*: use meta.authors everywhere

This commit is contained in:
Willi Ballenthin 2022-05-26 11:56:31 -06:00
parent eaa568abf6
commit 88c9c786ca
No known key found for this signature in database
668 changed files with 1279 additions and 669 deletions

View file

@ -2,7 +2,8 @@ rule:
meta:
name: execute shellcode via CopyFile2
namespace: load-code/shellcode
author: jakub.jozwiak@mandiant.com
authors:
- jakub.jozwiak@mandiant.com
scope: function
references:
- https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/CopyFile2/CopyFile2.cpp

View file

@ -2,7 +2,8 @@ rule:
meta:
name: execute shellcode via CreateThreadpoolWait
namespace: load-code/shellcode
author: jakub.jozwiak@mandiant.com
authors:
- jakub.jozwiak@mandiant.com
scope: function
references:
- https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/CreateThreadPoolWait/CreateThreadPoolWait.cpp

View file

@ -2,7 +2,8 @@ rule:
meta:
name: execute shellcode via EnumUILanguages
namespace: load-code/shellcode
author: jakub.jozwiak@mandiant.com
authors:
- jakub.jozwiak@mandiant.com
scope: function
mbc:
- Defense Evasion::Hijack Execution Flow::Abuse Windows Function Calls [F0015.006]

View file

@ -2,7 +2,8 @@ rule:
meta:
name: execute shellcode via Windows fibers
namespace: load-code/shellcode
author: jakub.jozwiak@mandiant.com
authors:
- jakub.jozwiak@mandiant.com
scope: function
mbc:
- Defense Evasion::Process Injection::Injection via Windows Fibers [E1055.m05]

View file

@ -2,7 +2,8 @@ rule:
meta:
name: spawn thread to RWX shellcode
namespace: load-code/shellcode
author: moritz.raabe@mandiant.com
authors:
- moritz.raabe@mandiant.com
scope: function
mbc:
- Memory::Allocate Memory [C0007]