v5.0.0
Summary
Added: 68 rules
Modified: 81 rules
Renamed: 10 rules
Deleted: 1 rule
Detailed release changes: rules v4.0.1...v5.0.0
Added rules (68)
- collection/use-dotnet-library-sharpclipboard.yml
- communication/mailslot/create-mailslot.yml
- communication/socket/tcp/create-tcp-socket-via-raw-afd-driver.yml
- compiler/nuitka/compiled-with-nuitka.yml
- data-manipulation/compression/compress-data-using-lzo.yml
- data-manipulation/compression/decompress-data-using-lzo.yml
- data-manipulation/encryption/aes/use-dotnet-library-encryptdecryptutils.yml
- data-manipulation/hashing/sha384/hash-data-using-sha384.yml
- data-manipulation/hashing/sha512/hash-data-using-sha512.yml
- data-manipulation/json/use-dotnet-library-newtonsoftjson.yml
- data-manipulation/svg/use-dotnet-library-sharpvectors.yml
- executable/resource/access-dotnet-resource.yml
- executable/resource/embed-dependencies-as-resources-using-fodycostura.yml
- host-interaction/file-system/reference-absolute-stream-path-on-windows.yml
- host-interaction/mutex/create-semaphore-on-linux.yml
- host-interaction/mutex/lock-semaphore-on-linux.yml
- host-interaction/mutex/unlock-semaphore-on-linux.yml
- host-interaction/process/map-section-object.yml
- host-interaction/uac/bypass/bypass-uac-via-rpc.yml
- lib/create-or-open-section-object.yml
- lib/get-os-version.yml
- linking/static/linked-against-cpp-standard-library.yml
- load-code/dotnet/execute-dotnet-assembly-via-clr-host.yml
- load-code/execute-vbscript-javascript-or-jscript-in-memory.yml
- nursery/access-wmi-data-in-dotnet.yml
- nursery/allocate-unmanaged-memory-in-dotnet.yml
- nursery/authenticate-data-with-md5-mac.yml
- nursery/check-file-extension-in-dotnet.yml
- nursery/check-for-vm-using-instruction-vpcext.yml
- nursery/compile-csharp-in-dotnet.yml
- nursery/compile-visual-basic-in-dotnet.yml
- nursery/compress-data-using-gzip-in-dotnet.yml
- nursery/decode-data-using-base64-in-dotnet.yml
- nursery/decode-data-using-url-encoding.yml
- nursery/decrypt-data-using-tea.yml
- nursery/deserialize-json-in-dotnet.yml
- nursery/encrypt-data-using-aes.yml
- nursery/encrypt-data-using-openssl-dsa.yml
- nursery/encrypt-data-using-openssl-ecdsa.yml
- nursery/encrypt-data-using-openssl-rsa.yml
- nursery/encrypt-data-using-tea.yml
- nursery/execute-sqlite-statement-in-dotnet.yml
- nursery/execute-via-asynchronous-task-in-dotnet.yml
- nursery/execute-via-timer-in-dotnet.yml
- nursery/extract-zip-archive.yml
- nursery/find-data-using-regex-in-dotnet.yml
- nursery/generate-method-via-reflection-in-dotnet.yml
- nursery/generate-random-bytes-in-dotnet.yml
- nursery/generate-random-filename-in-dotnet.yml
- nursery/get-os-version-in-dotnet.yml
- nursery/get-windows-directory-from-kuser_shared_data.yml
- nursery/hash-data-using-whirlpool.yml
- nursery/implement-com-dll.yml
- nursery/linked-against-libsodium.yml
- nursery/load-xml-in-dotnet.yml
- nursery/manipulate-console-window.yml
- nursery/manipulate-network-credentials-in-dotnet.yml
- nursery/manipulate-unmanaged-memory-in-dotnet.yml
- nursery/manipulate-user-privileges.yml
- nursery/obfuscated-with-koivm.yml
- nursery/reference-base58-string.yml
- nursery/resolve-function-by-djb2-hash.yml
- nursery/save-image-in-dotnet.yml
- nursery/send-email-in-dotnet.yml
- nursery/serialize-json-in-dotnet.yml
- nursery/set-http-user-agent-in-dotnet.yml
- nursery/unmanaged-call-via-dynamic-pinvoke-in-dotnet.yml
- runtime/dotnet/execute-via-dotnet-startup-hook.yml
Modified rules (81)
- anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml
- anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs.yml
- anti-analysis/anti-forensic/impersonate-file-version-information.yml
- anti-analysis/anti-forensic/self-deletion/self-delete.yml
- anti-analysis/anti-forensic/timestomp/timestomp-file.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-qemu.yml
- anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml
- collection/network/get-mac-address-on-windows.yml
- collection/screenshot/capture-screenshot.yml
- communication/http/read-http-header.yml
- communication/http/set-http-header.yml
- communication/socket/tcp/create-tcp-socket.yml
- communication/socket/udp/send/create-udp-socket.yml
- communication/tcp/client/act-as-tcp-client.yml
- communication/tcp/serve/start-tcp-server.yml
- data-manipulation/checksum/crc32/hash-data-with-crc32.yml
- data-manipulation/encoding/base64/encode-data-using-base64.yml
- data-manipulation/encryption/des/encrypt-data-using-des.yml
- data-manipulation/encryption/dpapi/encrypt-data-using-dpapi.yml
- data-manipulation/encryption/elliptic-curve/encrypt-data-using-curve25519.yml
