26 commits

Author	SHA1	Message	Date
Moritz	62f28b55fe	Update terminate-process.yml	2021-04-27 08:19:05 +02:00
Andrew	8a513b280b	Add rules from Egregor ransomware DLL	2021-04-26 11:56:25 -04:00
mike-hunhoff	eb8221d9ad	Merge pull request #305 from fireeye/enfore-string-format ... enforce string formatting	2021-03-25 12:36:51 -06:00
Michael Hunhoff	20e1b8fd4c	enforce string formatting with double quotes + escaped special characters	2021-03-24 14:14:38 -06:00
Moritz Raabe	77b737fcf0	rule tweaks based on PMA Lab 03-02.dll ... see #296	2021-03-22 19:05:08 +01:00
Michael Hunhoff	750e164a41	removing ntdll requirement from function features exported by both ntdll and ntoskrnl	2021-02-16 18:28:05 -07:00
Moritz Raabe	7ee2c63e83	capafmted rules	2021-01-28 17:26:25 +01:00
0x534a	cf84ebe7d3	Fixes rule logic of inject-thread.yml to also match allocation of RW memory	2021-01-28 16:46:20 +01:00
0x534a	bfd063c8ab	Fixes rule logic of inject-thread.yml to also match allocation of RW memory	2021-01-28 16:38:56 +01:00
0x534a	29fbeec36a	Adjusts test file of hijack-thread-execution.yml, resolves conflict in inject-thread.yml and removes articles from rules	2021-01-28 15:28:53 +01:00
0x534a	8c93d205a8	Improve injection detection and some refactoring of existing rules	2021-01-28 14:47:31 +01:00
William Ballenthin	f1f0b4a1b6	merge	2021-01-02 11:06:53 -07:00
William Ballenthin	d99c02aca7	update ATT&CK mappings	2021-01-02 11:06:02 -07:00
Desiree Beck	499308b3e9	update based on comments	2020-12-16 16:33:22 -05:00
Desiree Beck	c5d24c671a	added mbc mappings in the host-interaction namespace	2020-12-16 15:30:06 -05:00
re-fox	edb3e1290d	Update and rename nursery/inject-apc.yml to host-interaction/process/inject/inject-apc.yml	2020-12-11 13:51:26 -05:00
Michael Hunhoff	d569817bdf	adding new rules for Gh0st	2020-12-02 08:14:20 -07:00
re-fox	7d3ab51ab0	Create terminate-process-via-fastfail.yml	2020-10-05 12:14:27 -04:00
Michael Hunhoff	febacd30b0	PR changes additional	2020-08-27 09:45:06 -06:00
Michael Hunhoff	2c59aaf16b	PR fixes	2020-08-26 16:07:09 -06:00
Michael Hunhoff	6ccc9a736f	fresh rules from al-khaser project	2020-08-13 09:39:42 -06:00
Michael Hunhoff	9320b70185	adding new rules for sample with MD5 hash 03B236B23B1EC37C663527C1F53AF3FE	2020-07-30 17:33:13 -06:00
William Ballenthin	1c39bd8349	graduate rules that pass the linter	2020-07-23 17:30:37 -06:00
William Ballenthin	54cfb05bd0	rules: address comments in #14	2020-06-26 17:45:56 -06:00
William Ballenthin	7b4f4d10fb	rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better	2020-06-21 17:54:01 -06:00
William Ballenthin	5f57dbdbc9	rules: reorganize rule names, namespaces, and ATT&CK mappings	2020-06-21 17:25:43 -06:00