reformated using capafmt

anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml

@@ -15,17 +15,17 @@ rule:
       - or:
         - string: /avghook(x|a)\.dll/i
           description: AVG
-        - string: /snxhk\.dll/i 
+        - string: /snxhk\.dll/i
           description: Avast
-        - string: /sf2\.dll/i 
+        - string: /sf2\.dll/i
           description: Avast
         - string: /sbiedll\.dll/i
           description: Sandboxie
-        - string: /dbghelp\.dll/i 
+        - string: /dbghelp\.dll/i
           description: WindBG
-        - string: /api_log\.dll/i 
+        - string: /api_log\.dll/i
           description: iDefense Lab
-        - string: /dir_watch\.dll/ 
+        - string: /dir_watch\.dll/
           description: iDefense Lab
         - string: /pstorec\.dll/i
           description: SunBelt Sandbox
@@ -33,11 +33,11 @@ rule:
           description: Virtual PC
         - string: /wpespy\.dll/i
           description: WPE Pro
-        - string: /cmdvrt(64|32).dll/i 
+        - string: /cmdvrt(64|32).dll/i
           description: Comodo Container
-        - string: /sxin.dll/i 
+        - string: /sxin.dll/i
           description: 360 SOFTWARE
         - string: /dbghelp\.dll/i
           description: WINE
-        - string: /printfhelp\.dll/i 
+        - string: /printfhelp\.dll/i
           description: Unknown Sandbox

anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml

@@ -7,11 +7,11 @@ rule:
     scope: function
     mbc:
       - Defense Evasion::Disable or Evade Security Tools::Heavens Gate [F0004.008]
-    examples:
-      - 79abd17391adc6251ecdc58d13d76baf:0x10002385
     references:
       - https://download.bitdefender.com/resources/files/News/CaseStudies/study/318/Bitdefender-TRR-Whitepaper-Maze-creat4351-en-EN-GenericUse.pdf
       - https://www.malwaretech.com/2014/02/the-0x33-segment-selector-heavens-gate.html
+    examples:
+      - 79abd17391adc6251ecdc58d13d76baf:0x10002385
   features:
     - and:
       - and:

anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml

@@ -16,5 +16,5 @@ rule:
     - and:
       - string: /OfficePackagesForWDAG/
       - api: GetWindowsDirectory
-      - optional: 
+      - optional:
         - api: CreateFile

anti-analysis/anti-vm/vm-detection/check-for-sandbox-username.yml

@@ -8,10 +8,10 @@ rule:
       - Defense Evasion::Virtualization/Sandbox Evasion [T1497]
     mbc:
       - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]
-    examples:
-      - ccbf7cba35bab56563c0fbe4237fdc41:0x402B90
     references:
       - https://github.com/LloydLabs/wsb-detect
+    examples:
+      - ccbf7cba35bab56563c0fbe4237fdc41:0x402B90
   features:
     - and:
       - api: GetUserName

anti-analysis/packer/aspack/packed-with-aspack.yml

@@ -8,11 +8,11 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
-      - 2055994ff75b4309eee3a49c5749d306
     references:
       - http://www.aspack.com/
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
+      - 2055994ff75b4309eee3a49c5749d306
   features:
     - or:
       - section: .aspack

anti-analysis/packer/kkrunchy/packed-with-kkrunchy.yml

@@ -8,11 +8,11 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
-      - f9ac6b16273556b3a57bf2c6d7e7db97
     references:
       - http://www.farbrausch.de/~fg/kkrunchy/
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
+      - f9ac6b16273556b3a57bf2c6d7e7db97
   features:
     - or:
       - section: kkrunchy

anti-analysis/packer/nspack/packed-with-nspack.yml

@@ -8,10 +8,10 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
-      - 02179f3ba93663074740b5c0d283bae2
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
+      - 02179f3ba93663074740b5c0d283bae2
   features:
     - or:
       - section: .nsp0

anti-analysis/packer/pebundle/packed-with-pebundle.yml

@@ -8,10 +8,10 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
-      - db9fe790b4e18abf55df31aa0b81e558
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
+      - db9fe790b4e18abf55df31aa0b81e558
   features:
     - or:
       - section: pebundle

anti-analysis/packer/pelocknt/packed-with-pelocknt.yml

@@ -8,10 +8,10 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
-      - f0a6a1bd6d760497623611e8297a81df
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
+      - f0a6a1bd6d760497623611e8297a81df
   features:
     - or:
       - section: PELOCKnt

anti-analysis/packer/peshield/packed-with-peshield.yml

@@ -8,10 +8,10 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
-      - a3c0a2425ea84103adde03a92176424c
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
+      - a3c0a2425ea84103adde03a92176424c
   features:
     - or:
       - section: PESHiELD

anti-analysis/packer/petite/packed-with-petite.yml

@@ -8,10 +8,10 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
-      - 2a7429d60040465f9bd27bbae2beef88
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
+      - 2a7429d60040465f9bd27bbae2beef88
   features:
     - or:
       - section: .petite

anti-analysis/packer/rlpack/packed-with-rlpack.yml

@@ -8,10 +8,10 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
-      - 068a76d4823419b376d418cf03215d5c
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
+      - 068a76d4823419b376d418cf03215d5c
   features:
     - or:
       - section: .RLPack

anti-analysis/packer/upack/packed-with-upack.yml

@@ -8,10 +8,10 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
-      - 9d98f8519d9fee8219caca5b31eef0bd
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
+      - 9d98f8519d9fee8219caca5b31eef0bd
   features:
     - and:
       - section: .Upack

anti-analysis/packer/y0da/packed-with-y0da-crypter.yml

@@ -8,10 +8,10 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
-      - 0cd2b334aede270b14868db28211cde3
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
+      - 0cd2b334aede270b14868db28211cde3
   features:
     - or:
       - section: .y0da

c2/file-transfer/download-and-write-a-file.yml

@@ -2,6 +2,7 @@ rule:
   meta:
     name: download and write a file
     namespace: c2/file-transfer
+    maec/malware-category: downloader
     author: [email protected]
     scope: function
     att&ck:
@@ -10,7 +11,6 @@ rule:
       - Command and Control::C2 Communication::Server to Client File Transfer [B0030.003]
     examples:
       - 5D7C34B6854D48D3DA4F96B71550A221:0x401346
-    maec/malware-category: downloader
   features:
     - and:
       - match: receive data

