Still / Azaka 7269873b0c Add rules for detecting donut-related features (#997) ... * Initial additions for detecting donut features Signed-off-by: Still Hsu <dev@stillu.cc> * Lint rules Signed-off-by: Still Hsu <dev@stillu.cc> * Update ATT&CK for donut rule Signed-off-by: Still Hsu <dev@stillu.cc> * Fix comment for dynamic scope on donut loader Signed-off-by: Still Hsu <dev@stillu.cc> * Require at least one donut function match for donut rule Signed-off-by: Still Hsu <dev@stillu.cc> * Add offset for examples Signed-off-by: Still Hsu <dev@stillu.cc> * Add indirect call for IAssembly matching Signed-off-by: Still Hsu <dev@stillu.cc> * Match known vtable offsets for assembly loading * Remove loop matching --------- Signed-off-by: Still Hsu <dev@stillu.cc>		2025-03-21 10:15:28 -06:00
..
dotnet	Add rules for detecting donut-related features (#997)	2025-03-21 10:15:28 -06:00
pe	use "span of calls" scope (#973)	2025-01-29 10:27:13 +01:00
powershell	use "span of calls" scope (#973)	2025-01-29 10:27:13 +01:00
shellcode	use "span of calls" scope (#973)	2025-01-29 10:27:13 +01:00
execute-vbscript-javascript-or-jscript-in-memory.yml	upgrade rules using updated script	2023-11-24 11:34:28 +01:00