├── LICENSE.txt ├── MalwareHashes.txt ├── MitreTechniques.json ├── MitreTechniques.xlsx ├── README.md ├── snort ├── cve_2021_22893.rules ├── cve_2021_22893_2.rules ├── cve_2021_22893_3.rules ├── pulsecheck1.rules ├── pulsecheck2.rules ├── slightpulse1.rules ├── slightpulse2.rules ├── slightpulse3.rules ├── steadypulse1.rules ├── steadypulse2.rules ├── steadypulse3.rules └── steadypulse4.rules └── yara ├── atrium.yar ├── atrium2.yar ├── bloodbank.yar ├── bloodbank2.yar ├── bloodmine.yar ├── bloodmine2.yar ├── cleanpulse.yar ├── cleanpulse2.yar ├── hardpulse.yar ├── lockpick.yar ├── pacemaker_linux32.yar ├── pacemaker_linux64.yar ├── pulsecheck.yar ├── pulsejump.yar ├── quietpulse.yar ├── radialpulse.yar ├── radialpulse2.yar ├── radialpulse3.yar ├── rapidpulse.yar ├── slightpulse.yar ├── slowpulse.yar ├── slowpulse2.yar ├── steadypulse.yar ├── thinblood.yar ├── thinblood2.yar └── thinblood3.yar /LICENSE.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/LICENSE.txt -------------------------------------------------------------------------------- /MalwareHashes.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/MalwareHashes.txt -------------------------------------------------------------------------------- /MitreTechniques.json: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/MitreTechniques.json -------------------------------------------------------------------------------- /MitreTechniques.xlsx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/MitreTechniques.xlsx -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/README.md -------------------------------------------------------------------------------- /snort/cve_2021_22893.rules: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/snort/cve_2021_22893.rules -------------------------------------------------------------------------------- /snort/cve_2021_22893_2.rules: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/snort/cve_2021_22893_2.rules -------------------------------------------------------------------------------- /snort/cve_2021_22893_3.rules: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/snort/cve_2021_22893_3.rules -------------------------------------------------------------------------------- /snort/pulsecheck1.rules: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/snort/pulsecheck1.rules -------------------------------------------------------------------------------- /snort/pulsecheck2.rules: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/snort/pulsecheck2.rules -------------------------------------------------------------------------------- /snort/slightpulse1.rules: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/snort/slightpulse1.rules -------------------------------------------------------------------------------- /snort/slightpulse2.rules: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/snort/slightpulse2.rules -------------------------------------------------------------------------------- /snort/slightpulse3.rules: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/snort/slightpulse3.rules -------------------------------------------------------------------------------- /snort/steadypulse1.rules: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/snort/steadypulse1.rules -------------------------------------------------------------------------------- /snort/steadypulse2.rules: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/snort/steadypulse2.rules -------------------------------------------------------------------------------- /snort/steadypulse3.rules: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/snort/steadypulse3.rules -------------------------------------------------------------------------------- /snort/steadypulse4.rules: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/snort/steadypulse4.rules -------------------------------------------------------------------------------- /yara/atrium.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/atrium.yar -------------------------------------------------------------------------------- /yara/atrium2.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/atrium2.yar -------------------------------------------------------------------------------- /yara/bloodbank.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/bloodbank.yar -------------------------------------------------------------------------------- /yara/bloodbank2.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/bloodbank2.yar -------------------------------------------------------------------------------- /yara/bloodmine.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/bloodmine.yar -------------------------------------------------------------------------------- /yara/bloodmine2.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/bloodmine2.yar -------------------------------------------------------------------------------- /yara/cleanpulse.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/cleanpulse.yar -------------------------------------------------------------------------------- /yara/cleanpulse2.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/cleanpulse2.yar -------------------------------------------------------------------------------- /yara/hardpulse.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/hardpulse.yar -------------------------------------------------------------------------------- /yara/lockpick.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/lockpick.yar -------------------------------------------------------------------------------- /yara/pacemaker_linux32.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/pacemaker_linux32.yar -------------------------------------------------------------------------------- /yara/pacemaker_linux64.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/pacemaker_linux64.yar -------------------------------------------------------------------------------- /yara/pulsecheck.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/pulsecheck.yar -------------------------------------------------------------------------------- /yara/pulsejump.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/pulsejump.yar -------------------------------------------------------------------------------- /yara/quietpulse.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/quietpulse.yar -------------------------------------------------------------------------------- /yara/radialpulse.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/radialpulse.yar -------------------------------------------------------------------------------- /yara/radialpulse2.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/radialpulse2.yar -------------------------------------------------------------------------------- /yara/radialpulse3.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/radialpulse3.yar -------------------------------------------------------------------------------- /yara/rapidpulse.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/rapidpulse.yar -------------------------------------------------------------------------------- /yara/slightpulse.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/slightpulse.yar -------------------------------------------------------------------------------- /yara/slowpulse.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/slowpulse.yar -------------------------------------------------------------------------------- /yara/slowpulse2.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/slowpulse2.yar -------------------------------------------------------------------------------- /yara/steadypulse.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/steadypulse.yar -------------------------------------------------------------------------------- /yara/thinblood.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/thinblood.yar -------------------------------------------------------------------------------- /yara/thinblood2.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/thinblood2.yar -------------------------------------------------------------------------------- /yara/thinblood3.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/pulsesecure_exploitation_countermeasures/HEAD/yara/thinblood3.yar --------------------------------------------------------------------------------