c2/file-transfer/write-and-execute-a-file.yml

@@ -2,6 +2,7 @@ rule:
   meta:
     name: write and execute a file
     namespace: c2/file-transfer
+    maec/malware-category: launcher
     author: [email protected]
     scope: function
     mbc:
@@ -9,7 +10,6 @@ rule:
     examples:
       - 9324D1A8AE37A36AE560C37448C9705A:0x403A40
       - Practical Malware Analysis Lab 01-04.exe_:0x4011FC
-    maec/malware-category: launcher
   features:
     - and:
       - match: write file

collection/network/capture-public-ip.yml

@@ -14,14 +14,14 @@ rule:
       - api: InternetOpenUrl
       - api: InternetReadFile
       - or:
-          - string: /bot\.whatismyipaddress.com/
-          - string: /ipinfo.io\/ip/
-          - string: /checkip\.dyndns\.org/
-          - string: /ifconfig\.me/
-          - string: /ipecho\.net\/plain/
-          - string: /api\.ipify\.org/
-          - string: /checkip\.amazonaws\.com/
-          - string: /icanhazip\.com/
-          - string: /wtfismyip\.com/text/
-          - string: /api\.myip\.com/
-          - string: /ip\-api\.com\/line/
+        - string: /bot\.whatismyipaddress.com/
+        - string: /ipinfo.io\/ip/
+        - string: /checkip\.dyndns\.org/
+        - string: /ifconfig\.me/
+        - string: /ipecho\.net\/plain/
+        - string: /api\.ipify\.org/
+        - string: /checkip\.amazonaws\.com/
+        - string: /icanhazip\.com/
+        - string: /wtfismyip\.com/text/
+        - string: /api\.myip\.com/
+        - string: /ip\-api\.com\/line/

collection/network/get-domain-trust-relationships.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: get domain trust relationships 
+    name: get domain trust relationships
     namespace: collection/network
     author: johnk3r
     scope: function

collection/screenshot/capture-screenshot.yml

@@ -2,7 +2,7 @@ rule:
   meta:
     name: capture screenshot
     namespace: collection/screenshot
-    author: 
+    author:
       - [email protected]
       - "@_re_fox"
       - [email protected]

communication/http/client/create-http-request.yml

@@ -5,7 +5,7 @@ rule:
     author: [email protected]
     scope: function
     mbc:
-      - Communication::HTTP Communication::Create Request [C0002.012] 
+      - Communication::HTTP Communication::Create Request [C0002.012]
     examples:
       - 6f99a2c8944cb02ff28c6f9ced59b161:0x40E2F0
   features:

compiler/perl2exe/compiled-with-perl2exe.yml

@@ -10,7 +10,7 @@ rule:
     - and:
       - api: LoadLibrary
       - api: FreeLibrary
-      - string: /^p2x[a-z0-9]{1,10}\.dll/i 
+      - string: /^p2x[a-z0-9]{1,10}\.dll/i
       - basic block:
         - and:
           - api: GetProcAddress

compiler/py2exe/compiled-with-py2exe.yml

@@ -9,4 +9,4 @@ rule:
   features:
     - and:
       - string: PY2EXE_VERBOSE
-      - api: getenv 
+      - api: getenv

data-manipulation/compression/decompress-data-using-quicklz.yml

@@ -1,56 +1,56 @@
 rule:
-    meta:
-      name: decompress data using QuickLZ
-      namespace: data-manipulation/compression
-      author: [email protected]
-      description: detects the inner decompression loop from QuickLZ
-      scope: function
-      mbc:
-        - Data::Decompress Data::QuickLZ [C0025.001]
-      examples:
-        - 64d9f7d96b99467f36e22fada623c3bb:0x10001510
-        - 234c8034e88b2d097d2da51a85253825:0x100015B0
-        - f54a09e966bb929e68f5c01fa3087a3a:0x10001590
-        - d115f4b2ec8579be33fe883219c00ae2:0x1800015E0
-        - 831083e1614090dbb5815dba36faa2f3:0x1800016E0
-        - 7e0b974f004e4e0523fe4d9b9d89e5ad:0x1800016B0
-        - 6a352c3e55e8ae5ed39dc1be7fb964b1:0x10010DE0
-      references:
-        - http://www.quicklz.com/
-    features:
-      - or:
+  meta:
+    name: decompress data using QuickLZ
+    namespace: data-manipulation/compression
+    author: [email protected]
+    description: detects the inner decompression loop from QuickLZ
+    scope: function
+    mbc:
+      - Data::Decompress Data::QuickLZ [C0025.001]
+    references:
+      - http://www.quicklz.com/
+    examples:
+      - 64d9f7d96b99467f36e22fada623c3bb:0x10001510
+      - 234c8034e88b2d097d2da51a85253825:0x100015B0
+      - f54a09e966bb929e68f5c01fa3087a3a:0x10001590
+      - d115f4b2ec8579be33fe883219c00ae2:0x1800015E0
+      - 831083e1614090dbb5815dba36faa2f3:0x1800016E0
+      - 7e0b974f004e4e0523fe4d9b9d89e5ad:0x1800016B0
+      - 6a352c3e55e8ae5ed39dc1be7fb964b1:0x10010DE0
+  features:
+    - or:
+      - basic block:
+        - and:
+          - description: Mode 1 decompression
+          - mnemonic: xor
+          - mnemonic: shr
+          - mnemonic: and
+          - number: 0xC
+          - number: 0xFFF
+          - or:
+            - offset: 0x4000
+            - offset: 0x8000
+      - basic block:
+        - and:
+          - description: Mode 2 decompression
+          - mnemonic: shr
+          - mnemonic: and
+          - mnemonic: mov
+          - number: 0x5
+          - number: 0x1
+          - number: 0x7FF
+      - and:
+        - description: Mode 3 decompression
         - basic block:
           - and:
-            - description: Mode 1 decompression
-            - mnemonic: xor
-            - mnemonic: shr
-            - mnemonic: and
-            - number: 0xC
-            - number: 0xFFF
-            - or:
-              - offset: 0x4000
-              - offset: 0x8000
-        - basic block:
-          - and:
-            - description: Mode 2 decompression
             - mnemonic: shr
             - mnemonic: and
             - mnemonic: mov
-            - number: 0x5
-            - number: 0x1
-            - number: 0x7FF
-        - and:
-          - description: Mode 3 decompression
-          - basic block:
-            - and:
-              - mnemonic: shr
-              - mnemonic: and
-              - mnemonic: mov
-              - number: 0x2
-              - number: 0x3
-              - number: 0x3FFF
-          - basic block:
-            - and:
-              - mnemonic: shr
-              - mnemonic: and
-              - number: 0x3FF
+            - number: 0x2
+            - number: 0x3
+            - number: 0x3FFF
+        - basic block:
+          - and:
+            - mnemonic: shr
+            - mnemonic: and
+            - number: 0x3FF

