-interaction/hardware/keyboard/get-keyboard-layout.yml @@ -2,7 +2,8 @@ rule: meta: name: get keyboard layout namespace: host-interaction/hardware/keyboard - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::System Location Discovery::System Language Discovery [T1614.001] diff --git a/host-interaction/hardware/keyboard/simulate-ctrl-alt-del.yml b/host-interaction/hardware/keyboard/simulate-ctrl-alt-del.yml index 9aedf1c4..2d9bf462 100644 --- a/host-interaction/hardware/keyboard/simulate-ctrl-alt-del.yml +++ b/host-interaction/hardware/keyboard/simulate-ctrl-alt-del.yml @@ -2,7 +2,7 @@ rule: meta: name: simulate CTRL ALT DEL namespace: host-interaction/hardware/keyboard - author: + authors: - michael.hunhoff@mandiant.com - johnk3r scope: function diff --git a/host-interaction/hardware/memory/get-memory-capacity.yml b/host-interaction/hardware/memory/get-memory-capacity.yml index 1df3f5b6..017640ec 100644 --- a/host-interaction/hardware/memory/get-memory-capacity.yml +++ b/host-interaction/hardware/memory/get-memory-capacity.yml @@ -2,7 +2,8 @@ rule: meta: name: get memory capacity namespace: host-interaction/hardware/memory - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Discovery::System Information Discovery [T1082] diff --git a/host-interaction/hardware/memory/get-memory-information.yml b/host-interaction/hardware/memory/get-memory-information.yml index b3fc5aa6..8827b407 100644 --- a/host-interaction/hardware/memory/get-memory-information.yml +++ b/host-interaction/hardware/memory/get-memory-information.yml @@ -2,7 +2,8 @@ rule: meta: name: get memory information namespace: host-interaction/hardware/memory - author: joakim@intezer.com + authors: + - joakim@intezer.com scope: function att&ck: - Discovery::System Information Discovery [T1082] diff --git a/host-interaction/hardware/mouse/swap-mouse-buttons.yml b/host-interaction/hardware/mouse/swap-mouse-buttons.yml index 666d7abb..f5390162 100644 --- a/host-interaction/hardware/mouse/swap-mouse-buttons.yml +++ b/host-interaction/hardware/mouse/swap-mouse-buttons.yml @@ -2,7 +2,8 @@ rule: meta: name: swap mouse buttons namespace: host-interaction/hardware/mouse - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - Impact::Modify Hardware::Mouse [B0042.002] diff --git a/host-interaction/hardware/storage/enumerate-disk-properties.yml b/host-interaction/hardware/storage/enumerate-disk-properties.yml index 4d7b9783..6118e8a5 100644 --- a/host-interaction/hardware/storage/enumerate-disk-properties.yml +++ b/host-interaction/hardware/storage/enumerate-disk-properties.yml @@ -2,7 +2,8 @@ rule: meta: name: enumerate disk properties namespace: host-interaction/hardware/storage - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::System Information Discovery [T1082] diff --git a/host-interaction/hardware/storage/get-disk-information.yml b/host-interaction/hardware/storage/get-disk-information.yml index e174a6a9..a23fd95c 100644 --- a/host-interaction/hardware/storage/get-disk-information.yml +++ b/host-interaction/hardware/storage/get-disk-information.yml @@ -2,7 +2,8 @@ rule: meta: name: get disk information namespace: host-interaction/hardware/storage - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Discovery::System Information Discovery [T1082] diff --git a/host-interaction/hardware/storage/get-disk-size.yml b/host-interaction/hardware/storage/get-disk-size.yml index 958c84e1..248a58fa 100644 --- a/host-interaction/hardware/storage/get-disk-size.yml +++ b/host-interaction/hardware/storage/get-disk-size.yml @@ -2,7 +2,8 @@ rule: meta: name: get disk size namespace: host-interaction/hardware/storage - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::System Information Discovery [T1082] diff --git a/host-interaction/log/clfs/read-data-from-clfs-log-container.yml b/host-interaction/log/clfs/read-data-from-clfs-log-container.yml index 37838ee3..1b308263 100755 --- a/host-interaction/log/clfs/read-data-from-clfs-log-container.yml +++ b/host-interaction/log/clfs/read-data-from-clfs-log-container.yml @@ -3,7 +3,8 @@ rule: meta: name: read data from CLFS log container namespace: host-interaction/log/clfs/read - author: blaine.stancill@mandiant.com + authors: + - blaine.stancill@mandiant.com scope: function mbc: - Discovery::File and Directory Discovery::Log File [E1083.m01] diff --git a/host-interaction/log/debug/write-event/print-debug-messages.yml b/host-interaction/log/debug/write-event/print-debug-messages.yml index 102b5263..67fe5b27 100644 --- a/host-interaction/log/debug/write-event/print-debug-messages.yml +++ b/host-interaction/log/debug/write-event/print-debug-messages.yml @@ -2,7 +2,8 @@ rule: meta: name: print debug messages namespace: host-interaction/log/debug/write-event - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function examples: - 493167E85E45363D09495D0841C30648:0x401000 diff --git a/host-interaction/log/winevt/access/access-the-windows-event-log.yml b/host-interaction/log/winevt/access/access-the-windows-event-log.yml index edfc8712..8d86a219 100644 --- a/host-interaction/log/winevt/access/access-the-windows-event-log.yml +++ b/host-interaction/log/winevt/access/access-the-windows-event-log.yml @@ -2,7 +2,8 @@ rule: meta: name: access the Windows event log namespace: host-interaction/log/winevt/access - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - Discovery::File and Directory Discovery::Log File [E1083.m01] diff --git a/host-interaction/mutex/check-mutex-and-exit.yml b/host-interaction/mutex/check-mutex-and-exit.yml index 907b3d39..37a3ba08 100644 --- a/host-interaction/mutex/check-mutex-and-exit.yml +++ b/host-interaction/mutex/check-mutex-and-exit.yml @@ -2,7 +2,7 @@ rule: meta: name: check mutex and exit namespace: host-interaction/mutex - author: + authors: - "@_re_fox" - moritz.raabe@mandiant.com scope: function diff --git a/host-interaction/mutex/check-mutex.yml b/host-interaction/mutex/check-mutex.yml index 5a2c4e67..f87e02eb 100644 --- a/host-interaction/mutex/check-mutex.yml +++ b/host-interaction/mutex/check-mutex.yml @@ -2,7 +2,8 @@ rule: meta: name: check mutex namespace: host-interaction/mutex - author: moritz.raabem@mandiant.com + authors: + - moritz.raabem@mandiant.com scope: basic block mbc: - Process::Check Mutex [C0043] diff --git a/host-interaction/mutex/create-mutex.yml b/host-interaction/mutex/create-mutex.yml index 14aa8269..9e22d95c 100644 --- a/host-interaction/mutex/create-mutex.yml +++ b/host-interaction/mutex/create-mutex.yml @@ -2,7 +2,8 @@ rule: meta: name: create mutex namespace: host-interaction/mutex - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - Process::Create Mutex [C0042] diff --git a/host-interaction/mutex/lock-file.yml b/host-interaction/mutex/lock-file.yml index 9f3e4201..cac4863f 100644 --- a/host-interaction/mutex/lock-file.yml +++ b/host-interaction/mutex/lock-file.yml @@ -2,7 +2,8 @@ rule: meta: name: lock file namespace: host-interaction/mutex - author: joakim@intezer.com + authors: + - joakim@intezer.com scope: basic block mbc: - Process::Create Mutex [C0042] diff --git a/host-interaction/network/address/get-local-ipv4-addresses.yml b/host-interaction/network/address/get-local-ipv4-addresses.yml index 3147acbb..92afbadf 100644 --- a/host-interaction/network/address/get-local-ipv4-addresses.yml +++ b/host-interaction/network/address/get-local-ipv4-addresses.yml @@ -2,7 +2,7 @@ rule: meta: name: get local IPv4 addresses namespace: host-interaction/network/address - author: + authors: - moritz.raabe@mandiant.com - joakim@intezer.com scope: function diff --git a/host-interaction/network/connectivity/check-internet-connectivity-via-wininet.yml b/host-interaction/network/connectivity/check-internet-connectivity-via-wininet.yml index 140c45b8..3f74f98c 100644 --- a/host-interaction/network/connectivity/check-internet-connectivity-via-wininet.yml +++ b/host-interaction/network/connectivity/check-internet-connectivity-via-wininet.yml @@ -2,7 +2,7 @@ rule: meta: name: check Internet connectivity via WinINet namespace: host-interaction/network/connectivity - author: + authors: - matthew.williams@mandiant.com - michael.hunhoff@mandiant.com scope: basic block diff --git a/host-interaction/network/dns/resolve/resolve-dns.yml b/host-interaction/network/dns/resolve/resolve-dns.yml index 659b575a..a4aad1dd 100644 --- a/host-interaction/network/dns/resolve/resolve-dns.yml +++ b/host-interaction/network/dns/resolve/resolve-dns.yml @@ -2,7 +2,7 @@ rule: meta: name: resolve DNS namespace: host-interaction/network/dns/resolve - author: + authors: - william.ballenthin@mandiant.com - johnk3r - joakim@intezer.com diff --git a/host-interaction/network/domain/enumerate-domain-computers-via-ldap.yml b/host-interaction/network/domain/enumerate-domain-computers-via-ldap.yml index b4336b97..2cb447de 100644 --- a/host-interaction/network/domain/enumerate-domain-computers-via-ldap.yml +++ b/host-interaction/network/domain/enumerate-domain-computers-via-ldap.yml @@ -2,7 +2,8 @@ rule: meta: name: enumerate domain computers via LDAP namespace: host-interaction/network/domain - author: awillia2@cisco.com + authors: + - awillia2@cisco.com description: Looks for an LDAP query and related Windows API calls used to enumerate other computers on the Windows domain that a computer is connected to. scope: function att&ck: diff --git a/host-interaction/network/domain/get-domain-controller-name.yml b/host-interaction/network/domain/get-domain-controller-name.yml index aabbb14a..028a9872 100644 --- a/host-interaction/network/domain/get-domain-controller-name.yml +++ b/host-interaction/network/domain/get-domain-controller-name.yml @@ -2,7 +2,8 @@ rule: meta: name: get domain controller name namespace: host-interaction/network/domain - author: awillia2@cisco.com + authors: + - awillia2@cisco.com description: Looks for calls to Windows APIs that can be used to determine the name of the domain controller for a Windows domain that a computer is connected to. scope: function att&ck: diff --git a/host-interaction/network/domain/get-domain-information.yml b/host-interaction/network/domain/get-domain-information.yml index af5d0837..a76b364e 100644 --- a/host-interaction/network/domain/get-domain-information.yml +++ b/host-interaction/network/domain/get-domain-information.yml @@ -2,7 +2,8 @@ rule: meta: name: get domain information namespace: host-interaction/network/domain - author: awillia2@cisco.com + authors: + - awillia2@cisco.com description: Looks for imported Windows APIs being called to collect information about the Windows domain that a computer is connected to. scope: function att&ck: diff --git a/host-interaction/network/interface/get-networking-interfaces.yml b/host-interaction/network/interface/get-networking-interfaces.yml index 86637564..9d476a87 100644 --- a/host-interaction/network/interface/get-networking-interfaces.yml +++ b/host-interaction/network/interface/get-networking-interfaces.yml @@ -2,7 +2,7 @@ rule: meta: name: get networking interfaces namespace: host-interaction/network/interface - author: + authors: - moritz.raabe@mandiant.com - joakim@intezer.com scope: function diff --git a/host-interaction/network/traffic/copy/copy-network-traffic.yml b/host-interaction/network/traffic/copy/copy-network-traffic.yml index d84735a4..0747b5c1 100644 --- a/host-interaction/network/traffic/copy/copy-network-traffic.yml +++ b/host-interaction/network/traffic/copy/copy-network-traffic.yml @@ -2,7 +2,8 @@ rule: meta: name: copy network traffic namespace: host-interaction/network/traffic/copy - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::Network Sniffing [T1040] diff --git a/host-interaction/network/traffic/filter/register-network-filter-via-wfp-api.yml b/host-interaction/network/traffic/filter/register-network-filter-via-wfp-api.yml index 71255f8b..9a3a89be 100644 --- a/host-interaction/network/traffic/filter/register-network-filter-via-wfp-api.yml +++ b/host-interaction/network/traffic/filter/register-network-filter-via-wfp-api.yml @@ -2,7 +2,8 @@ rule: meta: name: register network filter via WFP API namespace: host-interaction/network/traffic/filter - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Impact::Data Manipulation::Transmitted Data Manipulation [T1565.002] diff --git a/host-interaction/os/hostname/get-hostname.yml b/host-interaction/os/hostname/get-hostname.yml index 430ab8e9..6fc8ca44 100644 --- a/host-interaction/os/hostname/get-hostname.yml +++ b/host-interaction/os/hostname/get-hostname.yml @@ -2,7 +2,7 @@ rule: meta: name: get hostname namespace: host-interaction/os/hostname - author: + authors: - moritz.raabe@mandiant.com - joakim@intezer.com scope: function diff --git a/host-interaction/os/info/get-system-information-on-windows.yml b/host-interaction/os/info/get-system-information-on-windows.yml index fb1858d2..ee8bdb49 100644 --- a/host-interaction/os/info/get-system-information-on-windows.yml +++ b/host-interaction/os/info/get-system-information-on-windows.yml @@ -2,7 +2,7 @@ rule: meta: name: get system information on Windows namespace: host-interaction/os/info - author: + authors: - moritz.raabe@mandiant.com - joakim@intezer.com scope: function diff --git a/host-interaction/os/shutdown-system.yml b/host-interaction/os/shutdown-system.yml index b850acdc..c1fa5e9a 100644 --- a/host-interaction/os/shutdown-system.yml +++ b/host-interaction/os/shutdown-system.yml @@ -2,7 +2,8 @@ rule: meta: name: shutdown system namespace: host-interaction/os - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Impact::System Shutdown/Reboot [T1529] diff --git a/host-interaction/os/version/check-os-version.yml b/host-interaction/os/version/check-os-version.yml index d2c9f829..942f229e 100644 --- a/host-interaction/os/version/check-os-version.yml +++ b/host-interaction/os/version/check-os-version.yml @@ -2,7 +2,7 @@ rule: meta: name: check OS version namespace: host-interaction/os/version - author: + authors: - michael.hunhoff@mandiant.com - johnk3r scope: function diff --git a/host-interaction/os/version/get-kernel-version.yml b/host-interaction/os/version/get-kernel-version.yml index 1c34e397..cc39769b 100644 --- a/host-interaction/os/version/get-kernel-version.yml +++ b/host-interaction/os/version/get-kernel-version.yml @@ -2,7 +2,8 @@ rule: meta: name: get kernel version namespace: host-interaction/os/version - author: joakim@intezer.com + authors: + - joakim@intezer.com scope: function att&ck: - Discovery::System Information Discovery [T1082] diff --git a/host-interaction/os/version/get-linux-distribution.yml b/host-interaction/os/version/get-linux-distribution.yml index 573675c1..a5ab0ce4 100644 --- a/host-interaction/os/version/get-linux-distribution.yml +++ b/host-interaction/os/version/get-linux-distribution.yml @@ -2,7 +2,8 @@ rule: meta: name: get Linux distribution namespace: host-interaction/os/version - author: joakim@intezer.com + authors: + - joakim@intezer.com scope: function att&ck: - Discovery::System Information Discovery [T1082] diff --git a/host-interaction/process/allocate-thread-local-storage.yml b/host-interaction/process/allocate-thread-local-storage.yml index 801a5f62..0313f726 100644 --- a/host-interaction/process/allocate-thread-local-storage.yml +++ b/host-interaction/process/allocate-thread-local-storage.yml @@ -2,7 +2,8 @@ rule: meta: name: allocate thread local storage namespace: host-interaction/process - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Process::Allocate Thread Local Storage [C0040] diff --git a/host-interaction/process/create/create-a-process-with-modified-io-handles-and-window.yml b/host-interaction/process/create/create-a-process-with-modified-io-handles-and-window.yml index 6fd47a1f..c9ec9999 100644 --- a/host-interaction/process/create/create-a-process-with-modified-io-handles-and-window.yml +++ b/host-interaction/process/create/create-a-process-with-modified-io-handles-and-window.yml @@ -2,7 +2,8 @@ rule: meta: name: create a process with modified I/O handles and window namespace: host-interaction/process/create - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: function mbc: - Process::Create Process [C0017] diff --git a/host-interaction/process/create/create-process-on-linux.yml b/host-interaction/process/create/create-process-on-linux.yml index 4bfd10bc..44987b88 100644 --- a/host-interaction/process/create/create-process-on-linux.yml +++ b/host-interaction/process/create/create-process-on-linux.yml @@ -2,7 +2,7 @@ rule: meta: name: create process on Linux namespace: host-interaction/process/create - author: + authors: - joakim@intezer.com scope: basic block mbc: diff --git a/host-interaction/process/create/create-process-on-windows.yml b/host-interaction/process/create/create-process-on-windows.yml index af112731..d37402ec 100644 --- a/host-interaction/process/create/create-process-on-windows.yml +++ b/host-interaction/process/create/create-process-on-windows.yml @@ -2,7 +2,7 @@ rule: meta: name: create process on Windows namespace: host-interaction/process/create - author: + authors: - moritz.raabe@mandiant.com scope: basic block mbc: diff --git a/host-interaction/process/create/create-process-suspended.yml b/host-interaction/process/create/create-process-suspended.yml index a897ffd0..63e50e71 100644 --- a/host-interaction/process/create/create-process-suspended.yml +++ b/host-interaction/process/create/create-process-suspended.yml @@ -2,7 +2,8 @@ rule: meta: name: create process suspended namespace: host-interaction/process/create - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: basic block mbc: - Process::Create Process::Create Suspended Process [C0017.003] diff --git a/host-interaction/process/create/execute-command.yml b/host-interaction/process/create/execute-command.yml index 95ba9037..1ca1d9fd 100644 --- a/host-interaction/process/create/execute-command.yml +++ b/host-interaction/process/create/execute-command.yml @@ -2,7 +2,8 @@ rule: meta: name: execute command namespace: host-interaction/process/create - author: "@mr-tz" + authors: + - "@mr-tz" scope: function mbc: - Process::Create Process [C0017] diff --git a/host-interaction/process/dump/create-process-memory-minidump.yml b/host-interaction/process/dump/create-process-memory-minidump.yml index e361d4d1..14e5d39c 100644 --- a/host-interaction/process/dump/create-process-memory-minidump.yml +++ b/host-interaction/process/dump/create-process-memory-minidump.yml @@ -3,7 +3,8 @@ rule: meta: name: create process memory minidump namespace: host-interaction/process/dump - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block mbc: - File System::Writes File [C0052] diff --git a/host-interaction/process/get-process-heap-flags.yml b/host-interaction/process/get-process-heap-flags.yml index 1ecc43d6..50683b13 100644 --- a/host-interaction/process/get-process-heap-flags.yml +++ b/host-interaction/process/get-process-heap-flags.yml @@ -2,7 +2,8 @@ rule: meta: name: get process heap flags namespace: host-interaction/process - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Discovery::Process Discovery [T1057] diff --git a/host-interaction/process/get-process-heap-force-flags.yml b/host-interaction/process/get-process-heap-force-flags.yml index 7de5c80c..408ef028 100644 --- a/host-interaction/process/get-process-heap-force-flags.yml +++ b/host-interaction/process/get-process-heap-force-flags.yml @@ -2,7 +2,8 @@ rule: meta: name: get process heap force flags namespace: host-interaction/process - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Discovery::Process Discovery [T1057] diff --git a/host-interaction/process/inject/allocate-rwx-memory.yml b/host-interaction/process/inject/allocate-rwx-memory.yml index 8e3d3d45..d8587e00 100644 --- a/host-interaction/process/inject/allocate-rwx-memory.yml +++ b/host-interaction/process/inject/allocate-rwx-memory.yml @@ -2,7 +2,8 @@ rule: meta: name: allocate RWX memory namespace: host-interaction/process/inject - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: basic block mbc: - Memory::Allocate