readme: remove reference to rule-category

This commit is contained in:
Willi Ballenthin
2020-07-01 14:30:39 -06:00
committed by GitHub
parent e5db226844
commit 101ef4ac0c
-19
View File
@@ -4,25 +4,6 @@ Standard collection of rules for [capa](https://ghe.eng.fireeye.com/FLARE/capa):
# philosophy
We want rule writing to be easy and fun! A larger rule corpus benefits everyone in the community and we encourage all kinds of contributions. If you have improvement ideas or encounter any issues, please let us know.
# structure
Most rules fit into an `$objective/$behavior/$technique` taxonomy.
This is specified via the `rule.meta.rule-category` field.
By convention, we organize the rule files into a directory structure that mirrors this taxonomy.
For example, the rule [send-data-on-socket.yml](./communication/communication-via-socket/send-data/send-data-on-socket.yml)
is found in the directory
[communication](./communication/) /
[communication-via-socket](./communication/communication-via-socket/) /
[send-data](./communication/communication-via-socket/send-data/)
that also matches the rule category.
Other directories here:
- [maec](./maec/) - rules that match a sample's "disposition" and "role", which are specified via MAEC vocabularies:
- disposition: [analysis-conclusion-ov](./maec/analysis-conclusion/)
- role: [malware-category-ov](./maec/malware-category/)
- [other-features](./other-features/) - miscellaneous attributes of a sample, such as "embedded PE" or "resource section".
# rule nursery
The rule [nursery](https://github.com/fireeye/capa-rules/tree/master/nursery) is a staging ground for rules that are not quite polished. Nursery rule logic should still be solid, though metadata may be incomplete. For example, rules that miss a public example of the technique.