data-manipulation/compression/decompress-data-via-iencodingfilterfactory.yml

@@ -5,7 +5,7 @@ rule:
     author: [email protected]
     scope: function
     mbc:
-        - Data::Decompress Data::IEncodingFilterFactory [C0025.002]
+      - Data::Decompress Data::IEncodingFilterFactory [C0025.002]
     references:
       - https://www.virusbulletin.com/virusbulletin/2012/09/urlzone-reloaded-new-evolution/
     examples:
@@ -15,4 +15,4 @@ rule:
       - api: ole32.CoCreateInstance
       - bytes: D0 7C C3 54 44 D9 D0 11 A9 F4 00 60 97 94 23 11 = StdEncodingFilterFac
       - bytes: 00 DE BD 70 8E C1 D0 11 A9 CE 00 60 97 94 23 11 = IEncodingFilterFactory
-      - count(offset(0x10 = IEncodingFilterFactory.GetDefaultFilter and <filter>.DoDecode)): 2 or more   
+      - count(offset(0x10 = IEncodingFilterFactory.GetDefaultFilter and <filter>.DoDecode)): 2 or more

data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml

@@ -9,7 +9,7 @@ rule:
     mbc:
       - Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]
       - Cryptography::Encrypt Data::Blowfish [C0027.002]
-    examples: 
+    examples:
       - 0761142efbda6c4b1e801223de723578:0x653E19E5
   features:
     - or:

data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml

@@ -25,4 +25,4 @@ rule:
         - or:
           - api: CryptAcquireContext
           - api: CryptEncrypt
-          - api: CryptDecrypt 
+          - api: CryptDecrypt

data-manipulation/encryption/des/encrypt-data-using-des.yml

@@ -34,5 +34,5 @@ rule:
         - number: 0x8
         - number: 0x3f
         - characteristic: nzxor
-        - count(mnemonic(shr)): 8 or more 
+        - count(mnemonic(shr)): 8 or more
         - mnemonic: ror

data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml

@@ -10,11 +10,11 @@ rule:
     mbc:
       - Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]
       - Cryptography::Encrypt Data::HC-128 [C0027.006]
-    examples:
-      - e69a8eb94f65480980deaf1ff5a431a6:0x405D0D
     references:
       - https://download.bitdefender.com/resources/files/News/CaseStudies/study/318/Bitdefender-TRR-Whitepaper-Maze-creat4351-en-EN-GenericUse.pdf
       - https://github.com/rost1993/hc128/blob/master/hc128.c
+    examples:
+      - e69a8eb94f65480980deaf1ff5a431a6:0x405D0D
   features:
     - and:
       - and:

data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml

@@ -12,6 +12,5 @@ rule:
     examples:
       - 94d3c854aadbcfde46b2f82801015c31:0x429C0730
   features:
-    - and: 
-      - bytes: a3 d7 09 83 f8 48 f6 f4 b3 21 15 78 99 b1 af f9 e7 2d 4d 8a ce 4c ca 2e 52 95 d9 1e 4e 38 44 28 0a df 02 a0 17 f1 60 68 12 b7 7a c3 e9 fa 3d 53 96 84 6b ba f2 63 9a 19 7c ae e5 f5 f7 16 6a a2 39 b6 7b 0f c1 93 81 1b ee b4 1a ea d0 91 2f b8 55 b9 da 85 3f 41 bf e0 5a 58 80 5f 66 0b d8 90 35 d5 c0 a7 33 06 65 69 45 00 94 56 6d 98 9b 76 97 fc b2 c2 b0 fe db 20 e1 eb d6 e4 dd 47 4a 1d 42 ed 9e 6e 49 3c cd 43 27 d2 07 d4 de c7 67 18 89 cb 30 1f 8d c6 8f aa c8 74 dc c9 5d 5c 31 a4 70 88 61 2c 9f 0d 2b 87 50 82 54 64 26 7d 03 40 34 4b 1c 73 d1 c4 fd 3b cc fb 7f ab e6 3e 5b a5 ad 04 23 9c 14 51 22 f0 29 79 71 7e ff 8c 0e e2 0c ef bc 72 75 6f 37 a1 ec d3 8e 62 8b 86 10 e8 08 77 11 be 92 4f 24 c5 32 36 9d cf f3 a6 bb ac 5e 6c a9 13 57 25 b5 e3 bd a8 3a 01 05 59 2a 46 = FTable 
-      
+    - and:
+      - bytes: a3 d7 09 83 f8 48 f6 f4 b3 21 15 78 99 b1 af f9 e7 2d 4d 8a ce 4c ca 2e 52 95 d9 1e 4e 38 44 28 0a df 02 a0 17 f1 60 68 12 b7 7a c3 e9 fa 3d 53 96 84 6b ba f2 63 9a 19 7c ae e5 f5 f7 16 6a a2 39 b6 7b 0f c1 93 81 1b ee b4 1a ea d0 91 2f b8 55 b9 da 85 3f 41 bf e0 5a 58 80 5f 66 0b d8 90 35 d5 c0 a7 33 06 65 69 45 00 94 56 6d 98 9b 76 97 fc b2 c2 b0 fe db 20 e1 eb d6 e4 dd 47 4a 1d 42 ed 9e 6e 49 3c cd 43 27 d2 07 d4 de c7 67 18 89 cb 30 1f 8d c6 8f aa c8 74 dc c9 5d 5c 31 a4 70 88 61 2c 9f 0d 2b 87 50 82 54 64 26 7d 03 40 34 4b 1c 73 d1 c4 fd 3b cc fb 7f ab e6 3e 5b a5 ad 04 23 9c 14 51 22 f0 29 79 71 7e ff 8c 0e e2 0c ef bc 72 75 6f 37 a1 ec d3 8e 62 8b 86 10 e8 08 77 11 be 92 4f 24 c5 32 36 9d cf f3 a6 bb ac 5e 6c a9 13 57 25 b5 e3 bd a8 3a 01 05 59 2a 46 = FTable