Memory [C0007] diff --git a/host-interaction/process/inject/allocate-user-process-rwx-memory.yml b/host-interaction/process/inject/allocate-user-process-rwx-memory.yml index 3bbe1ce7..d2f4b40a 100644 --- a/host-interaction/process/inject/allocate-user-process-rwx-memory.yml +++ b/host-interaction/process/inject/allocate-user-process-rwx-memory.yml @@ -2,7 +2,8 @@ rule: meta: name: allocate user process RWX memory namespace: host-interaction/process/inject - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Defense Evasion::Process Injection [T1055] diff --git a/host-interaction/process/inject/attach-user-process-memory.yml b/host-interaction/process/inject/attach-user-process-memory.yml index 74cf5f3c..8335bdb3 100644 --- a/host-interaction/process/inject/attach-user-process-memory.yml +++ b/host-interaction/process/inject/attach-user-process-memory.yml @@ -2,7 +2,8 @@ rule: meta: name: attach user process memory namespace: host-interaction/process/inject - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Defense Evasion::Process Injection [T1055] diff --git a/host-interaction/process/inject/free-user-process-memory.yml b/host-interaction/process/inject/free-user-process-memory.yml index ae321f17..8b0baec7 100644 --- a/host-interaction/process/inject/free-user-process-memory.yml +++ b/host-interaction/process/inject/free-user-process-memory.yml @@ -2,7 +2,8 @@ rule: meta: name: free user process memory namespace: host-interaction/process/inject - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Defense Evasion::Process Injection [T1055] diff --git a/host-interaction/process/inject/hijack-thread-execution.yml b/host-interaction/process/inject/hijack-thread-execution.yml index 1a12441b..6ecbae26 100644 --- a/host-interaction/process/inject/hijack-thread-execution.yml +++ b/host-interaction/process/inject/hijack-thread-execution.yml @@ -2,7 +2,7 @@ rule: meta: name: hijack thread execution namespace: host-interaction/process/inject - author: + authors: - 0x534a@mailbox.org - michael.hunhoff@mandiant.com scope: function diff --git a/host-interaction/process/inject/inject-apc.yml b/host-interaction/process/inject/inject-apc.yml index 0eca6a06..d6596d21 100644 --- a/host-interaction/process/inject/inject-apc.yml +++ b/host-interaction/process/inject/inject-apc.yml @@ -2,7 +2,8 @@ rule: meta: name: inject APC namespace: host-interaction/process/inject - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function att&ck: - Defense Evasion::Process Injection::Asynchronous Procedure Call [T1055.004] diff --git a/host-interaction/process/inject/inject-dll.yml b/host-interaction/process/inject/inject-dll.yml index ba184ad0..a9276aa1 100644 --- a/host-interaction/process/inject/inject-dll.yml +++ b/host-interaction/process/inject/inject-dll.yml @@ -2,7 +2,8 @@ rule: meta: name: inject dll namespace: host-interaction/process/inject - author: 0x534a@mailbox.org + authors: + - 0x534a@mailbox.org scope: function att&ck: - Defense Evasion::Process Injection::Dynamic-link Library Injection [T1055.001] diff --git a/host-interaction/process/inject/inject-pe.yml b/host-interaction/process/inject/inject-pe.yml index 992ea79f..3ce5e81b 100644 --- a/host-interaction/process/inject/inject-pe.yml +++ b/host-interaction/process/inject/inject-pe.yml @@ -2,7 +2,8 @@ rule: meta: name: inject pe namespace: host-interaction/process/inject - author: 0x534a@mailbox.org + authors: + - 0x534a@mailbox.org scope: function att&ck: - Defense Evasion::Process Injection::Portable Executable Injection [T1055.002] diff --git a/host-interaction/process/inject/inject-shellcode-using-a-file-mapping-object.yml b/host-interaction/process/inject/inject-shellcode-using-a-file-mapping-object.yml index 6d3d256a..7bf617d3 100644 --- a/host-interaction/process/inject/inject-shellcode-using-a-file-mapping-object.yml +++ b/host-interaction/process/inject/inject-shellcode-using-a-file-mapping-object.yml @@ -2,7 +2,8 @@ rule: meta: name: inject shellcode using a file mapping object namespace: host-interaction/process/inject - author: jakub.jozwiak@mandiant.com + authors: + - jakub.jozwiak@mandiant.com scope: function att&ck: - Defense Evasion::Process Injection [T1055] diff --git a/host-interaction/process/inject/inject-thread.yml b/host-interaction/process/inject/inject-thread.yml index 79c618bf..97a66feb 100644 --- a/host-interaction/process/inject/inject-thread.yml +++ b/host-interaction/process/inject/inject-thread.yml @@ -2,7 +2,7 @@ rule: meta: name: inject thread namespace: host-interaction/process/inject - author: + authors: - anamaria.martinezgom@mandiant.com - 0x534a@mailbox.org scope: function diff --git a/host-interaction/process/inject/use-process-doppelgänging.yml b/host-interaction/process/inject/use-process-doppelgänging.yml index 41d9017c..866ced9b 100644 --- a/host-interaction/process/inject/use-process-doppelgänging.yml +++ b/host-interaction/process/inject/use-process-doppelgänging.yml @@ -2,7 +2,8 @@ rule: meta: name: use process Doppelgänging namespace: host-interaction/process/inject - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: file att&ck: - Defense Evasion::Process Injection::Process Doppelgänging [T1055.013] diff --git a/host-interaction/process/inject/use-process-replacement.yml b/host-interaction/process/inject/use-process-replacement.yml index aec731ba..1f11157a 100644 --- a/host-interaction/process/inject/use-process-replacement.yml +++ b/host-interaction/process/inject/use-process-replacement.yml @@ -2,7 +2,8 @@ rule: meta: name: use process replacement namespace: host-interaction/process/inject - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function att&ck: - Defense Evasion::Process Injection::Process Hollowing [T1055.012] diff --git a/host-interaction/process/list/enumerate-processes-on-remote-desktop-session-host.yml b/host-interaction/process/list/enumerate-processes-on-remote-desktop-session-host.yml index e39998f4..7f32dd57 100644 --- a/host-interaction/process/list/enumerate-processes-on-remote-desktop-session-host.yml +++ b/host-interaction/process/list/enumerate-processes-on-remote-desktop-session-host.yml @@ -2,7 +2,8 @@ rule: meta: name: enumerate processes on remote desktop session host namespace: host-interaction/process/list - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::Process Discovery [T1057] diff --git a/host-interaction/process/list/enumerate-processes-via-ntquerysysteminformation.yml b/host-interaction/process/list/enumerate-processes-via-ntquerysysteminformation.yml index 054d9dfc..b3c602a4 100644 --- a/host-interaction/process/list/enumerate-processes-via-ntquerysysteminformation.yml +++ b/host-interaction/process/list/enumerate-processes-via-ntquerysysteminformation.yml @@ -2,7 +2,8 @@ rule: meta: name: enumerate processes via NtQuerySystemInformation namespace: host-interaction/process/list - author: "@_re_fox" + authors: + - "@_re_fox" scope: basic block att&ck: - Discovery::Process Discovery [T1057] diff --git a/host-interaction/process/list/enumerate-processes.yml b/host-interaction/process/list/enumerate-processes.yml index 4191ed72..7439bcf8 100644 --- a/host-interaction/process/list/enumerate-processes.yml +++ b/host-interaction/process/list/enumerate-processes.yml @@ -2,7 +2,8 @@ rule: meta: name: enumerate processes namespace: host-interaction/process/list - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Discovery::Process Discovery [T1057] diff --git a/host-interaction/process/list/find-process-by-pid.yml b/host-interaction/process/list/find-process-by-pid.yml index 043b1150..7ec36fe9 100644 --- a/host-interaction/process/list/find-process-by-pid.yml +++ b/host-interaction/process/list/find-process-by-pid.yml @@ -2,7 +2,8 @@ rule: meta: name: find process by PID namespace: host-interaction/process/list - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::Process Discovery [T1057] diff --git a/host-interaction/process/list/get-explorer-pid.yml b/host-interaction/process/list/get-explorer-pid.yml index 6cd63622..0d3e888e 100644 --- a/host-interaction/process/list/get-explorer-pid.yml +++ b/host-interaction/process/list/get-explorer-pid.yml @@ -2,7 +2,8 @@ rule: meta: name: get Explorer PID namespace: host-interaction/process/list - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Discovery::Process Discovery [T1057] diff --git a/host-interaction/process/modify/acquire-debug-privileges.yml b/host-interaction/process/modify/acquire-debug-privileges.yml index f0719264..35893a61 100644 --- a/host-interaction/process/modify/acquire-debug-privileges.yml +++ b/host-interaction/process/modify/acquire-debug-privileges.yml @@ -2,7 +2,8 @@ rule: meta: name: acquire debug privileges namespace: host-interaction/process/modify - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: basic block att&ck: - Privilege Escalation::Access Token Manipulation [T1134] diff --git a/host-interaction/process/modify/modify-access-privileges.yml b/host-interaction/process/modify/modify-access-privileges.yml index adba3a28..e127f503 100644 --- a/host-interaction/process/modify/modify-access-privileges.yml +++ b/host-interaction/process/modify/modify-access-privileges.yml @@ -2,7 +2,8 @@ rule: meta: name: modify access privileges namespace: host-interaction/process/modify - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Privilege Escalation::Access Token Manipulation [T1134] diff --git a/host-interaction/process/modules/list/enumerate-process-modules.yml b/host-interaction/process/modules/list/enumerate-process-modules.yml index d4179eec..708e4ddc 100644 --- a/host-interaction/process/modules/list/enumerate-process-modules.yml +++ b/host-interaction/process/modules/list/enumerate-process-modules.yml @@ -2,7 +2,8 @@ rule: meta: name: enumerate process modules namespace: host-interaction/process/modules/list - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::Process Discovery [T1057] diff --git a/host-interaction/process/set-thread-local-storage-value.yml b/host-interaction/process/set-thread-local-storage-value.yml index 3f06c506..edb7329a 100644 --- a/host-interaction/process/set-thread-local-storage-value.yml +++ b/host-interaction/process/set-thread-local-storage-value.yml @@ -2,7 +2,8 @@ rule: meta: name: set thread local storage value namespace: host-interaction/process - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Process::Set Thread Local Storage Value [C0041] diff --git a/host-interaction/process/terminate/terminate-process-via-fastfail.yml b/host-interaction/process/terminate/terminate-process-via-fastfail.yml index e657d0e9..d6ab318f 100644 --- a/host-interaction/process/terminate/terminate-process-via-fastfail.yml +++ b/host-interaction/process/terminate/terminate-process-via-fastfail.yml @@ -2,7 +2,8 @@ rule: meta: name: terminate process via fastfail namespace: host-interaction/process/terminate - author: "@_re_fox" + authors: + - "@_re_fox" scope: basic block mbc: - Process::Terminate Process [C0018] diff --git a/host-interaction/process/terminate/terminate-process-via-kill.yml b/host-interaction/process/terminate/terminate-process-via-kill.yml index f87b7ca9..b9140122 100644 --- a/host-interaction/process/terminate/terminate-process-via-kill.yml +++ b/host-interaction/process/terminate/terminate-process-via-kill.yml @@ -2,7 +2,8 @@ rule: meta: name: terminate process via kill namespace: host-interaction/process/terminate - author: joakim@intezer.com + authors: + - joakim@intezer.com scope: basic block mbc: - Process::Terminate Process [C0018] diff --git a/host-interaction/process/terminate/terminate-process.yml b/host-interaction/process/terminate/terminate-process.yml index 7219ba09..e2d5aebf 100644 --- a/host-interaction/process/terminate/terminate-process.yml +++ b/host-interaction/process/terminate/terminate-process.yml @@ -2,7 +2,8 @@ rule: meta: name: terminate process namespace: host-interaction/process/terminate - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - Process::Terminate Process [C0018] diff --git a/host-interaction/recycle-bin/empty-recycle-bin-quietly.yml b/host-interaction/recycle-bin/empty-recycle-bin-quietly.yml index c6ff1480..83ced0f9 100644 --- a/host-interaction/recycle-bin/empty-recycle-bin-quietly.yml +++ b/host-interaction/recycle-bin/empty-recycle-bin-quietly.yml @@ -2,7 +2,8 @@ rule: meta: name: empty recycle bin quietly namespace: host-interaction/recycle-bin - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: basic block att&ck: - Defense Evasion::Indicator Removal on Host [T1070] diff --git a/host-interaction/registry/create-or-open-registry-key.yml b/host-interaction/registry/create-or-open-registry-key.yml index e24a0972..561225af 100644 --- a/host-interaction/registry/create-or-open-registry-key.yml +++ b/host-interaction/registry/create-or-open-registry-key.yml @@ -2,7 +2,8 @@ rule: meta: name: create or open registry key namespace: host-interaction/registry - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block mbc: - Operating System::Registry::Create Registry Key [C0036.004] diff --git a/host-interaction/registry/create-registry-key-via-offline-registry-library.yml b/host-interaction/registry/create-registry-key-via-offline-registry-library.yml index c7e1e9fe..65469376 100644 --- a/host-interaction/registry/create-registry-key-via-offline-registry-library.yml +++ b/host-interaction/registry/create-registry-key-via-offline-registry-library.yml @@ -2,7 +2,8 @@ rule: meta: name: create registry key via offline registry library namespace: host-interaction/registry - author: johnk3r + authors: + - johnk3r scope: function att&ck: - Defense Evasion::Modify Registry [T1112] diff --git a/host-interaction/registry/create/set-registry-value.yml b/host-interaction/registry/create/set-registry-value.yml index 04cf0db4..37875c0e 100644 --- a/host-interaction/registry/create/set-registry-value.yml +++ b/host-interaction/registry/create/set-registry-value.yml @@ -2,7 +2,7 @@ rule: meta: name: set registry value namespace: host-interaction/registry/create - author: + authors: - moritz.raabe@mandiant.com - michael.hunhoff@mandiant.com scope: function diff --git a/host-interaction/registry/delete/delete-registry-key.yml b/host-interaction/registry/delete/delete-registry-key.yml index 46d266cc..62da327b 100644 --- a/host-interaction/registry/delete/delete-registry-key.yml +++ b/host-interaction/registry/delete/delete-registry-key.yml @@ -2,7 +2,7 @@ rule: meta: name: delete registry key namespace: host-interaction/registry/delete - author: + authors: - moritz.raabe@mandiant.com - michael.hunhoff@mandiant.com - johnk3r diff --git a/host-interaction/registry/delete/delete-registry-value.yml b/host-interaction/registry/delete/delete-registry-value.yml index 9b6f2ca9..eaac0f6a 100644 --- a/host-interaction/registry/delete/delete-registry-value.yml +++ b/host-interaction/registry/delete/delete-registry-value.yml @@ -2,7 +2,8 @@ rule: meta: name: delete registry value namespace: host-interaction/registry/delete - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Defense Evasion::Modify Registry [T1112] diff --git a/host-interaction/registry/open-registry-key-via-offline-registry-library.yml b/host-interaction/registry/open-registry-key-via-offline-registry-library.yml index ae4c06d2..7baadd03 100644 --- a/host-interaction/registry/open-registry-key-via-offline-registry-library.yml +++ b/host-interaction/registry/open-registry-key-via-offline-registry-library.yml @@ -2,7 +2,8 @@ rule: meta: name: open registry key via offline registry library namespace: host-interaction/registry - author: johnk3r + authors: + - johnk3r scope: function mbc: - Operating System::Registry::Open Registry Key [C0036.003] diff --git a/host-interaction/registry/query-or-enumerate-registry-key.yml b/host-interaction/registry/query-or-enumerate-registry-key.yml index f18d9bd2..2fdd179a 100644 --- a/host-interaction/registry/query-or-enumerate-registry-key.yml +++ b/host-interaction/registry/query-or-enumerate-registry-key.yml @@ -2,7 +2,8 @@ rule: meta: name: query or enumerate registry key namespace: host-interaction/registry - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::Query Registry [T1012] diff --git a/host-interaction/registry/query-or-enumerate-registry-value.yml b/host-interaction/registry/query-or-enumerate-registry-value.yml index 03b6ee80..40125b84 100644 --- a/host-interaction/registry/query-or-enumerate-registry-value.yml +++ b/host-interaction/registry/query-or-enumerate-registry-value.yml @@ -2,7 +2,7 @@ rule: meta: name: query or enumerate registry value namespace: host-interaction/registry - author: + authors: - william.ballenthin@mandiant.com - michael.hunhoff@mandiant.com scope: function diff --git a/host-interaction/registry/query-registry-key-via-offline-registry-library.yml b/host-interaction/registry/query-registry-key-via-offline-registry-library.yml index 310e1185..6092ed4c 100644 --- a/host-interaction/registry/query-registry-key-via-offline-registry-library.yml +++ b/host-interaction/registry/query-registry-key-via-offline-registry-library.yml @@ -2,7 +2,8 @@ rule: meta: name: query registry key via offline registry library namespace: host-interaction/registry - author: johnk3r + authors: + - johnk3r scope: function att&ck: - Discovery::Query Registry [T1012] diff --git a/host-interaction/registry/set-registry-key-via-offline-registry-library.yml b/host-interaction/registry/set-registry-key-via-offline-registry-library.yml index 3a5fdaf6..dc1e8438 100644 --- a/host-interaction/registry/set-registry-key-via-offline-registry-library.yml +++ b/host-interaction/registry/set-registry-key-via-offline-registry-library.yml @@ -2,7 +2,8 @@ rule: meta: name: set registry key via offline registry library namespace: host-interaction/registry - author: johnk3r + authors: + - johnk3r scope: function att&ck: - Defense Evasion::Modify Registry [T1112] diff --git a/host-interaction/service/create/create-service.yml b/host-interaction/service/create/create-service.yml index 55af7e52..5987994d 100644 --- a/host-interaction/service/create/create-service.yml +++ b/host-interaction/service/create/create-service.yml @@ -2,7 +2,8 @@ rule: meta: name: create service namespace: host-interaction/service/create - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Persistence::Create or Modify System Process::Windows Service [T1543.003] diff --git a/host-interaction/service/delete/delete-service.yml b/host-interaction/service/delete/delete-service.yml index 07b67aa1..b704dd52 100644 --- a/host-interaction/service/delete/delete-service.yml +++ b/host-interaction/service/delete/delete-service.yml @@ -2,7 +2,8 @@ rule: meta: name: delete service namespace: host-interaction/service/delete - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Persistence::Create or Modify System Process::Windows Service [T1543.003] diff --git a/host-interaction/service/list/enumerate-services.yml b/host-interaction/service/list/enumerate-services.yml index d6b15688..6c4bd7c6 100644 --- a/host-interaction/service/list/enumerate-services.yml +++ b/host-interaction/service/list/enumerate-services.yml @@ -2,7 +2,7 @@ rule: meta: name: enumerate services namespace: host-interaction/service/list - author: + authors: - moritz.raabe@mandiant.com - michael.hunhoff@mandiant.com scope: function diff --git a/host-interaction/service/modify/modify-service.yml b/host-interaction/service/modify/modify-service.yml index fe8d5ec1..2ada512e 100644 --- a/host-interaction/service/modify/modify-service.yml +++ b/host-interaction/service/modify/modify-service.yml @@ -2,7 +2,8 @@ rule: meta: name: modify service namespace: host-interaction/service/modify - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Persistence::Create or Modify System Process::Windows Service [T1543.003] diff --git a/host-interaction/service/query-service-status.yml b/host-interaction/service/query-service-status.yml index 50009fc8..0d729310 100644 --- a/host-interaction/service/query-service-status.yml +++ b/host-interaction/service/query-service-status.yml @@ -2,7 +2,8 @@ rule: meta: name: query service status namespace: host-interaction/service - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::System Service Discovery [T1007] diff --git a/host-interaction/service/run-as-service.yml b/host-interaction/service/run-as-service.yml index 96cb89a8..4edfe834 100644 --- a/host-interaction/service/run-as-service.yml +++ b/host-interaction/service/run-as-service.yml @@ -2,7 +2,7 @@ rule: meta: name: run as service namespace: host-interaction/service - author: + authors: - moritz.raabe@mandiant.com - michael.hunhoff@mandiant.com scope: file diff --git a/host-interaction/service/start/start-service.yml b/host-interaction/service/start/start-service.yml index 520e6e19..a8ff5f63 100644 --- a/host-interaction/service/start/start-service.yml +++ b/host-interaction/service/start/start-service.yml @@ -2,7 +2,8 @@ rule: meta: name: start service namespace: host-interaction/service/start - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Persistence::Create or Modify System Process::Windows Service [T1543.003] diff --git a/host-interaction/service/stop/stop-service.yml b/host-interaction/service/stop/stop-service.yml index 78d46a5c..80a60bc8 100644 --- a/host-interaction/service/stop/stop-service.yml +++ b/host-interaction/service/stop/stop-service.yml @@ -2,7 +2,8 @@ rule: meta: name: stop service namespace: host-interaction/service/stop - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Persistence::Create or Modify System Process::Windows Service [T1543.003] diff --git a/host-interaction/session/get-logon-sessions.yml b/host-interaction/session/get-logon-sessions.yml index e9c8a138..22795918 100644 --- a/host-interaction/session/get-logon-sessions.yml +++ b/host-interaction/session/get-logon-sessions.yml @@ -2,7 +2,8 @@ rule: meta: name: get logon sessions namespace: host-interaction/session - author: awillia2@cisco.com + authors: + - awillia2@cisco.com description: Looks for imported Windows APIs being called to enumerate user sessions. scope: function att&ck: diff --git a/host-interaction/session/get-session-integrity-level.yml b/host-interaction/session/get-session-integrity-level.yml index 07f0b864..c3221f56 100644 --- a/host-interaction/session/get-session-integrity-level.yml +++ b/host-interaction/session/get-session-integrity-level.yml @@ -2,7 +2,8 @@ rule: meta: name: get session integrity level namespace: host-interaction/session - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::System Owner/User Discovery [T1033] diff --git a/host-interaction/session/get-session-user-name.yml b/host-interaction/session/get-session-user-name.yml index ecd62834..c83bc094 100644 --- a/host-interaction/session/get-session-user-name.yml +++ b/host-interaction/session/get-session-user-name.yml @@ -2,7 +2,8 @@ rule: meta: name: get session user name namespace: host-interaction/session - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Discovery::System Owner/User Discovery [T1033] diff --git a/host-interaction/session/get-token-membership.yml b/host-interaction/session/get-token-membership.yml index d1b70f3a..731a695d 100644 --- a/host-interaction/session/get-token-membership.yml +++ b/host-interaction/session/get-token-membership.yml @@ -2,7 +2,8 @@ rule: meta: name: get token membership namespace: host-interaction/session - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::System Owner/User Discovery [T1033] diff --git a/host-interaction/session/get-user-security-identifier.yml b/host-interaction/session/get-user-security-identifier.yml index d54df817..587c114f 100644 --- a/host-interaction/session/get-user-security-identifier.yml +++ b/host-interaction/session/get-user-security-identifier.yml @@ -3,7 +3,8 @@ rule: meta: name: get user security identifier namespace: host-interaction/session - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Discovery::Account Discovery [T1087] diff --git a/host-interaction/thread/create/create-thread.yml b/host-interaction/thread/create/create-thread.yml index dd6c7859..e6921b5d 100644 --- a/host-interaction/thread/create/create-thread.yml +++ b/host-interaction/thread/create/create-thread.yml @@ -2,7 +2,7 @@ rule: meta: name: create thread namespace: host-interaction/thread/create - author: + authors: - moritz.raabe@mandiant.com - michael.hunhoff@mandiant.com - joakim@intezer.com diff --git a/host-interaction/thread/list/enumerate-threads.yml b/host-interaction/thread/list/enumerate-threads.yml index fcdbb9f8..5b375764 100644 --- a/host-interaction/thread/list/enumerate-threads.yml +++ b/host-interaction/thread/list/enumerate-threads.yml @@ -2,7 +2,8 @@ rule: meta: name: enumerate threads namespace: host-interaction/thread/list - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Discovery::Process Discovery [T1057] diff --git a/host-interaction/thread/resume/resume-thread.yml b/host-interaction/thread/resume/resume-thread.yml index 4f20a4f9..468f5c3d 100644 --- a/host-interaction/thread/resume/resume-thread.yml +++ b/host-interaction/thread/resume/resume-thread.yml @@ -2,7 +2,8 @@ rule: meta: name: resume thread namespace: host-interaction/thread/resume - author: 0x534a@mailbox.org + authors: + - 0x534a@mailbox.org scope: basic block mbc: - Process::Resume Thread [C0054] diff --git a/host-interaction/thread/suspend/suspend-thread.yml b/host-interaction/thread/suspend/suspend-thread.yml index 8cd7f708..36263358 100644 --- a/host-interaction/thread/suspend/suspend-thread.yml +++ b/host-interaction/thread/suspend/suspend-thread.yml @@ -2,7 +2,8 @@ rule: meta: name: suspend thread namespace: host-interaction/thread/suspend - author: 0x534a@mailbox.org + authors: + - 0x534a@mailbox.org scope: basic block mbc: - Process::Suspend Thread [C0055] diff --git a/host-interaction/thread/terminate/terminate-thread.yml b/host-interaction/thread/terminate/terminate-thread.yml index 18e91bab..c7edc4b8 100644 --- a/host-interaction/thread/terminate/terminate-thread.yml +++ b/host-interaction/thread/terminate/terminate-thread.yml @@ -2,7 +2,7 @@ rule: meta: name: terminate thread namespace: host-interaction/thread/terminate - author: + authors: - moritz.raabe@mandiant.com - michael.hunhoff@mandiant.com scope: basic block diff --git a/host-interaction/uac/bypass/bypass-uac-via-appinfo-alpc.yml b/host-interaction/uac/bypass/bypass-uac-via-appinfo-alpc.yml index 63f344ac..83748e71 100644 --- a/host-interaction/uac/bypass/bypass-uac-via-appinfo-alpc.yml +++ b/host-interaction/uac/bypass/bypass-uac-via-appinfo-alpc.yml @@ -2,7 +2,8 @@ rule: meta: name: bypass UAC via AppInfo ALPC namespace: host-interaction/uac/bypass - author: richard.cole@mandiant.com + authors: + - richard.cole@mandiant.com scope: function att&ck: - Defense Evasion::Abuse Elevation Control Mechanism::Bypass User Account Control [T1548.002] diff --git a/host-interaction/uac/bypass/bypass-uac-via-icmluautil.yml b/host-interaction/uac/bypass/bypass-uac-via-icmluautil.yml index 97469877..2b1b3a3f 100644 --- a/host-interaction/uac/bypass/bypass-uac-via-icmluautil.yml +++ b/host-interaction/uac/bypass/bypass-uac-via-icmluautil.yml @@ -2,7 +2,8 @@ rule: meta: name: bypass UAC via ICMLuaUtil namespace: host-interaction/uac/bypass - author: anamaria.martinezgom@mandiant.com + authors: + - anamaria.martinezgom@mandiant.com scope: function att&ck: - Defense Evasion::Abuse Elevation Control Mechanism::Bypass User Account Control [T1548.002] diff --git a/host-interaction/uac/bypass/bypass-uac-via-token-manipulation.yml b/host-interaction/uac/bypass/bypass-uac-via-token-manipulation.yml index 58af20c9..cb165f4b 100644 --- a/host-interaction/uac/bypass/bypass-uac-via-token-manipulation.yml +++ b/host-interaction/uac/bypass/bypass-uac-via-token-manipulation.yml @@ -2,7 +2,8 @@ rule: meta: name: bypass UAC via token manipulation namespace: host-interaction/uac/bypass - author: richard.cole@mandiant.com + authors: + - richard.cole@mandiant.com scope: function att&ck: - Defense Evasion::Abuse Elevation Control Mechanism::Bypass User Account Control [T1548.002] diff --git a/host-interaction/wmi/connect-to-wmi-namespace-via-wbemlocator.yml b/host-interaction/wmi/connect-to-wmi-namespace-via-wbemlocator.yml index 3d1a416f..88fb85da 100644 --- a/host-interaction/wmi/connect-to-wmi-namespace-via-wbemlocator.yml +++ b/host-interaction/wmi/connect-to-wmi-namespace-via-wbemlocator.yml @@ -3,7 +3,8 @@ rule: meta: name: connect to WMI namespace via WbemLocator namespace: host-interaction/wmi - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Execution::Windows Management Instrumentation [T1047] diff --git a/impact/inhibit-system-recovery/delete-volume-shadow-copies.yml b/impact/inhibit-system-recovery/delete-volume-shadow-copies.yml index ba9a581f..6c6d6bf0 100644 --- a/impact/inhibit-system-recovery/delete-volume-shadow-copies.yml +++ b/impact/inhibit-system-recovery/delete-volume-shadow-copies.yml @@ -2,7 +2,8 @@ rule: meta: name: delete volume shadow copies namespace: impact/inhibit-system-recovery - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Impact::Inhibit System Recovery [T1490] diff --git a/impact/wipe-disk/wipe-mbr/overwrite-master-boot-record-mbr.yml b/impact/wipe-disk/wipe-mbr/overwrite-master-boot-record-mbr.yml index eff78ba6..9cfc6ffb 100644 --- a/impact/wipe-disk/wipe-mbr/overwrite-master-boot-record-mbr.yml +++ b/impact/wipe-disk/wipe-mbr/overwrite-master-boot-record-mbr.yml @@ -2,7 +2,8 @@ rule: meta: name: overwrite Master Boot Record (MBR) namespace: impact/wipe-disk/wipe-mbr - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Impact::Disk Wipe::Disk Structure Wipe [T1561.002] diff --git a/internal/limitation/file/internal-autohotkey-file-limitation.yml b/internal/limitation/file/internal-autohotkey-file-limitation.yml index f188237c..3a82e33d 100644 --- a/internal/limitation/file/internal-autohotkey-file-limitation.yml +++ b/internal/limitation/file/internal-autohotkey-file-limitation.yml @@ -2,7 +2,8 @@ rule: meta: name: (internal) autohotkey file limitation namespace: internal/limitation/file - author: "@mr-tz" + authors: + - "@mr-tz" description: | This sample appears to be compiled with AutoHotkey. diff --git a/internal/limitation/file/internal-autoit-file-limitation.yml b/internal/limitation/file/internal-autoit-file-limitation.yml index c7f426e2..1d11979c 100644 --- a/internal/limitation/file/internal-autoit-file-limitation.yml +++ b/internal/limitation/file/internal-autoit-file-limitation.yml @@ -5,7 +5,8 @@ rule: # but these are due to the AutoIt runtime, not the payload script. # so, don't confuse the user with FP matches - bail instead namespace: internal/limitation/file - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com description: | This sample appears to be compiled with AutoIt. diff --git a/internal/limitation/file/internal-dotnet-file-limitation.yml b/internal/limitation/file/internal-dotnet-file-limitation.yml index ca648dfa..a0bc4124 100644 --- a/internal/limitation/file/internal-dotnet-file-limitation.yml +++ b/internal/limitation/file/internal-dotnet-file-limitation.yml @@ -5,7 +5,8 @@ rule: # it might match some file-level things. # for consistency, bail on things that we don't support. namespace: internal/limitation/file - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com description: | This sample appears to be a .NET module. diff --git a/internal/limitation/file/internal-installer-file-limitation.yml b/internal/limitation/file/internal-installer-file-limitation.yml index a3ada31a..c12eaed2 100644 --- a/internal/limitation/file/internal-installer-file-limitation.yml +++ b/internal/limitation/file/internal-installer-file-limitation.yml @@ -4,7 +4,8 @@ rule: # capa will likely detect installer specific functionality. # this is probably not what the user wants. namespace: internal/limitation/file - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com description: | This sample appears to be an installer. diff --git a/internal/limitation/file/internal-packer-file-limitation.yml b/internal/limitation/file/internal-packer-file-limitation.yml index 9418b0fb..9789d54e 100644 --- a/internal/limitation/file/internal-packer-file-limitation.yml +++ b/internal/limitation/file/internal-packer-file-limitation.yml @@ -2,7 +2,8 @@ rule: meta: name: (internal) packer file limitation namespace: internal/limitation/file - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com description: | This sample appears to be packed. diff --git a/internal/limitation/file/internal-visual-basic-file-limitation.yml b/internal/limitation/file/internal-visual-basic-file-limitation.yml index baa47488..20cc6dc4 100644 --- a/internal/limitation/file/internal-visual-basic-file-limitation.yml +++ b/internal/limitation/file/internal-visual-basic-file-limitation.yml @@ -2,7 +2,8 @@ rule: meta: name: (internal) Visual Basic file limitation namespace: internal/limitation/file - author: "@mr-tz" + authors: + - "@mr-tz" description: | This sample appears to be compiled from Visual Basic. diff --git a/lib/allocate-memory.yml b/lib/allocate-memory.yml index 1cc14ca4..e1840dd5 100644 --- a/lib/allocate-memory.yml +++ b/lib/allocate-memory.yml @@ -1,7 +1,8 @@ rule: meta: name: allocate memory - author: 0x534a@mailbox.org + authors: + - 0x534a@mailbox.org lib: true scope: basic block mbc: diff --git a/lib/allocate-rw-memory.yml b/lib/allocate-rw-memory.yml index 22fd3381..25c08529 100644 --- a/lib/allocate-rw-memory.yml +++ b/lib/allocate-rw-memory.yml @@ -1,7 +1,8 @@ rule: meta: name: allocate RW memory - author: 0x534a@mailbox.org + authors: + - 0x534a@mailbox.org lib: true scope: basic block mbc: diff --git a/lib/calculate-modulo-256-via-x86-assembly.yml b/lib/calculate-modulo-256-via-x86-assembly.yml index f46a471d..e2e8925a 100644 --- a/lib/calculate-modulo-256-via-x86-assembly.yml +++ b/lib/calculate-modulo-256-via-x86-assembly.yml @@ -1,7 +1,8 @@ rule: meta: name: calculate modulo 256 via x86 assembly - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com lib: true scope: basic block mbc: diff --git a/lib/contain-loop.yml b/lib/contain-loop.yml index 17098c08..6dcf5fda 100644 --- a/lib/contain-loop.yml +++ b/lib/contain-loop.yml @@ -1,7 +1,8 @@ rule: meta: name: contain loop - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com lib: true scope: function examples: diff --git a/lib/contain-pusha-popa-sequence.yml b/lib/contain-pusha-popa-sequence.yml index 1735ab76..1fbe9b25 100644 --- a/lib/contain-pusha-popa-sequence.yml +++ b/lib/contain-pusha-popa-sequence.yml @@ -1,7 +1,8 @@ rule: meta: name: contain pusha popa sequence - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com lib: true scope: function examples: diff --git a/lib/create-or-open-file.yml b/lib/create-or-open-file.yml index a8aee353..618552fc 100644 --- a/lib/create-or-open-file.yml +++ b/lib/create-or-open-file.yml @@ -1,7 +1,7 @@ rule: meta: name: create or open file - author: + authors: - michael.hunhoff@mandiant.com - joakim@intezer.com lib: true diff --git a/lib/delay-execution.yml b/lib/delay-execution.yml index 5f318f27..f0f39ee4 100644 --- a/lib/delay-execution.yml +++ b/lib/delay-execution.yml @@ -1,7 +1,8 @@ rule: meta: name: delay execution - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com lib: true scope: basic block mbc: diff --git a/lib/duplicate-stdin-and-stdout.yml b/lib/duplicate-stdin-and-stdout.yml index c892c434..ed94dbf6 100644 --- a/lib/duplicate-stdin-and-stdout.yml +++ b/lib/duplicate-stdin-and-stdout.yml @@ -1,7 +1,8 @@ rule: meta: name: duplicate stdin and stdout - author: joakim@intezer.com + authors: + - joakim@intezer.com lib: true scope: basic block examples: diff --git a/lib/get-service-handle.yml b/lib/get-service-handle.yml index 65db2a4d..703555c7 100644 --- a/lib/get-service-handle.yml +++ b/lib/get-service-handle.yml @@ -1,7 +1,8 @@ rule: meta: name: get service handle - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com lib: true scope: function examples: diff --git a/lib/open-process.yml b/lib/open-process.yml index 9a2b3070..684fc4fa 100644 --- a/lib/open-process.yml +++ b/lib/open-process.yml @@ -1,7 +1,8 @@ rule: meta: name: open process - author: 0x534a@mailbox.org + authors: + - 0x534a@mailbox.org lib: true scope: basic block mbc: diff --git a/lib/open-thread.yml b/lib/open-thread.yml index b94c25fa..60b0aca5 100644 --- a/lib/open-thread.yml +++ b/lib/open-thread.yml @@ -1,7 +1,8 @@ rule: meta: name: open thread - author: 0x534a@mailbox.org + authors: + - 0x534a@mailbox.org lib: true scope: basic block mbc: diff --git a/lib/peb-access.yml b/lib/peb-access.yml index 05da2d0a..411617c8 100644 --- a/lib/peb-access.yml +++ b/lib/peb-access.yml @@ -1,7 +1,8 @@ rule: meta: name: PEB access - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com lib: true scope: basic block mbc: diff --git a/lib/validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml b/lib/validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml index 2afeb98f..f9aeba65 100644 --- a/lib/validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml +++ b/lib/validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml @@ -1,7 +1,8 @@ rule: meta: name: validate payment card number using luhn algorithm with lookup table - author: "@_re_fox" + authors: + - "@_re_fox" lib: true scope: function mbc: diff --git a/lib/validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml b/lib/validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml index 2d0fed45..0c941057 100644 --- a/lib/validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml +++ b/lib/validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml @@ -1,7 +1,8 @@ rule: meta: name: validate payment card number using luhn algorithm with no lookup table - author: "@_re_fox" + authors: + - "@_re_fox" lib: true scope: function mbc: diff --git a/lib/write-process-memory.yml b/lib/write-process-memory.yml index cd61c5df..e5e2dd36 100644 --- a/lib/write-process-memory.yml +++ b/lib/write-process-memory.yml @@ -1,7 +1,8 @@ rule: meta: name: write process memory - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com lib: true scope: function att&ck: diff --git a/linking/runtime-linking/access-peb-ldr_data.yml b/linking/runtime-linking/access-peb-ldr_data.yml index 19ef6806..360b5669 100644 --- a/linking/runtime-linking/access-peb-ldr_data.yml +++ b/linking/runtime-linking/access-peb-ldr_data.yml @@ -2,7 +2,8 @@ rule: meta: name: access PEB ldr_data namespace: linking/runtime-linking - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: basic block att&ck: - Execution::Shared Modules [T1129] diff --git a/linking/runtime-linking/get-kernel32-base-address.yml b/linking/runtime-linking/get-kernel32-base-address.yml index 85c3474c..e2b27187 100644 --- a/linking/runtime-linking/get-kernel32-base-address.yml +++ b/linking/runtime-linking/get-kernel32-base-address.yml @@ -2,7 +2,8 @@ rule: meta: name: get kernel32 base address namespace: linking/runtime-linking - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: basic block att&ck: - Execution::Shared Modules [T1129] diff --git a/linking/runtime-linking/get-ntdll-base-address.yml b/linking/runtime-linking/get-ntdll-base-address.yml index 1379c69c..009e21b5 100644 --- a/linking/runtime-linking/get-ntdll-base-address.yml +++ b/linking/runtime-linking/get-ntdll-base-address.yml @@ -2,7 +2,8 @@ rule: meta: name: get ntdll base address namespace: linking/runtime-linking - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: basic block att&ck: - Execution::Shared Modules [T1129] diff --git a/linking/runtime-linking/link-function-at-runtime-on-windows.yml b/linking/runtime-linking/link-function-at-runtime-on-windows.yml index 8cbbb425..e0292df0 100644 --- a/linking/runtime-linking/link-function-at-runtime-on-windows.yml +++ b/linking/runtime-linking/link-function-at-runtime-on-windows.yml @@ -2,7 +2,7 @@ rule: meta: name: link function at runtime on Windows namespace: linking/runtime-linking - author: + authors: - moritz.raabe@mandiant.com scope: function att&ck: diff --git a/linking/runtime-linking/link-many-functions-at-runtime.yml b/linking/runtime-linking/link-many-functions-at-runtime.yml index 01f52127..b5b76591 100644 --- a/linking/runtime-linking/link-many-functions-at-runtime.yml +++ b/linking/runtime-linking/link-many-functions-at-runtime.yml @@ -2,7 +2,7 @@ rule: meta: name: link many functions at runtime namespace: linking/runtime-linking - author: + authors: - moritz.raabe@mandiant.com - joakim@intezer.com scope: function diff --git a/linking/runtime-linking/resolve-function-by-fin8-fasthash.yml b/linking/runtime-linking/resolve-function-by-fin8-fasthash.yml index d83748f6..6b9a3a71 100644 --- a/linking/runtime-linking/resolve-function-by-fin8-fasthash.yml +++ b/linking/runtime-linking/resolve-function-by-fin8-fasthash.yml @@ -2,7 +2,8 @@ rule: meta: name: resolve function by FIN8 fasthash namespace: linking/runtime-linking - author: "@r3c0nst (Frank Boldewin)" + authors: + - "@r3c0nst (Frank Boldewin)" description: APIHashing algorithm derived from a fasthash implementation in OpenCPN using seeds scope: function mbc: diff --git a/linking/static/cryptopp/linked-against-crypto.yml b/linking/static/cryptopp/linked-against-crypto.yml index 8c874f8b..3e021972 100644 --- a/linking/static/cryptopp/linked-against-crypto.yml +++ b/linking/static/cryptopp/linked-against-crypto.yml @@ -2,7 +2,8 @@ rule: meta: name: linked against Crypto++ namespace: linking/static/cryptopp - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: file mbc: - Cryptography::Crypto Library [C0059] diff --git a/linking/static/libcurl/linked-against-libcurl.yml b/linking/static/libcurl/linked-against-libcurl.yml index c8ef4940..d6dcbaca 100644 --- a/linking/static/libcurl/linked-against-libcurl.yml +++ b/linking/static/libcurl/linked-against-libcurl.yml @@ -2,7 +2,8 @@ rule: meta: name: linked against libcurl namespace: linking/static/libcurl - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: file examples: - A90E5B3454AA71D9700B2EA54615F44B diff --git a/linking/static/msdetours/linked-against-microsoft-detours.yml b/linking/static/msdetours/linked-against-microsoft-detours.yml index 4619e46d..7b3fee0d 100644 --- a/linking/static/msdetours/linked-against-microsoft-detours.yml +++ b/linking/static/msdetours/linked-against-microsoft-detours.yml @@ -2,7 +2,8 @@ rule: meta: name: linked against Microsoft Detours namespace: linking/static/msdetours - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: file att&ck: - Defense Evasion::Hijack Execution Flow [T1574] diff --git a/linking/static/openssl/linked-against-openssl.yml b/linking/static/openssl/linked-against-openssl.yml index 0ef56cc1..49519126 100644 --- a/linking/static/openssl/linked-against-openssl.yml +++ b/linking/static/openssl/linked-against-openssl.yml @@ -2,7 +2,7 @@ rule: meta: name: linked against OpenSSL namespace: linking/static/openssl - author: + authors: - william.ballenthin@mandiant.com - michael.hunhoff@mandiant.com scope: file diff --git a/linking/static/polarssl/linked-against-polarsslmbed-tls.yml b/linking/static/polarssl/linked-against-polarsslmbed-tls.yml index d0e5df3d..6d2fa7e1 100644 --- a/linking/static/polarssl/linked-against-polarsslmbed-tls.yml +++ b/linking/static/polarssl/linked-against-polarsslmbed-tls.yml @@ -2,7 +2,8 @@ rule: meta: name: linked against PolarSSL/mbed TLS namespace: linking/static/polarssl - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file mbc: - Cryptography::Crypto Library [C0059] diff --git a/linking/static/wolfcrypt/linked-against-wolfcrypt.yml b/linking/static/wolfcrypt/linked-against-wolfcrypt.yml index 93203b47..fb869029 100644 --- a/linking/static/wolfcrypt/linked-against-wolfcrypt.yml +++ b/linking/static/wolfcrypt/linked-against-wolfcrypt.yml @@ -2,7 +2,8 @@ rule: meta: name: linked against wolfCrypt namespace: linking/static/wolfcrypt - author: jakub.jozwiak@mandiant.com + authors: + - jakub.jozwiak@mandiant.com scope: file mbc: - Cryptography::Crypto Library [C0059] diff --git a/linking/static/wolfssl/linked-against-wolfssl.yml b/linking/static/wolfssl/linked-against-wolfssl.yml index 320b4876..f520af08 100644 --- a/linking/static/wolfssl/linked-against-wolfssl.yml +++ b/linking/static/wolfssl/linked-against-wolfssl.yml @@ -2,7 +2,8 @@ rule: meta: name: linked against wolfSSL namespace: linking/static/wolfssl - author: jakub.jozwiak@mandiant.com + authors: + - jakub.jozwiak@mandiant.com scope: file mbc: - Cryptography::Crypto Library [C0059] diff --git a/linking/static/zlib/linked-against-zlib.yml b/linking/static/zlib/linked-against-zlib.yml index ca121889..072a489b 100644 --- a/linking/static/zlib/linked-against-zlib.yml +++ b/linking/static/zlib/linked-against-zlib.yml @@ -2,7 +2,8 @@ rule: meta: name: linked against ZLIB namespace: linking/static/zlib - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file mbc: - Data::Compression Library [C0060] diff --git a/load-code/pe/access-pe-header.yml b/load-code/pe/access-pe-header.yml index f10dcb05..25976dad 100644 --- a/load-code/pe/access-pe-header.yml +++ b/load-code/pe/access-pe-header.yml @@ -2,7 +2,8 @@ rule: meta: name: access PE header namespace: load-code/pe - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Execution::Shared Modules [T1129] diff --git a/load-code/pe/enumerate-pe-sections.yml b/load-code/pe/enumerate-pe-sections.yml index 636ab804..a9c4519d 100644 --- a/load-code/pe/enumerate-pe-sections.yml +++ b/load-code/pe/enumerate-pe-sections.yml @@ -2,7 +2,8 @@ rule: meta: name: enumerate PE sections namespace: load-code/pe - author: "@Ana06" + authors: + - "@Ana06" scope: function mbc: - Discovery::Code Discovery::Enumerate PE Sections [B0046.001] diff --git a/load-code/pe/inject-dll-reflectively.yml b/load-code/pe/inject-dll-reflectively.yml index fe33dae0..210a16d6 100644 --- a/load-code/pe/inject-dll-reflectively.yml +++ b/load-code/pe/inject-dll-reflectively.yml @@ -2,7 +2,8 @@ rule: meta: name: inject DLL reflectively namespace: load-code/pe - author: "@Ana06" + authors: + - "@Ana06" scope: function att&ck: - Defense Evasion::Process Injection::Dynamic-link Library Injection [T1055.001] diff --git a/load-code/pe/inspect-section-memory-permissions.yml b/load-code/pe/inspect-section-memory-permissions.yml index 00e3ebb0..499d334d 100644 --- a/load-code/pe/inspect-section-memory-permissions.yml +++ b/load-code/pe/inspect-section-memory-permissions.yml @@ -2,7 +2,8 @@ rule: meta: name: inspect section memory permissions namespace: load-code/pe - author: "@Ana06" + authors: + - "@Ana06" description: "translate section memory permissions (specified in the 'Characteristics' field of the image section header) into page protection constants" scope: function mbc: diff --git a/load-code/pe/parse-pe-header.yml b/load-code/pe/parse-pe-header.yml index 5d342497..26c3c884 100644 --- a/load-code/pe/parse-pe-header.yml +++ b/load-code/pe/parse-pe-header.yml @@ -2,7 +2,8 @@ rule: meta: name: parse PE header namespace: load-code/pe - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Execution::Shared Modules [T1129] diff --git a/load-code/pe/rebuild-import-table.yml b/load-code/pe/rebuild-import-table.yml index c0c9c99c..953f8c72 100644 --- a/load-code/pe/rebuild-import-table.yml +++ b/load-code/pe/rebuild-import-table.yml @@ -2,7 +2,8 @@ rule: meta: name: rebuild import table namespace: load-code/pe - author: "@Ana06" + authors: + - "@Ana06" scope: function mbc: - Defense Evasion::Hijack Execution Flow::Import Address Table (IAT) Hooking [F0015.003] diff --git a/load-code/shellcode/execute-shellcode-via-copyfile2.yml b/load-code/shellcode/execute-shellcode-via-copyfile2.yml index b7dbd5db..6f18447e 100644 --- a/load-code/shellcode/execute-shellcode-via-copyfile2.yml +++ b/load-code/shellcode/execute-shellcode-via-copyfile2.yml @@ -2,7 +2,8 @@ rule: meta: name: execute shellcode via CopyFile2 namespace: load-code/shellcode - author: jakub.jozwiak@mandiant.com + authors: + - jakub.jozwiak@mandiant.com scope: function references: - https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/CopyFile2/CopyFile2.cpp diff --git a/load-code/shellcode/execute-shellcode-via-createthreadpoolwait.yml b/load-code/shellcode/execute-shellcode-via-createthreadpoolwait.yml index 68e1affa..6f8379bf 100644 --- a/load-code/shellcode/execute-shellcode-via-createthreadpoolwait.yml +++ b/load-code/shellcode/execute-shellcode-via-createthreadpoolwait.yml @@ -2,7 +2,8 @@ rule: meta: name: execute shellcode via CreateThreadpoolWait namespace: load-code/shellcode - author: jakub.jozwiak@mandiant.com + authors: + - jakub.jozwiak@mandiant.com scope: function references: - https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/CreateThreadPoolWait/CreateThreadPoolWait.cpp diff --git a/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml b/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml index 0c04754b..d7c32ac0 100644 --- a/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml +++ b/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml @@ -2,7 +2,8 @@ rule: meta: name: execute shellcode via EnumUILanguages namespace: load-code/shellcode - author: jakub.jozwiak@mandiant.com + authors: + - jakub.jozwiak@mandiant.com scope: function mbc: - Defense Evasion::Hijack Execution Flow::Abuse Windows Function Calls [F0015.006] diff --git a/load-code/shellcode/execute-shellcode-via-windows-fibers.yml b/load-code/shellcode/execute-shellcode-via-windows-fibers.yml index 9bb88228..7524d186 100644 --- a/load-code/shellcode/execute-shellcode-via-windows-fibers.yml +++ b/load-code/shellcode/execute-shellcode-via-windows-fibers.yml @@ -2,7 +2,8 @@ rule: meta: name: execute shellcode via Windows fibers namespace: load-code/shellcode - author: jakub.jozwiak@mandiant.com + authors: + - jakub.jozwiak@mandiant.com scope: function mbc: - Defense Evasion::Process Injection::Injection via Windows Fibers [E1055.m05] diff --git a/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml b/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml index e692f286..7920143b 100644 --- a/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml +++ b/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml @@ -2,7 +2,8 @@ rule: meta: name: spawn thread to RWX shellcode namespace: load-code/shellcode - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function mbc: - Memory::Allocate Memory [C0007] diff --git a/malware-family/plugx/match-known-plugx-module.yml b/malware-family/plugx/match-known-plugx-module.yml index 5f53e943..ca2e552d 100644 --- a/malware-family/plugx/match-known-plugx-module.yml +++ b/malware-family/plugx/match-known-plugx-module.yml @@ -3,7 +3,8 @@ rule: name: match known PlugX module namespace: malware-family/plugx maec/malware-family: PlugX - author: still@teamt5.org + authors: + - still@teamt5.org description: the sample references known PlugX watermarks (hexified YYYYMMDD + command opcode) scope: function references: diff --git a/nursery/add-file-to-cabinet-file.yml b/nursery/add-file-to-cabinet-file.yml index bd033536..5988a518 100644 --- a/nursery/add-file-to-cabinet-file.yml +++ b/nursery/add-file-to-cabinet-file.yml @@ -2,7 +2,8 @@ rule: meta: name: add file to cabinet file namespace: host-interaction/file-system - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function references: - https://docs.microsoft.com/en-us/windows/win32/msi/cabinet-files diff --git a/nursery/add-user-account-group.yml b/nursery/add-user-account-group.yml index d809ee18..3e2da64b 100644 --- a/nursery/add-user-account-group.yml +++ b/nursery/add-user-account-group.yml @@ -3,7 +3,8 @@ rule: meta: name: add user account group namespace: host-interaction/accounts - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Persistence::Account Manipulation [T1098] diff --git a/nursery/add-user-account-to-group.yml b/nursery/add-user-account-to-group.yml index daba65b0..22082075 100644 --- a/nursery/add-user-account-to-group.yml +++ b/nursery/add-user-account-to-group.yml @@ -3,7 +3,8 @@ rule: meta: name: add user account to group namespace: host-interaction/accounts - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Persistence::Account Manipulation [T1098] diff --git a/nursery/add-user-account.yml b/nursery/add-user-account.yml index 79b95057..a1941a4e 100644 --- a/nursery/add-user-account.yml +++ b/nursery/add-user-account.yml @@ -3,7 +3,8 @@ rule: meta: name: add user account namespace: host-interaction/accounts - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Persistence::Create Account [T1136] diff --git a/nursery/append-data-to-clfs-log-container.yml b/nursery/append-data-to-clfs-log-container.yml index 3e62ae98..10d585e0 100755 --- a/nursery/append-data-to-clfs-log-container.yml +++ b/nursery/append-data-to-clfs-log-container.yml @@ -3,7 +3,8 @@ rule: meta: name: append data to CLFS log container namespace: host-interaction/log/clfs/append - author: blaine.stancill@mandiant.com + authors: + - blaine.stancill@mandiant.com scope: function references: - https://docs.microsoft.com/en-us/windows/win32/api/clfsw32/ diff --git a/nursery/build-docker-image.yml b/nursery/build-docker-image.yml index 40a376ac..df029867 100644 --- a/nursery/build-docker-image.yml +++ b/nursery/build-docker-image.yml @@ -2,7 +2,8 @@ rule: meta: name: build Docker image namespace: host-interaction/container/docker - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function att&ck: - Defense Evasion::Build Image on Host [T1612] diff --git a/nursery/bypass-uac-via-scheduled-task-environment-variable.yml b/nursery/bypass-uac-via-scheduled-task-environment-variable.yml index 786dc8e7..ffe9bdf6 100644 --- a/nursery/bypass-uac-via-scheduled-task-environment-variable.yml +++ b/nursery/bypass-uac-via-scheduled-task-environment-variable.yml @@ -2,7 +2,8 @@ rule: meta: name: bypass UAC via scheduled task environment variable namespace: host-interaction/uac/bypass - author: anamaria.martinezgom@mandiant.com + authors: + - anamaria.martinezgom@mandiant.com scope: function att&ck: - Defense Evasion::Abuse Elevation Control Mechanism::Bypass User Account Control [T1548.002] diff --git a/nursery/capture-network-configuration-via-ifconfig.yml b/nursery/capture-network-configuration-via-ifconfig.yml index 1bf5887a..e6a073cf 100644 --- a/nursery/capture-network-configuration-via-ifconfig.yml +++ b/nursery/capture-network-configuration-via-ifconfig.yml @@ -2,7 +2,8 @@ rule: meta: name: capture network configuration via ifconfig namespace: collection/network - author: joakim@intezeer.com + authors: + - joakim@intezeer.com scope: basic block att&ck: - Discovery::System Network Configuration Discovery [T1016] diff --git a/nursery/capture-screenshot-in-go.yml b/nursery/capture-screenshot-in-go.yml index 5b8048fb..7dca50c9 100644 --- a/nursery/capture-screenshot-in-go.yml +++ b/nursery/capture-screenshot-in-go.yml @@ -2,7 +2,7 @@ rule: meta: name: capture screenshot in Go namespace: collection/screenshot - author: + authors: - joakim@intezer.com description: Detects screenshot capability via WinAPI for Go files. scope: file diff --git a/nursery/capture-webcam-video.yml b/nursery/capture-webcam-video.yml index bac260dc..e41a3ad3 100644 --- a/nursery/capture-webcam-video.yml +++ b/nursery/capture-webcam-video.yml @@ -2,7 +2,8 @@ rule: meta: name: capture webcam video namespace: collection/webcam - author: "@johnk3r" + authors: + - "@johnk3r" description: Rule that detects a system's webcam being used to capture video scope: function att&ck: diff --git a/nursery/change-user-account-password.yml b/nursery/change-user-account-password.yml index 9927c130..1de2ea6b 100644 --- a/nursery/change-user-account-password.yml +++ b/nursery/change-user-account-password.yml @@ -3,7 +3,8 @@ rule: meta: name: change user account password namespace: host-interaction/accounts - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Persistence::Account Manipulation [T1098] diff --git a/nursery/check-for-process-debug-object.yml b/nursery/check-for-process-debug-object.yml index 3e1bfb58..0f57418e 100644 --- a/nursery/check-for-process-debug-object.yml +++ b/nursery/check-for-process-debug-object.yml @@ -2,7 +2,8 @@ rule: meta: name: check for process debug object namespace: anti-analysis/anti-debugging/debugger-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Anti-Behavioral Analysis::Debugger Detection::NtQueryInformationProcess [B0001.012] diff --git a/nursery/check-for-windows-sandbox-via-mutex.yml b/nursery/check-for-windows-sandbox-via-mutex.yml index fbd085f7..8fa000e4 100644 --- a/nursery/check-for-windows-sandbox-via-mutex.yml +++ b/nursery/check-for-windows-sandbox-via-mutex.yml @@ -2,7 +2,8 @@ rule: meta: name: check for windows sandbox via mutex namespace: anti-analysis/anti-vm/vm-detection - author: "@_re_fox" + authors: + - "@_re_fox" scope: function att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] diff --git a/nursery/check-license-value.yml b/nursery/check-license-value.yml index 6436ea35..e6d979ee 100644 --- a/nursery/check-license-value.yml +++ b/nursery/check-license-value.yml @@ -2,7 +2,8 @@ rule: meta: name: check license value namespace: anti-analysis/anti-vm/vm-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] diff --git a/nursery/check-processdebugflags.yml b/nursery/check-processdebugflags.yml index 04f05530..e9989d6d 100644 --- a/nursery/check-processdebugflags.yml +++ b/nursery/check-processdebugflags.yml @@ -2,7 +2,8 @@ rule: meta: name: check ProcessDebugFlags namespace: anti-analysis/anti-debugging/debugger-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block mbc: - Anti-Behavioral Analysis::Debugger Detection::NtQueryInformationProcess [B0001.012] diff --git a/nursery/check-systemkerneldebuggerinformation.yml b/nursery/check-systemkerneldebuggerinformation.yml index 361ba7c0..07a39c07 100644 --- a/nursery/check-systemkerneldebuggerinformation.yml +++ b/nursery/check-systemkerneldebuggerinformation.yml @@ -2,7 +2,8 @@ rule: meta: name: check SystemKernelDebuggerInformation namespace: anti-analysis/anti-debugging/debugger-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block mbc: - Anti-Behavioral Analysis::Debugger Detection::NtQueryInformationProcess [B0001.012] diff --git a/nursery/check-thread-yield-allowed.yml b/nursery/check-thread-yield-allowed.yml index 256ff7c4..de2e3e8a 100644 --- a/nursery/check-thread-yield-allowed.yml +++ b/nursery/check-thread-yield-allowed.yml @@ -2,7 +2,8 @@ rule: meta: name: check thread yield allowed namespace: anti-analysis/anti-debugging/debugger-detection - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function mbc: - Anti-Behavioral Analysis::Debugger Detection::NtYieldExecution/SwitchToThread [B0001.015] diff --git a/nursery/collect-ssh-keys.yml b/nursery/collect-ssh-keys.yml index 220fcb08..0001f929 100644 --- a/nursery/collect-ssh-keys.yml +++ b/nursery/collect-ssh-keys.yml @@ -2,7 +2,8 @@ rule: meta: name: collect ssh keys namespace: collection - author: joakim@intezer.com + authors: + - joakim@intezer.com scope: function att&ck: - Credential Access::Unsecured Credentials::Private Keys [T1552.004] diff --git a/nursery/compare-security-identifiers.yml b/nursery/compare-security-identifiers.yml index a51b4ed9..4da0abd3 100644 --- a/nursery/compare-security-identifiers.yml +++ b/nursery/compare-security-identifiers.yml @@ -3,7 +3,8 @@ rule: meta: name: compare security identifiers namespace: host-interaction/sid - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block features: - or: diff --git a/nursery/compiled-from-epl.yml b/nursery/compiled-from-epl.yml index 4805b252..e9a8f3b9 100644 --- a/nursery/compiled-from-epl.yml +++ b/nursery/compiled-from-epl.yml @@ -2,7 +2,8 @@ rule: meta: name: compiled from EPL namespace: compiler/epl - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file references: - https://www.hexacorn.com/blog/2019/02/13/pe-files-and-the-easy-programming-language-epl/ diff --git a/nursery/connect-network-resource.yml b/nursery/connect-network-resource.yml index 93883cd2..d8bf343c 100644 --- a/nursery/connect-network-resource.yml +++ b/nursery/connect-network-resource.yml @@ -2,7 +2,8 @@ rule: meta: name: connect network resource namespace: communication/http - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com description: connect to disk or print resource scope: function features: diff --git a/nursery/create-container.yml b/nursery/create-container.yml index c3fb97ce..5514a137 100644 --- a/nursery/create-container.yml +++ b/nursery/create-container.yml @@ -2,7 +2,8 @@ rule: meta: name: create container namespace: host-interaction/container/docker - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function att&ck: - Execution::Deploy Container [T1610] diff --git a/nursery/create-registry-key-via-stdregprov.yml b/nursery/create-registry-key-via-stdregprov.yml index 2d86d9c0..c5b7558d 100644 --- a/nursery/create-registry-key-via-stdregprov.yml +++ b/nursery/create-registry-key-via-stdregprov.yml @@ -3,7 +3,8 @@ rule: meta: name: create registry key via StdRegProv namespace: host-interaction/registry - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function references: - https://docs.