Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

use "span of calls" scope #973

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
@@ -31,7 +31,7 @@ rule:
- [email protected]
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Execution::Command and Scripting Interpreter::Windows Command Shell [T1059.003]
mbc:
2 changes: 1 addition & 1 deletion anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: basic block
dynamic: thread
dynamic: span of calls
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: span of calls
dynamic: call

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: span of calls
dynamic: call

mbc:
- Anti-Behavioral Analysis::Virtual Machine Detection [B0009]
- Anti-Behavioral Analysis::Sandbox Detection [B0007]
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- [email protected]
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001]
mbc:
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- [email protected]
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001]
mbc:
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- [email protected]
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001]
mbc:
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- [email protected]
scopes:
static: basic block
dynamic: thread
dynamic: span of calls
mbc:
- Anti-Behavioral Analysis::Debugger Detection::OutputDebugString [B0001.016]
examples:
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- [email protected]
scopes:
static: function
dynamic: thread
dynamic: span of calls
mbc:
- Anti-Behavioral Analysis::Debugger Detection::SetHandleInformation [B0001.024]
references:
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- [email protected]
scopes:
static: function
dynamic: thread
dynamic: span of calls
mbc:
- Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check QueryPerformanceCounter [B0001.033]
examples:
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- [email protected]
scopes:
static: function
dynamic: thread
dynamic: span of calls
mbc:
- Anti-Behavioral Analysis::Debugger Detection [B0001]
references:
Original file line number Diff line number Diff line change
@@ -7,7 +7,7 @@ rule:
- [email protected]
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Defense Evasion::Debugger Evasion [T1622]
mbc:
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc:
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- [email protected]
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Defense Evasion::Indicator Removal::Clear Windows Event Logs [T1070.001]
examples:
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- [email protected]
scopes:
static: basic block
dynamic: thread
dynamic: span of calls
att&ck:
- Defense Evasion::Impair Defenses::Disable Windows Event Logging [T1562.002]
references:
Original file line number Diff line number Diff line change
@@ -7,7 +7,7 @@ rule:
description: Looks for Windows API calls associated with reading and then writing file version information of executables on disk. Malware can use these calls to overwrite its own version information with that of a legitimate executable on the system (for instance, explorer.exe) to make it appear to be a legitimate application.
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Defense Evasion::Indicator Removal [T1070]
references:
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- [email protected]
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Defense Evasion::Indicator Removal::File Deletion [T1070.004]
mbc:
2 changes: 1 addition & 1 deletion anti-analysis/anti-forensic/self-deletion/self-delete.yml
Original file line number Diff line number Diff line change
@@ -7,7 +7,7 @@ rule:
- "@mr-tz"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Defense Evasion::Indicator Removal::File Deletion [T1070.004]
mbc:
2 changes: 1 addition & 1 deletion anti-analysis/anti-forensic/timestomp/timestomp-file.yml
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- [email protected]
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Defense Evasion::Indicator Removal::Timestomp [T1070.006]
examples:
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc:
Original file line number Diff line number Diff line change
@@ -7,7 +7,7 @@ rule:
- "[email protected]"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion [T1497]
mbc:
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: basic block
dynamic: thread
dynamic: span of calls
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: span of calls
dynamic: call

att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc:
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc:
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc:
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc:
Original file line number Diff line number Diff line change
@@ -7,7 +7,7 @@ rule:
- [email protected]
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc:
Original file line number Diff line number Diff line change
@@ -7,7 +7,7 @@ rule:
- [email protected]
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
mbc:
Original file line number Diff line number Diff line change
@@ -7,7 +7,7 @@ rule:
- [email protected]
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Credential Access::Credentials from Password Stores::Windows Credential Manager [T1555.004]
examples:
2 changes: 1 addition & 1 deletion collection/browser/gather-firefox-profile-information.yml
Original file line number Diff line number Diff line change
@@ -7,7 +7,7 @@ rule:
- [email protected]
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Credential Access::Credentials from Password Stores::Credentials from Web Browsers [T1555.003]
examples:
2 changes: 1 addition & 1 deletion collection/database/sql/reference-sql-statements.yml
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- [email protected]
scopes:
static: function
dynamic: thread
dynamic: span of calls
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: span of calls
dynamic: span of calls
Suggested change
dynamic: span of calls
dynamic: call

att&ck:
- Collection::Data from Information Repositories [T1213]
examples:
2 changes: 1 addition & 1 deletion collection/database/wmi/reference-wmi-statements.yml
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- [email protected]
scopes:
static: function
dynamic: thread
dynamic: span of calls
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: span of calls
dynamic: call

att&ck:
- Collection::Data from Information Repositories [T1213]
examples:
2 changes: 1 addition & 1 deletion collection/file-managers/gather-3d-ftp-information.yml
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Credential Access::Credentials from Password Stores [T1555]
references:
2 changes: 1 addition & 1 deletion collection/file-managers/gather-alftp-information.yml
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Credential Access::Credentials from Password Stores [T1555]
references:
2 changes: 1 addition & 1 deletion collection/file-managers/gather-bitkinex-information.yml
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Credential Access::Credentials from Password Stores [T1555]
references:
2 changes: 1 addition & 1 deletion collection/file-managers/gather-blazeftp-information.yml
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Credential Access::Credentials from Password Stores [T1555]
references:
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Credential Access::Credentials from Password Stores [T1555]
references:
2 changes: 1 addition & 1 deletion collection/file-managers/gather-classicftp-information.yml
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: function
dynamic: thread
dynamic: span of calls
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: span of calls
dynamic: call

att&ck:
- Credential Access::Credentials from Password Stores [T1555]
references:
2 changes: 1 addition & 1 deletion collection/file-managers/gather-coreftp-information.yml
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Credential Access::Credentials from Password Stores [T1555]
references:
2 changes: 1 addition & 1 deletion collection/file-managers/gather-cuteftp-information.yml
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Credential Access::Credentials from Password Stores [T1555]
references:
2 changes: 1 addition & 1 deletion collection/file-managers/gather-cyberduck-information.yml
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Credential Access::Credentials from Password Stores [T1555]
references:
2 changes: 1 addition & 1 deletion collection/file-managers/gather-direct-ftp-information.yml
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Credential Access::Credentials from Password Stores [T1555]
references:
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Credential Access::Credentials from Password Stores [T1555]
references:
2 changes: 1 addition & 1 deletion collection/file-managers/gather-expandrive-information.yml
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Credential Access::Credentials from Password Stores [T1555]
references:
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Credential Access::Credentials from Password Stores [T1555]
references:
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Credential Access::Credentials from Password Stores [T1555]
references:
2 changes: 1 addition & 1 deletion collection/file-managers/gather-ffftp-information.yml
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@ rule:
- "@_re_fox"
scopes:
static: function
dynamic: thread
dynamic: span of calls
att&ck:
- Credential Access::Credentials from Password Stores [T1555]
references:
Loading