Mike Hunhoff
|
51de2eb818
|
Merge pull request #545 from mandiant/new/20222303
adding get-process-image-filename
|
2022-03-23 11:48:38 -06:00 |
|
Mike Hunhoff
|
a458d0d70a
|
Merge pull request #544 from mandiant/update/hijack-thread-execution
update hijack-thread-execution.yml to match additional scenarios
|
2022-03-23 11:48:24 -06:00 |
|
Michael Hunhoff
|
dddf45baa9
|
adding get-process-image-filename
|
2022-03-23 11:34:36 -06:00 |
|
Michael Hunhoff
|
94f1639cb4
|
update hijack-thread-execution.yml to match additional scenarios
|
2022-03-23 09:01:25 -06:00 |
|
Capa Bot
|
bc0b2d6fb0
|
Update rules number badge
|
2022-03-16 09:43:25 +00:00 |
|
Moritz
|
0e4d7071a0
|
Merge pull request #542 from htnhan/master
Issue #539: Sample manually build AES/Rijndael boxes
|
2022-03-16 10:43:11 +01:00 |
|
htnhan
|
cae4aa28ae
|
Issue #539: Sample manually build AES/Rijndael boxes
|
2022-03-14 14:01:07 -05:00 |
|
Willi Ballenthin
|
3a0d0811f6
|
Merge pull request #538 from mwilliams31/anti-debug-gettickcount
Minor update to anti-debug GetTickCount rule
|
2022-03-10 11:20:53 -07:00 |
|
Matt Williams
|
ce41016e8d
|
Minor update to anti-debug GetTickCount rule
Added `sub` and `cmp` mnemonics in an attempt to reduce FPs.
|
2022-03-10 09:43:27 -05:00 |
|
Moritz
|
27123103e2
|
Merge pull request #536 from mandiant/call5-update
call $+5 update rule and doc
|
2022-03-03 10:26:16 +01:00 |
|
Moritz Raabe
|
c5368ed9a2
|
call $+5 update rule and doc
|
2022-03-01 08:46:58 +01:00 |
|
Willi Ballenthin
|
6f27fef6ea
|
Merge pull request #530 from kn0wl3dge/fix/mbc-names
Fix MBC names and IDs
|
2022-02-06 11:48:41 -07:00 |
|
Baptistin Boilot
|
95e7bc8496
|
Update MBC names and IDs with the latest release
|
2022-02-06 11:27:09 +01:00 |
|
Baptistin Boilot
|
efea9a37d9
|
Fix MBC names and IDs
|
2022-02-06 11:13:23 +01:00 |
|
Willi Ballenthin
|
b01bd14e59
|
Merge pull request #529 from mandiant/mike-hunhoff-patch-1
update capture-screenshot.yml
|
2022-02-04 12:26:29 -07:00 |
|
Mike Hunhoff
|
c4b509594d
|
Update collection/screenshot/capture-screenshot.yml
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
|
2022-02-04 12:23:32 -07:00 |
|
Mike Hunhoff
|
22fe14008f
|
Update capture-screenshot.yml
|
2022-02-04 11:43:32 -07:00 |
|
Capa Bot
|
ca1dab21d4
|
Update rules number badge
|
2022-01-24 17:09:31 +00:00 |
|
Willi Ballenthin
|
4d39abedc6
|
Merge pull request #526 from jtothej/advobfuscator
Adding obfuscated-with-advobfuscator.yml
|
2022-01-24 10:06:34 -07:00 |
|
Willi Ballenthin
|
85e2129874
|
Merge pull request #525 from jtothej/arbitrary-code-guard
Adding block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml
|
2022-01-24 10:06:26 -07:00 |
|
Willi Ballenthin
|
3b6d3501a7
|
Merge pull request #523 from jtothej/process-mitigation-policies
Adding protect-spawned-processes-with-mitigation-policies.yml
|
2022-01-24 10:06:18 -07:00 |
|
Willi Ballenthin
|
cc7ccad4e5
|
Merge pull request #524 from kn0wl3dge/fix/attack-names
Fix Mitre Att&ck technique naming
|
2022-01-24 09:56:24 -07:00 |
|
Willi Ballenthin
|
afb71239da
|
Merge pull request #522 from jtothej/spoof-parent-pid
Updated and graduated spoof-parent-pid.yml
|
2022-01-24 09:50:36 -07:00 |
|
jtothej
|
a75281c25c
|
Adding obfuscated-with-advobfuscator.yml
|
2022-01-24 11:21:49 +07:00 |
|
jtothej
|
68d6a15152
|
Adding block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml
|
2022-01-23 18:32:03 +07:00 |
|
Baptistin Boilot
|
4f4914d572
|
Fix Mitre Att&ck technique naming
|
2022-01-22 16:59:27 +01:00 |
|
jtothej
|
8c29232bb2
|
Adding protect-spawned-processes-with-mitigation-policies.yml
|
2022-01-22 16:53:36 +07:00 |
|
jtothej
|
1f3fb133cc
|
Added example and attack mapping to spoof-parent-pid.yml. Moved to anti-analysis/anti-forensic from nursery.
