Mandiant red team tool countermeasures
- Repositorio
- https://github.com/mandiant/red_team_tool_countermeasures
- Commit
- 3561b71724dbfa3e2bb78106aaa2d7f8b892c43b
- Obtenido
- 2026-09-27
- Licencia
- BSD 2-Clause License
- ©
- Copyright (c) 2023, MANDIANT
- Publicación
- Texto completo
- Motivo
- BSD 2-Clause: redistribution allowed with the copyright notice and licence text retained.
Descargar paquete (.yar, 147 reglas)
Texto de la licencia (tal como lo obtuvo YARA Forge)
BSD 2-Clause License Copyright (c) 2023, MANDIANT Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Reglas de Mandiant red team tool countermeasures
This rule is looking for specific strings associated with network activity found within the MacOS generated variant of GORAT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08This detects if a sample is less than 50KB and has a number of strings found in the Gorat shellcode (stage0 loader). The loader contains an embedded DLL (stage0.dll) that contains a number of unique strings. The 'Cookie' string found in this loader is important as this cookie is needed by the C2 server to download the Gorat implant (stage1 payload).
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-02No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-02No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-27matryoshka_pe_to_shellcode.rs
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-02No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-02No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-27No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-27matryoshka_dropper.rs
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-02matryoshka_dropper.rs
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-02No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-04No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-04No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-02No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-25wql searches
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-30No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-02No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-01No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-01No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-18base.cs
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-24base.js, ./lib/payload/techniques/jscriptdotnet/jscriptdotnet_payload.py
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-25No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-03No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-03No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-01No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-27No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-27PE rich header matches PGF backdoor
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-27No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-27No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-27base dlls: /lib/payload/techniques/unmanaged_exports/
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-25base dlls: /lib/payload/techniques/dllmain/
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-25PGF payload, generated rule based on symfunc/c02594972dbab6d489b46c5dee059e66. Identifies dllmain_hook x86 payloads.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-26PGF payload, generated rule based on symfunc/a86b004b5005c0bcdbd48177b5bac7b8
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-27No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-27matryoshka_process_hollow.rs
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-02matryoshka.rs
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-02base dlls: /lib/payload/techniques/unmanaged_exports/
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-25base dlls: /lib/payload/techniques/dllmain/
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-25PGF payload, generated rule based on symfunc/8a2f2236fdfaa3583ab89076025c6269. Identifies dllmain_hook x64 payloads.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-26PGF payload, generated rule based on symfunc/8167a6d94baca72bac554299d7c7f83c
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-27No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-27No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-02No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-11-27No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-01No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-01No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-01No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-01No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-02No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-02This rule looks for .NET PE files that have the strings of various method names in the TitoSpecial code.
GenéricaMandiant red team tool countermeasures· FireEye· 2020-12-08The LNKSmasher project contains a prebuilt LNK file that has pieces added based on various configuration items. Because of this, several artifacts are present in every single LNK file generated by LNKSmasher, including the Drive Serial #, the File Droid GUID, and the GUID CLSID.
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-08No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-18This is a modification of an existing FireEye detection for SharpHound. However, it looks for the string 'PuppyHound' instead of 'SharpHound' as this is all that was needed to detect the PuppyHound variant of SharpHound.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08No description has been set in the source file - FireEye-RT
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08No description has been set in the source file - FireEye-RT
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-11-25No description has been set in the source file - FireEye-RT
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08smbexec
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-01wmiexec
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-01No description has been set in the source file - FireEye-RT
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-11-25No description has been set in the source file - FireEye-RT
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-11-25No description has been set in the source file - FireEye-RT
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-18No description has been set in the source file - FireEye-RT
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-18No description has been set in the source file - FireEye-RT
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-18No description has been set in the source file - FireEye-RT
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-08No description has been set in the source file - FireEye-RT
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-03No description has been set in the source file - FireEye-RT
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-03No description has been set in the source file - FireEye-RT
MalwareMandiant red team tool countermeasures· FireEye· 2020-11-25No description has been set in the source file - FireEye-RT
MalwareMandiant red team tool countermeasures· FireEye· 2020-11-25No description has been set in the source file - FireEye-RT
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-02No description has been set in the source file - FireEye-RT
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-02No description has been set in the source file - FireEye-RT
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-01No description has been set in the source file - FireEye-RT
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-02No description has been set in the source file - FireEye-RT
MalwareMandiant red team tool countermeasures· FireEye· 2020-11-25No description has been set in the source file - FireEye-RT
MalwareMandiant red team tool countermeasures· FireEye· 2020-11-26No description has been set in the source file - FireEye-RT
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-02The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'dtrim' project, which is a modified version of SharpSploit.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'justask' project.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'lualoader' project.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'modifiedsharpview' project.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpdacl' project.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpdns' project.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpgopher' project.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpnativezipper' project.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpnfs' project.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharppatchcheck' project.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpsack' project.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpsqlclient' project.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharptemplate' project.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpwebcrawler' project.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpziplibzipper' project.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08PDB string used in some PGF DLL samples
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the Gadget2JScript project.
GenéricaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpGenerator' project.
GenéricaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SinfulOffice' project.
GenéricaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CredSnatcher' project.
GenéricaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WCMDump' project.
GenéricaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CoreHound' project.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the recon utility 'getdomainpasswordpolicy' project.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the a customized version of the 'DUEDLLIGENCE' project.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'inveighzero' project.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'KeeFarce' project.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'KeePersist' project.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'PrepShellcode' project.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the PXE And Loot project.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public Rubeus project.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SafetyKatz project.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SeatBelt project.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharPersist project.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SharpHound3 project.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharPivot project.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpSchtask' project.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharpStomp project.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public 'sharpzerologon' project.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMISharp' project.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMIspy' project.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'AllTheThings' project.
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'C_Sharp_SectionInjection' project.
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'In-MemoryCompilation' project.
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'NetshShellCodeRunner' project.
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public RuralBishop project.
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-09The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharPy' project.
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the WildChild project.
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMIRunner' project.
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'DUEDLLIGENCE' project.
GenéricaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpGrep' project.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public 'DoHC2' External C2 project.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'noamci' project.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'red_team_materials' project.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'revolver' project.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08No description has been set in the source file - FireEye-RT
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-02The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the TitoSpecial project. There are 2 GUIDs in this rule as the x86 and x64 versions of this tool use a different ProjectGuid.
GenéricaMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'RedFlare - Module - PowerShell' project.
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-08The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'RedFlare - Plugin - .NET' project.
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-08Looking for suspicious char encoding
Sospechoso / huntingMandiant red team tool countermeasures· FireEye· 2020-12-08Identifies GoRat malware in memory based on strings.
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-08matryoshka_process_hollow.rs
APT / actorMandiant red team tool countermeasures· FireEye· 2020-12-02This rule looks for the binary signature of the 'Inject' method found in the main Excavator PE.
GenéricaMandiant red team tool countermeasures· FireEye· 2020-12-08This rule looks for the binary signature of the routine that calls PssFreeSnapshot found in the Excavator-Reflector DLL.
GenéricaMandiant red team tool countermeasures· FireEye· 2020-12-08This rule looks for strings present in unobfuscated HTAs generated by the WildChild builder.
MalwareMandiant red team tool countermeasures· FireEye· 2020-12-08This rule looks for .NET PE files that have the strings of various method names in the SharPivot code.
Herramienta ofensivaMandiant red team tool countermeasures· FireEye· 2020-12-08