Still / Azaka
7269873b0c
Add rules for detecting donut-related features ( #997 )
...
* Initial additions for detecting donut features
Signed-off-by: Still Hsu <dev@stillu.cc>
* Lint rules
Signed-off-by: Still Hsu <dev@stillu.cc>
* Update ATT&CK for donut rule
Signed-off-by: Still Hsu <dev@stillu.cc>
* Fix comment for dynamic scope on donut loader
Signed-off-by: Still Hsu <dev@stillu.cc>
* Require at least one donut function match for donut rule
Signed-off-by: Still Hsu <dev@stillu.cc>
* Add offset for examples
Signed-off-by: Still Hsu <dev@stillu.cc>
* Add indirect call for IAssembly matching
Signed-off-by: Still Hsu <dev@stillu.cc>
* Match known vtable offsets for assembly loading
* Remove loop matching
---------
Signed-off-by: Still Hsu <dev@stillu.cc>
2025-03-21 10:15:28 -06:00
Willi Ballenthin
c1d20764ad
use "span of calls" scope ( #973 )
...
* use sequence scope instead of thread scope for "static: function" rules
* use sequence scope instead of thread scope for "static: basic block" rules
* make runtime linking rules more concise
* doc: describe sequence scope
* rename "sequence" scope to "span of calls" scope
* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/get-geographical-location.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/file-managers/gather-classicftp-information.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/wmi/reference-wmi-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/sql/reference-sql-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
---------
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
2025-01-29 10:27:13 +01:00
Moritz
c61d7a7b95
Revert "Update Mappings for MBC (Q4 2023)"
2024-01-17 09:16:30 +01:00
ryan
4e81296369
Update Mappings for MBC (Q4 2023)
2023-12-15 13:53:34 -05:00
mr-tz
bebddeae1e
update scopes
2023-11-29 14:38:14 +01:00
mr-tz
e6f11c2913
Merge branch 'master' into dynamic-rules-mr-2
2023-11-29 14:34:07 +01:00
JJ
fa61e110ad
Update and add Cabinet archive related rules ( #808 )
...
* Update and add Cabinet archive related rules
2023-11-29 14:27:45 +01:00
mr-tz
8a36231025
fix scopes for rules with subscopes 2
2023-11-24 11:35:03 +01:00
mr-tz
784c9dca53
upgrade rules using updated script
2023-11-24 11:34:28 +01:00
ryan
153d4c0d2c
Update Mappings for MBC
2023-06-21 10:45:01 -04:00
Blas
b7a95a37f7
Rule for zlib inflate/deflate ( #695 )
...
* Create compress-data-via-zlib-inflate-or-deflate.yml
2023-02-15 11:56:28 +01:00
Moritz
613536dd1d
LZO compression / decompression rules continued ( #677 )
...
* Add rule for lzo compression
* Add matching decompression rule
---------
Co-authored-by: David Cannings <david.cannings@pwc.com>
2023-02-01 15:12:45 +01:00
Willi Ballenthin
57e1732f5c
Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""
...
This reverts commit d43a6ee544
2022-06-28 15:23:20 -06:00
Willi Ballenthin
88c9c786ca
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
William Ballenthin
d43a6ee544
Revert "Merge pull request #548 from mandiant/feature-remove-flavors"
...
This reverts commit bc28847dd982308c4109
2022-04-27 06:23:36 -06:00
Willi Ballenthin
904bf3ef00
*: remove /x32 and /x64 flavors and use instruction scope
2022-04-05 12:25:14 -06:00
jtothej
7d08c3648f
Add decompress-data-using-ucl.yml
2021-12-03 14:26:13 +08:00
Desiree Beck
e190179ffd
Merge pull request #1 from MBCProject/ryan-patches1
...
Update patch-process-command-line.yml
2021-11-22 11:27:15 -05:00
Willi Ballenthin
0b5def9556
decompress data using aplib: add further features
2021-11-03 11:07:44 -06:00
Chuong Dong
0b744d89f8
fix format
2021-10-28 11:52:41 +07:00
Chuong Dong
de0fad852a
change aPLib to detect BlackMatter's v3.0 decompression
2021-10-28 11:34:51 +07:00
William Ballenthin
345614c629
decompress data using aplib: remove missing example
2021-10-15 14:25:33 -06:00
Moritz Raabe
25938ca10c
change to mandiant.com
2021-09-28 12:21:11 +02:00
Ryan Xu
0114138ae4
More detailed mappings
2021-08-31 11:34:09 -05:00
Ryan Xu
b4e040dc50
preliminary mapping
2021-08-23 14:11:00 -05:00
William Ballenthin
6e501e8151
rules: convert inline comments to descriptions
...
closes #1
2021-05-18 10:45:41 -06:00
Moritz Raabe
30db0cddb8
add rules from fboldewin
...
Co-authored-by: Frank Boldewin <frank.boldewin@gmx.de>
2021-04-09 11:24:47 +02:00
Michael Hunhoff
20e1b8fd4c
enforce string formatting with double quotes + escaped special characters
2021-03-24 14:14:38 -06:00
Moritz Raabe
387334a603
reformated using capafmt
2021-01-27 15:30:59 +01:00
Desiree Beck
33817fdd83
update micro objective name: data manipulation to data
2020-12-12 12:18:47 -05:00
Desiree Beck
a0f10b4cf2
add mappings
2020-10-19 14:04:15 -04:00
Moritz Raabe
33ae14eb53
use new description syntax
2020-09-30 17:48:02 +02:00
Moritz Raabe
1fcec06e7e
comment out description blocks for statements
...
discussed in #312
2020-09-14 11:53:01 +02:00
David Cannings
e5786a1bd7
Graduate rule
2020-09-02 19:12:29 +01:00
0ssigeno
8dd3821274
fixed key, and added x32 and x64 flavours
2020-08-20 10:22:00 +02:00
William Ballenthin
7b4f4d10fb
rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better
2020-06-21 17:54:01 -06:00
William Ballenthin
5f57dbdbc9
rules: reorganize rule names, namespaces, and ATT&CK mappings
2020-06-21 17:25:43 -06:00
William Ballenthin
7f5fb71a5d
rules: use meta.references over meta.reference
...
closes #13
2020-06-21 16:41:18 -06:00
William Ballenthin
e9ad899b0f
rules: add trailing newline to end of each file
2020-06-21 15:50:42 -06:00
William Ballenthin
69507875b0
rules: reformat all rules using capafmt
2020-06-21 15:47:02 -06:00
William Ballenthin
eaae0e89a7
import existing rules, forgetting about 938 prior commits
2020-06-18 07:27:35 -06:00