|
2022-01-22 15:38:40 +07:00 |
|
Stephen Eckels
|
954f22acd8
|
Add golang runtime pattern (#518)
* Add golang runtime pattern
* Fix lints
* fix filename lint
* merge go rules
* Update compiler/go/compiled-with-go.yml
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
|
2021-12-23 17:34:11 +01:00 |
|
Capa Bot
|
e09db3504d
|
Update rules number badge
|
2021-12-20 12:47:59 +00:00 |
|
Moritz
|
e2dbb349f2
|
Merge pull request #515 from Still34/features/plugx-module
Add PlugX rule proposed in #469
|
2021-12-20 13:47:46 +01:00 |
|
Still Hsu
|
1f337cc717
|
Update malware-family/plugx/match-known-plugx-module.yml
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
|
2021-12-20 21:21:50 +09:00 |
|
Still Hsu
|
05c08c9cc7
|
Update malware-family/plugx/match-known-plugx-module.yml
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
|
2021-12-20 21:21:37 +09:00 |
|
Still Hsu
|
fbb511e148
|
Add missing command op codes
Signed-off-by: Still Hsu <dev@stillu.cc>
|
2021-12-16 16:51:37 +08:00 |
|
Still Hsu
|
7114d1b4cd
|
Add scrubbed timestamp in timestamp check
- Some samples may attempt to scrub the timestamp by replacing it with an invalid date (e.g., 0x8888888)
Signed-off-by: Still Hsu <dev@stillu.cc>
|
2021-12-16 16:40:17 +08:00 |
|
Still Hsu
|
7cacff8ac7
|
Update rule per request
Signed-off-by: Still Hsu <dev@stillu.cc>
|
2021-12-16 11:10:25 +08:00 |
|
Still Hsu
|
58d5430ab1
|
Add description to PlugX rule
Signed-off-by: Still Hsu <dev@stillu.cc>
|
2021-12-15 18:08:07 +08:00 |
|
Still Hsu
|
6343a4ed8b
|
Update rule namespace per suggestion
Signed-off-by: Still Hsu <dev@stillu.cc>
|
2021-12-15 16:29:46 +08:00 |
|
Capa Bot
|
e80e9ad09c
|
Update rules number badge
|
2021-12-14 21:51:29 +00:00 |
|
Willi Ballenthin
|
7b91f0ceee
|
Merge pull request #514 from jtothej/shellcode-via-copyfile2
Adding execute-shellcode-via-copyfile2.yml
|
2021-12-14 14:51:17 -07:00 |
|
Capa Bot
|
6fd7cea0aa
|
Update rules number badge
|
2021-12-14 21:46:18 +00:00 |
|
Willi Ballenthin
|
1b389db7a5
|
Merge pull request #513 from jtothej/mapping-injection
Adding inject-shellcode-using-mapping-injection.yml
|
2021-12-14 14:46:04 -07:00 |
|
Willi Ballenthin
|
26d216249f
|
Merge pull request #516 from dzbeck/capa-3-mbc-updates
update mappings for mbc (part 7)
|
2021-12-14 14:45:25 -07:00 |
|
Willi Ballenthin
|
c5d34ee255
|
Update host-interaction/bootloader/manipulate-boot-configuration.yml
|
2021-12-14 14:44:54 -07:00 |
|
Desiree Beck
|
1294158df2
|
fix formatting
|
2021-12-14 16:37:31 -05:00 |
|
Desiree Beck
|
ed3661b379
|
add mbc and att&ck tags
|
2021-12-14 16:16:07 -05:00 |
|
jtothej
|
bffb8e1233
|
Renaming inject-shellcode-using-mapping-injection.yml
|
2021-12-14 10:44:32 +08:00 |
|
Capa Bot
|
fcdd3266d2
|
Update rules number badge
|
2021-12-13 18:47:58 +00:00 |
|
Moritz
|
dbb157232b
|
Merge pull request #512 from jtothej/shellcode-via-createthreadpoolwait
Adding execute-shellcode-via-createthreadpoolwait.yml
|
2021-12-13 19:47:42 +01:00 |
|
Still Hsu
|
8c8de61f1a
|
Lint rule
Signed-off-by: Still Hsu <dev@stillu.cc>
|
2021-12-13 17:30:05 +08:00 |
|