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov#methods diff --git a/nursery/create-restart-manager-session.yml b/nursery/create-restart-manager-session.yml index 5952bd68..434c2e27 100644 --- a/nursery/create-restart-manager-session.yml +++ b/nursery/create-restart-manager-session.yml @@ -2,7 +2,8 @@ rule: meta: name: create Restart Manager session namespace: host-interaction/process - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com description: Windows Restart Manager can be used to close/unlock specific files, often abused by Ransomware scope: function references: diff --git a/nursery/create-shortcut-via-ishelllink.yml b/nursery/create-shortcut-via-ishelllink.yml index 73597e7e..9589f294 100644 --- a/nursery/create-shortcut-via-ishelllink.yml +++ b/nursery/create-shortcut-via-ishelllink.yml @@ -2,7 +2,8 @@ rule: meta: name: create shortcut via IShellLink namespace: host-interaction/file-system/write - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: function references: - https://docs.microsoft.com/en-us/windows/win32/shell/links#creating-a-shortcut-and-a-folder-shortcut-to-a-file diff --git a/nursery/debug-build.yml b/nursery/debug-build.yml index 036e6db4..020d6f82 100644 --- a/nursery/debug-build.yml +++ b/nursery/debug-build.yml @@ -2,7 +2,8 @@ rule: meta: name: debug build namespace: executable/pe/debug - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file features: - or: diff --git a/nursery/decrypt-data-via-sspi.yml b/nursery/decrypt-data-via-sspi.yml index 8827cc46..4d343505 100644 --- a/nursery/decrypt-data-via-sspi.yml +++ b/nursery/decrypt-data-via-sspi.yml @@ -2,7 +2,8 @@ rule: meta: name: decrypt data via SSPI namespace: data-manipulation/encryption - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: basic block att&ck: - Defense Evasion::Deobfuscate/Decode Files or Information [T1140] diff --git a/nursery/delete-internet-cache.yml b/nursery/delete-internet-cache.yml index be39c331..e7e96112 100644 --- a/nursery/delete-internet-cache.yml +++ b/nursery/delete-internet-cache.yml @@ -2,7 +2,8 @@ rule: meta: name: delete internet cache namespace: host-interaction/internet/cache - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function features: - and: diff --git a/nursery/delete-registry-key-via-offline-registry-library.yml b/nursery/delete-registry-key-via-offline-registry-library.yml index f01e3691..ce67f0ff 100644 --- a/nursery/delete-registry-key-via-offline-registry-library.yml +++ b/nursery/delete-registry-key-via-offline-registry-library.yml @@ -2,7 +2,8 @@ rule: meta: name: delete registry key via offline registry library namespace: host-interaction/registry - author: johnk3r + authors: + - johnk3r scope: function att&ck: - Defense Evasion::Modify Registry [T1112] diff --git a/nursery/delete-registry-key-via-stdregprov.yml b/nursery/delete-registry-key-via-stdregprov.yml index cae59043..93f218fe 100644 --- a/nursery/delete-registry-key-via-stdregprov.yml +++ b/nursery/delete-registry-key-via-stdregprov.yml @@ -3,7 +3,8 @@ rule: meta: name: delete registry key via StdRegProv namespace: host-interaction/registry - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function references: - https://docs.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov#methods diff --git a/nursery/delete-registry-value-via-stdregprov.yml b/nursery/delete-registry-value-via-stdregprov.yml index 45ae497d..946da742 100644 --- a/nursery/delete-registry-value-via-stdregprov.yml +++ b/nursery/delete-registry-value-via-stdregprov.yml @@ -3,7 +3,8 @@ rule: meta: name: delete registry value via StdRegProv namespace: host-interaction/registry - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function references: - https://docs.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov#methods diff --git a/nursery/delete-user-account-from-group.yml b/nursery/delete-user-account-from-group.yml index 920a712e..6b503871 100644 --- a/nursery/delete-user-account-from-group.yml +++ b/nursery/delete-user-account-from-group.yml @@ -3,7 +3,8 @@ rule: meta: name: delete user account from group namespace: host-interaction/accounts - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Persistence::Account Manipulation [T1098] diff --git a/nursery/delete-user-account-group.yml b/nursery/delete-user-account-group.yml index d0cb18a7..4cec4502 100644 --- a/nursery/delete-user-account-group.yml +++ b/nursery/delete-user-account-group.yml @@ -3,7 +3,8 @@ rule: meta: name: delete user account group namespace: host-interaction/accounts - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Persistence::Account Manipulation [T1098] diff --git a/nursery/delete-user-account.yml b/nursery/delete-user-account.yml index 56b3d8b0..0c924281 100644 --- a/nursery/delete-user-account.yml +++ b/nursery/delete-user-account.yml @@ -3,7 +3,8 @@ rule: meta: name: delete user account namespace: host-interaction/accounts - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Impact::Account Access Removal [T1531] diff --git a/nursery/delete-windows-backup-catalog.yml b/nursery/delete-windows-backup-catalog.yml index c65435cc..96498473 100644 --- a/nursery/delete-windows-backup-catalog.yml +++ b/nursery/delete-windows-backup-catalog.yml @@ -2,7 +2,8 @@ rule: meta: name: delete Windows backup catalog namespace: impact/inhibit-system-recovery - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Impact::Inhibit System Recovery [T1490] diff --git a/nursery/disable-automatic-windows-recovery-features.yml b/nursery/disable-automatic-windows-recovery-features.yml index 5162dff4..d58513dd 100644 --- a/nursery/disable-automatic-windows-recovery-features.yml +++ b/nursery/disable-automatic-windows-recovery-features.yml @@ -2,7 +2,8 @@ rule: meta: name: disable automatic Windows recovery features namespace: impact/inhibit-system-recovery - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Impact::Inhibit System Recovery [T1490] diff --git a/nursery/empty-the-recycle-bin.yml b/nursery/empty-the-recycle-bin.yml index f8e605db..051486aa 100644 --- a/nursery/empty-the-recycle-bin.yml +++ b/nursery/empty-the-recycle-bin.yml @@ -2,7 +2,8 @@ rule: meta: name: empty the recycle bin namespace: host-interaction/recycle-bin - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function features: - or: diff --git a/nursery/enable-safe-mode-boot.yml b/nursery/enable-safe-mode-boot.yml index a9301c25..7fea1795 100644 --- a/nursery/enable-safe-mode-boot.yml +++ b/nursery/enable-safe-mode-boot.yml @@ -2,7 +2,8 @@ rule: meta: name: enable safe mode boot namespace: host-interaction/bootloader - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function att&ck: - Defense Evasion::Impair Defenses::Safe Mode Boot [T1562.009] diff --git a/nursery/encrypt-data-using-aes-via-x86-extensions.yml b/nursery/encrypt-data-using-aes-via-x86-extensions.yml index bad72f13..778dfabb 100644 --- a/nursery/encrypt-data-using-aes-via-x86-extensions.yml +++ b/nursery/encrypt-data-using-aes-via-x86-extensions.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using AES via x86 extensions namespace: data-manipulation/encryption/aes - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/nursery/encrypt-data-using-fakem-cipher.yml b/nursery/encrypt-data-using-fakem-cipher.yml index 7fab9274..af5189ef 100644 --- a/nursery/encrypt-data-using-fakem-cipher.yml +++ b/nursery/encrypt-data-using-fakem-cipher.yml @@ -3,7 +3,8 @@ rule: meta: name: encrypt data using FAKEM cipher namespace: data-manipulation/encryption - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com description: Detect custom encryption cipher used by FAKEM malware family scope: basic block att&ck: diff --git a/nursery/encrypt-data-using-salsa20-or-chacha.yml b/nursery/encrypt-data-using-salsa20-or-chacha.yml index 5ba468b6..44df19d4 100644 --- a/nursery/encrypt-data-using-salsa20-or-chacha.yml +++ b/nursery/encrypt-data-using-salsa20-or-chacha.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data using Salsa20 or ChaCha namespace: data-manipulation/encryption/salsa20 - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/nursery/encrypt-data-via-sspi.yml b/nursery/encrypt-data-via-sspi.yml index c1c8b218..c9dd53d9 100644 --- a/nursery/encrypt-data-via-sspi.yml +++ b/nursery/encrypt-data-via-sspi.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt data via SSPI namespace: data-manipulation/encryption - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: basic block att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/nursery/encrypt-or-decrypt-data-via-bcrypt.yml b/nursery/encrypt-or-decrypt-data-via-bcrypt.yml index 8934c973..635cb53f 100644 --- a/nursery/encrypt-or-decrypt-data-via-bcrypt.yml +++ b/nursery/encrypt-or-decrypt-data-via-bcrypt.yml @@ -2,7 +2,8 @@ rule: meta: name: encrypt or decrypt data via BCrypt namespace: data-manipulation/encryption - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/nursery/enumerate-browser-history.yml b/nursery/enumerate-browser-history.yml index d2dbb2fd..f9044e90 100644 --- a/nursery/enumerate-browser-history.yml +++ b/nursery/enumerate-browser-history.yml @@ -2,7 +2,8 @@ rule: meta: name: enumerate browser history namespace: host-interaction/browser/history/list - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function features: - and: diff --git a/nursery/enumerate-disk-volumes.yml b/nursery/enumerate-disk-volumes.yml index c4db1032..cca3030a 100644 --- a/nursery/enumerate-disk-volumes.yml +++ b/nursery/enumerate-disk-volumes.yml @@ -2,7 +2,8 @@ rule: meta: name: enumerate disk volumes namespace: host-interaction/hardware/storage - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::System Information Discovery [T1082] diff --git a/nursery/enumerate-internet-cache.yml b/nursery/enumerate-internet-cache.yml index b53a6127..c9d22bb2 100644 --- a/nursery/enumerate-internet-cache.yml +++ b/nursery/enumerate-internet-cache.yml @@ -2,7 +2,8 @@ rule: meta: name: enumerate internet cache namespace: host-interaction/internet/cache - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function features: - and: diff --git a/nursery/enumerate-network-shares.yml b/nursery/enumerate-network-shares.yml index 5e30ac33..bb06b367 100644 --- a/nursery/enumerate-network-shares.yml +++ b/nursery/enumerate-network-shares.yml @@ -2,7 +2,8 @@ rule: meta: name: enumerate network shares namespace: host-interaction/network - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::Network Share Discovery [T1135] diff --git a/nursery/enumerate-processes-via-procfs.yml b/nursery/enumerate-processes-via-procfs.yml index 5822fd4c..fe738045 100644 --- a/nursery/enumerate-processes-via-procfs.yml +++ b/nursery/enumerate-processes-via-procfs.yml @@ -2,7 +2,8 @@ rule: meta: name: enumerate processes via procfs namespace: host-interaction/process/list - author: joakim@intezer.com + authors: + - joakim@intezer.com scope: function att&ck: - Discovery::Process Discovery [T1057] diff --git a/nursery/enumerate-system-firmware-tables.yml b/nursery/enumerate-system-firmware-tables.yml index f4378a53..414592e9 100644 --- a/nursery/enumerate-system-firmware-tables.yml +++ b/nursery/enumerate-system-firmware-tables.yml @@ -2,7 +2,8 @@ rule: meta: name: enumerate system firmware tables namespace: host-interaction/hardware/firmware - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function references: - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/Shared/Utils.cpp#L843 diff --git a/nursery/execute-shell-command-via-windows-remote-management.yml b/nursery/execute-shell-command-via-windows-remote-management.yml index af41aa55..8f69608a 100644 --- a/nursery/execute-shell-command-via-windows-remote-management.yml +++ b/nursery/execute-shell-command-via-windows-remote-management.yml @@ -3,7 +3,8 @@ rule: meta: name: execute shell command via Windows Remote Management namespace: host-interaction/process/create - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function features: - and: diff --git a/nursery/execute-syscall-instruction.yml b/nursery/execute-syscall-instruction.yml index 6b783dd6..cba27d2c 100644 --- a/nursery/execute-syscall-instruction.yml +++ b/nursery/execute-syscall-instruction.yml @@ -2,7 +2,7 @@ rule: meta: name: execute syscall instruction namespace: anti-analysis - author: + authors: - "@kulinacs" - "@mr-tz" description: may be used to evade hooks or hinder analysis diff --git a/nursery/flush-cabinet-file.yml b/nursery/flush-cabinet-file.yml index dfcc2f7d..b75ec4f6 100644 --- a/nursery/flush-cabinet-file.yml +++ b/nursery/flush-cabinet-file.yml @@ -2,7 +2,8 @@ rule: meta: name: flush cabinet file namespace: host-interaction/file-system - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function references: - https://docs.microsoft.com/en-us/windows/win32/msi/cabinet-files diff --git a/nursery/generate-random-numbers-using-the-delphi-lcg.yml b/nursery/generate-random-numbers-using-the-delphi-lcg.yml index 084be00b..daa0bb3c 100644 --- a/nursery/generate-random-numbers-using-the-delphi-lcg.yml +++ b/nursery/generate-random-numbers-using-the-delphi-lcg.yml @@ -2,7 +2,8 @@ rule: meta: name: generate random numbers using the Delphi LCG namespace: data-manipulation/prng/lcg - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: basic block mbc: - Cryptography::Generate Pseudo-random Sequence [C0021] diff --git a/nursery/get-client-handle-via-schannel.yml b/nursery/get-client-handle-via-schannel.yml index 02a03130..b90b27c7 100644 --- a/nursery/get-client-handle-via-schannel.yml +++ b/nursery/get-client-handle-via-schannel.yml @@ -2,7 +2,8 @@ rule: meta: name: get client handle via SChannel namespace: data-manipulation/encryption - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/nursery/get-inbound-credentials-handle-via-credssp.yml b/nursery/get-inbound-credentials-handle-via-credssp.yml index f79bf491..c948dc8d 100644 --- a/nursery/get-inbound-credentials-handle-via-credssp.yml +++ b/nursery/get-inbound-credentials-handle-via-credssp.yml @@ -2,7 +2,8 @@ rule: meta: name: get inbound credentials handle via CredSSP namespace: data-manipulation/encryption - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: basic block att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/nursery/get-installed-programs.yml b/nursery/get-installed-programs.yml index a8d77641..60c303b6 100644 --- a/nursery/get-installed-programs.yml +++ b/nursery/get-installed-programs.yml @@ -2,7 +2,8 @@ rule: meta: name: get installed programs namespace: host-interaction/software - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Discovery::Software Discovery [T1518] diff --git a/nursery/get-mac-address-on-linux.yml b/nursery/get-mac-address-on-linux.yml index 34c856f5..93d9b023 100644 --- a/nursery/get-mac-address-on-linux.yml +++ b/nursery/get-mac-address-on-linux.yml @@ -2,7 +2,7 @@ rule: meta: name: get MAC address on Linux namespace: collection/network - author: + authors: - joakim@intezer.com scope: function att&ck: diff --git a/nursery/get-networking-parameters.yml b/nursery/get-networking-parameters.yml index abfbf5a8..ff45d172 100644 --- a/nursery/get-networking-parameters.yml +++ b/nursery/get-networking-parameters.yml @@ -2,7 +2,8 @@ rule: meta: name: get networking parameters namespace: host-interaction/network - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::System Network Configuration Discovery [T1016] diff --git a/nursery/get-os-information-via-kuser_shared_data.yml b/nursery/get-os-information-via-kuser_shared_data.yml index 1966d93e..56646f48 100644 --- a/nursery/get-os-information-via-kuser_shared_data.yml +++ b/nursery/get-os-information-via-kuser_shared_data.yml @@ -3,7 +3,8 @@ rule: meta: name: get OS information via KUSER_SHARED_DATA namespace: host-interaction/os/version - author: "@mr-tz" + authors: + - "@mr-tz" scope: function references: - https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntexapi_x/kuser_shared_data/index.htm diff --git a/nursery/get-process-image-filename.yml b/nursery/get-process-image-filename.yml index ef18ee47..6c52875d 100644 --- a/nursery/get-process-image-filename.yml +++ b/nursery/get-process-image-filename.yml @@ -3,7 +3,8 @@ rule: meta: name: get process image filename namespace: host-interaction/process - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block features: - and: diff --git a/nursery/get-proxy.yml b/nursery/get-proxy.yml index 37c9d08d..a4bb4dfc 100644 --- a/nursery/get-proxy.yml +++ b/nursery/get-proxy.yml @@ -2,7 +2,8 @@ rule: meta: name: get proxy namespace: host-interaction/network/proxy - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Discovery::System Network Configuration Discovery [T1016] diff --git a/nursery/get-remote-cert-context-via-schannel.yml b/nursery/get-remote-cert-context-via-schannel.yml index a20b44b7..a45e4fdf 100644 --- a/nursery/get-remote-cert-context-via-schannel.yml +++ b/nursery/get-remote-cert-context-via-schannel.yml @@ -2,7 +2,8 @@ rule: meta: name: get remote cert context via SChannel namespace: data-manipulation/encryption - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: basic block att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/nursery/get-routing-table.yml b/nursery/get-routing-table.yml index da5760ef..d6302cb7 100644 --- a/nursery/get-routing-table.yml +++ b/nursery/get-routing-table.yml @@ -2,7 +2,8 @@ rule: meta: name: get routing table namespace: host-interaction/network/routing-table - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::System Network Configuration Discovery [T1016] diff --git a/nursery/get-session-information.yml b/nursery/get-session-information.yml index 17721178..714bebe7 100644 --- a/nursery/get-session-information.yml +++ b/nursery/get-session-information.yml @@ -2,7 +2,8 @@ rule: meta: name: get session information namespace: host-interaction/session - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::System Owner/User Discovery [T1033] diff --git a/nursery/get-socket-information.yml b/nursery/get-socket-information.yml index 05b621c4..7e9ad1e1 100644 --- a/nursery/get-socket-information.yml +++ b/nursery/get-socket-information.yml @@ -2,7 +2,8 @@ rule: meta: name: get socket information namespace: communication/socket - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Discovery::System Network Configuration Discovery [T1016] diff --git a/nursery/get-storage-device-properties.yml b/nursery/get-storage-device-properties.yml index db745d52..e95eb85e 100644 --- a/nursery/get-storage-device-properties.yml +++ b/nursery/get-storage-device-properties.yml @@ -3,7 +3,8 @@ rule: meta: name: get storage device properties namespace: host-interaction/hardware/storage - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function references: - https://docs.microsoft.com/en-us/windows/win32/api/winioctl/ni-winioctl-ioctl_storage_query_property