| .. |
|
acquire-debug-privileges.yml
|
dos2unix
|
2021-03-19 08:13:26 +01:00 |
|
add-file-to-cabinet-file.yml
|
|
|
|
authenticate-hmac.yml
|
new rule and some tweaks
|
2020-10-06 18:28:38 +02:00 |
|
bypass-uac-via-icmluautil.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
bypass-uac-via-scheduled-task-environment-variable.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
capture-screenshot-in-go.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
check-for-process-debug-object.yml
|
update ATT&CK and MBC mappings
|
2021-04-13 09:37:10 -06:00 |
|
check-for-windows-sandbox-via-mutex.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
check-license-value.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
check-processdebugflags.yml
|
update ATT&CK and MBC mappings
|
2021-04-13 09:37:10 -06:00 |
|
check-processdebugport.yml
|
update ATT&CK and MBC mappings
|
2021-04-13 09:37:10 -06:00 |
|
check-systemkerneldebuggerinformation.yml
|
update ATT&CK and MBC mappings
|
2021-04-13 09:37:10 -06:00 |
|
check-thread-yield-allowed.yml
|
update ATT&CK and MBC mappings
|
2021-04-13 09:37:10 -06:00 |
|
compare-security-identifiers.yml
|
updating rules + new rules
|
2021-03-25 13:10:42 -06:00 |
|
compiled-from-epl.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
compiled-with-nim.yml
|
adding compiled-with-nim.yml
|
2021-02-16 14:30:14 -07:00 |
|
connect-network-resource.yml
|
|
|
|
create-restart-manager-session.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
create-shortcut-via-ishelllink.yml
|
|
|
|
debug-build.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
decode-data-using-base64-via-winapi.yml
|
update ATT&CK and MBC mappings
|
2021-04-13 09:37:10 -06:00 |
|
decrypt-data-via-sspi.yml
|
update ATT&CK and MBC mappings
|
2021-04-13 09:37:10 -06:00 |
|
delete-internet-cache.yml
|
|
|
|
delete-registry-key-via-offline-registry-library.yml
|
update ATT&CK and MBC mappings
|
2021-04-13 09:37:10 -06:00 |
|
empty-recycle-bin-quietly.yml
|
use new description syntax
|
2020-09-30 17:48:02 +02:00 |
|
empty-the-recycle-bin.yml
|
|
|
|
encode-data-using-base64-via-winapi.yml
|
update ATT&CK and MBC mappings
|
2021-04-13 09:37:10 -06:00 |
|
encrypt-data-using-salsa20-or-chacha.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
encrypt-data-via-sspi.yml
|
|
|
|
encrypt-or-decrypt-data-via-bcrypt.yml
|
new BCrypt rules for encrypt/decrypt/hash
|
2020-11-12 20:08:29 -07:00 |
|
enumerate-browser-history.yml
|
|
|
|
enumerate-disk-volumes.yml
|
|
|
|
enumerate-internet-cache.yml
|
|
|
|
enumerate-network-shares.yml
|
update ATT&CK and MBC mappings
|
2021-04-13 09:37:10 -06:00 |
|
enumerate-system-firmware-tables.yml
|
|
|
|
enumerate-threads.yml
|
|
|
|
flush-cabinet-file.yml
|
|
|
|
generate-random-numbers-using-the-delphi-lcg.yml
|
Create generate-random-numbers-using-the-delphi-lcg.yml
|
2021-02-03 10:26:40 -07:00 |
|
get-client-handle-via-schannel.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
get-comspec-environment-variable.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
get-file-size.yml
|
|
|
|
get-file-version-info.yml
|
|
|
|
get-inbound-credentials-handle-via-credssp.yml
|
|
|
|
get-installed-programs.yml
|
PR change requests
|
2021-01-07 13:06:35 -07:00 |
|
get-networking-parameters.yml
|
|
|
|
get-outbound-credentials-handle-via-credssp.yml
|
|
|
|
get-proxy.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
get-remote-cert-context-via-schannel.yml
|
|
|
|
get-routing-table.yml
|
|
|
|
get-service-handle.yml
|
|
|
|
get-session-information.yml
|
|
|
|
get-socket-information.yml
|
update attack mappings
|
2021-01-02 11:46:20 -07:00 |
|
get-system-firmware-table.yml
|
|
|
|
get-thread-local-storage-value.yml
|
|
|
|
get-token-membership.yml
|
|
|
|
get-user-security-identifier.yml
|
capafmt
|
2021-04-13 09:49:02 -06:00 |
|
hash-data-using-crc32b.yml
|
|
|
|
hash-data-using-md4.yml
|
|
|
|
hash-data-using-murmur2.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
hash-data-using-sha1-via-wincrypt.yml
|
|
|
|
hash-data-using-sha1-via-x86-extensions.yml
|
|
|
|
hash-data-using-sha256-via-x86-extensions.yml
|
|
|
|
hash-data-via-bcrypt.yml
|
updating hash-data-via-bcrypt to include BCryptHash function
|
2020-11-13 10:41:53 -07:00 |
|
hash-data-with-md5.yml
|
|
|
|
hide-thread-from-debugger.yml
|
hide-thread-from-debugger: fix typo
|
2020-09-07 12:23:27 -06:00 |
|
hook-routines-via-microsoft-detours.yml
|
add a couple new rules
|
2020-10-20 14:59:12 -06:00 |
|
hooked-by-api-override.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
impersonate-user.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
initialize-hashing-via-wincrypt.yml
|
|
|
|
inspect-load-icon-resource.yml
|
adding inspect-load-icon-resource.yml
|
2021-02-12 10:59:35 -07:00 |
|
linked-against-c-regex-library.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
linked-against-go-process-enumeration-library.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
linked-against-go-registry-library.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
linked-against-go-static-asset-library.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