data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml

@@ -10,10 +10,10 @@ rule:
     mbc:
       - Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]
       - Cryptography::Encrypt Data::Sosemanuk [C0027.008]
-    examples:
-      - ea7bb99e03606702c1cbe543bb32b27e:0x10003350
     references:
       - https://labs.sentinelone.com/enter-the-maze-demystifying-an-affiliate-involved-in-maze-snow/
+    examples:
+      - ea7bb99e03606702c1cbe543bb32b27e:0x10003350
   features:
     - or:
       - bytes: 00 00 00 00 E1 9F CF 13 6B 97 37 26 8A 08 F8 35 D6 87 6E 4C 37 18 A1 5F BD 10 59 6A 5C 8F 96 79 05 A7 DC 98 E4 38 13 8B 6E 30 EB BE 8F AF 24 AD D3 20 B2 D4 32 BF 7D C7 B8 B7 85 F2 59 28 4A E1 0A E7 11 99 EB 78 DE 8A 61 70 26 BF 80 EF E9 AC DC 60 7F D5 3D FF B0 C6 B7 F7 48 F3 56 68 87 E0 0F 40 CD 01 EE DF 02 12 64 D7 FA 27 85 48 35 34 D9 C7 A3 4D 38 58 6C 5E B2 50 94 6B 53 CF 5B 78 = mul_a

data-manipulation/hashing/fnv/hash-data-using-fnv.yml

@@ -2,7 +2,7 @@ rule:
   meta:
     name: hash data using fnv
     namespace: data-manipulation/hashing/fnv
-    author: 
+    author:
       - [email protected]
       - "@_re_fox"
     description: can be any Fowler-Noll-Vo (FNV) hash variant, including FNV-1, FNV-1a, FNV-0

data-manipulation/hashing/murmur/hash-data-using-murmur3.yml

@@ -1,52 +1,52 @@
-rule:
-  meta:
-    name: hash data using murmur3
-    namespace: data-manipulation/hashing/murmur
-    author: [email protected]
-    scope: function
-    mbc:
-      - Data::Non-Cryptographic Hash::MurmurHash [C0030.001]
-    references:
-      - https://github.com/aappleby/smhasher/blob/master/src/MurmurHash3.cpp
-    examples:
-      - c66172b12971a329f8d5ff01665f204b:0x404A18
-  features:
-    - or:
-      - and:
-        - number: 0x85ebca6b = 32-bit finalization mix constant 1
-        - number: 0xc2b2ae35 = 32-bit finalization mix constant 2
-      - and:
-        - number: 0xff51afd7ed558ccd = 64-bit finalization mix constant 1
-        - number: 0xc4ceb9fe1a85ec53 = 64-bit finalization mix constant 2
-      - and:
-        - number: 0xcc9e2d51 = c1 32-bit hash
-        - number: 0x1b873593 = c2 32-bit hash
-      - and:
-        - number: 0x239b961b = 32-bit c1 for 128-bit hash
-        - number: 0xab0e9789 = 32-bit c2 for 128-bit hash
-        - number: 0x38b34ae5 = 32-bit c3 for 128-bit hash
-        - number: 0xa1e38b93 = 32-bit c4 for 128-bit hash
-      - and:
-        - number: 0x87c37b91114253d5 = 64-bit c1 for 128-bit hash
-        - number: 0x4cf5ad432745937f = 64-bit c2 for 128-bit hash
-      - basic block:
-        - and:
-          - description: 'hash >> 16; hash >> 13; hash >> 16'
-          - count(mnemonic(shr)): 3
-          - number: 16
-          - number: 13
-          - optional:
-            - count(characteristic(nzxor)): 3 or more
-      - and:
+rule:
+  meta:
+    name: hash data using murmur3
+    namespace: data-manipulation/hashing/murmur
+    author: [email protected]
+    scope: function
+    mbc:
+      - Data::Non-Cryptographic Hash::MurmurHash [C0030.001]
+    references:
+      - https://github.com/aappleby/smhasher/blob/master/src/MurmurHash3.cpp
+    examples:
+      - c66172b12971a329f8d5ff01665f204b:0x404A18
+  features:
+    - or:
+      - and:
+        - number: 0x85ebca6b = 32-bit finalization mix constant 1
+        - number: 0xc2b2ae35 = 32-bit finalization mix constant 2
+      - and:
+        - number: 0xff51afd7ed558ccd = 64-bit finalization mix constant 1
+        - number: 0xc4ceb9fe1a85ec53 = 64-bit finalization mix constant 2
+      - and:
+        - number: 0xcc9e2d51 = c1 32-bit hash
+        - number: 0x1b873593 = c2 32-bit hash
+      - and:
+        - number: 0x239b961b = 32-bit c1 for 128-bit hash
+        - number: 0xab0e9789 = 32-bit c2 for 128-bit hash
+        - number: 0x38b34ae5 = 32-bit c3 for 128-bit hash
+        - number: 0xa1e38b93 = 32-bit c4 for 128-bit hash
+      - and:
+        - number: 0x87c37b91114253d5 = 64-bit c1 for 128-bit hash
+        - number: 0x4cf5ad432745937f = 64-bit c2 for 128-bit hash
+      - basic block:
+        - and:
+          - description: 'hash >> 16; hash >> 13; hash >> 16'
+          - count(mnemonic(shr)): 3
+          - number: 16
+          - number: 13
+          - optional:
+            - count(characteristic(nzxor)): 3 or more
+      - and:
         # Group this two blocks under an `and` as on their own they are not
         # unique enough and would cause false positives
-        - basic block:
-          - and:
-            - description: k ROL r1
-            - mnemonic: rol
-            - number: 15 = r1
-        - basic block:
-          - and:
-            - description: hash ROL r2
-            - mnemonic: rol
-            - number: 13 = r2
+        - basic block:
+          - and:
+            - description: k ROL r1
+            - mnemonic: rol
+            - number: 15 = r1
+        - basic block:
+          - and:
+            - description: hash ROL r2
+            - mnemonic: rol
+            - number: 13 = r2

data-manipulation/hashing/tiger/hash-data-using-tiger.yml

@@ -6,7 +6,7 @@ rule:
     scope: basic block
     mbc:
       - Cryptography::Cryptographic Hash::Tiger [C0029.005]
-    examples: 
+    examples:
       - 0761142efbda6c4b1e801223de723578:0x65471B97
   features:
     - or:
@@ -21,6 +21,6 @@ rule:
           - number: 0x0123456789abcdef
           - number: 0x13
           - number: 0x17
-          - count(mnemonic(shr)) : 2 or more
-          - count(mnemonic(shl)) : 2 or more
+          - count(mnemonic(shr)): 2 or more
+          - count(mnemonic(shl)): 2 or more
           - characteristic: nzxor