diff --git a/nursery/get-system-firmware-table.yml b/nursery/get-system-firmware-table.yml index 671d0e5c..31584390 100644 --- a/nursery/get-system-firmware-table.yml +++ b/nursery/get-system-firmware-table.yml @@ -2,7 +2,8 @@ rule: meta: name: get system firmware table namespace: host-interaction/hardware/firmware - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function references: - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/Shared/Utils.cpp#L854 diff --git a/nursery/get-system-information-on-linux.yml b/nursery/get-system-information-on-linux.yml index 2fdf6968..27e32210 100644 --- a/nursery/get-system-information-on-linux.yml +++ b/nursery/get-system-information-on-linux.yml @@ -2,7 +2,7 @@ rule: meta: name: get system information on Linux namespace: host-interaction/os/info - author: + authors: - joakim@intezer.com scope: function att&ck: diff --git a/nursery/get-thread-local-storage-value.yml b/nursery/get-thread-local-storage-value.yml index bc9ef9bc..20ea67fd 100644 --- a/nursery/get-thread-local-storage-value.yml +++ b/nursery/get-thread-local-storage-value.yml @@ -2,7 +2,8 @@ rule: meta: name: get thread local storage value namespace: host-interaction/process - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function features: - and: diff --git a/nursery/get-token-privileges.yml b/nursery/get-token-privileges.yml index f44277b2..d1c6c7ea 100644 --- a/nursery/get-token-privileges.yml +++ b/nursery/get-token-privileges.yml @@ -3,7 +3,8 @@ rule: meta: name: get token privileges namespace: host-interaction/session - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function features: - and: diff --git a/nursery/hash-data-using-crc32b.yml b/nursery/hash-data-using-crc32b.yml index daf669b2..b39e8c44 100644 --- a/nursery/hash-data-using-crc32b.yml +++ b/nursery/hash-data-using-crc32b.yml @@ -2,7 +2,8 @@ rule: meta: name: hash data using CRC32b namespace: data-manipulation/checksum/crc32 - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function features: - and: diff --git a/nursery/hash-data-using-md4.yml b/nursery/hash-data-using-md4.yml index 01640c3c..ef482ce4 100644 --- a/nursery/hash-data-using-md4.yml +++ b/nursery/hash-data-using-md4.yml @@ -2,7 +2,8 @@ rule: meta: name: hash data using MD4 namespace: data-manipulation/hashing/md4 - author: anamaria.martinezgom@mandiant.com + authors: + - anamaria.martinezgom@mandiant.com scope: basic block features: - and: diff --git a/nursery/hash-data-using-murmur2.yml b/nursery/hash-data-using-murmur2.yml index 68ac0a59..d9c732d3 100644 --- a/nursery/hash-data-using-murmur2.yml +++ b/nursery/hash-data-using-murmur2.yml @@ -2,7 +2,8 @@ rule: meta: name: hash data using murmur2 namespace: data-manipulation/hashing/murmur - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function references: - https://github.com/abrandoned/murmur2/blob/master/MurmurHash2.c diff --git a/nursery/hash-data-using-sha1-via-wincrypt.yml b/nursery/hash-data-using-sha1-via-wincrypt.yml index 89cd2892..7df3f5b0 100644 --- a/nursery/hash-data-using-sha1-via-wincrypt.yml +++ b/nursery/hash-data-using-sha1-via-wincrypt.yml @@ -2,7 +2,8 @@ rule: meta: name: hash data using SHA1 via WinCrypt namespace: data-manipulation/hashing/sha1 - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function features: - or: diff --git a/nursery/hash-data-using-sha1-via-x86-extensions.yml b/nursery/hash-data-using-sha1-via-x86-extensions.yml index 447ae0cc..34e22fbe 100644 --- a/nursery/hash-data-using-sha1-via-x86-extensions.yml +++ b/nursery/hash-data-using-sha1-via-x86-extensions.yml @@ -2,7 +2,8 @@ rule: meta: name: hash data using sha1 via x86 extensions namespace: data-manipulation/hashing/sha1 - author: "@_re_fox" + authors: + - "@_re_fox" scope: basic block features: - or: diff --git a/nursery/hash-data-using-sha256-via-x86-extensions.yml b/nursery/hash-data-using-sha256-via-x86-extensions.yml index fb47541d..8c6b5045 100644 --- a/nursery/hash-data-using-sha256-via-x86-extensions.yml +++ b/nursery/hash-data-using-sha256-via-x86-extensions.yml @@ -2,7 +2,8 @@ rule: meta: name: hash data using sha256 via x86 extensions namespace: data-manipulation/hashing/sha256 - author: "@_re_fox" + authors: + - "@_re_fox" scope: basic block features: - or: diff --git a/nursery/hash-data-via-bcrypt.yml b/nursery/hash-data-via-bcrypt.yml index 9b6d5bf8..bb87c81e 100644 --- a/nursery/hash-data-via-bcrypt.yml +++ b/nursery/hash-data-via-bcrypt.yml @@ -2,7 +2,8 @@ rule: meta: name: hash data via BCrypt namespace: data-manipulation/hashing - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/nursery/hide-thread-from-debugger.yml b/nursery/hide-thread-from-debugger.yml index 7843536a..3fb0fc47 100644 --- a/nursery/hide-thread-from-debugger.yml +++ b/nursery/hide-thread-from-debugger.yml @@ -2,7 +2,8 @@ rule: meta: name: hide thread from debugger namespace: anti-analysis/anti-debugging - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block references: - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtSetInformationThread_ThreadHideFromDebugger.cpp diff --git a/nursery/hook-routines-via-microsoft-detours.yml b/nursery/hook-routines-via-microsoft-detours.yml index 82647fb4..f57ab934 100644 --- a/nursery/hook-routines-via-microsoft-detours.yml +++ b/nursery/hook-routines-via-microsoft-detours.yml @@ -2,7 +2,8 @@ rule: meta: name: hook routines via microsoft detours # namespace: linking/hooking - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function references: - https://www.fireeye.com/content/dam/fireeye-www/global/en/blog/threat-research/Flare-On%202017/Challenge7.pdf diff --git a/nursery/hooked-by-api-override.yml b/nursery/hooked-by-api-override.yml index b6ad18a3..a7832c0f 100644 --- a/nursery/hooked-by-api-override.yml +++ b/nursery/hooked-by-api-override.yml @@ -2,7 +2,8 @@ rule: meta: name: hooked by API Override namespace: executable/hooked/api-override - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file references: - https://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/ diff --git a/nursery/impersonate-user.yml b/nursery/impersonate-user.yml index 19b59638..dd9286c3 100644 --- a/nursery/impersonate-user.yml +++ b/nursery/impersonate-user.yml @@ -2,7 +2,8 @@ rule: meta: name: impersonate user namespace: host-interaction/user - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Privilege Escalation::Access Token Manipulation::Token Impersonation/Theft [T1134.001] diff --git a/nursery/initialize-hashing-via-wincrypt.yml b/nursery/initialize-hashing-via-wincrypt.yml index c624683e..cbd1b389 100644 --- a/nursery/initialize-hashing-via-wincrypt.yml +++ b/nursery/initialize-hashing-via-wincrypt.yml @@ -2,7 +2,8 @@ rule: meta: name: initialize hashing via WinCrypt namespace: data-manipulation/hashing - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function features: - and: diff --git a/nursery/inspect-load-icon-resource.yml b/nursery/inspect-load-icon-resource.yml index 3e4729e8..afa1ad45 100644 --- a/nursery/inspect-load-icon-resource.yml +++ b/nursery/inspect-load-icon-resource.yml @@ -3,7 +3,8 @@ rule: meta: name: inspect load icon resource namespace: anti-analysis - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block features: # check if call to LoadIcon fails when first argument is NULL diff --git a/nursery/interact-with-iptables.yml b/nursery/interact-with-iptables.yml index 7c992032..fefe3475 100644 --- a/nursery/interact-with-iptables.yml +++ b/nursery/interact-with-iptables.yml @@ -2,7 +2,8 @@ rule: meta: name: interact with iptables namespace: host-interaction/firewall - author: joakim@intezer.com + authors: + - joakim@intezer.com scope: basic block att&ck: - Discovery::Software Discovery::Security Software Discovery [T1518.001] diff --git a/nursery/link-function-at-runtime-on-linux.yml b/nursery/link-function-at-runtime-on-linux.yml index 3f5e3e69..db6acb21 100644 --- a/nursery/link-function-at-runtime-on-linux.yml +++ b/nursery/link-function-at-runtime-on-linux.yml @@ -2,7 +2,7 @@ rule: meta: name: link function at runtime on Linux namespace: linking/runtime-linking - author: + authors: - joakim@intezer.com scope: function att&ck: diff --git a/nursery/linked-against-cpp-http-library.yml b/nursery/linked-against-cpp-http-library.yml index 2cd4d1cf..0f248f14 100644 --- a/nursery/linked-against-cpp-http-library.yml +++ b/nursery/linked-against-cpp-http-library.yml @@ -2,7 +2,8 @@ rule: meta: name: linked against CPP HTTP library namespace: linking/static/httplib - author: "@mr-tz" + authors: + - "@mr-tz" scope: file references: - https://github.com/yhirose/cpp-httplib diff --git a/nursery/linked-against-cpp-json-library.yml b/nursery/linked-against-cpp-json-library.yml index aa448de7..44ed90e7 100644 --- a/nursery/linked-against-cpp-json-library.yml +++ b/nursery/linked-against-cpp-json-library.yml @@ -2,7 +2,8 @@ rule: meta: name: linked against CPP JSON library namespace: linking/static/jsoncpp - author: "@mr-tz" + authors: + - "@mr-tz" scope: file references: - https://github.com/open-source-parsers/jsoncpp diff --git a/nursery/linked-against-cpp-regex-library.yml b/nursery/linked-against-cpp-regex-library.yml index 5dd0e4f8..90748198 100644 --- a/nursery/linked-against-cpp-regex-library.yml +++ b/nursery/linked-against-cpp-regex-library.yml @@ -2,7 +2,8 @@ rule: meta: name: linked against CPP regex library namespace: linking/static/cppregex - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file references: - http://www.cplusplus.com/reference/regex/regex_error/ diff --git a/nursery/linked-against-go-process-enumeration-library.yml b/nursery/linked-against-go-process-enumeration-library.yml index f915749f..c50655cb 100644 --- a/nursery/linked-against-go-process-enumeration-library.yml +++ b/nursery/linked-against-go-process-enumeration-library.yml @@ -2,7 +2,7 @@ rule: meta: name: linked against Go process enumeration library namespace: host-interaction/process/list - author: + authors: - joakim@intezer.com description: Enumerating processes using a Go library scope: file diff --git a/nursery/linked-against-go-registry-library.yml b/nursery/linked-against-go-registry-library.yml index cd911c82..eb7ed878 100644 --- a/nursery/linked-against-go-registry-library.yml +++ b/nursery/linked-against-go-registry-library.yml @@ -2,7 +2,7 @@ rule: meta: name: linked against Go registry library namespace: host-interaction/registry - author: + authors: - joakim@intezer.com description: Uses a Go library for interacting with the Windows registry. scope: file diff --git a/nursery/linked-against-go-static-asset-library.yml b/nursery/linked-against-go-static-asset-library.yml index 7dc86932..060d2ce8 100644 --- a/nursery/linked-against-go-static-asset-library.yml +++ b/nursery/linked-against-go-static-asset-library.yml @@ -2,7 +2,7 @@ rule: meta: name: linked against Go static asset library namespace: executable/resource - author: + authors: - joakim@intezer.com description: Detects if the Go file includes an static assets. scope: file diff --git a/nursery/linked-against-go-wmi-library.yml b/nursery/linked-against-go-wmi-library.yml index 4bdaa0e7..1e635c0f 100644 --- a/nursery/linked-against-go-wmi-library.yml +++ b/nursery/linked-against-go-wmi-library.yml @@ -2,7 +2,7 @@ rule: meta: name: linked against Go WMI library namespace: collection/database/wmi - author: + authors: - joakim@intezer.com description: StackExchange's WMI library is used to interact with WMI. scope: file diff --git a/nursery/linked-against-xzip.yml b/nursery/linked-against-xzip.yml index 69508420..1b9b5c66 100644 --- a/nursery/linked-against-xzip.yml +++ b/nursery/linked-against-xzip.yml @@ -2,7 +2,8 @@ rule: meta: name: linked against XZip namespace: linking/static/xzip - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: file mbc: - Data::Compression Library [C0060] diff --git a/nursery/list-containers.yml b/nursery/list-containers.yml index e09da77d..1d15ee37 100644 --- a/nursery/list-containers.yml +++ b/nursery/list-containers.yml @@ -2,7 +2,8 @@ rule: meta: name: list containers namespace: host-interaction/container/docker - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function att&ck: - Discovery::Container and Resource Discovery [T1613] diff --git a/nursery/list-domain-servers.yml b/nursery/list-domain-servers.yml index 5796700c..73f89366 100644 --- a/nursery/list-domain-servers.yml +++ b/nursery/list-domain-servers.yml @@ -3,7 +3,8 @@ rule: meta: name: list domain servers namespace: host-interaction/domain - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Discovery::System Network Configuration Discovery::Internet Connection Discovery [T1016.001] diff --git a/nursery/list-drag-and-drop-files.yml b/nursery/list-drag-and-drop-files.yml index 97b0aaa8..b726f961 100644 --- a/nursery/list-drag-and-drop-files.yml +++ b/nursery/list-drag-and-drop-files.yml @@ -3,7 +3,8 @@ rule: meta: name: list drag and drop files namespace: host-interaction/clipboard - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Collection::Clipboard Data [T1115] diff --git a/nursery/list-groups-for-user-account.yml b/nursery/list-groups-for-user-account.yml index f10f680a..3e0c06e9 100644 --- a/nursery/list-groups-for-user-account.yml +++ b/nursery/list-groups-for-user-account.yml @@ -3,7 +3,8 @@ rule: meta: name: list groups for user account namespace: host-interaction/accounts - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com description: enumerates all the groups to which a user account belongs scope: basic block att&ck: diff --git a/nursery/list-tcp-connections-and-listeners.yml b/nursery/list-tcp-connections-and-listeners.yml index 05cbc67a..356c2079 100644 --- a/nursery/list-tcp-connections-and-listeners.yml +++ b/nursery/list-tcp-connections-and-listeners.yml @@ -3,7 +3,8 @@ rule: meta: name: list TCP connections and listeners namespace: collection/network - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block features: - or: diff --git a/nursery/list-udp-connections-and-listeners.yml b/nursery/list-udp-connections-and-listeners.yml index 01fc09ed..b975e818 100644 --- a/nursery/list-udp-connections-and-listeners.yml +++ b/nursery/list-udp-connections-and-listeners.yml @@ -3,7 +3,8 @@ rule: meta: name: list UDP connections and listeners namespace: collection/network - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block features: - or: diff --git a/nursery/list-user-account-groups.yml b/nursery/list-user-account-groups.yml index 45086da9..3e4040e8 100644 --- a/nursery/list-user-account-groups.yml +++ b/nursery/list-user-account-groups.yml @@ -3,7 +3,8 @@ rule: meta: name: list user account groups namespace: host-interaction/accounts - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com description: enumerates all the groups present on the system/domain scope: basic block att&ck: diff --git a/nursery/list-user-accounts-for-group.yml b/nursery/list-user-accounts-for-group.yml index ba894f13..172b6a93 100644 --- a/nursery/list-user-accounts-for-group.yml +++ b/nursery/list-user-accounts-for-group.yml @@ -3,7 +3,8 @@ rule: meta: name: list user accounts for group namespace: host-interaction/accounts - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Discovery::Permission Groups Discovery [T1069] diff --git a/nursery/list-user-accounts.yml b/nursery/list-user-accounts.yml index d72df066..066f2328 100644 --- a/nursery/list-user-accounts.yml +++ b/nursery/list-user-accounts.yml @@ -3,7 +3,8 @@ rule: meta: name: list user accounts namespace: host-interaction/accounts - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Discovery::Account Discovery [T1087] diff --git a/nursery/listen-for-remote-procedure-calls.yml b/nursery/listen-for-remote-procedure-calls.yml index 70578ac7..e32f0e88 100644 --- a/nursery/listen-for-remote-procedure-calls.yml +++ b/nursery/listen-for-remote-procedure-calls.yml @@ -3,7 +3,8 @@ rule: meta: name: listen for remote procedure calls namespace: communication/rpc/server - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block features: - or: diff --git a/nursery/load-windows-common-language-runtime.yml b/nursery/load-windows-common-language-runtime.yml index b685aa7c..6251b99b 100644 --- a/nursery/load-windows-common-language-runtime.yml +++ b/nursery/load-windows-common-language-runtime.yml @@ -3,7 +3,8 @@ rule: meta: name: load Windows Common Language Runtime namespace: load-code/dotnet - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block features: - or: diff --git a/nursery/log-keystrokes-via-raw-input-data.yml b/nursery/log-keystrokes-via-raw-input-data.yml index 451b75fe..d09e2630 100644 --- a/nursery/log-keystrokes-via-raw-input-data.yml +++ b/nursery/log-keystrokes-via-raw-input-data.yml @@ -3,7 +3,8 @@ rule: meta: name: log keystrokes via raw input data namespace: collection/keylog - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Collection::Input Capture::Keylogging [T1056.001] diff --git a/nursery/make-an-http-request-with-a-cookie.yml b/nursery/make-an-http-request-with-a-cookie.yml index 0ade6592..f5f4c83a 100644 --- a/nursery/make-an-http-request-with-a-cookie.yml +++ b/nursery/make-an-http-request-with-a-cookie.yml @@ -2,7 +2,8 @@ rule: meta: name: make an HTTP request with a Cookie namespace: communication/http/client - author: anamaria.martinezgom@mandiant.com + authors: + - anamaria.martinezgom@mandiant.com scope: function features: - and: diff --git a/nursery/migrate-process-to-active-window-station.yml b/nursery/migrate-process-to-active-window-station.yml index 17510641..3c22d61e 100644 --- a/nursery/migrate-process-to-active-window-station.yml +++ b/nursery/migrate-process-to-active-window-station.yml @@ -2,7 +2,8 @@ rule: meta: name: migrate process to active window station namespace: host-interaction/gui/window-station - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com description: set process to the active window station so it can receive GUI events. commonly seen in keyloggers. scope: function references: diff --git a/nursery/mine-cryptocurrency.yml b/nursery/mine-cryptocurrency.yml index d11a3cec..3d4310ee 100644 --- a/nursery/mine-cryptocurrency.yml +++ b/nursery/mine-cryptocurrency.yml @@ -2,7 +2,8 @@ rule: meta: name: mine cryptocurrency namespace: impact/cryptocurrency - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: file att&ck: - Impact::Resource Hijacking [T1496] diff --git a/nursery/monitor-clipboard-content.yml b/nursery/monitor-clipboard-content.yml index 19ffeb0c..7dafdb82 100644 --- a/nursery/monitor-clipboard-content.yml +++ b/nursery/monitor-clipboard-content.yml @@ -3,7 +3,8 @@ rule: meta: name: monitor clipboard content namespace: host-interaction/clipboard - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Collection::Clipboard Data [T1115] diff --git a/nursery/monitor-local-ipv4-address-changes.yml b/nursery/monitor-local-ipv4-address-changes.yml index 2fcce7b4..fdcab2c2 100644 --- a/nursery/monitor-local-ipv4-address-changes.yml +++ b/nursery/monitor-local-ipv4-address-changes.yml @@ -3,7 +3,8 @@ rule: meta: name: monitor local IPv4 address changes namespace: host-interaction/network/address - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block att&ck: - Discovery::System Network Configuration Discovery [T1016] diff --git a/nursery/open-cabinet-file.yml b/nursery/open-cabinet-file.yml index ea3689ca..2ee425ee 100644 --- a/nursery/open-cabinet-file.yml +++ b/nursery/open-cabinet-file.yml @@ -2,7 +2,8 @@ rule: meta: name: open cabinet file namespace: host-interaction/file-system - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function references: - https://docs.microsoft.com/en-us/windows/win32/msi/cabinet-files diff --git a/nursery/packaged-as-a-createinstall-installer.yml b/nursery/packaged-as-a-createinstall-installer.yml index d9865ba3..6a4e4af5 100644 --- a/nursery/packaged-as-a-createinstall-installer.yml +++ b/nursery/packaged-as-a-createinstall-installer.yml @@ -2,7 +2,8 @@ rule: meta: name: packaged as a CreateInstall installer namespace: executable/installer/createinstall - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file references: - https://www.createinstall.com/ diff --git a/nursery/packaged-as-a-nsis-installer.yml b/nursery/packaged-as-a-nsis-installer.yml index e8757ad3..ed7518dc 100644 --- a/nursery/packaged-as-a-nsis-installer.yml +++ b/nursery/packaged-as-a-nsis-installer.yml @@ -2,7 +2,8 @@ rule: meta: name: packaged as a NSIS installer namespace: executable/installer/nsis - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: file references: - https://nsis.sourceforge.io/Main_Page diff --git a/nursery/packaged-as-a-pintool.yml b/nursery/packaged-as-a-pintool.yml index 5f89048b..5c890341 100644 --- a/nursery/packaged-as-a-pintool.yml +++ b/nursery/packaged-as-a-pintool.yml @@ -2,7 +2,8 @@ rule: meta: name: packaged as a Pintool namespace: executable/pintool - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file references: - https://software.intel.com/content/www/us/en/develop/articles/pin-a-dynamic-binary-instrumentation-tool.html diff --git a/nursery/packaged-as-a-winzip-self-extracting-archive.yml b/nursery/packaged-as-a-winzip-self-extracting-archive.yml index ba901243..1282614d 100644 --- a/nursery/packaged-as-a-winzip-self-extracting-archive.yml +++ b/nursery/packaged-as-a-winzip-self-extracting-archive.yml @@ -2,7 +2,8 @@ rule: meta: name: packaged as a WinZip self-extracting archive namespace: executable/installer/winzip - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file references: - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/ diff --git a/nursery/packaged-as-a-wise-installer.yml b/nursery/packaged-as-a-wise-installer.yml index 601a3dda..1faf43be 100644 --- a/nursery/packaged-as-a-wise-installer.yml +++ b/nursery/packaged-as-a-wise-installer.yml @@ -2,7 +2,8 @@ rule: meta: name: packaged as a Wise installer namespace: executable/installer/wiseinstall - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: file features: - or: diff --git a/nursery/packaged-as-an-installshield-installer.yml b/nursery/packaged-as-an-installshield-installer.yml index 7186ed1f..e2cd630f 100644 --- a/nursery/packaged-as-an-installshield-installer.yml +++ b/nursery/packaged-as-an-installshield-installer.yml @@ -2,7 +2,8 @@ rule: meta: name: packaged as an InstallShield installer namespace: executable/installer/installshield - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: file features: - or: diff --git a/nursery/packed-with-ccg.yml b/nursery/packed-with-ccg.yml index 378649aa..36df60d5 100644 --- a/nursery/packed-with-ccg.yml +++ b/nursery/packed-with-ccg.