22 commits

Author	SHA1	Message	Date
William Ballenthin	e139b36c2e	appinit: add reference to enable/disable reg key	2021-05-01 10:05:54 -06:00
Moritz Raabe	387334a603	reformated using capafmt	2021-01-27 15:30:59 +01:00
William Ballenthin	f8a3de9367	update attack mappings	2021-01-02 11:46:20 -07:00
0x534a	8d54ac8fa3	Make escaping consistent	2020-12-23 23:38:37 +01:00
0x534a	13a4bf1946	Consolidated setting of registry value with reg.exe command in set-registry-value.yml	2020-12-23 22:42:59 +01:00
0x534a	13e454aeba	Make the linter happy	2020-12-22 16:33:13 +01:00
0x534a	7d550ecdf5	Fix logic of registry command detection and clean up	2020-12-22 16:30:08 +01:00
sja	f0c2087ab5	Fixed format of att&ck string	2020-12-21 18:18:17 +01:00
sja	5d1f5f1244	Add detection by command line to AppInit_DLLs	2020-12-21 17:51:10 +01:00
sja	fa4b0ab19e	Changed example hashes from sha256 to md5	2020-12-21 17:35:33 +01:00
sja	2ac93f8cd2	Enhancement of persistence rules	2020-12-21 17:18:58 +01:00
re-fox	7bbaaa250b	Update persist-via-run-registry-key.yml	2020-10-05 11:08:35 -04:00
Moritz Raabe	5a67716572	fix att&ck	2020-10-01 10:57:44 +02:00
William Ballenthin	1c39bd8349	graduate rules that pass the linter	2020-07-23 17:30:37 -06:00
William Ballenthin	5488530055	fix ATT&CK categories ... closes #25	2020-07-03 09:14:14 -06:00
William Ballenthin	54cfb05bd0	rules: address comments in #14	2020-06-26 17:45:56 -06:00
William Ballenthin	0482c936fb	rules: fix ATT&CK and MBC tags	2020-06-21 17:57:25 -06:00
William Ballenthin	7b4f4d10fb	rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better	2020-06-21 17:54:01 -06:00
William Ballenthin	5f57dbdbc9	rules: reorganize rule names, namespaces, and ATT&CK mappings	2020-06-21 17:25:43 -06:00
William Ballenthin	e9ad899b0f	rules: add trailing newline to end of each file	2020-06-21 15:50:42 -06:00
William Ballenthin	69507875b0	rules: reformat all rules using capafmt	2020-06-21 15:47:02 -06:00
William Ballenthin	eaae0e89a7	import existing rules, forgetting about 938 prior commits	2020-06-18 07:27:35 -06:00