mirror of
https://github.com/mandiant/capa-rules.git
synced 2026-10-12 11:19:51 +00:00
Still / Azaka
7269873b0c
* Initial additions for detecting donut features Signed-off-by: Still Hsu <[email protected]> * Lint rules Signed-off-by: Still Hsu <[email protected]> * Update ATT&CK for donut rule Signed-off-by: Still Hsu <[email protected]> * Fix comment for dynamic scope on donut loader Signed-off-by: Still Hsu <[email protected]> * Require at least one donut function match for donut rule Signed-off-by: Still Hsu <[email protected]> * Add offset for examples Signed-off-by: Still Hsu <[email protected]> * Add indirect call for IAssembly matching Signed-off-by: Still Hsu <[email protected]> * Match known vtable offsets for assembly loading * Remove loop matching --------- Signed-off-by: Still Hsu <[email protected]>