data-manipulation/prng/generate-random-numbers-via-winapi.yml

@@ -6,13 +6,13 @@ rule:
       - [email protected]
       - johnk3r
     scope: function
+    mbc:
+      - Cryptography::Generate Pseudo-random Sequence::Use API [C0021.003]
     examples:
       - ba947eb07d8c823949316a97364d060f:0x1400031E0
       - 3ca359f5085bb96a7950d4735b089ffe:0x403A80
       - e59ffeaf7acb0c326e452fa30bb71a36:0x40403E
       - 1195d0d18be9362fb8dd9e1738404c9d:0x404E90
-    mbc:
-      - Cryptography::Generate Pseudo-random Sequence::Use API [C0021.003]
   features:
     - and:
       - or:

host-interaction/cli/resolve-path-using-msvcrt.yml

@@ -16,4 +16,3 @@ rule:
       - api: msvcrt._get_wpgmptr
       - api: msvcrt._pgmptr
       - api: msvcrt._wpgmptr
-     

host-interaction/environment-variable/query-environment-variable.yml

@@ -2,7 +2,7 @@ rule:
   meta:
     name: query environment variable
     namespace: host-interaction/environment-variable
-    author: 
+    author:
       - [email protected]
       - "@_re_fox"
     scope: function

host-interaction/hardware/storage/get-disk-size.yml

@@ -24,4 +24,3 @@ rule:
           - string: /SELECT\s+\*\s+FROM\s+Win32_LogicalDisk/i
           - string: /SELECT\s+\*\s+FROM\s+Win32_DiskDrive\s+WHERE\s+\(SerialNumber\s+IS\s+NOT\s+NULL\)\s+AND\s+\(MediaType\s+LIKE\s+\'Fixed\s+hard\s+disk\%\'\)/i
         - string: Size
-

host-interaction/registry/query-or-enumerate-registry-key.yml

@@ -14,7 +14,7 @@ rule:
   features:
     - and:
       - optional:
-          - match: create or open registry key
+        - match: create or open registry key
       - or:
         - api: advapi32.RegEnumKey
         - api: advapi32.RegEnumKeyEx

host-interaction/registry/query-or-enumerate-registry-value.yml

@@ -16,7 +16,7 @@ rule:
   features:
     - and:
       - optional:
-          - match: create or open registry key
+        - match: create or open registry key
       - or:
         - api: advapi32.RegGetValue
         - api: advapi32.RegEnumValue

host-interaction/thread/create/create-thread.yml

@@ -12,13 +12,13 @@ rule:
       - 946A99F36A46D335DEC080D9A4371940:0x10001DA0
       - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x408020
   features:
-      - or:
-        - api: kernel32.CreateThread
-        - api: _beginthread
-        - api: _beginthreadex
-        - api: PsCreateSystemThread
-        - api: SHCreateThread
-        - api: SHCreateThreadWithHandle
-        - and:
-          - api: kernel32.GetCurrentProcess
-          - api: kernel32.CreateRemoteThread
+    - or:
+      - api: kernel32.CreateThread
+      - api: _beginthread
+      - api: _beginthreadex
+      - api: PsCreateSystemThread
+      - api: SHCreateThread
+      - api: SHCreateThreadWithHandle
+      - and:
+        - api: kernel32.GetCurrentProcess
+        - api: kernel32.CreateRemoteThread

host-interaction/uac/bypass/bypass-uac-via-appinfo-alpc.yml

@@ -5,16 +5,16 @@ rule:
     author: [email protected]
     scope: function
     att&ck:
-        - Defense Evasion::Abuse Elevation Control Mechanism::Bypass User Access Control [T1548.002]
+      - Defense Evasion::Abuse Elevation Control Mechanism::Bypass User Access Control [T1548.002]
     references:
-        - https://github.com/hfiref0x/UACME/blob/0a4d2bd67f4872c595f0217ef6ebdcf135186945/Source/Akagi/methods/tyranid.c#L597
+      - https://github.com/hfiref0x/UACME/blob/0a4d2bd67f4872c595f0217ef6ebdcf135186945/Source/Akagi/methods/tyranid.c#L597
     examples:
       - 2f43138aa75fb12ac482b486cbc98569:0x180002304
   features:
     - and:
-        - string: winver.exe
-        - string: WinSta0\Default
-        - string: taskmgr.exe
-        - api: WaitForDebugEvent
-        - api: ContinueDebugEvent
-        - api: TerminateProcess
+      - string: winver.exe
+      - string: WinSta0\Default
+      - string: taskmgr.exe
+      - api: WaitForDebugEvent
+      - api: ContinueDebugEvent
+      - api: TerminateProcess

host-interaction/uac/bypass/bypass-uac-via-token-manipulation.yml

@@ -5,15 +5,15 @@ rule:
     author: [email protected]
     scope: function
     att&ck:
-        - Defense Evasion::Abuse Elevation Control Mechanism::Bypass User Access Control [T1548.002]
+      - Defense Evasion::Abuse Elevation Control Mechanism::Bypass User Access Control [T1548.002]
     references:
-        - https://github.com/hfiref0x/UACME/blob/0a4d2bd67f4872c595f0217ef6ebdcf135186945/Source/Akagi/methods/tyranid.c#L83
+      - https://github.com/hfiref0x/UACME/blob/0a4d2bd67f4872c595f0217ef6ebdcf135186945/Source/Akagi/methods/tyranid.c#L83
     examples:
       - 2f43138aa75fb12ac482b486cbc98569:0x180001B48
   features:
     - and:
-        - string: wusa.exe
-        - api: ShellExecuteExW
-        - api: ImpersonateLoggedOnUser
-        - api: GetStartupInfoW
-        - api: CreateProcessWithLogonW
+      - string: wusa.exe
+      - api: ShellExecuteExW
+      - api: ImpersonateLoggedOnUser
+      - api: GetStartupInfoW
+      - api: CreateProcessWithLogonW

