JJ
19d48abd05
Add rules linked-against-funchook.yml and linked-against-plthook.yml ( #1073 )
2025-09-03 10:05:13 -06:00
JJ
35b17b676e
Merge linking/static/hp-socket/linked-against-hp-socket.yml and nursery/linked-against-hp-socket.yml ( #1070 )
2025-08-22 08:57:57 -06:00
JJ
6859d7c688
Add rule linked-against-hp-socket.yml ( #1069 )
...
* Add rule linked-against-hp-socket.yml
* Update linking/static/hp-socket/linked-against-hp-socket.yml
2025-08-21 08:56:38 -06:00
JJ
6d6495a16c
Add linking/static/grpc/linked-against-grpc.yml ( #1068 )
...
* Add linking/static/grpc/linked-against-grpc.yml
* Update linking/static/grpc/linked-against-grpc.yml
2025-08-21 08:56:28 -06:00
JJ
c783febdc5
Add linked-against-eclipse-paho-mqtt-c.yml and linked-against-qmqtt.yml ( #1066 )
...
* Add linked-against-eclipse-paho-mqtt-c.yml and linked-against-qmqtt.yml
* Update examples - swapping for much smaller files
2025-08-14 09:11:33 -06:00
Still / Azaka
16492182a3
Add .NET AoT & TouchSocket linking detection ( #948 )
...
* Add initial two rules
Signed-off-by: Still Hsu <dev@stillu.cc>
* Swap sample for a smaller custom compiled one
Signed-off-by: Still Hsu <dev@stillu.cc>
---------
Signed-off-by: Still Hsu <dev@stillu.cc>
2024-11-28 11:33:53 +01:00
Willi Ballenthin
5b288a527d
add linked against SQLCipher
2024-09-13 07:29:52 +00:00
jtothej
d2d77916d7
Add export features in linking/static/minhook/linked-against-minhook.yml
2024-09-05 18:06:16 +02:00
jtothej
887563556f
Add new rule linked-against-minhook.yml
2024-08-11 12:49:06 +02:00
mr-tz
784c9dca53
upgrade rules using updated script
2023-11-24 11:34:28 +01:00
Still / Azaka
037ca83cb3
Improve browser stealer & add SQLite lib detection ( #757 )
...
* Improve regex for existing browser data gathering detection
- Fix erroneous regex capture
+ Add detections for cookies gathering
+ Add generic browser detection (some webkit browser for some reason uses the same chromium-based paths?)
Signed-off-by: Still Hsu <dev@stillu.cc>
* Add rudimentary sqlite db libs detection
- Typically used along with browser data collection
Signed-off-by: Still Hsu <dev@stillu.cc>
---------
Signed-off-by: Still Hsu <dev@stillu.cc>
2023-08-19 11:36:10 +02:00
Still Hsu
80f1993388
Lint rule
...
Signed-off-by: Still Hsu <dev@stillu.cc>
2023-05-10 16:01:15 +08:00
Still Hsu
51a6a65f4a
Add aPLib linking detection
...
Signed-off-by: Still Hsu <dev@stillu.cc>
2023-05-10 15:55:14 +08:00
Moritz
106123eb61
Rules for the week ( #671 )
...
* add rules
* avoid FPs via mnemonics to ignore
* correct number logic
* add --onefile option strings
2023-01-27 09:56:12 +01:00
Willi Ballenthin
88c9c786ca
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
jtothej
80c6804ec1
Add linked-against-wolfssl.yml and linked-against-wolfcrypt.yml
2021-12-03 15:44:58 +08:00
Moritz Raabe
25938ca10c
change to mandiant.com
2021-09-28 12:21:11 +02:00
William Ballenthin
0ef69c4fbd
*: use substring features rather than unreadable regexes
...
closes #450
2021-08-24 12:47:26 -06:00
Michael Hunhoff
64c8746098
adding additional detection strings to linked-against-openssl.yml
2021-07-28 15:00:29 -06:00
Michael Hunhoff
20e1b8fd4c
enforce string formatting with double quotes + escaped special characters
2021-03-24 14:14:38 -06:00
Desiree Beck
5c11fe70b2
mappings for linking namespace
2021-01-21 15:27:42 -05:00
William Ballenthin
54cfb05bd0
rules: address comments in #14
2020-06-26 17:45:56 -06:00
William Ballenthin
7b4f4d10fb
rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better
2020-06-21 17:54:01 -06:00
William Ballenthin
5f57dbdbc9
rules: reorganize rule names, namespaces, and ATT&CK mappings
2020-06-21 17:25:43 -06:00
