Rename architecture-specific rules and update rule names inside YAML files

akh7177 · akh7177 · commit 1217201e4b9c · 2025-02-28T16:55:57.000+05:30
diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag-via-x86-assembly.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: check for PEB NtGlobalFlag flag
+    name: check for PEB NtGlobalFlag flag via x86 assembly
     namespace: anti-analysis/anti-debugging/debugger-detection
     authors:
       - moritz.raabe@mandiant.com
diff --git a/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception-via-x86-assembly.yml b/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: check for trap flag exception
+    name: check for trap flag exception via x86 assembly
     namespace: anti-analysis/anti-debugging/debugger-detection
     authors:
       - michael.hunhoff@mandiant.com
diff --git a/anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions-via-x86-assembly.yml b/anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: execute anti-debugging instructions
+    name: execute anti-debugging instructions via x86 assembly
     namespace: anti-analysis/anti-debugging/debugger-detection
     authors:
       - moritz.raabe@mandiant.com
diff --git a/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate-via-x86-assembly.yml b/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: 64-bit execution via heavens gate
+    name: 64-bit execution via heavens gate via x86 assembly
     namespace: anti-analysis/anti-disasm
     authors:
       - awillia2@cisco.com
diff --git a/anti-analysis/anti-forensic/patch-process-command-line-via-x86-assembly.yml b/anti-analysis/anti-forensic/patch-process-command-line-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: patch process command line
+    name: patch process command line via x86 assembly
     namespace: anti-analysis/anti-forensic
     authors:
       - william.ballenthin@mandiant.com
diff --git a/communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl-via-x86-assembly.yml b/communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: obtain TransmitPackets callback function via WSAIoctl
+    name: obtain TransmitPackets callback function via WSAIoctl via x86 assembly
     namespace: communication/socket/tcp/send
     authors:
       - jonathan.lepore@mandiant.com
diff --git a/data-manipulation/checksum/adler32/compute-adler32-checksum-via-x86-assembly.yml b/data-manipulation/checksum/adler32/compute-adler32-checksum-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: compute adler32 checksum
+    name: compute adler32 checksum via x86 assembly
     namespace: data-manipulation/checksum/adler32
     authors:
       - matthew.williams@mandiant.com
diff --git a/data-manipulation/checksum/crc32/hash-data-with-crc32-via-x86-assembly.yml b/data-manipulation/checksum/crc32/hash-data-with-crc32-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: hash data with CRC32
+    name: hash data with CRC32 via x86 assembly
     namespace: data-manipulation/checksum/crc32
     authors:
       - moritz.raabe@mandiant.com
diff --git a/data-manipulation/compression/decompress-data-using-aplib-via-x86-assembly.yml b/data-manipulation/compression/decompress-data-using-aplib-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: decompress data using aPLib
+    name: decompress data using aPLib via x86 assembly
     namespace: data-manipulation/compression
     authors:
       - "@r3c0nst (Frank Boldewin)"
diff --git a/data-manipulation/compression/decompress-data-using-ucl-via-x86-assembly.yml b/data-manipulation/compression/decompress-data-using-ucl-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: decompress data using UCL
+    name: decompress data using UCL via x86 assembly
     namespace: data-manipulation/compression
     authors:
       - jakub.jozwiak@mandiant.com
diff --git a/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table-via-x86-assembly.yml b/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: decode data using Base64 via dword translation table
+    name: decode data using Base64 via dword translation table via x86 assembly
     namespace: data-manipulation/encoding/base64
     authors:
       - gilbert.elliot@mandiant.com
diff --git a/data-manipulation/encryption/aes/manually-build-aes-constants-via-x86-assembly.yml b/data-manipulation/encryption/aes/manually-build-aes-constants-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: manually build AES constants
+    name: manually build AES constants via x86 assembly
     namespace: data-manipulation/encryption/aes
     authors:
       - huynh.t.nhan@gmail.com