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with CCG namespace: anti-analysis/packer/ccg - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/packed-with-crunch.yml b/nursery/packed-with-crunch.yml index 9460dcc2..5f94d7ef 100644 --- a/nursery/packed-with-crunch.yml +++ b/nursery/packed-with-crunch.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with Crunch namespace: anti-analysis/packer/crunch - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/packed-with-dragon-armor.yml b/nursery/packed-with-dragon-armor.yml index 88f46583..b98336d9 100644 --- a/nursery/packed-with-dragon-armor.yml +++ b/nursery/packed-with-dragon-armor.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with Dragon Armor namespace: anti-analysis/packer/dragon-armor - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/packed-with-enigma.yml b/nursery/packed-with-enigma.yml index f798f3e7..23d29108 100644 --- a/nursery/packed-with-enigma.yml +++ b/nursery/packed-with-enigma.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with enigma namespace: anti-analysis/packer/enigma - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/packed-with-epack.yml b/nursery/packed-with-epack.yml index 32bd4980..f172a2c1 100644 --- a/nursery/packed-with-epack.yml +++ b/nursery/packed-with-epack.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with Epack namespace: anti-analysis/packer/epack - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/packed-with-maskpe.yml b/nursery/packed-with-maskpe.yml index e95694e0..01ef712c 100644 --- a/nursery/packed-with-maskpe.yml +++ b/nursery/packed-with-maskpe.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with MaskPE namespace: anti-analysis/packer/maskpe - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/packed-with-mew.yml b/nursery/packed-with-mew.yml index cd5c00f3..578c8560 100644 --- a/nursery/packed-with-mew.yml +++ b/nursery/packed-with-mew.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with MEW namespace: anti-analysis/packer/mew - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/packed-with-mpress.yml b/nursery/packed-with-mpress.yml index 8ee135c1..e8f1a3d6 100644 --- a/nursery/packed-with-mpress.yml +++ b/nursery/packed-with-mpress.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with Mpress namespace: anti-analysis/packer/mpress - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/packed-with-neolite.yml b/nursery/packed-with-neolite.yml index 492dca76..0b752de0 100644 --- a/nursery/packed-with-neolite.yml +++ b/nursery/packed-with-neolite.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with Neolite namespace: anti-analysis/packer/neolite - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/packed-with-pepack.yml b/nursery/packed-with-pepack.yml index 09666a06..1062b76e 100644 --- a/nursery/packed-with-pepack.yml +++ b/nursery/packed-with-pepack.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with Pepack namespace: anti-analysis/packer/pepack - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/packed-with-perplex.yml b/nursery/packed-with-perplex.yml index 2971a06e..9cb1d14c 100644 --- a/nursery/packed-with-perplex.yml +++ b/nursery/packed-with-perplex.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with Perplex namespace: anti-analysis/packer/perplex - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/packed-with-procrypt.yml b/nursery/packed-with-procrypt.yml index bd2af78e..9d7015e5 100644 --- a/nursery/packed-with-procrypt.yml +++ b/nursery/packed-with-procrypt.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with ProCrypt namespace: anti-analysis/packer/procrypt - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/packed-with-rpcrypt.yml b/nursery/packed-with-rpcrypt.yml index 37033e10..6837a191 100644 --- a/nursery/packed-with-rpcrypt.yml +++ b/nursery/packed-with-rpcrypt.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with RPCrypt namespace: anti-analysis/packer/rpcrypt - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/packed-with-seausfx.yml b/nursery/packed-with-seausfx.yml index f988bd35..c61eee07 100644 --- a/nursery/packed-with-seausfx.yml +++ b/nursery/packed-with-seausfx.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with SeauSFX namespace: anti-analysis/packer/seausfx - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/packed-with-shrinker.yml b/nursery/packed-with-shrinker.yml index 92ac405d..44a215fc 100644 --- a/nursery/packed-with-shrinker.yml +++ b/nursery/packed-with-shrinker.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with Shrinker namespace: anti-analysis/packer/shrinker - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/packed-with-simple-pack.yml b/nursery/packed-with-simple-pack.yml index 3d49c3e9..42c1c76d 100644 --- a/nursery/packed-with-simple-pack.yml +++ b/nursery/packed-with-simple-pack.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with Simple Pack namespace: anti-analysis/packer/simple-pack - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/packed-with-starforce.yml b/nursery/packed-with-starforce.yml index 9fb9c380..b1e99912 100644 --- a/nursery/packed-with-starforce.yml +++ b/nursery/packed-with-starforce.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with StarForce namespace: anti-analysis/packer/starforce - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/packed-with-svkp.yml b/nursery/packed-with-svkp.yml index 1abaa866..8abcdc3f 100644 --- a/nursery/packed-with-svkp.yml +++ b/nursery/packed-with-svkp.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with SVKP namespace: anti-analysis/packer/svkp - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/packed-with-tsuloader.yml b/nursery/packed-with-tsuloader.yml index d8d3b35c..e03a3bc8 100644 --- a/nursery/packed-with-tsuloader.yml +++ b/nursery/packed-with-tsuloader.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with TSULoader namespace: anti-analysis/packer/tsuloader - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/packed-with-vprotect.yml b/nursery/packed-with-vprotect.yml index 9e6d1b7e..0624ed70 100644 --- a/nursery/packed-with-vprotect.yml +++ b/nursery/packed-with-vprotect.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with VProtect namespace: anti-analysis/packer/vprotect - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/packed-with-wwpack.yml b/nursery/packed-with-wwpack.yml index 4e6dc00f..a0e665a6 100644 --- a/nursery/packed-with-wwpack.yml +++ b/nursery/packed-with-wwpack.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with WWPACK namespace: anti-analysis/packer/wwpack - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/nursery/parse-url.yml b/nursery/parse-url.yml index ac50b65a..4e1577d1 100644 --- a/nursery/parse-url.yml +++ b/nursery/parse-url.yml @@ -3,7 +3,8 @@ rule: meta: name: parse URL namespace: communication/http - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block features: - or: diff --git a/nursery/prompt-user-for-credentials.yml b/nursery/prompt-user-for-credentials.yml index 4394927c..7fc786ec 100644 --- a/nursery/prompt-user-for-credentials.yml +++ b/nursery/prompt-user-for-credentials.yml @@ -3,7 +3,8 @@ rule: meta: name: prompt user for credentials namespace: collection/credentials - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function references: - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/credentials-collection-via-creduipromptforcredentials diff --git a/nursery/query-or-enumerate-registry-key-via-stdregprov.yml b/nursery/query-or-enumerate-registry-key-via-stdregprov.yml index 1606dae5..25c1472f 100644 --- a/nursery/query-or-enumerate-registry-key-via-stdregprov.yml +++ b/nursery/query-or-enumerate-registry-key-via-stdregprov.yml @@ -3,7 +3,8 @@ rule: meta: name: query or enumerate registry key via StdRegProv namespace: host-interaction/registry - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function references: - https://docs.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov#methods diff --git a/nursery/query-or-enumerate-registry-value-via-stdregprov.yml b/nursery/query-or-enumerate-registry-value-via-stdregprov.yml index 3cfdc847..36308468 100644 --- a/nursery/query-or-enumerate-registry-value-via-stdregprov.yml +++ b/nursery/query-or-enumerate-registry-value-via-stdregprov.yml @@ -3,7 +3,8 @@ rule: meta: name: query or enumerate registry value via StdRegProv namespace: host-interaction/registry - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function references: - https://docs.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov#methods diff --git a/nursery/query-remote-server-for-available-data.yml b/nursery/query-remote-server-for-available-data.yml index ee29018a..af757da5 100644 --- a/nursery/query-remote-server-for-available-data.yml +++ b/nursery/query-remote-server-for-available-data.yml @@ -3,7 +3,8 @@ rule: meta: name: query remote server for available data namespace: communication - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block features: - or: diff --git a/nursery/read-and-send-data-from-client-to-server.yml b/nursery/read-and-send-data-from-client-to-server.yml index 838d644d..cd5318a7 100644 --- a/nursery/read-and-send-data-from-client-to-server.yml +++ b/nursery/read-and-send-data-from-client-to-server.yml @@ -2,7 +2,8 @@ rule: meta: name: read and send data from client to server namespace: c2/file-transfer - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function features: - and: diff --git a/nursery/read-process-memory.yml b/nursery/read-process-memory.yml index 0735ffa6..f427658e 100644 --- a/nursery/read-process-memory.yml +++ b/nursery/read-process-memory.yml @@ -2,7 +2,7 @@ rule: meta: name: read process memory namespace: host-interaction/process - author: + authors: - matthew.williams@mandiant.com - "@_re_fox" scope: function diff --git a/nursery/read-raw-disk-data.yml b/nursery/read-raw-disk-data.yml index cdada737..8a4d1a4b 100644 --- a/nursery/read-raw-disk-data.yml +++ b/nursery/read-raw-disk-data.yml @@ -2,7 +2,8 @@ rule: meta: name: read raw disk data namespace: host-interaction/file-system - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file features: - or: diff --git a/nursery/rebuilt-by-imprec.yml b/nursery/rebuilt-by-imprec.yml index 1ea037e0..6afe346a 100644 --- a/nursery/rebuilt-by-imprec.yml +++ b/nursery/rebuilt-by-imprec.yml @@ -2,7 +2,8 @@ rule: meta: name: rebuilt by ImpRec namespace: executable/imprec - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file references: - https://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/ diff --git a/nursery/receive-and-write-data-from-server-to-client.yml b/nursery/receive-and-write-data-from-server-to-client.yml index a03486b7..2d8ecd2a 100644 --- a/nursery/receive-and-write-data-from-server-to-client.yml +++ b/nursery/receive-and-write-data-from-server-to-client.yml @@ -2,7 +2,8 @@ rule: meta: name: receive and write data from server to client namespace: c2/file-transfer - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function features: - and: diff --git a/nursery/reference-114dns-dns-server.yml b/nursery/reference-114dns-dns-server.yml index 57e56d14..b4a5d5fe 100644 --- a/nursery/reference-114dns-dns-server.yml +++ b/nursery/reference-114dns-dns-server.yml @@ -2,7 +2,8 @@ rule: meta: name: reference 114DNS DNS server namespace: communication/dns - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function references: - https://www.114dns.com/ diff --git a/nursery/reference-aes-constants.yml b/nursery/reference-aes-constants.yml index f123a0a5..f523e98d 100644 --- a/nursery/reference-aes-constants.yml +++ b/nursery/reference-aes-constants.yml @@ -2,7 +2,8 @@ rule: meta: name: reference AES constants namespace: data-manipulation/encryption/aes - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information [T1027] diff --git a/nursery/reference-alidns-dns-server.yml b/nursery/reference-alidns-dns-server.yml index 2a1f565e..d44846af 100644 --- a/nursery/reference-alidns-dns-server.yml +++ b/nursery/reference-alidns-dns-server.yml @@ -2,7 +2,8 @@ rule: meta: name: reference AliDNS DNS server namespace: communication/dns - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function references: - https://www.alidns.com/ diff --git a/nursery/reference-cloudflare-dns-server.yml b/nursery/reference-cloudflare-dns-server.yml index 4f0bef82..8e3c7405 100644 --- a/nursery/reference-cloudflare-dns-server.yml +++ b/nursery/reference-cloudflare-dns-server.yml @@ -2,7 +2,8 @@ rule: meta: name: reference Cloudflare DNS server namespace: communication/dns - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function references: - https://www.techradar.com/news/best-dns-server diff --git a/nursery/reference-comodo-secure-dns-server.yml b/nursery/reference-comodo-secure-dns-server.yml index b7ac603d..39c2d789 100644 --- a/nursery/reference-comodo-secure-dns-server.yml +++ b/nursery/reference-comodo-secure-dns-server.yml @@ -2,7 +2,8 @@ rule: meta: name: reference Comodo Secure DNS server namespace: communication/dns - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function references: - https://www.techradar.com/news/best-dns-server diff --git a/nursery/reference-google-public-dns-server.yml b/nursery/reference-google-public-dns-server.yml index 46935657..58ab22ad 100644 --- a/nursery/reference-google-public-dns-server.yml +++ b/nursery/reference-google-public-dns-server.yml @@ -2,7 +2,8 @@ rule: meta: name: reference Google Public DNS server namespace: communication/dns - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function references: - https://www.techradar.com/news/best-dns-server diff --git a/nursery/reference-hurricane-electric-dns-server.yml b/nursery/reference-hurricane-electric-dns-server.yml index b2e44872..5ceda0ec 100644 --- a/nursery/reference-hurricane-electric-dns-server.yml +++ b/nursery/reference-hurricane-electric-dns-server.yml @@ -2,7 +2,8 @@ rule: meta: name: reference Hurricane Electric DNS server namespace: communication/dns - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function references: - https://dns.he.net/ diff --git a/nursery/reference-kornet-dns-server.yml b/nursery/reference-kornet-dns-server.yml index 3e92456a..415039e0 100644 --- a/nursery/reference-kornet-dns-server.yml +++ b/nursery/reference-kornet-dns-server.yml @@ -2,7 +2,8 @@ rule: meta: name: reference kornet DNS server namespace: communication/dns - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function references: - https://whatismyipaddress.com/ip/168.126.63.1 diff --git a/nursery/reference-l3-dns-server.yml b/nursery/reference-l3-dns-server.yml index b9e43090..7a05f051 100644 --- a/nursery/reference-l3-dns-server.yml +++ b/nursery/reference-l3-dns-server.yml @@ -2,7 +2,8 @@ rule: meta: name: reference L3 DNS server namespace: communication/dns - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function references: - https://www.quora.com/What-is-a-4-2-2-1-DNS-server diff --git a/nursery/reference-opendns-dns-server.yml b/nursery/reference-opendns-dns-server.yml index 3dcb0a31..b60fc981 100644 --- a/nursery/reference-opendns-dns-server.yml +++ b/nursery/reference-opendns-dns-server.yml @@ -2,7 +2,8 @@ rule: meta: name: reference OpenDNS DNS server namespace: communication/dns - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function references: - https://www.techradar.com/news/best-dns-server diff --git a/nursery/reference-processor-manufacturer-constants.yml b/nursery/reference-processor-manufacturer-constants.yml index 3a284862..34aef0c9 100644 --- a/nursery/reference-processor-manufacturer-constants.yml +++ b/nursery/reference-processor-manufacturer-constants.yml @@ -2,7 +2,8 @@ rule: meta: name: reference processor manufacturer constants namespace: anti-analysis/anti-vm/vm-detection - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: basic block att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] diff --git a/nursery/reference-quad9-dns-server.yml b/nursery/reference-quad9-dns-server.yml index f6c161ef..df0fe817 100644 --- a/nursery/reference-quad9-dns-server.yml +++ b/nursery/reference-quad9-dns-server.yml @@ -2,7 +2,8 @@ rule: meta: name: reference Quad9 DNS server namespace: communication/dns - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function references: - https://www.techradar.com/news/best-dns-server diff --git a/nursery/reference-screen-saver-executable.yml b/nursery/reference-screen-saver-executable.yml index 27fe1b72..5c3ffe4c 100644 --- a/nursery/reference-screen-saver-executable.yml +++ b/nursery/reference-screen-saver-executable.yml @@ -2,7 +2,8 @@ rule: meta: name: reference screen saver executable namespace: persistence/screensaver - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com description: SCRNSAVE.EXE registry value specifies the name of the screen saver executable file scope: function att&ck: diff --git a/nursery/reference-startup-folder.yml b/nursery/reference-startup-folder.yml index e8956778..bdc762f6 100644 --- a/nursery/reference-startup-folder.yml +++ b/nursery/reference-startup-folder.yml @@ -2,7 +2,8 @@ rule: meta: name: reference startup folder namespace: persistence/startup-folder - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: file att&ck: - Persistence::Boot or Logon Autostart Execution::Registry Run Keys / Startup Folder [T1547.001] diff --git a/nursery/reference-the-vmware-io-port.yml