From 9083a1950cc3cd657ee903a922a0d279e662260a Mon Sep 17 00:00:00 2001 From: Willi Ballenthin Date: Tue, 28 Jun 2022 15:30:57 -0600 Subject: [PATCH] linter --- anti-analysis/packer/huan/packed-with-huan.yml | 3 ++- ...xports.yml => resolve-function-by-parsing-pe-exports.yml} | 0 nursery/mixed-mode.yml | 5 +++-- nursery/unmanaged-call.yml | 2 +- 4 files changed, 6 insertions(+), 4 deletions(-) rename load-code/pe/{resolve-function-by-parsing-PE-exports.yml => resolve-function-by-parsing-pe-exports.yml} (100%) diff --git a/anti-analysis/packer/huan/packed-with-huan.yml b/anti-analysis/packer/huan/packed-with-huan.yml index 0bfd7eea..d3dbd44d 100644 --- a/anti-analysis/packer/huan/packed-with-huan.yml +++ b/anti-analysis/packer/huan/packed-with-huan.yml @@ -2,7 +2,8 @@ rule: meta: name: packed with Huan namespace: anti-analysis/packer/huan - author: jakub.jozwiak@mandiant.com + authors: + - jakub.jozwiak@mandiant.com scope: file att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] diff --git a/load-code/pe/resolve-function-by-parsing-PE-exports.yml b/load-code/pe/resolve-function-by-parsing-pe-exports.yml similarity index 100% rename from load-code/pe/resolve-function-by-parsing-PE-exports.yml rename to load-code/pe/resolve-function-by-parsing-pe-exports.yml diff --git a/nursery/mixed-mode.yml b/nursery/mixed-mode.yml index 1874fa80..fb328ae8 100644 --- a/nursery/mixed-mode.yml +++ b/nursery/mixed-mode.yml @@ -2,9 +2,10 @@ rule: meta: name: mixed mode namespace: runtime - author: michael.hunhoff@mandiant.com - scope: file + authors: + - michael.hunhoff@mandiant.com description: file contains managed and unmanaged (native) code, often seen in .NET + scope: file features: - or: - characteristic: mixed mode diff --git a/nursery/unmanaged-call.yml b/nursery/unmanaged-call.yml index 93bd96d5..b29d1dd4 100644 --- a/nursery/unmanaged-call.yml +++ b/nursery/unmanaged-call.yml @@ -4,8 +4,8 @@ rule: namespace: runtime authors: - michael.hunhoff@mandiant.com - scope: function description: managed code calls unmanaged (native) code, often seen in .NET + scope: function features: - or: - characteristic: unmanaged call