3 Commits
Author SHA1 Message Date
Willi BallenthinandMike Hunhoff c1d20764ad use "span of calls" scope (#973)
* use sequence scope instead of thread scope for "static: function" rules

* use sequence scope instead of thread scope for "static: basic block" rules

* make runtime linking rules more concise

* doc: describe sequence scope

* rename "sequence" scope to "span of calls" scope

* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update collection/get-geographical-location.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update collection/file-managers/gather-classicftp-information.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update collection/database/wmi/reference-wmi-statements.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update collection/database/sql/reference-sql-statements.yml

Co-authored-by: Mike Hunhoff <[email protected]>

---------

Co-authored-by: Mike Hunhoff <[email protected]>
2025-01-29 10:27:13 +01:00
mr-tz 784c9dca53 upgrade rules using updated script 2023-11-24 11:34:28 +01:00
Mike Hunhoff dda76eadde new/update rules using .NET ctor method (#626) 2022-10-13 08:36:31 -06:00