HACKING

General:

* doc/* exists for a reason
* Cross link to related issues as https://github.com/timb-machine/linux-malware/issues/<N>
  in industry references
* Issue template can be found as .github/ISSUE_TEMPLATE/intel.yml
* Current intel workflow is something like:
  * src/tools/sync-issues.sh "updated:>=2022-04-25"
  * src/tools/generate-README.md.py
  * src/tools/generate-ATT&CK.md.py
  * src/tools/retrieve-articles.sh
  * src/tools/intel-lint.sh
  * src/tools/analyse-articles.pl
  * src/tools/sync-issues.sh "updated:>=2022-04-25"
* Current binary workflow is something like:
  * src/tools/unpack-binaries.sh
  * src/tools/scan-binaries.sh
  * src/tools/triage-binary.sh <binary name>
  * src/tools/binary-lint.sh

Commits:

* Automated commits from workflow should take form of "Updated <YYYYMMDDD>[.<N>]"
  unless they relate to:
  * Articles - "Added crudely archived articles"
  * Code - "Added referenced ... as submodules"
  * src & docs - "Added <path> to ..." and "Updated <path> to ..."

Tags:

* location: Industry reference > Location
* vertical: Industry reference > Vertical
* attack: - Industry reference > ATT&CK technique
* uses: - Industry reference > 
  * ksh93
  * Go
  * JavaScript
  * ElectronJS
  * Python
  * Perl
  * SHC
  * CrossCompile
  * Non-persistantStorage
  * RedirectionToNull
  * ProcessTreeSpoofing
  * ProcessTreeSpoofingBindMountProc
  * BPF
  * eBPF
  * DTrace
  * Auditd
  * LD_PRELOAD
  * LKM
  * PortHiding
  * k8s
* delivery: - Industry reference > Delivery
  * PyPI
  * NPM
* wltm - Malware reference > Binary wanted

Labels:

* new - on initial submission
* confirmed - vetted and issue cleaned up
* duplicate - duplicate finding
* deprecated - dummy issue
* enhancement - idea to improve the data
* ignore:malware - not really a specific piece of malware
* ignore:submodule - not really a specific offensive or defensive tool
* missing:classification - intel not classified
* missing:malware - sample not present
* missing:submodule - offensive or defensive tool not present
* missing:tactics - tactics not defined
* missing:tag: - industry reference not present, this can be any uses:/delivery: tag