diff --git a/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl-via-x86-assembly.yml b/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl-via-x86-assembly.yml
@@ -1,7 +1,7 @@
 # generated using capa explorer for IDA Pro
 rule:
   meta:
-    name: encrypt data using HC-128 via WolfSSL
+    name: encrypt data using HC-128 via WolfSSL via x86 assembly
     namespace: data-manipulation/encryption/hc-128
     authors:
       - blaine.stancill@mandiant.com
diff --git a/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-x86-assembly.yml b/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: encrypt data using HC-128
+    name: encrypt data using HC-128 via x86 assembly
     namespace: data-manipulation/encryption/hc-128
     authors:
       - awillia2@cisco.com
diff --git a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa-via-x86-assembly.yml b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: encrypt data using RC4 KSA
+    name: encrypt data using RC4 KSA via x86 assembly
     namespace: data-manipulation/encryption/rc4
     authors:
       - moritz.raabe@mandiant.com
diff --git a/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga-via-x86-assembly.yml b/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: encrypt data using RC4 PRGA
+    name: encrypt data using RC4 PRGA via x86 assembly
     namespace: data-manipulation/encryption/rc4
     authors:
       - moritz.raabe@mandiant.com
diff --git a/data-manipulation/encryption/rsa/encrypt-data-using-rsa-via-embedded-library-via-x86-assembly.yml b/data-manipulation/encryption/rsa/encrypt-data-using-rsa-via-embedded-library-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: encrypt data using RSA via embedded library
+    name: encrypt data using RSA via embedded library via x86 assembly
     namespace: data-manipulation/encryption/rsa
     authors:
       - "Ana06"
diff --git a/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk-via-x86-assembly.yml b/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: encrypt data using Sosemanuk
+    name: encrypt data using Sosemanuk via x86 assembly
     namespace: data-manipulation/encryption/sosemanuk
     authors:
       - awillia2@cisco.com
diff --git a/data-manipulation/encryption/tea/decrypt-data-using-tea-via-x86-assembly.yml b/data-manipulation/encryption/tea/decrypt-data-using-tea-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: decrypt data using TEA
+    name: decrypt data using TEA via x86 assembly
     namespace: data-manipulation/encryption/tea
     authors:
       - william.ballenthin@mandiant.com
diff --git a/data-manipulation/encryption/tea/encrypt-data-using-tea-via-x86-assembly.yml b/data-manipulation/encryption/tea/encrypt-data-using-tea-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: encrypt data using TEA
+    name: encrypt data using TEA via x86 assembly
     namespace: data-manipulation/encryption/tea
     authors:
       - william.ballenthin@mandiant.com
diff --git a/data-manipulation/encryption/xxtea/encrypt-data-using-xxtea-via-x86-assembly.yml b/data-manipulation/encryption/xxtea/encrypt-data-using-xxtea-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: encrypt data using XXTEA
+    name: encrypt data using XXTEA via x86 assembly
     namespace: data-manipulation/encryption/xxtea
     authors:
       - raymond.leong@mandiant.com
diff --git a/data-manipulation/hashing/djb2/hash-data-using-djb2-via-x86-assembly.yml b/data-manipulation/hashing/djb2/hash-data-using-djb2-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: hash data using djb2
+    name: hash data using djb2 via x86 assembly
     namespace: data-manipulation/hashing/djb2
     authors:
       - awillia2@cisco.com
diff --git a/data-manipulation/hashing/fnv/hash-data-using-fnv-via-x86-assembly.yml b/data-manipulation/hashing/fnv/hash-data-using-fnv-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: hash data using fnv
+    name: hash data using fnv via x86 assembly
     namespace: data-manipulation/hashing/fnv
     authors:
       - moritz.raabe@mandiant.com
diff --git a/data-manipulation/hashing/murmur/hash-data-using-murmur3-via-x86-assembly.yml b/data-manipulation/hashing/murmur/hash-data-using-murmur3-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: hash data using murmur3
+    name: hash data using murmur3 via x86 assembly
     namespace: data-manipulation/hashing/murmur
     authors:
       - william.ballenthin@mandiant.com
diff --git a/host-interaction/hardware/cpu/get-number-of-processors-via-x86-assembly.yml b/host-interaction/hardware/cpu/get-number-of-processors-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: get number of processors
+    name: get number of processors via x86 assembly
