mirror of
https://github.com/vee1e/capa-rules.git
synced 2026-09-01 19:07:15 +00:00
*: use meta.authors everywhere
This commit is contained in:
parent
eaa568abf6
commit
88c9c786ca
668 changed files with 1279 additions and 669 deletions
|
|
@ -2,7 +2,8 @@ rule:
|
|||
meta:
|
||||
name: execute shellcode via CopyFile2
|
||||
namespace: load-code/shellcode
|
||||
author: jakub.jozwiak@mandiant.com
|
||||
authors:
|
||||
- jakub.jozwiak@mandiant.com
|
||||
scope: function
|
||||
references:
|
||||
- https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/CopyFile2/CopyFile2.cpp
|
||||
|
|
|
|||
|
|
@ -2,7 +2,8 @@ rule:
|
|||
meta:
|
||||
name: execute shellcode via CreateThreadpoolWait
|
||||
namespace: load-code/shellcode
|
||||
author: jakub.jozwiak@mandiant.com
|
||||
authors:
|
||||
- jakub.jozwiak@mandiant.com
|
||||
scope: function
|
||||
references:
|
||||
- https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/CreateThreadPoolWait/CreateThreadPoolWait.cpp
|
||||
|
|
|
|||
|
|
@ -2,7 +2,8 @@ rule:
|
|||
meta:
|
||||
name: execute shellcode via EnumUILanguages
|
||||
namespace: load-code/shellcode
|
||||
author: jakub.jozwiak@mandiant.com
|
||||
authors:
|
||||
- jakub.jozwiak@mandiant.com
|
||||
scope: function
|
||||
mbc:
|
||||
- Defense Evasion::Hijack Execution Flow::Abuse Windows Function Calls [F0015.006]
|
||||
|
|
|
|||
|
|
@ -2,7 +2,8 @@ rule:
|
|||
meta:
|
||||
name: execute shellcode via Windows fibers
|
||||
namespace: load-code/shellcode
|
||||
author: jakub.jozwiak@mandiant.com
|
||||
authors:
|
||||
- jakub.jozwiak@mandiant.com
|
||||
scope: function
|
||||
mbc:
|
||||
- Defense Evasion::Process Injection::Injection via Windows Fibers [E1055.m05]
|
||||
|
|
|
|||
|
|
@ -2,7 +2,8 @@ rule:
|
|||
meta:
|
||||
name: spawn thread to RWX shellcode
|
||||
namespace: load-code/shellcode
|
||||
author: moritz.raabe@mandiant.com
|
||||
authors:
|
||||
- moritz.raabe@mandiant.com
|
||||
scope: function
|
||||
mbc:
|
||||
- Memory::Allocate Memory [C0007]
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue