v1.2.0
Summary
Added: 48 rules
Modified: 12 rules
Renamed: 2 rules
Deleted: 0 rules
Detailed release changes: rules v1.1.0...v1.2.0
Added rules (48)
- anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-protected-handle-exception.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-unexpected-memory-writes.yml
- anti-analysis/anti-debugging/debugger-detection/check-process-job-object.yml
- anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml
- anti-analysis/anti-vm/vm-detection/check-for-sandbox-username.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-parallels.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-qemu.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualbox.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualpc.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-vmware.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-xen.yml
- anti-analysis/packer/aspack/packed-with-aspack.yml
- anti-analysis/reference-analysis-tools-strings.yml
- collection/database/wmi/reference-wmi-statements.yml
- communication/icmp/send-icmp-echo-request.yml
- data-manipulation/checksum/luhn/validate-credit-card-number-using-luhn-algorithm.yml
- data-manipulation/encryption/rsa/reference-public-rsa-key.yml
- host-interaction/hardware/cpu/get-number-of-processor-cores.yml
- host-interaction/hardware/cpu/get-number-of-processors.yml
- host-interaction/hardware/storage/enumerate-disk-properties.yml
- host-interaction/hardware/storage/get-disk-size.yml
- host-interaction/process/get-process-heap-flags.yml
- host-interaction/process/get-process-heap-force-flags.yml
- host-interaction/process/list/get-explorer-pid.yml
- host-interaction/uac/bypass/bypass-uac-via-appinfo-alpc.yml
- host-interaction/uac/bypass/bypass-uac-via-token-manipulation.yml
- lib/delay-execution.yml
- lib/peb-access.yml
- lib/validate-credit-card-number-using-luhn-algorithm-with-no-lookup-table.yml
- linking/runtime-linking/link-many-functions-at-runtime.yml
- nursery/check-for-process-debug-object.yml
- nursery/check-license-value.yml
- nursery/check-processdebugflags.yml
- nursery/check-processdebugport.yml
- nursery/check-systemkerneldebuggerinformation.yml
- nursery/check-thread-yield-allowed.yml
- nursery/delete-internet-cache.yml
- nursery/enumerate-internet-cache.yml
- nursery/enumerate-system-firmware-tables.yml
- nursery/get-system-firmware-table.yml
- nursery/hash-data-using-fnv.yml
- nursery/hide-thread-from-debugger.yml
Modified rules (12)
- anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings.yml
- data-manipulation/compression/decompress-data-via-iencodingfilterfactory.yml
- data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml
- data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml
- data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml
- data-manipulation/hashing/murmur/hash-data-using-murmur3.yml
- host-interaction/hardware/storage/get-disk-information.yml
- host-interaction/mutex/check-mutex-and-exit.yml
- linking/runtime-linking/access-peb-ldr_data.yml
- nursery/get-service-handle.yml