     namespace: host-interaction/hardware/cpu
     authors:
       - michael.hunhoff@mandiant.com
diff --git a/host-interaction/process/create/create-a-process-with-modified-io-handles-and-window-via-x86-assembly.yml b/host-interaction/process/create/create-a-process-with-modified-io-handles-and-window-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: create a process with modified I/O handles and window
+    name: create a process with modified I/O handles and window via x86 assembly
     namespace: host-interaction/process/create
     authors:
       - matthew.williams@mandiant.com
diff --git a/host-interaction/process/create/create-process-on-linux-via-x86-assembly.yml b/host-interaction/process/create/create-process-on-linux-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: create process on Linux
+    name: create process on Linux via x86 assembly
     namespace: host-interaction/process/create
     authors:
       - joakim@intezer.com
diff --git a/host-interaction/process/get-process-filename-via-x86-assembly.yml b/host-interaction/process/get-process-filename-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: get process filename
+    name: get process filename via x86 assembly
     namespace: host-interaction/process
     authors:
       - matthew.williams@mandiant.com
diff --git a/host-interaction/process/get-process-heap-flags-via-x86-assembly.yml b/host-interaction/process/get-process-heap-flags-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: get process heap flags
+    name: get process heap flags via x86 assembly
     namespace: host-interaction/process
     authors:
       - michael.hunhoff@mandiant.com
diff --git a/host-interaction/process/get-process-heap-force-flags-via-x86-assembly.yml b/host-interaction/process/get-process-heap-force-flags-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: get process heap force flags
+    name: get process heap force flags via x86 assembly
     namespace: host-interaction/process
     authors:
       - michael.hunhoff@mandiant.com
diff --git a/host-interaction/wmi/connect-to-wmi-namespace-via-wbemlocator-via-x86-assembly.yml b/host-interaction/wmi/connect-to-wmi-namespace-via-wbemlocator-via-x86-assembly.yml
@@ -1,7 +1,7 @@
 # generated using capa explorer for IDA Pro
 rule:
   meta:
-    name: connect to WMI namespace via WbemLocator
+    name: connect to WMI namespace via WbemLocator via x86 assembly
     namespace: host-interaction/wmi
     authors:
       - michael.hunhoff@mandiant.com
diff --git a/lib/calculate-modulo-256-via-x86-assembly-via-x86-assembly.yml b/lib/calculate-modulo-256-via-x86-assembly-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: calculate modulo 256 via x86 assembly
+    name: calculate modulo 256 via x86 assembly via x86 assembly
     authors:
       - moritz.raabe@mandiant.com
     lib: true
diff --git a/lib/contain-pusha-popa-sequence-via-x86-assembly.yml b/lib/contain-pusha-popa-sequence-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: contain pusha popa sequence
+    name: contain pusha popa sequence via x86 assembly
     authors:
       - moritz.raabe@mandiant.com
     lib: true
diff --git a/lib/get-os-version-via-x86-assembly.yml b/lib/get-os-version-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: get OS version
+    name: get OS version via x86 assembly
     authors:
       - "@mr-tz"
     lib: true
diff --git a/lib/peb-access-via-x86-assembly.yml b/lib/peb-access-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: PEB access
+    name: PEB access via x86 assembly
     authors:
       - michael.hunhoff@mandiant.com
     lib: true
diff --git a/lib/validate-payment-card-number-using-luhn-algorithm-with-lookup-table-via-x86-assembly.yml b/lib/validate-payment-card-number-using-luhn-algorithm-with-lookup-table-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: validate payment card number using luhn algorithm with lookup table
+    name: validate payment card number using luhn algorithm with lookup table via x86 assembly
     authors:
       - "@_re_fox"
     lib: true
diff --git a/lib/validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table-via-x86-assembly.yml b/lib/validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: validate payment card number using luhn algorithm with no lookup table
+    name: validate payment card number using luhn algorithm with no lookup table via x86 assembly
     authors:
       - "@_re_fox"
     lib: true
diff --git a/linking/runtime-linking/access-peb-ldr_data-via-x86-assembly.yml b/linking/runtime-linking/access-peb-ldr_data-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: access PEB ldr_data
+    name: access PEB ldr_data via x86 assembly