lib/validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml

@@ -1,8 +1,8 @@
 rule:
   meta:
     name: validate payment card number using luhn algorithm with lookup table
-    lib: true
     author: "@_re_fox"
+    lib: true
     scope: function
     mbc:
       - Data::Checksum::Luhn [C0032.002]
@@ -11,7 +11,7 @@ rule:
       - 60abaef3fda131ffa20df480cb3f8029:0x4048e0
   features:
     - and:
-      - not: 
+      - not:
         - characteristic: nzxor
       - characteristic: loop
         description: Iterate over CC digits
@@ -57,7 +57,7 @@ rule:
             - mnemonic: idiv
             - mnemonic: cdq
             - number: 0xa
-            - optional : 
+            - optional:
               - mnemonic: neg
           - and:
             - description: Compiler optimized returning checkum % 10
@@ -66,5 +66,5 @@ rule:
             - number: 0x66666667
             - number: 0x1f
             - number: 0x2
-            - optional : 
+            - optional:
               - mnemonic: neg

lib/validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml

@@ -1,8 +1,8 @@
 rule:
   meta:
     name: validate payment card number using luhn algorithm with no lookup table
-    lib: true
     author: "@_re_fox"
+    lib: true
     scope: function
     mbc:
       - Data::Checksum::Luhn [C0032.002]
@@ -10,7 +10,7 @@ rule:
       - 6fcc13563aad936c7d0f3165351cb453:0x4026C0
   features:
     - and:
-      - not: 
+      - not:
         - characteristic: nzxor
       - characteristic: loop
         description: Iterate over CC digits
@@ -22,7 +22,7 @@ rule:
                 - mnemonic: add
               - and:
                 - mnemonic: shl
-                - number: 0x1 
+                - number: 0x1
             - mnemonic: cmp
             - number: 0x9
             - description: Digital Root check number*2 < 0x9
@@ -55,7 +55,7 @@ rule:
             - mnemonic: idiv
             - mnemonic: cdq
             - number: 0xa
-            - optional : 
+            - optional:
               - mnemonic: neg
             - description: Final section returning checkum % 10
           - and:
@@ -64,6 +64,6 @@ rule:
             - number: 0x66666667
             - number: 0x1f
             - number: 0x2
-            - optional : 
+            - optional:
               - mnemonic: neg
             - description: Compiler optimized returning checkum % 10

linking/runtime-linking/access-peb-ldr_data.yml

@@ -22,7 +22,7 @@ rule:
         # LDR_DATA* Ldr;
         # good PEB layout reference here:
         # https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm
-        - offset/x32: 0x0C = PEB.LDR_DATA 
+        - offset/x32: 0x0C = PEB.LDR_DATA
 
         # resolve a module list
         - or:
@@ -38,7 +38,7 @@ rule:
           # in the case of CallObfuscator, gs:[rax]
           # ref: https://github.com/d35ha/CallObfuscator/blob/5834aff9ff4511f1408ae4ce80b79737af4ae77b/ShellCode/shell_x64.asm#L8
           - and:
-            - number/x64: 0x60 
+            - number/x64: 0x60
             - characteristic: gs access
           # in 0f5d5d07c6533bc6d991836ce79daaa1
           # then we have:
@@ -46,15 +46,15 @@ rule:
           #     xor edx, edx
           #     mov edx, fs:[edx+30h]
           - and:
-            - offset/x64: 0x60 = PEB 
+            - offset/x64: 0x60 = PEB
             - characteristic: gs access
 
         # good PEB layout reference here:
         # https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm
-        - offset/x64: 0x18 = PEB.LDR_DATA  
+        - offset/x64: 0x18 = PEB.LDR_DATA
 
         # resolve a module list
         - or:
-          - offset/x64: 0x10 = PEB.LDR_DATA.InLoadOrderModuleList  
+          - offset/x64: 0x10 = PEB.LDR_DATA.InLoadOrderModuleList
           - offset/x64: 0x20 = PEB.LDR_DATA.InMemoryOrderModuleList
           - offset/x64: 0x30 = PEB.LDR_DATA.InInitializationOrderModuleList

linking/runtime-linking/get-kernel32-base-address.yml

@@ -6,11 +6,11 @@ rule:
     scope: basic block
     att&ck:
       - Execution::Shared Modules [T1129]
-    examples:
-      - 67f8302a2fd28d15f62d6d20d748bfe350334e5353cbdef112bd1f8231b5599d:0x406936
     references:
       - https://idafchev.github.io/exploit/2017/09/26/writing_windows_shellcode.html
       - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/ldr_data_table_entry.htm
+    examples:
+      - 67f8302a2fd28d15f62d6d20d748bfe350334e5353cbdef112bd1f8231b5599d:0x406936
   features:
     - and:
       # PEB -> PEB.Ldr -> PEB_LDR_DATA.InLoadOrderModuleList.Flink

linking/runtime-linking/get-ntdll-base-address.yml

@@ -6,11 +6,11 @@ rule:
     scope: basic block
     att&ck:
       - Execution::Shared Modules [T1129]
-    examples:
-      - 67f8302a2fd28d15f62d6d20d748bfe350334e5353cbdef112bd1f8231b5599d:0x40694A
     references:
       - https://idafchev.github.io/exploit/2017/09/26/writing_windows_shellcode.html
       - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/ldr_data_table_entry.htm
+    examples:
+      - 67f8302a2fd28d15f62d6d20d748bfe350334e5353cbdef112bd1f8231b5599d:0x40694A
   features:
     - and:
       # PEB -> PEB.Ldr -> PEB_LDR_DATA.InLoadOrderModuleList.Flink

nursery/acquire-debug-privileges.yml

@@ -1,15 +1,15 @@
-rule:
-  meta:
-    name: acquire debug privileges
-    namespace: host-interaction/process/modify
-    author: [email protected]
-    scope: basic block
-    att&ck:
-      - Privilege Escalation::Access Token Manipulation [T1134]
-    examples:
+rule:
+  meta:
+    name: acquire debug privileges
+    namespace: host-interaction/process/modify
+    author: [email protected]
+    scope: basic block
+    att&ck:
+      - Privilege Escalation::Access Token Manipulation [T1134]
+    examples:
       # - unpacked Cl0p ransomware
-  features:
-    - and:
-      - string: "SeDebugPrivilege"
-      - optional:
-        - match: modify access privileges
+  features:
+    - and:
+      - string: "SeDebugPrivilege"
+      - optional:
+        - match: modify access privileges

nursery/compiled-from-epl.yml

@@ -18,4 +18,4 @@ rule:
       - import: krnln.fne
       - import: krnln.fnr
       - import: eAPI.fne
-      - import: RegEx.fnr
+      - import: RegEx.fnr

