* Move get-routing-table.yml out of nursery. Add enumerate-tcp-connections-via-wmi-com-api.yml and create-routing-table-entry.yml
* Update scopes in enumerate-tcp-connections-via-wmi-com-api.yml, create-routing-table-entry.yml, get-routing-table.yml
* Move and update impersonate-user rule
Renamed impersonate-user.yml from nursery to host-interaction/user and added an examples section with a sample hash.
* Simplify API checks in impersonate-user rule
Removed optional and or conditions for GetUserName and DuplicateToken APIs
* Bring the Ex back
* Add disable-powershell-transcription.yml and access-powershell-lockdown-policy.yml
* Update disable-powershell-transcription.yml and bypass-powershell-constrained-language-mode-via-getsystemlockdownpolicy-patch.yml
* Add rule to detect advanced mouse movement analysis references issue #1050
* Update nursery/detect-mouse-movement-analysis.yml
Co-authored-by: Mike Hunhoff <[email protected]>
* Update nursery/detect-mouse-movement-analysis.yml
Co-authored-by: Mike Hunhoff <[email protected]>
* Move the new rule for mouse analysis to the vm-detection folder
* Fix filename to match the rule name
---------
Co-authored-by: Mike Hunhoff <[email protected]>
* add new rules to detect disabling features via registry on Windows
* refactor
* refactor
* refactor
* update control registry regex to better handle multiple control sets
* Initial additions for detecting donut features
Signed-off-by: Still Hsu <[email protected]>
* Lint rules
Signed-off-by: Still Hsu <[email protected]>
* Update ATT&CK for donut rule
Signed-off-by: Still Hsu <[email protected]>
* Fix comment for dynamic scope on donut loader
Signed-off-by: Still Hsu <[email protected]>
* Require at least one donut function match for donut rule
Signed-off-by: Still Hsu <[email protected]>
* Add offset for examples
Signed-off-by: Still Hsu <[email protected]>
* Add indirect call for IAssembly matching
Signed-off-by: Still Hsu <[email protected]>
* Match known vtable offsets for assembly loading
* Remove loop matching
---------
Signed-off-by: Still Hsu <[email protected]>
* detect usage of TripleDESCryptoServiceProvider
* detect usage of TripleDes via dotnet api
* detect usage of TripleDesCryptoServiceProvider
* removed duplicate file
* seperate encrypt and decrypt methods
* changed file names to match desc
* lint fix
* lint fix
* small fixes
* Separate socket connection rules for TCP and UDP
- Introduce a generic "connect socket" rule capturing common connection APIs (connect, ws2_32.connect, WSAConnect, ConnectEx, and related ConnectEx setup patterns).
- Refactor the TCP connect rule to require a match on "create TCP socket" and the generic rule, preserving TCP-specific behaviors while maximizing reuse.
- Add a new UDP connect rule that requires a match on "create UDP socket" and the generic connect rule.
Closes#965.
* Update socket rule examples with correct offsets for UDP/TCP
* Updated suggested changes
copilot-swe-agent[bot]