vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-02 03:17:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
capa-rules/exploitation/spraying
History
Exact
zdw@ e6df480758
add first set of exploit detection rules (#1046) 
* add ntoskrnl.exe loading rule

* fix name

* add explicit os

* add suspicious ntquerysysteinformation detections

* ntfscontrolfile wip

* fix ntfscontrolfile rule

* rename ntquerysysinfo rule

* add ntoskrnl gadgets rule

* make descs more generic

* refactor rules to exploitation namespace

* add caveat to ntfscontrolfile rule

* tweak rule names

* tweak ntfscontrolfile name
2025-05-22 12:53:30 -06:00
..
make-suspicious-ntfscontrolfile-call.yml