nursery/create-restart-manager-session.yml

@@ -3,8 +3,8 @@ rule:
     name: create Restart Manager session
     namespace: host-interaction/process
     author: [email protected]
-    scope: function
     description: Windows Restart Manager can be used to close/unlock specific files, often abused by Ransomware
+    scope: function
     references: https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/
   features:
     - or:

nursery/hash-data-using-murmur2.yml

@@ -1,15 +1,15 @@
-rule:
-  meta:
-    name: hash data using murmur2
-    namespace: data-manipulation/hashing/murmur
-    author: [email protected]
-    scope: function
-    references:
-      - https://github.com/abrandoned/murmur2/blob/master/MurmurHash2.c
-    examples:
-  features:
-    - and:
-      - or:
-        - number: 0xc6a4a7935bd1e995 = 64-bit mixing constant m
-        - number: 0x5bd1e995 = 32-bit mixing constant m
-      - mnemonic: imul
+rule:
+  meta:
+    name: hash data using murmur2
+    namespace: data-manipulation/hashing/murmur
+    author: [email protected]
+    scope: function
+    references:
+      - https://github.com/abrandoned/murmur2/blob/master/MurmurHash2.c
+    examples:
+  features:
+    - and:
+      - or:
+        - number: 0xc6a4a7935bd1e995 = 64-bit mixing constant m
+        - number: 0x5bd1e995 = 32-bit mixing constant m
+      - mnemonic: imul

nursery/hooked-by-api-override.yml

@@ -9,4 +9,4 @@ rule:
       - http://jacquelin.potier.free.fr/winapioverride32/
   features:
     - or:
-      - section: .winapi
+      - section: .winapi

nursery/impersonate-user.yml

@@ -3,9 +3,9 @@ rule:
     name: impersonate user
     namespace: host-interaction/user
     author: [email protected]
+    scope: function
     att&ck:
       - Privilege Escalation::Access Token Manipulation::Token Impersonation/Theft [T1134.001]
-    scope: function
   features:
     - or:
       - api: advapi32.LogonUser

nursery/packaged-as-a-createinstall-installer.yml

@@ -9,4 +9,4 @@ rule:
       - https://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
   features:
     - or:
-      - section: .gentee
+      - section: .gentee

nursery/packaged-as-a-nsis-installer.yml

@@ -8,4 +8,4 @@ rule:
       - https://nsis.sourceforge.io/Main_Page
   features:
     - or:
-      - string: /http://nsis\.sf\.net/
+      - string: /http://nsis\.sf\.net/

nursery/packaged-as-a-pintool.yml

@@ -11,4 +11,4 @@ rule:
   features:
     - or:
       - section: .charmve
-      - section: .pinclie
+      - section: .pinclie

nursery/packed-with-ccg.yml

@@ -8,9 +8,9 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
-      - section: .ccg
+      - section: .ccg

nursery/packed-with-crunch.yml

@@ -8,9 +8,9 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
-      - section: BitArts
+      - section: BitArts

nursery/packed-with-dragon-armor.yml

@@ -8,9 +8,9 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
-      - section: DAStub
+      - section: DAStub

nursery/packed-with-enigma.yml

@@ -8,9 +8,9 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
       - section: .enigma1

nursery/packed-with-epack.yml

@@ -8,9 +8,9 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
-      - section: "!Epack"
+      - section: "!Epack"

nursery/packed-with-maskpe.yml

@@ -8,9 +8,9 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
-      - section: .MaskPE
+      - section: .MaskPE

nursery/packed-with-mew.yml

@@ -8,9 +8,9 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
-      - section: MEW
+      - section: MEW

nursery/packed-with-mpress.yml

@@ -8,10 +8,10 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
       - section: .MPRESS1
-      - section: .MPRESS2
+      - section: .MPRESS2

nursery/packed-with-neolite.yml

@@ -8,10 +8,10 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
       - section: .neolite
-      - section: .neolit
+      - section: .neolit

nursery/packed-with-pecompact.yml

@@ -8,9 +8,9 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
       - section: PEC2TO

nursery/packed-with-pepack.yml

@@ -8,9 +8,9 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
       - section: PEPACK!!

nursery/packed-with-perplex.yml

@@ -8,9 +8,9 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
-      - section: .perplex
+      - section: .perplex

nursery/packed-with-procrypt.yml

@@ -8,9 +8,9 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
-      - section: ProCrypt
+      - section: ProCrypt

nursery/packed-with-rpcrypt.yml

@@ -8,10 +8,10 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
       - section: RCryptor
-      - section: .RCrypt
+      - section: .RCrypt

nursery/packed-with-seausfx.yml

@@ -8,9 +8,9 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
-      - section: .seau
+      - section: .seau

nursery/packed-with-shrinker.yml

@@ -8,11 +8,11 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
       - section: .shrink1
       - section: .shrink2
-      - section: .shrink3
+      - section: .shrink3

nursery/packed-with-simple-pack.yml

@@ -8,9 +8,9 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
-      - section: .spack
+      - section: .spack

nursery/packed-with-starforce.yml

@@ -8,9 +8,9 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
-      - section: .sforce3
+      - section: .sforce3

nursery/packed-with-svkp.yml

@@ -8,9 +8,9 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
-      - section: .svkp
+      - section: .svkp

nursery/packed-with-themida.yml

@@ -8,11 +8,11 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
       - section: Themida
       - section: .Themida
-      - section: WinLicen
+      - section: WinLicen

nursery/packed-with-tsuloader.yml

@@ -8,9 +8,9 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
       - section: .tsuarch

nursery/packed-with-vprotect.yml

@@ -8,9 +8,9 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
       - section: VProtect

nursery/packed-with-wwpack.yml

@@ -8,9 +8,9 @@ rule:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
       - Anti-Static Analysis::Software Packing [F0001]
-    examples:
     references:
       - https://www.hexacorn.com/blog/2016/12/15/pe-section-names-re-visited/
+    examples:
   features:
     - or:
       - section: .WWPACK

nursery/read-process-memory.yml

@@ -2,7 +2,7 @@ rule:
   meta:
     name: read process memory
     namespace: host-interaction/process
-    author: 
+    author:
       - [email protected]
       - "@_re_fox"
     scope: function

nursery/rebuilt-by-imprec.yml

@@ -8,4 +8,4 @@ rule:
       - https://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
   features:
     - or:
-      - section: .mackt
+      - section: .mackt

nursery/reference-alidns-dns-server.yml

@@ -13,4 +13,4 @@ rule:
       - string: 223.5.5.5
       - string: 223.6.6.6
       - string: 2400:3200::1
-      - string: 2400:3200:baba::1
+      - string: 2400:3200:baba::1

