Ervin Ocampo 708b06dd0a Add capa rule load-code/shellcode/execute-shellcode-via-windows-callback-function.yml (#744) ... * Add capa rule load-code/shellcode/execute-shellcode-via-callback-functions.yml * Update load-code/shellcode/execute-shellcode-via-callback-functions.yml Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com> * Update load-code/shellcode/execute-shellcode-via-callback-functions.yml Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com> * Update load-code/shellcode/execute-shellcode-via-callback-functions.yml Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com> * Update execute-shellcode-via-callback-functions.yml Omitted A and W on WinAPI function names since capa handles this automatically. * Update execute-shellcode-via-callback-functions.yml Added EnumTimeFormats and deduplicated EnumSystemCodePages * Update and rename execute-shellcode-via-callback-functions.yml to execute-shellcode-via-windows-callback-function.yml Renamed file to execute-shellcode-via-windows-callback-function.yml and merged https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml * Delete execute-shellcode-via-enumuilanguages.yml Delete rule due to merge with execute-shellcode-via-windows-callback-function.yml --------- Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>		2023-04-19 09:56:15 -06:00
..
dotnet	Create execute-dotnet-assembly-via-clr-host.yml (#688)	2023-02-06 10:12:02 -07:00
pe	specify offset operand to reduce FPs (#716)	2023-03-01 16:08:17 +01:00
powershell	Update Mappings for MBC (part 9)	2022-08-30 09:15:15 -04:00
shellcode	Add capa rule load-code/shellcode/execute-shellcode-via-windows-callback-function.yml (#744)	2023-04-19 09:56:15 -06:00
execute-vbscript-javascript-or-jscript-in-memory.yml	Create execute-vbscript-javascript-or-jscript-in-memory.yml	2023-02-06 13:31:07 -05:00