Mike Hunhoff
|
75c16e4b14
|
remove redundant matches for dynamic scope (#987)
* remove redundant matches for dynamic scope
* fix lints
* fix lints
* tighten scopes
|
2025-02-04 09:32:24 +01:00 |
|
Willi Ballenthin
|
c1d20764ad
|
use "span of calls" scope (#973)
* use sequence scope instead of thread scope for "static: function" rules
* use sequence scope instead of thread scope for "static: basic block" rules
* make runtime linking rules more concise
* doc: describe sequence scope
* rename "sequence" scope to "span of calls" scope
* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/get-geographical-location.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/file-managers/gather-classicftp-information.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/wmi/reference-wmi-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/sql/reference-sql-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
---------
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
|
2025-01-29 10:27:13 +01:00 |
|
mr-tz
|
e18704545a
|
fix call/thread scopes manually
|
2023-11-24 11:35:00 +01:00 |
|
mr-tz
|
784c9dca53
|
upgrade rules using updated script
|
2023-11-24 11:34:28 +01:00 |
|
Moritz
|
6d7191fac6
|
Update generate-random-numbers-via-rtlgenrandom.yml
|
2023-10-10 11:53:01 +02:00 |
|
Moritz
|
e454699082
|
Update generate-random-numbers-via-rtlgenrandom.yml (#828)
|
2023-10-09 12:07:38 -06:00 |
|
Willi Ballenthin
|
aec19f3a95
|
add generate random numbers via rtlgenrandom (#698)
closes #318
|
2023-02-13 10:46:33 +01:00 |
|
Moritz
|
761ccbab47
|
update ATT&CK/MBC meta data (#675)
* update ATT&CK/MBC meta data
|
2023-02-01 10:08:58 +01:00 |
|
Willi Ballenthin
|
88c9c786ca
|
*: use meta.authors everywhere
|
2022-05-26 11:56:31 -06:00 |
|
Moritz Raabe
|
25938ca10c
|
change to mandiant.com
|
2021-09-28 12:21:11 +02:00 |
|
Moritz Raabe
|
387334a603
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
johnk3r
|
1dd2a33d10
|
Rename generate-random-numbers-via-WinAPI.yml to generate-random-numbers-via-winapi.yml
|
2021-01-07 10:15:43 -03:00 |
|
johnk3r
|
1ad0ff65a5
|
Rename get-generation-random-numbers.yml to generate-random-numbers-via-WinAPI.yml
|
2021-01-07 10:02:48 -03:00 |
|
johnk3r
|
1a8d18d0f9
|
Update get-generation-random-numbers.yml
|
2021-01-07 10:02:15 -03:00 |
|
johnk3r
|
e77253f61b
|
Create get-generation-random-numbers.yml
https://github.com/fireeye/capa-rules/issues/21
|
2021-01-06 22:05:19 -03:00 |
|
Desiree Beck
|
a0f10b4cf2
|
add mappings
|
2020-10-19 14:04:15 -04:00 |
|
William Ballenthin
|
7b4f4d10fb
|
rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better
|
2020-06-21 17:54:01 -06:00 |
|
William Ballenthin
|
5f57dbdbc9
|
rules: reorganize rule names, namespaces, and ATT&CK mappings
|
2020-06-21 17:25:43 -06:00 |
|