zdw@ e6df480758 add first set of exploit detection rules (#1046) ...

* add ntoskrnl.exe loading rule

* fix name

* add explicit os

* add suspicious ntquerysysteinformation detections

* ntfscontrolfile wip

* fix ntfscontrolfile rule

* rename ntquerysysinfo rule

* add ntoskrnl gadgets rule

* make descs more generic

* refactor rules to exploitation namespace

* add caveat to ntfscontrolfile rule

* tweak rule names

* tweak ntfscontrolfile name

2025-05-22 12:53:30 -06:00

..

load-ntoskrnl.yml

add first set of exploit detection rules (#1046)

2025-05-22 12:53:30 -06:00

resolve-ntoskrnl-gadgets.yml

add first set of exploit detection rules (#1046)

2025-05-22 12:53:30 -06:00