Repository navigation
Summary
Added: 12 rules
Modified: 24 rules
Renamed: 3 rules
Deleted: 0 rules
Detailed release changes: rules v9.4.0...v10.0.0
Added rules (12)
- anti-analysis/anti-debugging/check-for-time-delay-in-dotnet.yml
- compiler/crystal/compiled-with-crystal.yml
- compiler/odin/compiled-with-odin.yml
- host-interaction/network/connectivity/check-internet-connectivity-in-dotnet.yml
- load-code/dotnet/load-dotnet-assembly-via-runtimeassemblynloadimage.yml
- nursery/connect-to-websocket-server-in-dotnet.yml
- nursery/decode-pe-stored-as-uuid.yml
- nursery/decrypt-payload-stored-as-ipv6-strings.yml
- nursery/receive-data-on-websocket-in-dotnet.yml
- nursery/search-for-file-via-winapi.yml
- nursery/send-data-on-websocket-in-dotnet.yml
- nursery/upload-or-download-file-via-dropbox.yml
Modified rules (24)
- anti-analysis/anti-forensic/self-deletion/self-delete.yml
- anti-analysis/reference-analysis-tools-strings.yml
- collection/database/wmi/reference-wmi-statements.yml
- collection/keylog/log-keystrokes-via-direct-input.yml
- collection/keylog/register-raw-input-devices.yml
- communication/http/set-http-header.yml
- communication/socket/attach-bpf-to-socket-on-linux.yml
- compiler/ps2exe/compiled-with-ps2exe.yml
- host-interaction/file-system/reference-absolute-stream-path-on-windows.yml
- host-interaction/hardware/cpu/get-number-of-processors.yml
- host-interaction/network/domain/get-domain-information.yml
- host-interaction/process/get-process-heap-flags.yml
- host-interaction/registry/open-recentdocs-registry-key.yml
- malware-family/plugx/match-known-plugx-module.yml
- nursery/disable-automatic-windows-recovery-features.yml
- nursery/get-current-process-command-line.yml
- nursery/get-current-process-file-path.yml
- nursery/get-current-process-filesystem-mounts-on-linux.yml
- nursery/get-current-process-memory-mapping-on-linux.yml
- nursery/get-system-property-on-android.yml
- nursery/invoke-dotnet-assembly-method.yml
- nursery/persist-via-hhctrl-com-hijack.yml
- persistence/registry/persist-via-shellserviceobjectdelayload-registry-key.yml
- runtime/dotnet/compiled-with-dotnet-aot.yml
Renamed rules (3)
- host-interaction/process/inject/inject-shellcode-using-thread-pool-work-insertion-with-tp_io.yml (was nursery/inject-shellcode-using-thread-pool-work-insertion-with-tp_io.yml)
- host-interaction/process/inject/inject-shellcode-using-thread-pool-work-insertion-with-tp_timer.yml (was nursery/inject-shellcode-using-thread-pool-work-insertion-with-tp_timer.yml)
- host-interaction/process/inject/inject-shellcode-using-thread-pool-work-insertion-with-tp_work.yml (was nursery/inject-shellcode-using-thread-pool-work-insertion-with-tp_work.yml)