b/nursery/reference-the-vmware-io-port.yml index 7f0adaaa..668ee70f 100644 --- a/nursery/reference-the-vmware-io-port.yml +++ b/nursery/reference-the-vmware-io-port.yml @@ -2,7 +2,8 @@ rule: meta: name: reference the VMWare IO port namespace: anti-analysis/anti-vm/vm-detection - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: function att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] diff --git a/nursery/reference-verisign-dns-server.yml b/nursery/reference-verisign-dns-server.yml index 28442728..2bc86f7c 100644 --- a/nursery/reference-verisign-dns-server.yml +++ b/nursery/reference-verisign-dns-server.yml @@ -2,7 +2,8 @@ rule: meta: name: reference Verisign DNS server namespace: communication/dns - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function references: - https://www.techradar.com/news/best-dns-server diff --git a/nursery/register-http-server-url.yml b/nursery/register-http-server-url.yml index 9a45995e..241cff21 100644 --- a/nursery/register-http-server-url.yml +++ b/nursery/register-http-server-url.yml @@ -3,7 +3,8 @@ rule: meta: name: register HTTP server URL namespace: communication/http/server - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block features: - or: diff --git a/nursery/register-raw-input-devices.yml b/nursery/register-raw-input-devices.yml index 64231d37..90dc25fe 100644 --- a/nursery/register-raw-input-devices.yml +++ b/nursery/register-raw-input-devices.yml @@ -3,7 +3,8 @@ rule: meta: name: register raw input devices namespace: host-interaction/hardware - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block features: - or: diff --git a/nursery/resize-volume-shadow-copy-storage.yml b/nursery/resize-volume-shadow-copy-storage.yml index cc418d16..e22bf7db 100644 --- a/nursery/resize-volume-shadow-copy-storage.yml +++ b/nursery/resize-volume-shadow-copy-storage.yml @@ -3,7 +3,8 @@ rule: meta: name: resize volume shadow copy storage namespace: impact/inhibit-system-recovery - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block features: - and: diff --git a/nursery/resolve-function-by-fnv-1a-hash.yml b/nursery/resolve-function-by-fnv-1a-hash.yml index a454c0ab..59710c4c 100644 --- a/nursery/resolve-function-by-fnv-1a-hash.yml +++ b/nursery/resolve-function-by-fnv-1a-hash.yml @@ -2,7 +2,8 @@ rule: meta: name: resolve function by FNV-1a hash namespace: linking/runtime-linking - author: still@teamt5.org + authors: + - still@teamt5.org description: - known import name hashes calculated using the non-cryptographic FNV-1a hashing algorithm scope: function diff --git a/nursery/resolve-function-by-hash.yml b/nursery/resolve-function-by-hash.yml index aa20f7a5..0b697a21 100644 --- a/nursery/resolve-function-by-hash.yml +++ b/nursery/resolve-function-by-hash.yml @@ -2,7 +2,8 @@ rule: meta: name: resolve function by hash namespace: linking/runtime-linking - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function att&ck: - Defense Evasion::Obfuscated Files or Information::Indicator Removal from Tools [T1027.005] diff --git a/nursery/run-in-container.yml b/nursery/run-in-container.yml index 994037d7..d8fd0f50 100644 --- a/nursery/run-in-container.yml +++ b/nursery/run-in-container.yml @@ -2,7 +2,8 @@ rule: meta: name: run in container namespace: host-interaction/container/docker - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function att&ck: - Execution::Container Administration Command [T1609] diff --git a/nursery/run-powershell-expression.yml b/nursery/run-powershell-expression.yml index a65e9c4f..df5c6d5d 100644 --- a/nursery/run-powershell-expression.yml +++ b/nursery/run-powershell-expression.yml @@ -2,7 +2,8 @@ rule: meta: name: run PowerShell expression namespace: load-code/powershell/ - author: anamaria.martinezgom@mandiant.com + authors: + - anamaria.martinezgom@mandiant.com scope: function att&ck: - Execution::Command and Scripting Interpreter::PowerShell [T1059.001] diff --git a/nursery/schedule-task-via-itaskservice.yml b/nursery/schedule-task-via-itaskservice.yml index 1eb2548f..09c84745 100644 --- a/nursery/schedule-task-via-itaskservice.yml +++ b/nursery/schedule-task-via-itaskservice.yml @@ -2,7 +2,8 @@ rule: meta: name: schedule task via ITaskService namespace: persistence/scheduled-tasks - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function att&ck: - Persistence::Scheduled Task/Job::Scheduled Task [T1053.005] diff --git a/nursery/search-for-credit-card-data.yml b/nursery/search-for-credit-card-data.yml index ff8f1d2c..7c688c2c 100644 --- a/nursery/search-for-credit-card-data.yml +++ b/nursery/search-for-credit-card-data.yml @@ -2,7 +2,8 @@ rule: meta: name: search for credit card data namespace: collection/credit-card - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: function features: - and: diff --git a/nursery/send-http-request-with-host-header.yml b/nursery/send-http-request-with-host-header.yml index 0125a83c..4646f893 100644 --- a/nursery/send-http-request-with-host-header.yml +++ b/nursery/send-http-request-with-host-header.yml @@ -2,7 +2,8 @@ rule: meta: name: send HTTP request with Host header namespace: communication/http - author: anamaria.martinezgom@mandiant.com + authors: + - anamaria.martinezgom@mandiant.com scope: function features: - and: diff --git a/nursery/set-global-application-hook.yml b/nursery/set-global-application-hook.yml index b98cf172..d634231c 100644 --- a/nursery/set-global-application-hook.yml +++ b/nursery/set-global-application-hook.yml @@ -2,7 +2,8 @@ rule: meta: name: set global application hook namespace: host-interaction/gui - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: basic block features: - and: diff --git a/nursery/set-registry-value-via-stdregprov.yml b/nursery/set-registry-value-via-stdregprov.yml index dfd9eca5..1f194339 100644 --- a/nursery/set-registry-value-via-stdregprov.yml +++ b/nursery/set-registry-value-via-stdregprov.yml @@ -3,7 +3,8 @@ rule: meta: name: set registry value via StdRegProv namespace: host-interaction/registry - author: michael.hunhoff@mandiant.com + authors: + - michael.hunhoff@mandiant.com scope: function references: - https://docs.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov#methods diff --git a/nursery/terminate-process-by-name.yml b/nursery/terminate-process-by-name.yml index 393ee9fc..081a9503 100644 --- a/nursery/terminate-process-by-name.yml +++ b/nursery/terminate-process-by-name.yml @@ -2,7 +2,8 @@ rule: meta: name: terminate process by name namespace: host-interaction/process/terminate - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function examples: # - unpacked Cl0p ransomware diff --git a/persistence/iis/persist-via-iis-module.yml b/persistence/iis/persist-via-iis-module.yml index d079a159..cee74ded 100644 --- a/persistence/iis/persist-via-iis-module.yml +++ b/persistence/iis/persist-via-iis-module.yml @@ -2,7 +2,8 @@ rule: meta: name: persist via IIS module namespace: persistence - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com description: IIS 7.0 introduced modules that provide the same unrestricted access to HTTP requests and responses as ISAPI extensions and filters. scope: file att&ck: diff --git a/persistence/iis/persist-via-isapi-extension.yml b/persistence/iis/persist-via-isapi-extension.yml index ddc508d5..89230c9b 100644 --- a/persistence/iis/persist-via-isapi-extension.yml +++ b/persistence/iis/persist-via-isapi-extension.yml @@ -2,7 +2,8 @@ rule: meta: name: persist via ISAPI extension namespace: persistence - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com description: Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. scope: file att&ck: diff --git a/persistence/persist-via-desktop-autostart.yml b/persistence/persist-via-desktop-autostart.yml index 0d5cfc09..3a1ed342 100644 --- a/persistence/persist-via-desktop-autostart.yml +++ b/persistence/persist-via-desktop-autostart.yml @@ -2,7 +2,8 @@ rule: meta: name: persist via .desktop autostart namespace: persistence - author: joakim@intezer.com + authors: + - joakim@intezer.com scope: function att&ck: - Persistence::Boot or Logon Autostart Execution::XDG Autostart Entries [T1547.013] diff --git a/persistence/persist-via-shell-profile-or-rc-file.yml b/persistence/persist-via-shell-profile-or-rc-file.yml index ebe579b4..73ecb0f2 100644 --- a/persistence/persist-via-shell-profile-or-rc-file.yml +++ b/persistence/persist-via-shell-profile-or-rc-file.yml @@ -2,7 +2,8 @@ rule: meta: name: persist via shell profile or rc file namespace: persistence - author: joakim@intezer.com + authors: + - joakim@intezer.com scope: function att&ck: - Persistence::Event Triggered Execution::Unix Shell Configuration Modification [T1546.004] diff --git a/persistence/registry/appinitdlls/disable-appinit_dlls-code-signature-enforcement.yml b/persistence/registry/appinitdlls/disable-appinit_dlls-code-signature-enforcement.yml index ed46787a..42872d58 100644 --- a/persistence/registry/appinitdlls/disable-appinit_dlls-code-signature-enforcement.yml +++ b/persistence/registry/appinitdlls/disable-appinit_dlls-code-signature-enforcement.yml @@ -2,7 +2,8 @@ rule: meta: name: disable AppInit_DLLs code signature enforcement namespace: persistence/registry/appinitdlls - author: william.ballenthin@fireye.com + authors: + - william.ballenthin@fireye.com scope: function att&ck: - Persistence::Event Triggered Execution::AppInit DLLs [T1546.010] diff --git a/persistence/registry/appinitdlls/persist-via-appinit_dlls-registry-key.yml b/persistence/registry/appinitdlls/persist-via-appinit_dlls-registry-key.yml index 13b913fc..69863387 100644 --- a/persistence/registry/appinitdlls/persist-via-appinit_dlls-registry-key.yml +++ b/persistence/registry/appinitdlls/persist-via-appinit_dlls-registry-key.yml @@ -2,7 +2,8 @@ rule: meta: name: persist via AppInit_DLLs registry key namespace: persistence/registry/appinitdlls - author: michael.hunhoff@fireye.com + authors: + - michael.hunhoff@fireye.com scope: function att&ck: - Persistence::Event Triggered Execution::AppInit DLLs [T1546.010] diff --git a/persistence/registry/ginadll/persist-via-ginadll-registry-key.yml b/persistence/registry/ginadll/persist-via-ginadll-registry-key.yml index 43addc88..0ae9335e 100644 --- a/persistence/registry/ginadll/persist-via-ginadll-registry-key.yml +++ b/persistence/registry/ginadll/persist-via-ginadll-registry-key.yml @@ -2,7 +2,8 @@ rule: meta: name: persist via GinaDLL registry key namespace: persistence/registry/ginadll - author: michael.hunhoff@fireye.com + authors: + - michael.hunhoff@fireye.com scope: function att&ck: - Persistence::Event Triggered Execution [T1546] diff --git a/persistence/registry/persist-via-active-setup-registry-key.yml b/persistence/registry/persist-via-active-setup-registry-key.yml index c4caf923..64628d2a 100644 --- a/persistence/registry/persist-via-active-setup-registry-key.yml +++ b/persistence/registry/persist-via-active-setup-registry-key.yml @@ -2,7 +2,8 @@ rule: meta: name: persist via Active Setup registry key namespace: persistence/registry - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Persistence::Boot or Logon Autostart Execution::Active Setup [T1547.014] diff --git a/persistence/registry/run/persist-via-run-registry-key.yml b/persistence/registry/run/persist-via-run-registry-key.yml index 135c8cbf..8ca5e332 100644 --- a/persistence/registry/run/persist-via-run-registry-key.yml +++ b/persistence/registry/run/persist-via-run-registry-key.yml @@ -2,7 +2,8 @@ rule: meta: name: persist via Run registry key namespace: persistence/registry/run - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Persistence::Boot or Logon Autostart Execution::Registry Run Keys / Startup Folder [T1547.001] diff --git a/persistence/registry/winlogon-helper/persist-via-winlogon-helper-dll-registry-key.yml b/persistence/registry/winlogon-helper/persist-via-winlogon-helper-dll-registry-key.yml index ce7a851a..b11e8819 100644 --- a/persistence/registry/winlogon-helper/persist-via-winlogon-helper-dll-registry-key.yml +++ b/persistence/registry/winlogon-helper/persist-via-winlogon-helper-dll-registry-key.yml @@ -2,7 +2,8 @@ rule: meta: name: persist via Winlogon Helper DLL registry key namespace: persistence/registry/winlogon-helper - author: 0x534a@mailbox.org + authors: + - 0x534a@mailbox.org scope: function att&ck: - Persistence::Boot or Logon Autostart Execution::Winlogon Helper DLL [T1547.004] diff --git a/persistence/scheduled-tasks/schedule-task-via-command-line.yml b/persistence/scheduled-tasks/schedule-task-via-command-line.yml index 626c69d6..afa4b304 100644 --- a/persistence/scheduled-tasks/schedule-task-via-command-line.yml +++ b/persistence/scheduled-tasks/schedule-task-via-command-line.yml @@ -2,7 +2,8 @@ rule: meta: name: schedule task via command line namespace: persistence/scheduled-tasks - author: 0x534a@mailbox.org + authors: + - 0x534a@mailbox.org scope: function att&ck: - Persistence::Scheduled Task/Job::Scheduled Task [T1053.005] diff --git a/persistence/scheduled-tasks/schedule-task-via-itaskscheduler.yml b/persistence/scheduled-tasks/schedule-task-via-itaskscheduler.yml index be8ee2ab..5c20d31d 100644 --- a/persistence/scheduled-tasks/schedule-task-via-itaskscheduler.yml +++ b/persistence/scheduled-tasks/schedule-task-via-itaskscheduler.yml @@ -2,7 +2,8 @@ rule: meta: name: schedule task via ITaskScheduler namespace: persistence/scheduled-tasks - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Persistence::Scheduled Task/Job::Scheduled Task [T1053.005] diff --git a/persistence/service/persist-via-rc-script.yml b/persistence/service/persist-via-rc-script.yml index 61e9c58d..1d4c6b0a 100644 --- a/persistence/service/persist-via-rc-script.yml +++ b/persistence/service/persist-via-rc-script.yml @@ -2,7 +2,8 @@ rule: meta: name: persist via rc script namespace: persistence/service - author: joakim@intezer.com + authors: + - joakim@intezer.com scope: function att&ck: - Persistence::Boot or Logon Initialization Scripts::RC Scripts [T1037.004] diff --git a/persistence/service/persist-via-windows-service.yml b/persistence/service/persist-via-windows-service.yml index 381f2022..4f958167 100644 --- a/persistence/service/persist-via-windows-service.yml +++ b/persistence/service/persist-via-windows-service.yml @@ -2,7 +2,8 @@ rule: meta: name: persist via Windows service namespace: persistence/service - author: moritz.raabe@mandiant.com + authors: + - moritz.raabe@mandiant.com scope: function att&ck: - Persistence::Create or Modify System Process::Windows Service [T1543.003] diff --git a/persistence/startup-folder/get-startup-folder.yml b/persistence/startup-folder/get-startup-folder.yml index 558846bb..bc671794 100644 --- a/persistence/startup-folder/get-startup-folder.yml +++ b/persistence/startup-folder/get-startup-folder.yml @@ -2,7 +2,8 @@ rule: meta: name: get startup folder namespace: persistence/startup-folder - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: basic block att&ck: - Persistence::Boot or Logon Autostart Execution::Registry Run Keys / Startup Folder [T1547.001] diff --git a/persistence/startup-folder/write-file-to-startup-folder.yml b/persistence/startup-folder/write-file-to-startup-folder.yml index 04aa70b7..7ac1c059 100644 --- a/persistence/startup-folder/write-file-to-startup-folder.yml +++ b/persistence/startup-folder/write-file-to-startup-folder.yml @@ -2,7 +2,8 @@ rule: meta: name: write file to startup folder namespace: persistence/startup-folder - author: matthew.williams@mandiant.com + authors: + - matthew.williams@mandiant.com scope: function att&ck: - Persistence::Boot or Logon Autostart Execution::Registry Run Keys / Startup Folder [T1547.001] diff --git a/runtime/dotnet/compiled-to-the-net-platform.yml b/runtime/dotnet/compiled-to-the-net-platform.yml index ef1cfe7f..ebc8541d 100644 --- a/runtime/dotnet/compiled-to-the-net-platform.yml +++ b/runtime/dotnet/compiled-to-the-net-platform.yml @@ -2,7 +2,8 @@ rule: meta: name: compiled to the .NET platform namespace: runtime/dotnet - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file examples: - b9f5bd514485fb06da39beff051b9fdc diff --git a/targeting/automated-teller-machine/diebold-nixdorf/load-diebold-nixdorf-atm-library.yml b/targeting/automated-teller-machine/diebold-nixdorf/load-diebold-nixdorf-atm-library.yml index 9f697f2f..2d150e12 100644 --- a/targeting/automated-teller-machine/diebold-nixdorf/load-diebold-nixdorf-atm-library.yml +++ b/targeting/automated-teller-machine/diebold-nixdorf/load-diebold-nixdorf-atm-library.yml @@ -2,7 +2,8 @@ rule: meta: name: load Diebold Nixdorf ATM library namespace: targeting/automated-teller-machine/diebold-nixdorf - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file references: - https://www.vkremez.com/2017/12/lets-learn-cutlet-atm-malware-internals.html diff --git a/targeting/automated-teller-machine/diebold-nixdorf/reference-diebold-atm-routines.yml b/targeting/automated-teller-machine/diebold-nixdorf/reference-diebold-atm-routines.yml index abda9adb..1a9c6b34 100644 --- a/targeting/automated-teller-machine/diebold-nixdorf/reference-diebold-atm-routines.yml +++ b/targeting/automated-teller-machine/diebold-nixdorf/reference-diebold-atm-routines.yml @@ -2,7 +2,8 @@ rule: meta: name: reference Diebold ATM routines namespace: targeting/automated-teller-machine/diebold-nixdorf - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file references: - https://www.fireeye.com/blog/threat-research/2017/01/new_ploutus_variant.html diff --git a/targeting/automated-teller-machine/identify-atm-dispenser-service-provider.yml b/targeting/automated-teller-machine/identify-atm-dispenser-service-provider.yml index c42d73a5..4c8b495a 100644 --- a/targeting/automated-teller-machine/identify-atm-dispenser-service-provider.yml +++ b/targeting/automated-teller-machine/identify-atm-dispenser-service-provider.yml @@ -2,7 +2,8 @@ rule: meta: name: identify ATM dispenser service provider namespace: targeting/automated-teller-machine - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file references: - https://doc.axxonsoft.com/confluence/display/atm70en/Configuring+the+connection+to+the+dispenser+service+provider diff --git a/targeting/automated-teller-machine/ncr/load-ncr-atm-library.yml b/targeting/automated-teller-machine/ncr/load-ncr-atm-library.yml index 6517345a..bd47629a 100644 --- a/targeting/automated-teller-machine/ncr/load-ncr-atm-library.yml +++ b/targeting/automated-teller-machine/ncr/load-ncr-atm-library.yml @@ -2,7 +2,8 @@ rule: meta: name: load NCR ATM library namespace: targeting/automated-teller-machine/ncr - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: file references: - https://www.pcworld.com/article/2824572/leaked-programming-manual-may-help-criminals-develop-more-atm-malware.html diff --git a/targeting/automated-teller-machine/ncr/reference-ncr-atm-library-routines.yml b/targeting/automated-teller-machine/ncr/reference-ncr-atm-library-routines.yml index beced26d..a0973a99 100644 --- a/targeting/automated-teller-machine/ncr/reference-ncr-atm-library-routines.yml +++ b/targeting/automated-teller-machine/ncr/reference-ncr-atm-library-routines.yml @@ -2,7 +2,8 @@ rule: meta: name: reference NCR ATM library routines namespace: targeting/automated-teller-machine/ncr - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function references: - https://www.pcworld.com/article/2824572/leaked-programming-manual-may-help-criminals-develop-more-atm-malware.html diff --git a/targeting/language/identify-system-language-via-api.yml b/targeting/language/identify-system-language-via-api.yml index 28a34160..6645fc32 100644 --- a/targeting/language/identify-system-language-via-api.yml +++ b/targeting/language/identify-system-language-via-api.yml @@ -2,7 +2,8 @@ rule: meta: name: identify system language via API namespace: targeting/language - author: william.ballenthin@mandiant.com + authors: + - william.ballenthin@mandiant.com scope: function att&ck: - Discovery::System Location Discovery::System Language Discovery [T1614.001]