mirror of
https://github.com/vee1e/capa-rules.git
synced 2026-09-04 04:17:34 +00:00
7269873b0c
* Initial additions for detecting donut features Signed-off-by: Still Hsu <dev@stillu.cc> * Lint rules Signed-off-by: Still Hsu <dev@stillu.cc> * Update ATT&CK for donut rule Signed-off-by: Still Hsu <dev@stillu.cc> * Fix comment for dynamic scope on donut loader Signed-off-by: Still Hsu <dev@stillu.cc> * Require at least one donut function match for donut rule Signed-off-by: Still Hsu <dev@stillu.cc> * Add offset for examples Signed-off-by: Still Hsu <dev@stillu.cc> * Add indirect call for IAssembly matching Signed-off-by: Still Hsu <dev@stillu.cc> * Match known vtable offsets for assembly loading * Remove loop matching --------- Signed-off-by: Still Hsu <dev@stillu.cc> |
||
|---|---|---|
| .. | ||
| aes | ||
| blowfish | ||
| camellia | ||
| chaskey | ||
| des | ||
| dpapi | ||
| elliptic-curve | ||
| hc-128 | ||
| rc4 | ||
| rc6 | ||
| rsa | ||
| skipjack | ||
| sosemanuk | ||
| speck | ||
| tea | ||
| twofish | ||
| vest | ||
| xtea | ||
| xxtea | ||
| create-new-key-via-cryptacquirecontext.yml | ||
| encrypt-data-using-memfrob-from-glibc.yml | ||
| encrypt-or-decrypt-via-wincrypt.yml | ||
| get-outbound-credentials-handle-via-credssp.yml | ||
| import-public-key.yml | ||
| use-bigint-function.yml | ||