v5.1.0
Summary
Added: 24 rules
Modified: 38 rules
Renamed: 7 rules
Deleted: 0 rules
Detailed release changes: rules v5.0.0...v5.1.0
Added rules (24)
- communication/http/get-http-content-length.yml
- communication/http/reference-http-user-agent-string.yml
- communication/ip/convert-ip-address-from-string.yml
- communication/socket/create-raw-socket.yml
- data-manipulation/compression/compress-data-via-zlib-inflate-or-deflate.yml
- data-manipulation/encryption/xtea/encrypt-data-using-xtea.yml
- data-manipulation/encryption/xxtea/encrypt-data-using-xxtea.yml
- data-manipulation/prng/generate-random-numbers-via-rtlgenrandom.yml
- executable/installer/dotnet/packaged-as-single-file-dotnet-application.yml
- nursery/check-for-minimum-number-of-windows-on-screen.yml
- nursery/check-for-windows-sandbox-via-subdirectory.yml
- nursery/compiled-with-cx_freeze.yml
- nursery/contain-a-thread-local-storage-tls-section-in-dotnet.yml
- nursery/create-zip-archive-in-dotnet.yml
- nursery/destroy-software-breakpoint-capability.yml
- nursery/enumerate-pe-sections-in-dotnet.yml
- nursery/get-http-request-uri.yml
- nursery/hash-data-using-ripemd128.yml
- nursery/hash-data-using-ripemd256.yml
- nursery/hash-data-using-ripemd320.yml
- nursery/move-directory.yml
- nursery/send-data-to-internet.yml
- nursery/set-web-proxy-in-dotnet.yml
- persistence/scheduled-tasks/schedule-task-via-at.yml
Modified rules (38)
- anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml
- anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
- anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml
- anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-genuine-state.yml
- anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-process-name.yml
- anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-registry.yml
- anti-analysis/reference-analysis-tools-strings.yml
- collection/get-geographical-location.yml
- collection/network/get-mac-address-on-windows.yml
- communication/http/client/check-http-status-code.yml
- communication/http/set-http-header.yml
- communication/named-pipe/connect/connect-pipe.yml
- communication/named-pipe/create/create-pipe.yml
- communication/send-data.yml
- communication/socket/receive/receive-data-on-socket.yml
- communication/socket/send/send-data-on-socket.yml
- communication/socket/udp/send/create-udp-socket.yml
- compiler/rust/compiled-with-rust.yml
- data-manipulation/hashing/md5/hash-data-with-md5.yml
- data-manipulation/hashing/sha1/hash-data-using-sha1.yml
- host-interaction/clipboard/read-clipboard-data.yml
- host-interaction/file-system/create/create-directory.yml
- host-interaction/file-system/delete/delete-file.yml
- host-interaction/file-system/exists/check-if-file-exists.yml
- host-interaction/file-system/files/list/enumerate-files-on-windows.yml
- host-interaction/file-system/files/list/enumerate-files-recursively.yml
- host-interaction/file-system/reference-absolute-stream-path-on-windows.yml
- host-interaction/process/list/enumerate-processes-via-ntquerysysteminformation.yml
- host-interaction/registry/create/set-registry-value.yml
- host-interaction/registry/query-or-enumerate-registry-key.yml
- host-interaction/registry/query-or-enumerate-registry-value.yml
- linking/runtime-linking/link-function-at-runtime-on-windows.yml
- load-code/pe/enumerate-pe-sections.yml
- load-code/pe/parse-pe-header.yml
- nursery/check-for-process-debug-object.yml
- nursery/check-for-windows-sandbox-via-mutex.yml
- nursery/check-systemkerneldebuggerinformation.yml
- nursery/get-os-version-in-dotnet.yml
Renamed rules (7)
- anti-analysis/anti-vm/vm-detection/check-for-sandbox-username-or-hostname.yml (was anti-analysis/anti-vm/vm-detection/check-for-sandbox-username.yml)
- communication/dns/resolve-dns.yml (was host-interaction/network/dns/resolve/resolve-dns.yml)
- data-manipulation/encryption/tea/decrypt-data-using-tea.yml (was nursery/decrypt-data-using-tea.yml)
- data-manipulation/encryption/tea/encrypt-data-using-tea.yml (was nursery/encrypt-data-using-tea.yml)
- nursery/extract-zip-archive-in-dotnet.yml (was nursery/extract-zip-archive.yml)
- nursery/reference-cryptocurrency-strings.yml (was nursery/mine-cryptocurrency.yml)
- persistence/scheduled-tasks/schedule-task-via-schtasks.yml (was persistence/scheduled-tasks/schedule-task-via-command-line.yml)