mirror of
https://github.com/vee1e/capa-rules.git
synced 2026-09-01 10:58:40 +00:00
7269873b0c
* Initial additions for detecting donut features Signed-off-by: Still Hsu <dev@stillu.cc> * Lint rules Signed-off-by: Still Hsu <dev@stillu.cc> * Update ATT&CK for donut rule Signed-off-by: Still Hsu <dev@stillu.cc> * Fix comment for dynamic scope on donut loader Signed-off-by: Still Hsu <dev@stillu.cc> * Require at least one donut function match for donut rule Signed-off-by: Still Hsu <dev@stillu.cc> * Add offset for examples Signed-off-by: Still Hsu <dev@stillu.cc> * Add indirect call for IAssembly matching Signed-off-by: Still Hsu <dev@stillu.cc> * Match known vtable offsets for assembly loading * Remove loop matching --------- Signed-off-by: Still Hsu <dev@stillu.cc> |
||
|---|---|---|
| .. | ||
| compress-data-using-lzo.yml | ||
| compress-data-via-winapi.yml | ||
| compress-data-via-zlib-inflate-or-deflate.yml | ||
| create-cabinet-on-windows.yml | ||
| decompress-data-using-aplib.yml | ||
| decompress-data-using-lzo.yml | ||
| decompress-data-using-quicklz.yml | ||
| decompress-data-using-ucl.yml | ||
| decompress-data-via-iencodingfilterfactory.yml | ||
| extract-cabinet-on-windows.yml | ||