 zdw@
|
e6df480758
|
add first set of exploit detection rules (#1046)
* add ntoskrnl.exe loading rule
* fix name
* add explicit os
* add suspicious ntquerysysteinformation detections
* ntfscontrolfile wip
* fix ntfscontrolfile rule
* rename ntquerysysinfo rule
* add ntoskrnl gadgets rule
* make descs more generic
* refactor rules to exploitation namespace
* add caveat to ntfscontrolfile rule
* tweak rule names
* tweak ntfscontrolfile name
|
2025-05-22 12:53:30 -06:00 |
|