nursery/reference-cloudflare-dns-server.yml

@@ -10,4 +10,4 @@ rule:
   features:
     - or:
       - string: 1.1.1.1
-      - string: 1.0.0.1
+      - string: 1.0.0.1

nursery/reference-comodo-secure-dns-server.yml

@@ -10,4 +10,4 @@ rule:
   features:
     - or:
       - string: 8.26.56.26
-      - string: 8.20.247.20
+      - string: 8.20.247.20

nursery/reference-dns-over-https-endpoints.yml

@@ -7,8 +7,8 @@ rule:
     references:
       - https://github.com/curl/curl/wiki/DNS-over-HTTPS
     examples:
-       - 749e7becf00fccc6dff324a83976dc0d:0x00004589 # https://dns.google.com/resolve?name=
-       - 749e7becf00fccc6dff324a83976dc0d:0x000045d6 # https://cloudflare-dns.com/dns-query?ct=application/dns-json&name= 
+      - 749e7becf00fccc6dff324a83976dc0d:0x00004589  # https://dns.google.com/resolve?name=
+      - 749e7becf00fccc6dff324a83976dc0d:0x000045d6  # https://cloudflare-dns.com/dns-query?ct=application/dns-json&name= 
   features:
     - or:
       - string: /https://doh.seby.io:8443/dns-query.*/i

nursery/reference-google-public-dns-server.yml

@@ -13,4 +13,4 @@ rule:
       - string: 8.8.8.8
       - string: 8.8.4.4
       - string: 2001:4860:4860::8888
-      - string: 2001:4860:4860::8844
+      - string: 2001:4860:4860::8844

nursery/reference-hurricane-electric-dns-server.yml

@@ -19,4 +19,4 @@ rule:
       - string: 216.66.1.2
         description: ns4.he.net
       - string: 216.66.80.18
-        description: ns5.he.net
+        description: ns5.he.net

nursery/reference-kornet-dns-server.yml

@@ -11,4 +11,4 @@ rule:
   features:
     - or:
       - string: 168.126.63.1
-        description: kns.kornet.net
+        description: kns.kornet.net

nursery/reference-opendns-dns-server.yml

@@ -10,4 +10,4 @@ rule:
   features:
     - or:
       - string: 208.67.222.222
-      - string: 208.67.220.220
+      - string: 208.67.220.220

nursery/reference-quad9-dns-server.yml

@@ -10,4 +10,4 @@ rule:
   features:
     - or:
       - string: 9.9.9.9
-      - string: 149.112.112.112
+      - string: 149.112.112.112

nursery/reference-verisign-dns-server.yml

@@ -10,4 +10,4 @@ rule:
   features:
     - or:
       - string: 64.6.64.6
-      - string: 64.6.65.6
+      - string: 64.6.65.6

nursery/resolve-function-by-hash.yml

@@ -1,22 +1,22 @@
-rule:
-  meta:
-    name: resolve function by hash
-    namespace: linking/runtime-linking
-    author: [email protected]
-    scope: function
-    att&ck:
-      - Defense Evasion::Obfuscated Files or Information::Indicator Removal from Tools [T1027.005]
-    examples:
-    references:
-      - https://www.fireeye.com/blog/threat-research/2012/11/precalculated-string-hashes-reverse-engineering-shellcode.html
-      - https://pastebin.com/ci5XYW4P
-  features:
-    - or:
-      - number: 0x6a4abc5b = ROR13(kernel32.dll)
-      - number: 0x3cfa685d = ROR13(ntdll.dll)
-      - number: 0xec0e4e8e = ROR13(LoadLibraryA)
-      - number: 0x7c0dfcaa = ROR13(GetProcAddress)
-      - number: 0x91afca54 = ROR13(VirtualAlloc)
-      - number: 0x534c0ab8 = ROR13(NtFlushInstructionCache)
-      - number: 0xff7f061a = ROR13(RtlExitUserThread)
-      - number: 0x60e0ceef = ROR13(ExitThread)
+rule:
+  meta:
+    name: resolve function by hash
+    namespace: linking/runtime-linking
+    author: [email protected]
+    scope: function
+    att&ck:
+      - Defense Evasion::Obfuscated Files or Information::Indicator Removal from Tools [T1027.005]
+    references:
+      - https://www.fireeye.com/blog/threat-research/2012/11/precalculated-string-hashes-reverse-engineering-shellcode.html
+      - https://pastebin.com/ci5XYW4P
+    examples:
+  features:
+    - or:
+      - number: 0x6a4abc5b = ROR13(kernel32.dll)
+      - number: 0x3cfa685d = ROR13(ntdll.dll)
+      - number: 0xec0e4e8e = ROR13(LoadLibraryA)
+      - number: 0x7c0dfcaa = ROR13(GetProcAddress)
+      - number: 0x91afca54 = ROR13(VirtualAlloc)
+      - number: 0x534c0ab8 = ROR13(NtFlushInstructionCache)
+      - number: 0xff7f061a = ROR13(RtlExitUserThread)
+      - number: 0x60e0ceef = ROR13(ExitThread)

nursery/terminate-process-by-name.yml

@@ -1,14 +1,14 @@
-rule:
-  meta:
-    name: terminate process by name
-    namespace: host-interaction/process/terminate
-    author: [email protected]
-    scope: function
-    examples:
+rule:
+  meta:
+    name: terminate process by name
+    namespace: host-interaction/process/terminate
+    author: [email protected]
+    scope: function
+    examples:
       # - unpacked Cl0p ransomware
-  features:
-    - and:
-      - match: terminate process
-      - match: enumerate processes
-      - or:
-        - offset: 0x24 = pe.szExeFile (x32)
+  features:
+    - and:
+      - match: terminate process
+      - match: enumerate processes
+      - or:
+        - offset: 0x24 = pe.szExeFile (x32)

persistence/scheduled-tasks/schedule-task-via-command-line.yml

@@ -10,9 +10,9 @@ rule:
       - 79cde1aa711e321b4939805d27e160be:0x401440
   features:
     - and:
-        - match: create process
-        - or:
-          - and:
-            - string: /schtasks/i
-            - string: /\/create /i
-          - string: /Register-ScheduledTask /i
+      - match: create process
+      - or:
+        - and:
+          - string: /schtasks/i
+          - string: /\/create /i
+        - string: /Register-ScheduledTask /i