
Detection Rule List
Rule Name | Rule Type | Technique Count | Creation Date |
---|---|---|---|
CAPA_localsize | CAPA | 1 | 9 months, 1 week |
CAPA_vm_registry | CAPA | 1 | 9 months, 1 week |
CAPA_vm_artefact2 | CAPA | 1 | 9 months, 1 week |
CAPA_vm_instruction | CAPA | 0 | 9 months, 1 week |
CAPA_gettickcount | CAPA | 1 | 9 months, 1 week |
CAPA_debugged_flag | CAPA | 1 | 9 months, 1 week |
CAPA_mouse_cursor | CAPA | 1 | 9 months, 1 week |
CAPA_timestomp | CAPA | 0 | 9 months, 1 week |
CAPA_ntglobalflag | CAPA | 1 | 9 months, 1 week |
CAPA_stackstring_obf | CAPA | 0 | 9 months, 1 week |
CAPA_vm_artefact | CAPA | 1 | 9 months, 1 week |
CAPA_kill_process | CAPA | 1 | 9 months, 1 week |
CAPA_detect_vm_process | CAPA | 2 | 9 months, 1 week |
CAPA_device_pipe | CAPA | 0 | 9 months, 1 week |
CAPA_QueryPerformanceCounter | CAPA | 1 | 9 months, 1 week |
CAPA_output_debug_string | CAPA | 1 | 9 months, 1 week |
CAPA_clear_log | CAPA | 1 | 9 months, 1 week |
CAPA_crash_eventlog | CAPA | 2 | 9 months, 1 week |
CAPA_debug_register | CAPA | 1 | 9 months, 1 week |
CAPA_debugger_api | CAPA | 1 | 9 months, 1 week |
SIGMA_bitsadmin | SIGMA | 0 | 9 months, 1 week |
SIGMA_spoofed_extension | SIGMA | 0 | 9 months, 1 week |
SIGMA_hide_copy_melt | SIGMA | 1 | 9 months, 1 week |
SIGMA_base64_download | SIGMA | 0 | 9 months, 1 week |
SIGMA_lolbins | SIGMA | 0 | 9 months, 1 week |
SIGMA_detect_region | SIGMA | 0 | 9 months, 1 week |
SIGMA_delete_shadow_copy | SIGMA | 1 | 9 months, 1 week |
SIGMA_ANTI_VM | SIGMA | 0 | 9 months, 1 week |
SIGMA_stop_service | SIGMA | 0 | 9 months, 1 week |
CAPA_fingerprint_av | SIGMA | 1 | 9 months, 1 week |