Update capa to v8.0.1 (#174)

* Update disable-or-evade-security-tools.md

Added overwrite DLL .text section to remove hooks rule released in 7.2

* Update socket-communication.md

Added rule "attach BPF to socket on Linux" released in v 7.2

* Update self-deletion.md

Updated for congruence with CAPA 7.2 changes

* Update hijack-execution-flow.md

Updated APIs for "execute shellcode via Windows callback function"

* Update software-packing.md

Added "packed with nmm-protect" from CAPA 7.4

anti-static-analysis/software-packing.md

@@ -88,6 +88,7 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software
 |[packed with nspack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/nspack/packed-with-nspack.yml)|Software Packing (F0001)|--|
 |[packed with kkrunchy](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/kkrunchy/packed-with-kkrunchy.yml)|Software Packing (F0001)|--|
 |[packed with PESpin](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pespin/packed-with-pespin.yml)|Software Packing (F0001)|--|
+|[packed with nmm-protect](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/nmm-protect/packed-with-nmm-protect.yml)|Software Packing::VMProtect (F0001.010)|--|
 
 |Tool: CAPE|Mapping|APIs|
 |---|---|---|

defense-evasion/disable-or-evade-security-tools.md

@@ -67,6 +67,7 @@ See ATT&CK: **Impair Defenses: Disable or Modify Tools ([T1562.001](https://atta
 |[protect spawned processes with mitigation policies](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/protect-spawned-processes-with-mitigation-policies.yml)|Disable or Evade Security Tools::Modify Policy (F0004.005)|UpdateProcThreadAttribute|
 |[bypass Windows File Protection](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml)|Disable or Evade Security Tools::Bypass Windows File Protection (F0004.007)|--|
 |[disable driver code integrity](https://github.com/mandiant/capa-rules/blob/master/host-interaction/driver/disable-driver-code-integrity.yml)|Disable or Evade Security Tools::Disable Code Integrity (F0004.009)|--|
+|[overwrite DLL .text section to remove hooks](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/overwrite-dll-text-section-to-remove-hooks.yml)|Disable or Evade Security Tools (F0004)|GetModuleHandle, GetModuleHandleEx|
 
 |Tool: CAPE|Mapping|APIs|
 |---|---|---|

defense-evasion/hijack-execution-flow.md

@@ -71,7 +71,7 @@ See ATT&CK: **Hijack Execution Flow ([T1574](https://attack.mitre.org/techniques
 |Tool: capa|Mapping|APIs|
 |---|---|---|
 |[create new application domain in .NET](https://github.com/mandiant/capa-rules/blob/master/host-interaction/memory/create-new-application-domain-in-dotnet.yml)|Hijack Execution Flow (F0015)|--|
-|[execute shellcode via Windows callback function](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml)|Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)|CallWindowProc, EnumCalendarInfo, EnumCalendarInfoEx, EnumDateFormats, GrayString, LineDDA, EnumChildWindows, EnumDesktops, EnumDesktopWindows, EnumFontFamilies, EnumFontFamiliesEx, EnumFonts, EnumProps, EnumPropsEx, EnumResourceTypes, EnumSystemCodePages, EnumSystemGeoID, EnumSystemLanguageGroups, EnumSystemLocales, EnumThreadWindows, EnumUILanguages, EnumWindows, EnumChildWindows, EnumTimeFormats|
+|[execute shellcode via Windows callback function](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml)|Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)|AddPropSheetPageProc, CallWindowProc, CertEnumSystemStore, CertEnumSystemStoreLocator, CreateTimerQueueTimer, CryptEnumOIDInfo, DPA_Create, DPA_SetPtr, DPA_EnumCallback, DSA_Create, DSA_InsertItem, DSA_EnumCallback, DrawState, EnumCalendarInfo, EnumCalendarInfoEx, EnumDateFormats, GrayString, ImmEnumInputContext, LineDDA, EnumChildWindows, EnumDesktops, EnumDesktopWindows, EnumDirTree, EnumDisplayMonitors, EnumFontFamilies, EnumFontFamiliesEx, EnumFonts, EnumLanguageGroupLocales, GetDC, GetDCEx, EnumObjects, EnumProps, EnumPropsEx, EnumPwrSchemes, EnumResourceTypes, EnumSystemCodePages, EnumSystemGeoID, EnumSystemGeoNames, EnumSystemLanguageGroups, EnumSystemLocales, EnumThreadWindows, EnumUILanguages, EnumWindows, EnumWindowsStations, EnumerateLoadedModules, EnumTimeFormats, SymInitialize, SymEnumProcesses, SymRegisterCallback, VerifierEnumerateResource|
 |[rebuild import table](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/rebuild-import-table.yml)|Hijack Execution Flow::Import Address Table Hooking (F0015.003)|LoadLibraryA, GetProcAddress|
 