     namespace: linking/runtime-linking
     authors:
       - moritz.raabe@mandiant.com
diff --git a/linking/runtime-linking/get-kernel32-base-address-via-x86-assembly.yml b/linking/runtime-linking/get-kernel32-base-address-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: get kernel32 base address
+    name: get kernel32 base address via x86 assembly
     namespace: linking/runtime-linking
     authors:
       - moritz.raabe@mandiant.com
diff --git a/linking/runtime-linking/get-ntdll-base-address-via-x86-assembly.yml b/linking/runtime-linking/get-ntdll-base-address-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: get ntdll base address
+    name: get ntdll base address via x86 assembly
     namespace: linking/runtime-linking
     authors:
       - moritz.raabe@mandiant.com
diff --git a/linking/runtime-linking/populate-syswhispers2-syscall-list-via-x86-assembly.yml b/linking/runtime-linking/populate-syswhispers2-syscall-list-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: populate SysWhispers2 syscall list
+    name: populate SysWhispers2 syscall list via x86 assembly
     namespace: linking/runtime-linking
     authors:
       - still@teamt5.org
diff --git a/linking/runtime-linking/resolve-function-by-brute-ratel-badger-hash-via-x86-assembly.yml b/linking/runtime-linking/resolve-function-by-brute-ratel-badger-hash-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: resolve function by Brute Ratel Badger hash
+    name: resolve function by Brute Ratel Badger hash via x86 assembly
     namespace: linking/runtime-linking
     authors:
       - jakub.jozwiak@mandiant.com
diff --git a/linking/runtime-linking/resolve-function-by-fin8-fasthash-via-x86-assembly.yml b/linking/runtime-linking/resolve-function-by-fin8-fasthash-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: resolve function by FIN8 fasthash
+    name: resolve function by FIN8 fasthash via x86 assembly
     namespace: linking/runtime-linking
     authors:
       - "@r3c0nst (Frank Boldewin)"
diff --git a/linking/static/openssl/linked-against-openssl-via-x86-assembly.yml b/linking/static/openssl/linked-against-openssl-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: linked against OpenSSL
+    name: linked against OpenSSL via x86 assembly
     namespace: linking/static/openssl
     authors:
       - william.ballenthin@mandiant.com
diff --git a/load-code/pe/enumerate-pe-sections-via-x86-assembly.yml b/load-code/pe/enumerate-pe-sections-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: enumerate PE sections
+    name: enumerate PE sections via x86 assembly
     namespace: load-code/pe
     authors:
       - "@Ana06"
diff --git a/load-code/pe/parse-pe-header-via-x86-assembly.yml b/load-code/pe/parse-pe-header-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: parse PE header
+    name: parse PE header via x86 assembly
     namespace: load-code/pe
     authors:
       - moritz.raabe@mandiant.com
diff --git a/load-code/pe/rebuild-import-table-via-x86-assembly.yml b/load-code/pe/rebuild-import-table-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: rebuild import table
+    name: rebuild import table via x86 assembly
     namespace: load-code/pe
     authors:
       - "@Ana06"
diff --git a/load-code/pe/resolve-function-by-parsing-pe-exports-via-x86-assembly.yml b/load-code/pe/resolve-function-by-parsing-pe-exports-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: resolve function by parsing PE exports
+    name: resolve function by parsing PE exports via x86 assembly
     namespace: load-code/pe
     authors:
       - sara-rn
diff --git a/nursery/decode-data-using-base64-via-vbmi-lookup-table-via-x86-assembly.yml b/nursery/decode-data-using-base64-via-vbmi-lookup-table-via-x86-assembly.yml
@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: decode data using Base64 via VBMI lookup table
+    name: decode data using Base64 via VBMI lookup table via x86 assembly
     namespace: data-manipulation/encoding/base64
     authors:
       - still@teamt5.org
diff --git a/nursery/execute-syscall-via-x86-assembly.yml b/nursery/execute-syscall-via-x86-assembly.yml
diff --git a/nursery/get-ntoskrnl-base-address-via-x86-assembly.yml b/nursery/get-ntoskrnl-base-address-via-x86-assembly.yml
diff --git a/nursery/hook-routines-via-dlsym-rtld_next-via-x86-assembly.yml b/nursery/hook-routines-via-dlsym-rtld_next-via-x86-assembly.yml
diff --git a/nursery/reference-processor-manufacturer-constants-via-x86-assembly.yml b/nursery/reference-processor-manufacturer-constants-via-x86-assembly.yml
diff --git a/nursery/send-sms-on-android-via-x86-assembly.yml b/nursery/send-sms-on-android-via-x86-assembly.yml
