Mike Hunhoff
48a553e1ca
add more APIs to "link function at runtime on Windows" to remove FNs ( #1029 )
2025-03-19 11:29:07 -06:00
dhruvak001
fe99a653e8
CI error:scope interchanged
2025-02-03 19:55:12 +01:00
Willi Ballenthin
c1d20764ad
use "span of calls" scope ( #973 )
...
* use sequence scope instead of thread scope for "static: function" rules
* use sequence scope instead of thread scope for "static: basic block" rules
* make runtime linking rules more concise
* doc: describe sequence scope
* rename "sequence" scope to "span of calls" scope
* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/get-geographical-location.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/file-managers/gather-classicftp-information.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/wmi/reference-wmi-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/sql/reference-sql-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
---------
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
2025-01-29 10:27:13 +01:00
Matt Williams
60fcf98741
access-peb-ldr_data.yml: reference update
2024-10-15 15:03:46 +00:00
Still / Azaka
1fd0d8e141
Add SysWhispers2 detection & add 0x2e syscall detection ( #888 )
...
* Add SysWhisper2 detection & add int 2e to syscall detection
---------
Signed-off-by: Still Hsu <dev@stillu.cc>
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
2024-09-24 13:24:52 +02:00
Moritz
e63c454fbb
Merge pull request #908 from mandiant/fix/dependency-scopes
...
fix the scope of some rules with dependencies
2024-06-14 11:01:35 +02:00
mr-tz
0c7d1bdfac
remove optional block with LoadLibrary APIs and indirect call
2024-06-14 08:59:18 +00:00
Willi Ballenthin
e6befc9b53
fix the scope of some rules with dependencies
...
ref: https://github.com/mandiant/capa/issues/2124
2024-06-06 09:39:53 +02:00
mr-tz
f344af3327
add android OS where applicable
2024-04-23 13:49:05 +02:00
mr-tz
8a36231025
fix scopes for rules with subscopes 2
2023-11-24 11:35:03 +01:00
mr-tz
e18704545a
fix call/thread scopes manually
2023-11-24 11:35:00 +01:00
mr-tz
784c9dca53
upgrade rules using updated script
2023-11-24 11:34:28 +01:00
ryan
6fbf5187e5
Update Mappings for MBC (part 11)
2023-09-27 15:01:03 -04:00
JJ
82714cd7d0
Add resolve-function-by-brute-ratel-badger-hash.yml ( #793 )
...
* Add resolve-function-by-brute-ratel-badger-hash.yml
2023-07-12 12:12:42 +02:00
Mike Hunhoff
e5ae505682
update .NET detections ( #703 )
2023-02-21 14:38:03 -07:00
Willi Ballenthin
57e1732f5c
Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""
...
This reverts commit d43a6ee544
2022-06-28 15:23:20 -06:00
Willi Ballenthin
88c9c786ca
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
William Ballenthin
d43a6ee544
Revert "Merge pull request #548 from mandiant/feature-remove-flavors"
...
This reverts commit bc28847dd982308c4109
2022-04-27 06:23:36 -06:00
Willi Ballenthin
904bf3ef00
*: remove /x32 and /x64 flavors and use instruction scope
2022-04-05 12:25:14 -06:00
Ryan Xu
5b3c56ae44
Update linking/runtime-linking/resolve-function-by-fin8-fasthash.yml
...
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
2021-11-24 11:52:41 -05:00
Ryan Xu
607a06e184
Adding changes suggested by Mandiant
2021-11-23 09:01:53 -05:00
Desiree Beck
e190179ffd
Merge pull request #1 from MBCProject/ryan-patches1
...
Update patch-process-command-line.yml
2021-11-22 11:27:15 -05:00
Moritz Raabe
25938ca10c
change to mandiant.com
2021-09-28 12:21:11 +02:00
Ryan Xu
0114138ae4
More detailed mappings
2021-08-31 11:34:09 -05:00
William Ballenthin
ea3ea14c22
minor reorg linux rules and logic
...
ref #442
2021-08-25 15:31:51 -06:00
Ryan Xu
b4e040dc50
preliminary mapping
2021-08-23 14:11:00 -05:00
Joakim Kennedy
78fbf5f3c5
Fix linting errors
2021-08-05 15:35:27 +01:00
Joakim Kennedy
765e182553
A set of rules for Linux ELFs
2021-08-04 15:47:00 +01:00
William Ballenthin
6e501e8151
rules: convert inline comments to descriptions
...
closes #1
2021-05-18 10:45:41 -06:00
Moritz Raabe
aedf47d971
remove unneeded or, fix offset
2021-04-09 11:24:48 +02:00
Moritz Raabe
30db0cddb8
add rules from fboldewin
...
Co-authored-by: Frank Boldewin <frank.boldewin@gmx.de>
2021-04-09 11:24:47 +02:00
Moritz Raabe
387334a603
reformated using capafmt
2021-01-27 15:30:59 +01:00
Moritz Raabe
15911402d8
comms and shellcode technique rules
2020-12-15 21:49:18 +01:00
mike-hunhoff
bcfbebc567
Merge pull request #100 from fireeye/init-al-khaser-rules
2020-08-27 10:07:58 -06:00
Willi Ballenthin
c59913b22a
Merge pull request #104 from fireeye/rules-8-27
...
add new rules
2020-08-27 07:52:15 -06:00
Moritz Raabe
e995189224
add new rules
2020-08-27 10:38:59 +02:00
Michael Hunhoff
a7c9192cc5
Merge branch 'master' into init-al-khaser-rules
2020-08-26 13:55:46 -06:00
0ssigeno
1ea6c4c38e
number doesn't have inline comment
2020-08-20 10:34:16 +02:00
0ssigeno
8dd3821274
fixed key, and added x32 and x64 flavours
2020-08-20 10:22:00 +02:00
Michael Hunhoff
6ccc9a736f
fresh rules from al-khaser project
2020-08-13 09:39:42 -06:00
Ana María Martínez Gómez
25f1157db0
Change characteristic syntax in rules
...
Get rid of `true` in characteristic as it is implicit.
The changes are the result of executing the following commands:
```
find . -type f -exec sed -i.bak "s/\(.*\)characteristic(\(.*\)): true/\1characteristic: \2/g" {} \;
find . -name "*.bak" -type f -delete
```
2020-07-01 19:19:49 +02:00
William Ballenthin
0d77564785
merge
2020-06-26 17:47:37 -06:00
William Ballenthin
7b4f4d10fb
rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better
2020-06-21 17:54:01 -06:00
William Ballenthin
5f57dbdbc9
rules: reorganize rule names, namespaces, and ATT&CK mappings
2020-06-21 17:25:43 -06:00
