Skip to content

Commit

Permalink
initial commit
Browse files Browse the repository at this point in the history
  • Loading branch information
@yelhamer
yelhamer committed Aug 22, 2023
1 parent a20c17d commit 73724d9
Show file tree
Hide file tree
Showing 831 changed files with 2,493 additions and 831 deletions.
4 changes: 3 additions & 1 deletion ...alysis/anti-av/block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-av
authors:
- [email protected]
scope: basic block
scopes:
static: basic block
dynamic: unspecified # rule hasn't been migrated yet
att&ck:
- Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-av
authors:
- "@_re_fox"
scope: basic block
scopes:
static: basic block
dynamic: unspecified # rule hasn't been migrated yet
mbc:
- Anti-Behavioral Analysis::Virtual Machine Detection [B0009]
- Anti-Behavioral Analysis::Sandbox Detection [B0007]
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-av/patch-event-tracing-for-windows-function.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-av
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
att&ck:
- Defense Evasion::Impair Defenses::Indicator Blocking [T1562.006]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-av/protect-spawned-processes-with-mitigation-policies.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-av
authors:
- [email protected]
scope: basic block
scopes:
static: basic block
dynamic: unspecified # rule hasn't been migrated yet
att&ck:
- Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ rule:
authors:
- [email protected]
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
mbc:
- Anti-Behavioral Analysis::Debugger Detection::CheckRemoteDebuggerPresent [B0001.002]
- Anti-Behavioral Analysis::Debugger Detection::WudfIsAnyDebuggerPresent [B0001.031]
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
mbc:
- Anti-Behavioral Analysis::Debugger Detection::Hardware Breakpoints [B0001.005]
references:
Expand Down
4 changes: 3 additions & 1 deletion ...debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
mbc:
- Anti-Behavioral Analysis::Debugger Detection [B0001]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-for-outputdebugstring-error.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: basic block
scopes:
static: basic block
dynamic: unspecified # rule hasn't been migrated yet
mbc:
- Anti-Behavioral Analysis::Debugger Detection::OutputDebugString [B0001.016]
examples:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: basic block
scopes:
static: basic block
dynamic: unspecified # rule hasn't been migrated yet
mbc:
- Anti-Behavioral Analysis::Debugger Detection::Process Environment Block BeingDebugged [B0001.035]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
mbc:
- Anti-Behavioral Analysis::Debugger Detection::Process Environment Block NtGlobalFlag [B0001.036]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-for-protected-handle-exception.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
mbc:
- Anti-Behavioral Analysis::Debugger Detection::SetHandleInformation [B0001.024]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
mbc:
- Anti-Behavioral Analysis::Debugger Detection::Software Breakpoints [B0001.025]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
mbc:
- Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCount [B0001.032]
examples:
Expand Down
4 changes: 3 additions & 1 deletion ...is/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
mbc:
- Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check QueryPerformanceCounter [B0001.033]
examples:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: basic block
scopes:
static: basic block
dynamic: unspecified # rule hasn't been migrated yet
mbc:
- Anti-Behavioral Analysis::Debugger Detection [B0001]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-for-unexpected-memory-writes.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: basic block
scopes:
static: basic block
dynamic: unspecified # rule hasn't been migrated yet
mbc:
- Anti-Behavioral Analysis::Debugger Detection::Memory Write Watching [B0001.010]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-process-job-object.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
mbc:
- Anti-Behavioral Analysis::Debugger Detection [B0001]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/check-processdebugport.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: basic block
scopes:
static: basic block
dynamic: unspecified # rule hasn't been migrated yet
mbc:
- Anti-Behavioral Analysis::Debugger Detection::NtQueryInformationProcess [B0001.012]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-debugging/debugger-detection
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
mbc:
- Anti-Behavioral Analysis::Debugger Detection::Anti-debugging Instructions [B0001.034]
examples:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-debugging/debugger-evasion/hide-thread-from-debugger.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ rule:
authors:
- [email protected]
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
att&ck:
- Defense Evasion::Debugger Evasion [T1622]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ rule:
authors:
- [email protected]
description: Looks for instructions related to executing 64-bit code from a 32-bit process (Heaven's Gate)
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
mbc:
- Defense Evasion::Disable or Evade Security Tools::Heavens Gate [F0004.008]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-disasm/contain-anti-disasm-techniques.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-disasm
authors:
- [email protected]
scope: file
scopes:
static: file
dynamic: unspecified # rule hasn't been migrated yet
mbc:
- Anti-Static Analysis::Disassembler Evasion [B0012]
examples:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-emulation/wine
authors:
- "@_re_fox"
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-forensic/clear-logs
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
att&ck:
- Defense Evasion::Indicator Removal::Clear Windows Event Logs [T1070.001]
examples:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-forensic/crash-the-windows-event-logging-service.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-forensic
authors:
- [email protected]
scope: basic block
scopes:
static: basic block
dynamic: unspecified # rule hasn't been migrated yet
att&ck:
- Defense Evasion::Impair Defenses::Disable Windows Event Logging [T1562.002]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-forensic/impersonate-file-version-information.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ rule:
authors:
- [email protected]
description: Looks for Windows API calls associated with reading and then writing file version information of executables on disk. Malware can use these calls to overwrite its own version information with that of a legitimate executable on the system (for instance, explorer.exe) to make it appear to be a legitimate application.
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
att&ck:
- Defense Evasion::Indicator Removal [T1070]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-forensic/patch-process-command-line.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ rule:
authors:
- [email protected]
- "@_re_fox"
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
att&ck:
- Defense Evasion::Process Injection [T1055]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-forensic/self-deletion/self-delete.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ rule:
authors:
- [email protected]
- "@mr-tz"
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
att&ck:
- Defense Evasion::Indicator Removal::File Deletion [T1070.004]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-forensic/spoof-parent-pid.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ rule:
namespace: anti-analysis/anti-forensic
authors:
- [email protected]
scope: basic block
scopes:
static: basic block
dynamic: unspecified # rule hasn't been migrated yet
att&ck:
- Defense Evasion::Access Token Manipulation::Parent PID Spoofing [T1134.004]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-forensic/timestomp/timestomp-file.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-forensic/timestomp
authors:
- [email protected]
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
att&ck:
- Defense Evasion::Indicator Removal::Timestomp [T1070.006]
examples:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-vm/vm-detection/check-for-foreground-window-switch.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ rule:
authors:
- [email protected]
description: Detect usage of GetForegroundWindow and Sleep APIs to check if there is any foreground window switch. Typically, sandboxes do not switch the foreground window like a user would in a normal environment.
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks [T1497.002]
references:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-vm/vm-detection
authors:
- "@_re_fox"
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-vm/vm-detection/check-for-sandbox-username-or-hostname.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ rule:
authors:
- "@_re_fox"
- "[email protected]"
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion [T1497]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-vm/vm-detection
authors:
- BitsOfBinary
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks [T1497.002]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-vm/vm-detection
authors:
- "@_re_fox"
scope: basic block
scopes:
static: basic block
dynamic: unspecified # rule hasn't been migrated yet
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc:
Expand Down
4 changes: 3 additions & 1 deletion anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ rule:
namespace: anti-analysis/anti-vm/vm-detection
authors:
- "@_re_fox"
scope: function
scopes:
static: function
dynamic: unspecified # rule hasn't been migrated yet
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc:
Expand Down
Loading

0 comments on commit 73724d9

Please sign in to comment.