linked-against-go-wmi-library.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
linked-against-xzip.yml
|
Update nursery/linked-against-xzip.yml
|
2021-02-23 16:18:08 +01:00 |
|
listen-for-remote-procedure-calls.yml
|
updating rules + new rules
|
2021-03-25 13:10:42 -06:00 |
|
make-an-http-request-with-a-cookie.yml
|
|
|
|
migrate-process-to-active-window-station.yml
|
missing example, move to nursery
|
2020-11-19 16:41:19 +01:00 |
|
mine-cryptocurrency.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
move-file.yml
|
|
|
|
open-cabinet-file.yml
|
|
|
|
packaged-as-a-createinstall-installer.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packaged-as-a-nsis-installer.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packaged-as-a-pintool.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packaged-as-a-winzip-self-extracting-archive.yml
|
rules: add rules from Hexacorn's blog
|
2020-10-21 12:04:31 -06:00 |
|
packaged-as-a-wise-installer.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
packaged-as-an-installshield-installer.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
packed-with-ccg.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-crunch.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-dragon-armor.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-enigma.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-epack.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-maskpe.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-mew.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-mpress.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-neolite.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-pecompact.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-pepack.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-perplex.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-procrypt.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-rpcrypt.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-seausfx.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-shrinker.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-simple-pack.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-starforce.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-svkp.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-themida.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-tsuloader.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-vprotect.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
packed-with-wwpack.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
query-remote-server-for-available-data.yml
|
Rename query-remote-server-for-availible-data.yml to query-remote-server-for-available-data.yml
|
2021-03-25 14:44:51 -06:00 |
|
read-and-send-data-from-client-to-server.yml
|
update ATT&CK mappings
|
2021-01-02 11:06:02 -07:00 |
|
read-process-memory.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
read-raw-disk-data.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
rebuilt-by-imprec.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
receive-and-write-data-from-server-to-client.yml
|
update ATT&CK mappings
|
2021-01-02 11:06:02 -07:00 |
|
reference-114dns-dns-server.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
reference-aes-constants.yml
|
|
|
|
reference-alidns-dns-server.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
reference-cloudflare-dns-server.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
reference-comodo-secure-dns-server.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
reference-dns-over-https-endpoints.yml
|
fix rules
|
2021-02-09 14:49:02 +01:00 |
|
reference-google-public-dns-server.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
reference-hurricane-electric-dns-server.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
reference-kornet-dns-server.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
reference-l3-dns-server.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
reference-opendns-dns-server.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
reference-processor-manufacturer-constants.yml
|
update ATT&CK and MBC mappings
|
2021-04-13 09:37:10 -06:00 |
|
reference-quad9-dns-server.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
reference-screen-saver-executable.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
reference-startup-folder.yml
|
|
|
|
reference-the-vmware-io-port.yml
|
update ATT&CK and MBC mappings
|
2021-04-13 09:37:10 -06:00 |
|
reference-verisign-dns-server.yml
|
enforce string formatting with double quotes + escaped special characters
|
2021-03-24 14:14:38 -06:00 |
|
resolve-function-by-hash.yml
|
reformated using capafmt
|
2021-01-27 15:30:59 +01:00 |
|
run-powershell-expression.yml
|
|
|
|
schedule-task-via-itaskservice.yml
|
adding new rules to nursery
|
2020-09-17 12:31:07 -06:00 |
|
search-for-credit-card-data.yml
|
|
|
|
send-http-request-with-host-header.yml
|
|
|
|
set-console-window-title.yml
|
|
|
|
set-global-application-hook.yml
|
|
|
|
spawn-thread-to-rwx-shellcode.yml
|
|
|
|
terminate-process-by-name.yml
|
dos2unix
|
2021-03-19 08:13:26 +01:00 |
