Files

.github
anti-analysis
collection
communication
compiler
data-manipulation
doc
executable
host-interaction
impact
internal
lib
linking
load-code
malware-family
nursery
- access-camera-in-dotnet-on-android.yml
- access-wmi-data-in-dotnet.yml
- add-user-account-group.yml
- add-user-account-to-group.yml
- add-user-account.yml
- add-value-to-global-atom-table.yml
- allocate-unmanaged-memory-in-dotnet.yml
- append-data-to-clfs-log-container.yml
- authenticate-data-with-md5-mac.yml
- build-docker-image.yml
- bypass-hidden-api-restrictions-via-jni-on-android.yml
- bypass-uac-via-scheduled-task-environment-variable.yml
- capture-microphone-audio-in-dotnet-on-android.yml
- capture-network-configuration-via-ifconfig.yml
- capture-process-snapshot-data.yml
- capture-screenshot-in-dotnet-on-android.yml
- capture-screenshot-in-go.yml
- capture-webcam-video.yml
- change-memory-permission-on-linux.yml
- change-user-account-password.yml
- check-clipboard-data.yml
- check-file-extension-in-dotnet.yml
- check-file-permission-on-linux.yml
- check-for-incoming-call-in-dotnet-on-android.yml
- check-for-minimum-number-of-windows-on-screen.yml
- check-for-outgoing-call-in-dotnet-on-android.yml
- check-for-process-debug-object.yml
- check-for-sandbox-via-mac-address-ouis-in-dotnet.yml
- check-for-vm-using-instruction-vpcext.yml
- check-for-windows-sandbox-via-mutex.yml
- check-for-windows-sandbox-via-subdirectory.yml
- check-if-directory-exists.yml
- check-if-process-is-running-under-android-emulator-on-android.yml
- check-license-value.yml
- check-processdebugflags.yml
- check-systemkerneldebuggerinformation.yml
- check-thread-yield-allowed.yml
- clear-clipboard-data.yml
- collect-ssh-keys.yml
- communicate-with-kernel-module-via-netlink-socket-on-linux.yml
- compare-security-identifiers.yml
- compile-csharp-in-dotnet.yml
- compile-dotnet-assembly.yml
- compile-visual-basic-in-dotnet.yml
- compiled-from-epl.yml
- compiled-with-exescript.yml
- compiled-with-xamarin.yml
- compress-data-using-gzip-in-dotnet.yml
- connect-network-resource.yml
- contain-a-thread-local-storage-tls-section-in-dotnet.yml
- covertly-decode-and-write-data-to-windows-directory-using-indirect-calls.yml
- create-container.yml
- create-process-via-wmi-in-dotnet.yml
- create-registry-key-via-stdregprov.yml
- create-restart-manager-session.yml
- create-zip-archive-in-dotnet.yml
- debug-build.yml
- decode-data-using-base64-in-dotnet.yml
- decode-data-using-url-encoding.yml
- decrypt-data-using-rsa.yml
- decrypt-data-via-sspi.yml
- delete-internet-cache.yml
- delete-registry-key-via-offline-registry-library.yml
- delete-registry-key-via-stdregprov.yml
- delete-registry-value-via-stdregprov.yml
- delete-user-account-from-group.yml
- delete-user-account-group.yml
- delete-user-account.yml
- delete-windows-backup-catalog.yml
- deserialize-json-in-dotnet.yml
- destroy-software-breakpoint-capability.yml
- disable-automatic-windows-recovery-features.yml
- display-service-notification-message-box.yml
- empty-the-recycle-bin.yml
- enable-safe-mode-boot.yml
- encrypt-data-using-aes-via-x86-extensions.yml
- encrypt-data-using-aes.yml
- encrypt-data-using-fakem-cipher.yml
- encrypt-data-using-openssl-dsa.yml
- encrypt-data-using-openssl-ecdsa.yml
- encrypt-data-using-openssl-rsa.yml
- encrypt-data-using-rsa.yml
- encrypt-data-using-salsa20-or-chacha.yml
- encrypt-data-via-sspi.yml
- encrypt-or-decrypt-data-via-bcrypt.yml
- enumerate-browser-history.yml
- enumerate-device-drivers-on-linux.yml
- enumerate-device-drivers-on-windows.yml
- enumerate-disk-volumes.yml
- enumerate-drives.yml
- enumerate-files-in-dotnet.yml
