8e9985c72e
restructured yaml
2026-03-09 21:33:49 +05:30
2654d5c1bd
fix rc4 false negative in #1043
2026-03-09 19:56:07 +05:30
Moritz
cd272f5b11
Merge pull request #1129 from EclipseAditya/fix/escape-plus-in-base64-regex-1101
...
fix: escape + and / in Base64 string regex pattern
2026-03-04 21:29:39 +01:00
Aditya Pandey
bd29ed4563
fix: escape + and / in Base64 string regex, add URL-safe variant
2026-03-05 00:09:35 +05:30
Moritz
35498e9dae
Merge pull request #1124 from CosmoWorker/scexe-create
...
Extend create-service rule to detect sc.exe usage patterns
2026-03-03 08:48:00 +01:00
xpzhxhm
5da642668e
Add new rule persist-via-shellserviceobjectdelayload-registry-key.yml ( #1117 )
...
* Create persist-via-shellserviceobjectdelayload-registry-key.yml
* Update persist-via-shellserviceobjectdelayload-registry-key.yml
Update rules and description, improve scope to function/basic block by adding HKLM constant, remove blank line.
* Update persist-via-shellserviceobjectdelayload-registry-key.yml
* Change the scope to function
2026-02-26 09:44:06 -07:00
Saniya Fatima
9609e19ddb
Powershell expression ( #1118 )
...
* Fix: Reduce the false positive in Powershell expression
* Enhance powershell execution detection
2026-02-23 13:51:19 -07:00
CosmoWorker
19380b704e
update create-service to detect sc.exe usage
2026-02-23 22:50:55 +05:30
Maijin
f0292fc977
feat(targeting): add cloud and container collection/interaction rules ( #1098 )
...
This adds rules for:
- enumerating AWS resources (CloudFormation, CloudTrail, DirectConnect, EC2, IAM, S3, Support)
- stealing credentials for AWS, GCP, Cloudflare
- stealing credentials for Docker and Kubernetes
Rules are categorized into host-interaction and collection namespaces.
2026-02-23 09:32:32 -07:00
Moritz
2e72aa5536
Merge pull request #1121 from mandiant/lsc-1771433323.1682847
...
Refactor Github Action per b/485167538
2026-02-19 21:33:18 +01:00
Ben Knutson
e91dc056cb
Refactor Github Action per b/485167538
2026-02-18 16:48:44 +00:00
Devarjya
2a55a30478
Refine Speck detection using variant-specific rotation constants ( #1115 )
2026-02-17 14:18:46 -07:00
Saniya Fatima
7f70ec18ff
Flexible version of send HTTP request ( #1110 )
...
* Flexible version of send HTTP request
* Fix lint errors
2026-01-30 10:40:47 -07:00
Saniya Fatima
94e855bebc
Fix: False positive in UDP socket ( #1111 )
2026-01-30 10:04:39 -07:00
Moritz
98c1e9de5a
Merge pull request #1107 from mandiant/anti-llm-anthropic
2026-01-28 17:42:47 +00:00
Willi Ballenthin
b6c8ad8175
add terminate-anthropic-session-via-magic-strings
2026-01-28 11:30:14 +01:00
Saniya Fatima
8caf489d8c
Fix false positive in send HTTP request ( #1099 )
2026-01-26 09:40:58 -07:00
Willi Ballenthin
6a0d506713
add encrypt-data-using-hc-256 ( #1097 )
2026-01-06 10:01:44 -07:00
Still / Azaka
a4411edeea
Add RtlRegisterWait API to shellcode exec callback ( #1094 )
...
* Add RtlRegisterWait API to shellcode exec callback
* Require SetEvent to reduce fp
2025-12-29 10:20:58 -07:00
Still / Azaka
6120dfb6e0
Add Thread Pool injection techniques ( #1087 )
...
* Add Thread Pool injection techniques
Signed-off-by: Still Hsu <dev@stillu.cc>
* Fix format
Signed-off-by: Still Hsu <dev@stillu.cc>
* Replace filename to be lint-compliant
Signed-off-by: Still Hsu <dev@stillu.cc>
* Add description for each of the rules
Signed-off-by: Still Hsu <dev@stillu.cc>
* Remove PoolParty PoC reference
Signed-off-by: Still Hsu <dev@stillu.cc>
---------
Signed-off-by: Still Hsu <dev@stillu.cc>
2025-12-04 10:17:27 -07:00
Still / Azaka
fb3737b90a
Loosen AFD driver usage detection ( #1086 )
...
* Move CreateEvent to optional
Signed-off-by: Still Hsu <dev@stillu.cc>
2025-12-04 13:10:46 +01:00
Mike Hunhoff
3b42582539
adding/updating rules based on recent samples ( #1085 )
2025-11-25 13:38:55 -07:00
Moritz
b0b486fe0c
updated broken link ( #1045 )
2025-11-12 11:26:26 +01:00
Mike Hunhoff
7a52b6f9c0
dotnet: adding new rules based on recent samples ( #1082 )
...
* dotnet: adding new rules based on recent samples
2025-11-07 08:39:46 +01:00
Zeze
9e4cc28265
feat: log keystrokes via rawinput ( #1078 )
...
* feat: log keystrokes via directx
* fix: williballenthin review
* move register-raw-input-devices from nursery
* use original rule name
2025-10-28 09:20:39 -06:00
Zeze
14dcc55c32
Merge pull request #1079 from zeze-zeze/zeze/feat/DirectInput
...
feat: log keystrokes via direct input
2025-10-28 14:12:07 +01:00
JJ
7ae786cf70
Add new rule use-io_uring-io-interface-on-linux.yml ( #1080 )
2025-10-20 09:27:16 -06:00
Paul
fa246a4a9b
terminate process with RestartMgr.RmShutdown ( #1077 )
...
