ION28 / BLUESPAWN

An Active Defense and EDR software to empower Blue Teams
GNU General Public License v3.0
1.23k stars 167 forks source link

Modify scan triggers for associativity scans #357

Closed Jack-McDowell closed 4 years ago

Jack-McDowell commented 4 years ago

Some associativity scans are long and complicated while others are near instantaneous. More complicated associativity scans should only be run for more malicious things while quicker ones should be run in most if not all cases. Move the check to determine if the certainty is high enough into the scans themselves.

Jack-McDowell commented 4 years ago

Done in #370