- enumerate-internet-cache.yml
- enumerate-network-shares.yml
- enumerate-pe-sections-in-dotnet.yml
- enumerate-processes-that-use-resource.yml
- enumerate-processes-via-procfs.yml
- enumerate-system-firmware-tables.yml
- execute-dotnet-assembly.yml
- execute-shell-command-via-windows-remote-management.yml
- execute-shellcode-via-indirect-call.yml
- execute-sqlite-statement-in-dotnet.yml
- execute-syscall.yml
- execute-via-asynchronous-task-in-dotnet.yml
- execute-via-timer-in-dotnet.yml
- extract-zip-archive-in-dotnet.yml
- find-data-using-regex-in-dotnet.yml
- find-process-by-name.yml
- generate-method-via-reflection-in-dotnet.yml
- generate-random-bytes-in-dotnet.yml
- generate-random-filename-in-dotnet.yml
- generate-random-numbers-in-dotnet.yml
- generate-random-numbers-using-the-delphi-lcg.yml
- get-client-handle-via-schannel.yml
- get-current-pid-on-linux.yml
- get-current-process-command-line.yml
- get-current-process-file-path.yml
- get-current-process-filesystem-mounts-on-linux.yml
- get-current-process-memory-mapping-on-linux.yml
- get-disk-information-via-ioctl.yml
- get-file-system-information-on-linux.yml
- get-http-request-uri.yml
- get-inbound-credentials-handle-via-credssp.yml
- get-mac-address-in-dotnet.yml
- get-mac-address-on-linux.yml
- get-networking-parameters.yml
- get-ntoskrnl-base-address.yml
- get-os-information-via-kuser_shared_data.yml
- get-os-version-in-dotnet-on-android.yml
- get-os-version-in-dotnet.yml
- get-password-database-entry-on-linux.yml
- get-process-image-filename.yml
- get-proxy.yml
- get-remote-cert-context-via-schannel.yml
- get-routing-table.yml
- get-session-information.yml
- get-socket-information.yml
- get-storage-device-properties.yml
- get-system-firmware-table.yml
- get-system-information-on-linux.yml
- get-system-property-on-android.yml
- get-system-web-proxy.yml
- get-thread-local-storage-value.yml
- get-token-privileges.yml
- get-volume-information-via-ioctl.yml
- hash-data-using-aphash.yml
- hash-data-using-crc32b.yml
- hash-data-using-jshash.yml
- hash-data-using-md4.yml
- hash-data-using-murmur2.yml
- hash-data-using-ripemd128.yml
- hash-data-using-ripemd256.yml
- hash-data-using-ripemd320.yml
- hash-data-using-rshash.yml
- hash-data-using-sha1-via-wincrypt.yml
- hash-data-using-sha1-via-x86-extensions.yml
- hash-data-using-sha256-via-x86-extensions.yml
- hash-data-using-sha512managed-in-dotnet.yml
- hash-data-using-whirlpool.yml
- hash-data-via-bcrypt.yml
- hook-routines-via-dlsym-rtld_next.yml
- hook-routines-via-lsplant.yml
- hook-routines-via-microsoft-detours.yml
- hooked-by-api-override.yml
- impersonate-user.yml
- implement-com-dll.yml
- initialize-hashing-via-wincrypt.yml
- inspect-load-icon-resource.yml
- interact-with-iptables.yml
- invoke-dotnet-assembly-method.yml
- link-function-at-runtime-on-linux.yml
- linked-against-cpp-http-library.yml
- linked-against-cpp-json-library.yml
- linked-against-cpp-regex-library.yml
- linked-against-go-process-enumeration-library.yml
- linked-against-go-registry-library.yml
- linked-against-go-static-asset-library.yml
- linked-against-go-wmi-library.yml
- linked-against-hp-socket.yml
- linked-against-libsodium.yml
- linked-against-xzip.yml
- list-containers.yml
- list-domain-servers.yml
- list-drag-and-drop-files.yml
- list-groups-for-user-account.yml
- list-tcp-connections-and-listeners.yml
- list-udp-connections-and-listeners.yml
- list-user-account-groups.yml
- list-user-accounts-for-group.yml
- list-user-accounts.yml
- listen-for-remote-procedure-calls.yml
- load-dotnet-assembly.yml
- load-packed-dex-via-jiagu-on-android.yml
- load-xml-in-dotnet.yml
