Mike Hunhoff
|
e85887a875
|
fix: escape "." that are not expected to be dot operators (#1028)
|
2025-03-18 15:01:39 -06:00 |
|
Willi Ballenthin
|
36bf945aee
|
fix scopes from lint errors
ref https://github.com/mandiant/capa/pull/2579
|
2025-01-29 18:54:25 +01:00 |
|
Willi Ballenthin
|
c1d20764ad
|
use "span of calls" scope (#973)
* use sequence scope instead of thread scope for "static: function" rules
* use sequence scope instead of thread scope for "static: basic block" rules
* make runtime linking rules more concise
* doc: describe sequence scope
* rename "sequence" scope to "span of calls" scope
* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/get-geographical-location.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/file-managers/gather-classicftp-information.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/wmi/reference-wmi-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/sql/reference-sql-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
---------
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
|
2025-01-29 10:27:13 +01:00 |
|
Moritz
|
109890c8c6
|
add rule for driver major function ID (#939)
* add rule
|
2024-09-30 14:05:20 +02:00 |
|
Willi Ballenthin
|
33feff1e46
|
add rules for volume interaction via IOCTLs (#879)
* add rules for volume interaction via IOCTLs
* rename interact with driver
* factor out IOCTL handling
* fix 'set-system-properties' for 'install driver'
* fmt
|
2024-02-14 14:56:47 +01:00 |
|
mr-tz
|
e18704545a
|
fix call/thread scopes manually
|
2023-11-24 11:35:00 +01:00 |
|
mr-tz
|
784c9dca53
|
upgrade rules using updated script
|
2023-11-24 11:34:28 +01:00 |
|
Willi Ballenthin
|
88c9c786ca
|
*: use meta.authors everywhere
|
2022-05-26 11:56:31 -06:00 |
|
Desiree Beck
|
e190179ffd
|
Merge pull request #1 from MBCProject/ryan-patches1
Update patch-process-command-line.yml
|
2021-11-22 11:27:15 -05:00 |
|
Moritz Raabe
|
25938ca10c
|
change to mandiant.com
|
2021-09-28 12:21:11 +02:00 |
|
Ryan Xu
|
0114138ae4
|
More detailed mappings
|
2021-08-31 11:34:09 -05:00 |
|
William Ballenthin
|
0ef69c4fbd
|
*: use substring features rather than unreadable regexes
closes #450
|
2021-08-24 12:47:26 -06:00 |
|
Ryan Xu
|
b4e040dc50
|
preliminary mapping
|
2021-08-23 14:11:00 -05:00 |
|
Moritz Raabe
|
d81e757728
|
adding rules based on more PMA labs
|
2021-06-30 23:38:17 +02:00 |
|
Moritz Raabe
|
b340a6229c
|
address optional blocks
|
2021-05-05 17:25:07 +02:00 |
|
William Ballenthin
|
0e0d882ad3
|
lint
|
2021-05-01 10:20:00 -06:00 |
|
William Ballenthin
|
cdc286d253
|
add driver/disable-driver-code-integrity
|
2021-05-01 10:08:00 -06:00 |
|
Desiree Beck
|
c5d24c671a
|
added mbc mappings in the host-interaction namespace
|
2020-12-16 15:30:06 -05:00 |
|
William Ballenthin
|
0d77564785
|
merge
|
2020-06-26 17:47:37 -06:00 |
|
William Ballenthin
|
7b4f4d10fb
|
rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better
|
2020-06-21 17:54:01 -06:00 |
|
William Ballenthin
|
5f57dbdbc9
|
rules: reorganize rule names, namespaces, and ATT&CK mappings
|
2020-06-21 17:25:43 -06:00 |
|