admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,704 Commits 5 Branches 42 Tags
dynamic-syntax
Commit Graph

90 Commits

Author SHA1 Message Date
Willi Ballenthin 05ee3df679 update scope syntax 2023-10-17 11:34:31 +00:00
Willi Ballenthin 9cb8848b03 Merge branch 'master' into dynamic-syntax 2023-10-17 10:29:30 +00:00
Moritz a39a2c0b52 Merge branch 'master' into update-alloc-rules 2023-10-11 12:03:42 +02:00
mr-tz 66f58dffa0 update match rule name 2023-10-11 11:20:23 +02:00
mr-tz 5f223ea5ce rename rules 2023-10-11 11:17:13 +02:00
mr-tz ed791c9b17 separate allocate and change memory protection 2023-10-11 11:14:14 +02:00
Mike Hunhoff 2a37df98f5 adding new rules based on private Linux sample(s) (#821) 
* adding new rules based on private Linux sample(s)

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2023-10-09 18:27:33 +02:00
Yacine Elhamer d20a7e0a48 add elaborative comment 2023-08-29 21:32:37 +02:00
Yacine Elhamer d5f05f4e88 initial commit 2023-08-29 21:23:55 +02:00
Yacine Elhamer 5b73ddcd24 manual pass 2023-08-22 09:40:13 +02:00
Yacine Elhamer 0aea484e04 updated rules 2023-08-21 19:14:45 +02:00
Yacine Elhamer 3a42318eae fix improper scope for rules containing a subscope in and 2023-08-21 14:33:12 +02:00
Yacine Elhamer c4cdd9bae7 fix improper scope for rules containing a subscope in and 2023-08-21 14:27:45 +02:00
Yacine Elhamer a55d769da8 fix author quoting 2023-08-21 09:10:33 +02:00
Yacine Elhamer 8d851f3343 updated rules 2023-08-20 15:39:29 +02:00
mr-tz 64d3a359d3 fix example function address 2023-08-19 11:27:55 +02:00
Yacine Elhamer 850909bd82 update 2023-08-17 11:07:02 +02:00
Yacine Elhamer e937af1ee6 initial commit 2023-08-17 10:41:11 +02:00
JJ 1d6c6cbc56 Update host-interaction/process/inject/inject-shellcode-using-window-subclass-procedure.yml 
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
 2023-07-06 18:56:09 +08:00
jtothej fb55d37726 Add inject-shellcode-using-extra-window-memory.yml and inject-shellcode-using-window-subclass-procedure.yml 2023-07-06 16:19:40 +08:00
Moritz 21077c2908 revert MBC 
E1055.004 cannot be validated at the moment
 2023-06-28 07:50:07 +02:00
ryan 153d4c0d2c Update Mappings for MBC 2023-06-21 10:45:01 -04:00
Moritz 977ad92ea3 improve debug detection features (#721) 2023-03-14 19:30:12 +01:00
Willi Ballenthin 5941a484b5 add section access/map rules (#681) 
* add section access/map rules

closes #4

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2023-02-02 09:11:46 +01:00
Ryan Xu 74596020b8 Update Mappings for MBC (part 10) (#674) 
* Update capa mappings 01/2023

---------

Co-authored-by: Desiree Beck <dbeck@mitre.org>
 2023-02-01 10:09:34 +01:00
Moritz b48fcd5dd8 improve rules that often match (#655) 
* improve rules that often match
 2023-01-09 14:07:53 +01:00
Mike Hunhoff 96a1abddca new/update .NET rules (#625) 2022-10-07 09:39:57 -06:00
Anushka Virgaonkar 1fbee15a3c Add dotnet rules having property features (#601) 2022-10-03 09:28:05 -06:00
Moritz e88db21de4 fix: rule logic (#592) 
* fix: rule logic

* fix: rule logic
 2022-07-12 18:09:51 +02:00
Anushka Virgaonkar 95dc5eb27f Add new dotnet rules that capture capabilites typically found in backdoors. (#579) 2022-07-07 13:39:51 -06:00
Willi Ballenthin 57e1732f5c Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors"" 
This reverts commit d43a6ee544.
 2022-06-28 15:23:20 -06:00
Mike Hunhoff d4af075660 dotnet rule updates (#566) 2022-06-28 15:16:24 -06:00
William Ballenthin 2d66aace99 *: add APIs used by .NET samples for basic interactions 2022-06-08 11:18:23 -06:00
Willi Ballenthin 88c9c786ca *: use meta.authors everywhere 2022-05-26 11:56:31 -06:00
William Ballenthin d43a6ee544 Revert "Merge pull request #548 from mandiant/feature-remove-flavors" 
This reverts commit bc28847dd9, reversing
changes made to 82308c4109.
 2022-04-27 06:23:36 -06:00
Willi Ballenthin 904bf3ef00 *: remove /x32 and /x64 flavors and use instruction scope 2022-04-05 12:25:14 -06:00
Michael Hunhoff 94f1639cb4 update hijack-thread-execution.yml to match additional scenarios 2022-03-23 09:01:25 -06:00
Baptistin Boilot efea9a37d9 Fix MBC names and IDs 2022-02-06 11:13:23 +01:00
jtothej bffb8e1233 Renaming inject-shellcode-using-mapping-injection.yml 2021-12-14 10:44:32 +08:00
jtothej b70a876a26 Adding inject-shellcode-using-mapping-injection.yml 2021-12-12 16:07:58 +08:00
Ryan Xu 607a06e184 Adding changes suggested by Mandiant 2021-11-23 09:01:53 -05:00
Desiree Beck e190179ffd Merge pull request #1 from MBCProject/ryan-patches1 
Update patch-process-command-line.yml
 2021-11-22 11:27:15 -05:00
William Ballenthin 8b8b584e2d injection: add ATT&CK Reflective Code Loading 
closes #477
 2021-10-22 12:43:30 -06:00
Moritz Raabe 25938ca10c change to mandiant.com 2021-09-28 12:21:11 +02:00
William Ballenthin f6b9564332 *: fix ntdll/ntoskrnl lints 2021-08-26 17:52:24 -06:00
William Ballenthin c0fa8a2318 linux: add examples 2021-08-26 17:48:20 -06:00
William Ballenthin ea3ea14c22 minor reorg linux rules and logic 
ref #442
 2021-08-25 15:31:51 -06:00
Willi Ballenthin 6f582bd395 Merge pull request #442 from TcM1911/linux-rules 
A set of rules for Linux ELFs
 2021-08-25 14:33:25 -06:00
William Ballenthin 0ef69c4fbd *: use substring features rather than unreadable regexes 
closes #450
 2021-08-24 12:47:26 -06:00
Ryan Xu b4e040dc50 preliminary mapping 2021-08-23 14:11:00 -05:00