37 commits

Author	SHA1	Message	Date
Willi Ballenthin	88c9c786ca	*: use meta.authors everywhere	2022-05-26 11:56:31 -06:00
William Ballenthin	d43a6ee544	Revert "Merge pull request #548 from mandiant/feature-remove-flavors" ... This reverts commit bc28847dd9, reversing changes made to 82308c4109.	2022-04-27 06:23:36 -06:00
Willi Ballenthin	904bf3ef00	*: remove /x32 and /x64 flavors and use instruction scope	2022-04-05 12:25:14 -06:00
Desiree Beck	e190179ffd	Merge pull request #1 from MBCProject/ryan-patches1 ... Update patch-process-command-line.yml	2021-11-22 11:27:15 -05:00
Moritz Raabe	25938ca10c	change to mandiant.com	2021-09-28 12:21:11 +02:00
Ryan Xu	0114138ae4	More detailed mappings	2021-08-31 11:34:09 -05:00
Ryan Xu	b4e040dc50	preliminary mapping	2021-08-23 14:11:00 -05:00
William Ballenthin	d35347d66a	md5: fix optional constants	2021-06-08 11:14:09 -06:00
William Ballenthin	cb9d886940	graduate "hash data with MD5"	2021-06-08 11:02:18 -06:00
Andrew	54d422b085	Add hash-data-using-djb2 ... The djb2 hash function was recently observed being used by Gamaredon for Windows API function hashing, so this commit adds hash-data-using-djb2 to look for a commonly referenced djb2 implementation	2021-05-22 23:34:40 -04:00
William Ballenthin	913cebdb38	Merge branch 'master' into fix-1	2021-05-18 10:48:06 -06:00
Moritz Raabe	624fa5e980	remove single child statements	2021-05-19 18:12:09 +02:00
William Ballenthin	6e501e8151	rules: convert inline comments to descriptions ... closes #1	2021-05-18 10:45:41 -06:00
Arnim Rupp	3a565c6ffd	fix URLs & formatting	2021-05-12 12:52:06 +02:00
Michael Hunhoff	c0216c9e60	hash-data-using-fnv: removing arch requirement from number constants	2021-03-24 14:36:13 -06:00
Moritz Raabe	ed04be796a	dos2unix	2021-03-19 08:13:26 +01:00
Moritz Raabe	387334a603	reformated using capafmt	2021-01-27 15:30:59 +01:00
Desiree Beck	5d285c5651	mappings for additions to namespaces	2021-01-21 15:29:06 -05:00
Moritz	11d360f286	Merge pull request #204 from re-fox/master ... Merging FNV hash rules	2020-12-17 18:14:03 +01:00
re-fox	4c878c41ad	Update hash-data-using-fnv.yml	2020-12-17 11:05:22 -05:00
re-fox	c1ad8e7d0c	Update hash-data-using-fnv.yml	2020-12-17 10:32:26 -05:00
re-fox	f93c2cb928	Update and rename hash-data-using-fnv-1.yml to hash-data-using-fnv.yml	2020-12-17 10:28:15 -05:00
Desiree Beck	3339dd6b68	Merge branch 'master' of https://github.com/fireeye/capa-rules into mbc-updates-p4	2020-12-16 17:27:50 -05:00
re-fox	19abc2ef09	Update hash-data-using-fnv-1.yml	2020-12-16 15:34:15 -05:00
re-fox	8482e7b765	Create hash-data-using-fnv-1.yml	2020-12-16 12:06:34 -05:00
Desiree Beck	33817fdd83	update micro objective name: data manipulation to data	2020-12-12 12:18:47 -05:00
Desiree Beck	a0f10b4cf2	add mappings	2020-10-19 14:04:15 -04:00
Moritz Raabe	33ae14eb53	use new description syntax	2020-09-30 17:48:02 +02:00
Moritz Raabe	1fcec06e7e	comment out description blocks for statements ... discussed in #312	2020-09-14 11:53:01 +02:00
Ana María Martínez Gómez	106fd3b54f	Clean up top level and/or in murmur3 ... The `and` is not needed.	2020-08-14 17:54:34 +02:00
Ana María Martínez Gómez	8e0ab6510f	Improve hash-data-using-murmur3 rule ... Include more ways to detect MurmurHash3 algorithm. For reference check the algorithm at: https://en.wikipedia.org/wiki/MurmurHash	2020-08-14 16:05:48 +02:00
re-fox	c270d28673	Create hash-data-using-tiger.yml	2020-08-03 13:24:09 -04:00
Michael Hunhoff	9320b70185	adding new rules for sample with MD5 hash 03B236B23B1EC37C663527C1F53AF3FE	2020-07-30 17:33:13 -06:00
William Ballenthin	1796e41d61	graduate murmur3 hash	2020-07-23 11:29:42 -06:00
William Ballenthin	54cfb05bd0	rules: address comments in #14	2020-06-26 17:45:56 -06:00
William Ballenthin	7b4f4d10fb	rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better	2020-06-21 17:54:01 -06:00
William Ballenthin	5f57dbdbc9	rules: reorganize rule names, namespaces, and ATT&CK mappings	2020-06-21 17:25:43 -06:00