- data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml
- data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml
- data-manipulation/encryption/rc6/encrypt-data-using-rc6.yml
- data-manipulation/hashing/djb2/hash-data-using-djb2.yml
- data-manipulation/hashing/sha1/hash-data-using-sha1.yml
- data-manipulation/hashing/sha224/hash-data-using-sha224.yml
- data-manipulation/hashing/sha256/hash-data-using-sha256.yml
- data-manipulation/prng/mersenne/generate-random-numbers-using-a-mersenne-twister.yml
- executable/resource/extract-resource-via-kernel32-functions.yml
- host-interaction/cli/accept-command-line-arguments.yml
- host-interaction/environment-variable/get-comspec-environment-variable.yml
- host-interaction/environment-variable/query-environment-variable.yml
- host-interaction/file-system/delete/delete-directory.yml
- host-interaction/file-system/exists/check-if-file-exists.yml
- host-interaction/file-system/files/list/enumerate-files-on-linux.yml
- host-interaction/file-system/files/list/enumerate-files-on-windows.yml
- host-interaction/file-system/files/list/enumerate-files-recursively.yml
- host-interaction/file-system/get-common-file-path.yml
- host-interaction/file-system/meta/get-file-attributes.yml
- host-interaction/file-system/meta/get-file-size.yml
- host-interaction/file-system/meta/get-file-version-info.yml
- host-interaction/file-system/meta/set-file-attributes.yml
- host-interaction/gui/enumerate-gui-resources.yml
- host-interaction/gui/window/get-text/get-graphical-window-text.yml
- host-interaction/hardware/cpu/get-number-of-processors.yml
- host-interaction/hardware/storage/get-disk-information.yml
- host-interaction/hardware/storage/get-disk-size.yml
- host-interaction/mutex/create-mutex.yml
- host-interaction/network/domain/get-domain-information.yml
- host-interaction/os/hostname/get-hostname.yml
- host-interaction/os/version/check-os-version.yml
- host-interaction/process/create/create-a-process-with-modified-io-handles-and-window.yml
- host-interaction/process/inject/attach-user-process-memory.yml
- host-interaction/process/inject/inject-apc.yml
- host-interaction/process/modules/list/enumerate-process-modules.yml
- host-interaction/process/terminate/terminate-process.yml
- host-interaction/recycle-bin/empty-recycle-bin-quietly.yml
- host-interaction/registry/create/set-registry-value.yml
- host-interaction/registry/delete/delete-registry-key.yml
- host-interaction/service/run-as-service.yml
- host-interaction/session/get-session-user-name.yml
- host-interaction/thread/create/create-thread.yml
- host-interaction/uac/bypass/bypass-uac-via-token-manipulation.yml
- host-interaction/wmi/connect-to-wmi-namespace-via-wbemlocator.yml
- impact/inhibit-system-recovery/delete-volume-shadow-copies.yml
- lib/delay-execution.yml
- load-code/pe/rebuild-import-table.yml
- load-code/powershell/run-powershell-expression.yml
- nursery/decrypt-data-using-rsa.yml
- nursery/encrypt-data-using-rsa.yml
- nursery/generate-random-numbers-in-dotnet.yml
- nursery/get-os-information-via-kuser_shared_data.yml
- nursery/get-process-image-filename.yml
- nursery/get-system-web-proxy.yml
- nursery/read-and-send-data-from-client-to-server.yml
- nursery/receive-and-write-data-from-server-to-client.yml
- nursery/send-request-in-dotnet.yml
- nursery/set-http-cookie.yml
- nursery/unmanaged-call.yml
- persistence/registry/run/persist-via-run-registry-key.yml
- persistence/service/persist-via-windows-service.yml
Renamed rules (10)
- communication/c2/file-transfer/download-and-write-a-file.yml (was c2/file-transfer/download-and-write-a-file.yml)
- communication/c2/file-transfer/write-and-execute-a-file.yml (was c2/file-transfer/write-and-execute-a-file.yml)
- communication/c2/shell/create-reverse-shell-on-linux.yml (was c2/shell/create-reverse-shell-on-linux.yml)
- communication/c2/shell/create-reverse-shell.yml (was c2/shell/create-reverse-shell.yml)
- communication/c2/shell/execute-shell-command-and-capture-output.yml (was c2/shell/execute-shell-command-and-capture-output.yml)
- communication/c2/shell/execute-shell-command-received-from-socket-on-linux.yml (was c2/shell/execute-shell-command-received-from-socket-on-linux.yml)
- communication/ftp/send/send-file-using-ftp.yml (was communication/ftp/send/send-file-using-ftp-via-wininet.yml)
- host-interaction/console/manipulate-console-buffer.yml (was host-interaction/console/manipulate-console.yml)
- lib/create-or-open-registry-key.yml (was host-interaction/registry/create-or-open-registry-key.yml)
- nursery/create-process-via-wmi-in-dotnet.yml (was nursery/create-process-via-wmi.yml)