- log-keystrokes-via-input-method-manager.yml
- log-keystrokes-via-raw-input-data.yml
- make-an-http-request-with-a-cookie.yml
- manipulate-console-window.yml
- manipulate-network-credentials-in-dotnet.yml
- manipulate-unmanaged-memory-in-dotnet.yml
- manipulate-user-privileges.yml
- map-or-unmap-memory-on-linux.yml
- mark-thread-detached-on-linux.yml
- migrate-process-to-active-window-station.yml
- mixed-mode.yml
- modify-api-blacklist-or-denylist-via-jni-on-android.yml
- monitor-clipboard-content.yml
- monitor-local-ipv4-address-changes.yml
- move-directory.yml
- obfuscated-with-koivm.yml
- packaged-as-a-createinstall-installer.yml
- packaged-as-a-nsis-installer.yml
- packaged-as-a-pintool.yml
- packaged-as-a-winzip-self-extracting-archive.yml
- packaged-as-a-wise-installer.yml
- packaged-as-an-installshield-installer.yml
- packed-with-ccg.yml
- packed-with-crunch.yml
- packed-with-dragon-armor.yml
- packed-with-enigma.yml
- packed-with-epack.yml
- packed-with-maskpe.yml
- packed-with-mew.yml
- packed-with-mpress.yml
- packed-with-neolite.yml
- packed-with-pepack.yml
- packed-with-perplex.yml
- packed-with-procrypt.yml
- packed-with-rpcrypt.yml
- packed-with-seausfx.yml
- packed-with-shrinker.yml
- packed-with-simple-pack.yml
- packed-with-starforce.yml
- packed-with-svkp.yml
- packed-with-tsuloader.yml
- packed-with-vprotect.yml
- packed-with-wwpack.yml
- parse-url.yml
- persist-via-gnome-autostart-on-linux.yml
- power-down-monitor.yml
- prompt-user-for-credentials.yml
- query-or-enumerate-registry-key-via-stdregprov.yml
- query-or-enumerate-registry-value-via-stdregprov.yml
- query-remote-server-for-available-data.yml
- read-and-send-data-from-client-to-server.yml
- read-process-memory.yml
- read-raw-disk-data.yml
- rebuilt-by-imprec.yml
- receive-and-write-data-from-server-to-client.yml
- reference-114dns-dns-server.yml
- reference-aes-constants.yml
- reference-alidns-dns-server.yml
- reference-base58-string.yml
- reference-cloudflare-dns-server.yml
- reference-comodo-secure-dns-server.yml
- reference-cryptocurrency-strings.yml
- reference-google-public-dns-server.yml
- reference-hurricane-electric-dns-server.yml
- reference-kornet-dns-server.yml
- reference-l3-dns-server.yml
- reference-opendns-dns-server.yml
- reference-processor-manufacturer-constants.yml
- reference-quad9-dns-server.yml
- reference-screen-saver-executable.yml
- reference-startup-folder.yml
- reference-the-vmware-io-port.yml
- reference-verisign-dns-server.yml
- register-http-server-url.yml
- register-raw-input-devices.yml
- resize-volume-shadow-copy-storage.yml
- resolve-function-by-djb2-hash.yml
- resolve-function-by-fnv-1a-hash.yml
- resolve-function-by-hash.yml
- run-in-container.yml
- save-image-in-dotnet.yml
- schedule-task-via-itaskservice.yml
- search-for-credit-card-data.yml
- send-data-to-internet.yml
- send-email-in-dotnet.yml
- send-http-request-with-host-header.yml
- send-keystrokes.yml
- send-request-in-dotnet.yml
- send-sms-on-android.yml
- serialize-json-in-dotnet.yml
- set-current-directory.yml
- set-global-application-hook.yml
- set-http-cookie.yml
- set-http-user-agent-in-dotnet.yml
- set-registry-value-via-stdregprov.yml
- set-thread-name-on-linux.yml
- set-web-proxy-in-dotnet.yml
- terminate-process-by-name-in-dotnet.yml
- terminate-process-by-name.yml
- truncate-file-on-linux.yml
- unmanaged-call-via-dynamic-pinvoke-in-dotnet.yml
- unmanaged-call.yml
- unmount-volume-via-ioctl.yml
persistence
runtime
targeting
.gitattributes
LICENSE.txt
README.md

map-or-unmap-memory-on-linux.yml

adding new and updating linux / android rules (#903 )

May 31, 2024

ded2744 · May 31, 2024