admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,704 Commits 5 Branches 42 Tags
dynamic-syntax
Commit Graph

43 Commits

Author SHA1 Message Date
Willi Ballenthin 9cb8848b03 Merge branch 'master' into dynamic-syntax 2023-10-17 10:29:30 +00:00
Mike Hunhoff 2a37df98f5 adding new rules based on private Linux sample(s) (#821) 
* adding new rules based on private Linux sample(s)

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2023-10-09 18:27:33 +02:00
Yacine Elhamer d20a7e0a48 add elaborative comment 2023-08-29 21:32:37 +02:00
Yacine Elhamer d5f05f4e88 initial commit 2023-08-29 21:23:55 +02:00
Yacine Elhamer 5b73ddcd24 manual pass 2023-08-22 09:40:13 +02:00
Yacine Elhamer 0aea484e04 updated rules 2023-08-21 19:14:45 +02:00
Yacine Elhamer c4cdd9bae7 fix improper scope for rules containing a subscope in and 2023-08-21 14:27:45 +02:00
Yacine Elhamer a55d769da8 fix author quoting 2023-08-21 09:10:33 +02:00
Yacine Elhamer 8d851f3343 updated rules 2023-08-20 15:39:29 +02:00
Yacine Elhamer 850909bd82 update 2023-08-17 11:07:02 +02:00
Yacine Elhamer e937af1ee6 initial commit 2023-08-17 10:41:11 +02:00
jtothej 098dacbae1 Add create-vmci-socket.yml 2023-07-04 14:24:29 +08:00
ryan 153d4c0d2c Update Mappings for MBC 2023-06-21 10:45:01 -04:00
Mike Hunhoff 63a4c6d5db improve .NET detections incl. sockets, files, directories (#708) 2023-02-23 09:45:49 +01:00
Mike Hunhoff c9f7f685dd update recieve-data-on-socket for .NET (#707) 2023-02-22 12:24:16 -07:00
Blas 005f9ced10 Rule for raw socket creation (#696) 
* Create create-raw-socket-in-windows.yml

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2023-02-15 17:45:38 +01:00
Willi Ballenthin 4658e8dd4c add create tcp socket via raw AFD driver 
closes #537
 2023-02-01 11:47:52 +01:00
Mike Hunhoff dda76eadde new/update rules using .NET ctor method (#626) 2022-10-13 08:36:31 -06:00
Anushka Virgaonkar 1fbee15a3c Add dotnet rules having property features (#601) 2022-10-03 09:28:05 -06:00
Anushka Virgaonkar 95dc5eb27f Add new dotnet rules that capture capabilites typically found in backdoors. (#579) 2022-07-07 13:39:51 -06:00
Willi Ballenthin 57e1732f5c Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors"" 
This reverts commit d43a6ee544.
 2022-06-28 15:23:20 -06:00
Willi Ballenthin 88c9c786ca *: use meta.authors everywhere 2022-05-26 11:56:31 -06:00
idiom 49ac35dbe7 Update rules to use a list item instead of a string value for references. 2022-05-11 10:39:42 -04:00
William Ballenthin d43a6ee544 Revert "Merge pull request #548 from mandiant/feature-remove-flavors" 
This reverts commit bc28847dd9, reversing
changes made to 82308c4109.
 2022-04-27 06:23:36 -06:00
Willi Ballenthin 904bf3ef00 *: remove /x32 and /x64 flavors and use instruction scope 2022-04-05 12:25:14 -06:00
Desiree Beck ed3661b379 add mbc and att&ck tags 2021-12-14 16:16:07 -05:00
Moritz Raabe 25938ca10c change to mandiant.com 2021-09-28 12:21:11 +02:00
jlepore-fe 92972fd988 update function ptr size comments 2021-09-08 10:05:27 -04:00
jlepore-fe 9d1338113b transmitpackets callback function via wsaioctl (#456) 
* transmitpackets callback function via wsaioctl

* Update communication/socket/tcp/send/wsaioctl_transmitpackets_callbackfunc.yml

Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>

* Update and rename wsaioctl_transmitpackets_callbackfunc.yml to obtain-transmitpackets-callback-function-via-wsaioctl

* Rename obtain-transmitpackets-callback-function-via-wsaioctl to obtain-transmitpackets-callback-function-via-wsaioctl.yml

* Update obtain-transmitpackets-callback-function-via-wsaioctl.yml

* Update obtain-transmitpackets-callback-function-via-wsaioctl.yml

Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
 2021-08-30 18:30:14 +02:00
Joakim Kennedy 78fbf5f3c5 Fix linting errors 2021-08-05 15:35:27 +01:00
Joakim Kennedy 765e182553 A set of rules for Linux ELFs 2021-08-04 15:47:00 +01:00
Willi Ballenthin 1f48bd02a6 whitespace 2021-02-04 16:38:09 -07:00
Willi Ballenthin ebb14294b1 whitespace 2021-02-04 16:28:13 -07:00
Willi Ballenthin 06984304e4 connect-tcp-socket: add SO_UPDATE_CONNECT_CONTEXT 2021-02-04 16:25:44 -07:00
Willi Ballenthin b7809dae41 connect-tcp-socket: add SIO_GET_EXTENSION_FUNCTION_POINTER 2021-02-04 16:22:51 -07:00
Willi Ballenthin 0f6e2dacb3 connect-tcp-socket: fix lint issue 2021-02-04 16:20:27 -07:00
Willi Ballenthin f44903cb53 connect-tcp-socket: add ConnectEx via WSAID_CONNECTEX 2021-02-04 16:18:01 -07:00
William Ballenthin f8a3de9367 update attack mappings 2021-01-02 11:46:20 -07:00
Moritz Raabe 47c1b485c0 fix mbc objective 2020-10-01 10:30:08 +02:00
Desiree Beck 69e7479e40 mapping capa rule updates 2020-09-29 15:05:11 -04:00
Moritz Raabe b585c0ef73 update to basic block scope 2020-07-11 14:02:30 +02:00
William Ballenthin 7b4f4d10fb rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better 2020-06-21 17:54:01 -06:00
William Ballenthin 5f57dbdbc9 rules: reorganize rule names, namespaces, and ATT&CK mappings 2020-06-21 17:25:43 -06:00