* Add Thread Pool injection techniques
Signed-off-by: Still Hsu <dev@stillu.cc>
* Fix format
Signed-off-by: Still Hsu <dev@stillu.cc>
* Replace filename to be lint-compliant
Signed-off-by: Still Hsu <dev@stillu.cc>
* Add description for each of the rules
Signed-off-by: Still Hsu <dev@stillu.cc>
* Remove PoolParty PoC reference
Signed-off-by: Still Hsu <dev@stillu.cc>
---------
Signed-off-by: Still Hsu <dev@stillu.cc>
* Move get-routing-table.yml out of nursery. Add enumerate-tcp-connections-via-wmi-com-api.yml and create-routing-table-entry.yml
* Update scopes in enumerate-tcp-connections-via-wmi-com-api.yml, create-routing-table-entry.yml, get-routing-table.yml
* Move and update impersonate-user rule
Renamed impersonate-user.yml from nursery to host-interaction/user and added an examples section with a sample hash.
* Simplify API checks in impersonate-user rule
Removed optional and or conditions for GetUserName and DuplicateToken APIs
* Bring the Ex back
* add new rules to detect disabling features via registry on Windows
* refactor
* refactor
* refactor
* update control registry regex to better handle multiple control sets
* detect usage of TripleDESCryptoServiceProvider
* detect usage of TripleDes via dotnet api
* detect usage of TripleDesCryptoServiceProvider
* removed duplicate file
* seperate encrypt and decrypt methods
* changed file names to match desc
* lint fix
* lint fix
* small fixes
* remove duplicate features from some rules
* keep commented hex values to show AfdOpenPacketX structure
Signed-off-by: vibhatsu <maulikbarot2915@gmail.com>
---------
Signed-off-by: vibhatsu <maulikbarot2915@gmail.com>
* Add use-bigint-function
Add new `data-manipulation/encryption/use-bigint-function.yml` rule to
identify bigint functions as these functions may help reverse engineers
identifying crypto. Example of bigint functions identified by this rule:
- `bi_copi`
- `bi_permanent`
- `bi_depermant`
- `bi_free`
Reference:
- 147d69429b/src/bigint.c
- 3e9b57d82a/src/crypto/bigint.c
* Add rsa-encrypt
Add new rule `data-manipulation/encryption/rsa/rsa-encrypt.yml` that
identifies the RSA encryption implementation from:
- 147d69429b/src/rsa.c (L232)
- 3e9b57d82a/src/crypto/rsa.c (L233)
Rename current RSA encryption/decryption rules in the nursery to add
`via WinAPI` to prevent name conflict.
* Improve existing persistence rules by limiting their scope, and adding some more details.
* Update persistence/startup-folder/write-file-to-startup-folder.yml
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
* change scope to call for shell command via WRM
* Update persistence/startup-folder/write-file-to-startup-folder.yml
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
* fix startup folder persistence rule
* change name screensaver persistence technique
* change name screensaver persistence technique pt 2
* fix write to startup folder persistence rule
---------
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
* Add SysWhisper2 detection & add int 2e to syscall detection
---------
Signed-off-by: Still Hsu <dev@stillu.cc>
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
