Willi Ballenthin
|
c1d20764ad
|
use "span of calls" scope (#973)
* use sequence scope instead of thread scope for "static: function" rules
* use sequence scope instead of thread scope for "static: basic block" rules
* make runtime linking rules more concise
* doc: describe sequence scope
* rename "sequence" scope to "span of calls" scope
* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/get-geographical-location.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/file-managers/gather-classicftp-information.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/wmi/reference-wmi-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/sql/reference-sql-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
---------
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
|
2025-01-29 10:27:13 +01:00 |
|
Willi Ballenthin
|
33feff1e46
|
add rules for volume interaction via IOCTLs (#879)
* add rules for volume interaction via IOCTLs
* rename interact with driver
* factor out IOCTL handling
* fix 'set-system-properties' for 'install driver'
* fmt
|
2024-02-14 14:56:47 +01:00 |
|
Willi Ballenthin
|
f50b80d530
|
add delete drive layout via ioctl (#878)
|
2024-02-05 10:34:13 +01:00 |
|
mr-tz
|
784c9dca53
|
upgrade rules using updated script
|
2023-11-24 11:34:28 +01:00 |
|
ryan
|
153d4c0d2c
|
Update Mappings for MBC
|
2023-06-21 10:45:01 -04:00 |
|
mr-tz
|
dbeab1fe46
|
match on create or open file library rule
|
2023-05-12 12:19:48 +02:00 |
|
Moritz
|
761ccbab47
|
update ATT&CK/MBC meta data (#675)
* update ATT&CK/MBC meta data
|
2023-02-01 10:08:58 +01:00 |
|
Willi Ballenthin
|
88c9c786ca
|
*: use meta.authors everywhere
|
2022-05-26 11:56:31 -06:00 |
|
Baptistin Boilot
|
efea9a37d9
|
Fix MBC names and IDs
|
2022-02-06 11:13:23 +01:00 |
|
Moritz Raabe
|
25938ca10c
|
change to mandiant.com
|
2021-09-28 12:21:11 +02:00 |
|
William Ballenthin
|
6e501e8151
|
rules: convert inline comments to descriptions
closes #1
|
2021-05-18 10:45:41 -06:00 |
|
Michael Hunhoff
|
20e1b8fd4c
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
William Ballenthin
|
f1f0b4a1b6
|
merge
|
2021-01-02 11:06:53 -07:00 |
|
William Ballenthin
|
d99c02aca7
|
update ATT&CK mappings
|
2021-01-02 11:06:02 -07:00 |
|
Desiree Beck
|
4e884a3e76
|
added mbc mapping in impact namespace
|
2020-12-16 15:34:52 -05:00 |
|
Moritz Raabe
|
649ecfa6ca
|
add rule delete volume shadow copies
|
2020-10-05 22:33:54 +02:00 |
|
William Ballenthin
|
54cfb05bd0
|
rules: address comments in #14
|
2020-06-26 17:45:56 -06:00 |
|
William Ballenthin
|
7b4f4d10fb
|
rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better
|
2020-06-21 17:54:01 -06:00 |
|
William Ballenthin
|
5f57dbdbc9
|
rules: reorganize rule names, namespaces, and ATT&CK mappings
|
2020-06-21 17:25:43 -06:00 |
|