 |Tool: CAPE|Mapping|APIs|

defense-evasion/self-deletion.md

@@ -54,7 +54,7 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630
 |Tool: capa|Mapping|APIs|
 |---|---|---|
 |[self delete](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/self-deletion/self-delete.yml)|Self Deletion::COMSPEC Environment Variable (F0007.001)|--|
-|[self delete using alternate data streams](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml)|Defense Evasion::Self Deletion (F0007)|SetFileInformationByHandle|
+|[self delete using alternate data streams](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml)|Defense Evasion::Self Deletion (F0007)|SetFileInformationByHandle, kernel32.SetFileInformationByHandle|
 
 |Tool: CAPE|Mapping|APIs|
 |---|---|---|

micro-behaviors/communication/socket-communication.md

@@ -82,6 +82,7 @@ Instead of being listed alphabetically, methods have been grouped to better faci
 |[create UDP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/udp/send/create-udp-socket.yml)|Socket Communication::Create UDP Socket (C0001.010)|ws2_32.socket, ws2_32.WSASocket, socket, WSASocketA, WSASocketW, System.Net.Sockets.Socket::ctor, System.Net.Sockets.UdpClient::ctor|
 |[send data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/send/send-data-on-socket.yml)|Socket Communication::Send Data (C0001.007)|ws2_32.send, ws2_32.sendto, ws2_32.WSASend, ws2_32.WSASendMsg, ws2_32.WSASendTo, send, sendto, WSASend, WSASendTo, System.Net.Sockets.Socket::Send, System.Net.Sockets.Socket::SendAsync, System.Net.Sockets.Socket::SendTo, System.Net.Sockets.Socket::SendToAsync, System.Net.Sockets.UdpClient::Send|
 |[receive data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/receive/receive-data-on-socket.yml)|Socket Communication::Receive Data (C0001.006)|ws2_32.recv, ws2_32.recvfrom, ws2_32.WSARecv, ws2_32.WSARecvDisconnect, ws2_32.WSARecvEx, ws2_32.WSARecvFrom, ws2_32.WSARecvMsg, recv, WSARecv, WSARecvDisconnect, WSARecvFrom, recvmsg, System.Net.Sockets.Socket::Receive, System.Net.Sockets.Socket::ReceiveAsync, System.Net.Sockets.Socket::ReceiveFrom, System.Net.Sockets.Socket::ReceiveFromAsync, System.Net.Sockets.Socket::ReceiveMessageFrom, System.Net.Sockets.Socket::ReceiveMessageFromAsync, System.Net.Sockets.Socket::BeginReceive, System.Net.Sockets.Socket::BeginReceiveFrom, System.Net.Sockets.Socket::BeginReceiveMessageFrom, System.Net.Sockets.Socket::EndReceive, System.Net.Sockets.Socket::EndReceiveFrom, System.Net.Sockets.Socket::EndReceiveMessageFrom|
+|[attach BPF to socket on Linux](https://github.com/mandiant/capa-rules/blob/master/communication/socket/attach-bpf-to-socket-on-linux.yml)|Socket Communication::Set Socket Config (C0001.001)|setsockopt|
 
 |Tool: CAPE|Class|Mapping|APIs|
 |---|---|---|---|