* terminate process with RestartMgr.RmShutdown
* fix 'and' to 'api'
2025-09-23 14:17:49 -06:00
JJ
277540ac24
Add LdrCallEnclave in execute-shellcode-via-windows-callback-function.yml ( #1076 )
2025-09-09 13:21:58 -06:00
JJ
1a065e6dea
Move get-routing-table.yml out of nursery. Add enumerate-tcp-connecti… ( #1074 )
...
* Move get-routing-table.yml out of nursery. Add enumerate-tcp-connections-via-wmi-com-api.yml and create-routing-table-entry.yml
* Update scopes in enumerate-tcp-connections-via-wmi-com-api.yml, create-routing-table-entry.yml, get-routing-table.yml
2025-09-09 13:21:48 -06:00
Elad Levi
5d990adef2
Move impersonate user from nursery ( #1072 )
...
* Move and update impersonate-user rule
Renamed impersonate-user.yml from nursery to host-interaction/user and added an examples section with a sample hash.
* Simplify API checks in impersonate-user rule
Removed optional and or conditions for GetUserName and DuplicateToken APIs
* Bring the Ex back
2025-09-03 10:27:04 -06:00
JJ
4026d60a48
Update enumerate-minifilter-drivers.yml ( #1075 )
2025-09-03 10:08:36 -06:00
JJ
19d48abd05
Add rules linked-against-funchook.yml and linked-against-plthook.yml ( #1073 )
2025-09-03 10:05:13 -06:00
JJ
13e8622f8a
Add rule execute-jscript-via-vsaengine-in-dotnet.yml ( #1071 )
2025-08-25 13:07:56 -06:00
JJ
35b17b676e
Merge linking/static/hp-socket/linked-against-hp-socket.yml and nursery/linked-against-hp-socket.yml ( #1070 )
2025-08-22 08:57:57 -06:00
JJ
6859d7c688
Add rule linked-against-hp-socket.yml ( #1069 )
...
* Add rule linked-against-hp-socket.yml
* Update linking/static/hp-socket/linked-against-hp-socket.yml
2025-08-21 08:56:38 -06:00
JJ
6d6495a16c
Add linking/static/grpc/linked-against-grpc.yml ( #1068 )
...
* Add linking/static/grpc/linked-against-grpc.yml
* Update linking/static/grpc/linked-against-grpc.yml
2025-08-21 08:56:28 -06:00
JJ
1874535449
Add disable-powershell-transcription.yml and access-powershell-lockdo… ( #1065 )
...
* Add disable-powershell-transcription.yml and access-powershell-lockdown-policy.yml
* Update disable-powershell-transcription.yml and bypass-powershell-constrained-language-mode-via-getsystemlockdownpolicy-patch.yml
2025-08-20 10:04:29 -06:00
Mike Hunhoff
ebdd6b85d5
update reference-http-user-agent-string.yml ( #1067 )
...
* update reference-http-user-agent-string.yml
* update rule documentation
2025-08-14 14:59:09 -06:00
JJ
c783febdc5
Add linked-against-eclipse-paho-mqtt-c.yml and linked-against-qmqtt.yml ( #1066 )
...
* Add linked-against-eclipse-paho-mqtt-c.yml and linked-against-qmqtt.yml
* Update examples - swapping for much smaller files
2025-08-14 09:11:33 -06:00
JJ
760c214299
Update patch-antimalware-scan-interface-function.yml - include additional functions that can be patched ( #1064 )
2025-08-13 08:39:59 -06:00
Mike Hunhoff
7a719809d1
new/updated rules from recent malware samples ( #1063 )
2025-08-12 10:21:05 -06:00
JJ
c76ef7fb9b
Add patch-bitdefender-hooking-dll-function.yml rule ( #1061 )
2025-08-12 09:43:24 -06:00
JJ
b18e5f1046
Add CAPA rule packed-with-dxpack.yml ( #1062 )
2025-08-12 09:42:37 -06:00
Moritz
2f09b4d471
add create executable heap rule ( #1058 )
2025-08-04 12:40:42 -06:00
Teva JEANDIDIER
47ee3a8777
Add rule to detect advanced mouse movement analysis references issue … ( #1055 )
...
* Add rule to detect advanced mouse movement analysis references issue #1050
* Update nursery/detect-mouse-movement-analysis.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update nursery/detect-mouse-movement-analysis.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Move the new rule for mouse analysis to the vm-detection folder
* Fix filename to match the rule name
---------
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
2025-06-20 10:16:06 -06:00
Mike Hunhoff
edabdffa8c
use call scope for get-local-ipv4-addresses ( #1052 )
2025-06-02 13:16:36 -06:00
Mike Hunhoff
2676846e77
tighten subscope for get-local-ipv4-addresses ( #1051 )
2025-06-02 12:46:52 -06:00
Elad Levi
834981fcfe
Unload Sysmon ( #1049 )
...
* Create unload-sysmon.yml
* Update unload-sysmon.yml
2025-05-28 14:44:20 -06:00
zdw@
e6df480758
add first set of exploit detection rules ( #1046 )
...
* add ntoskrnl.exe loading rule
* fix name
* add explicit os
* add suspicious ntquerysysteinformation detections
* ntfscontrolfile wip
* fix ntfscontrolfile rule
* rename ntquerysysinfo rule
* add ntoskrnl gadgets rule
* make descs more generic
* refactor rules to exploitation namespace
* add caveat to ntfscontrolfile rule
* tweak rule names
* tweak ntfscontrolfile name
2025-05-22 12:53:30 -06:00
