vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 10:58:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
capa-rules/exploitation
History
Exact
zdw@ e6df480758
add first set of exploit detection rules (#1046) 
* add ntoskrnl.exe loading rule

* fix name

* add explicit os

* add suspicious ntquerysysteinformation detections

* ntfscontrolfile wip

* fix ntfscontrolfile rule

* rename ntquerysysinfo rule

* add ntoskrnl gadgets rule

* make descs more generic

* refactor rules to exploitation namespace

* add caveat to ntfscontrolfile rule

* tweak rule names

* tweak ntfscontrolfile name
2025-05-22 12:53:30 -06:00
..
enumeration add first set of exploit detection rules (#1046) 2025-05-22 12:53:30 -06:00
gadgets add first set of exploit detection rules (#1046) 2025-05-22 12:53:30 -06:00
spraying add first set of exploit detection rules (#1046) 2025-05-22 12:53:30 -06:00