9. Appendices

• 9.1. Military Programming Law (MPL)
  • 9.1.1. Regulatory reminders
  • 9.1.2. Goal Reminders
  • 9.1.3. Reminders of requirements
  • 9.1.4. MPL applied to the GCenter
  • 9.1.5. Groups
• 9.2. Engine log data structure
  • 9.2.1. Counters of the header part of logs
  • 9.2.2. Counters of the source part of logs
• 9.3. Comparison of the counters between V02 and V103
  • 9.3.1. Beacon detect engine
  • 9.3.2. Malcore engine
  • 9.3.3. DGA engine
  • 9.3.4. Malicious powershell engine
  • 9.3.5. Shellcode engine
  • 9.3.6. Ransomware detect engine
  • 9.3.7. Sigflow alert
  • 9.3.8. Sigflow dcerpc
  • 9.3.9. Sigflow DGA
  • 9.3.10. Sigflow dhcp
  • 9.3.11. Sigflow dnp3
  • 9.3.12. Sigflow dns
  • 9.3.13. Sigflow file
  • 9.3.14. Sigflow ftp
  • 9.3.15. Sigflow ftp data
  • 9.3.16. Sigflow http
  • 9.3.17. Sigflow http2
  • 9.3.18. Sigflow ikev2
  • 9.3.19. Sigflow krb5
  • 9.3.20. Sigflow mqtt
  • 9.3.21. Sigflow netflow
  • 9.3.22. Sigflow nfs
  • 9.3.23. Sigflow rdp
  • 9.3.24. Sigflow rfb
  • 9.3.25. Sigfmow sip
  • 9.3.26. Sigflow SMB
  • 9.3.27. Sigflow SMTP
  • 9.3.28. Sigflow snmp
  • 9.3.29. Sigflow ssh
  • 9.3.30. Sigflow tftp
  • 9.3.31. Sigflow tls
  • 9.3.32. Yara engine
• 9.4. Malcore engine results