admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,704 Commits 5 Branches 42 Tags
dynamic-syntax
Commit Graph

29 Commits

Author SHA1 Message Date
Yacine Elhamer 5b73ddcd24 manual pass 2023-08-22 09:40:13 +02:00
Yacine Elhamer 0aea484e04 updated rules 2023-08-21 19:14:45 +02:00
Yacine Elhamer c4cdd9bae7 fix improper scope for rules containing a subscope in and 2023-08-21 14:27:45 +02:00
Yacine Elhamer a55d769da8 fix author quoting 2023-08-21 09:10:33 +02:00
Yacine Elhamer 8d851f3343 updated rules 2023-08-20 15:39:29 +02:00
Yacine Elhamer e937af1ee6 initial commit 2023-08-17 10:41:11 +02:00
Anushka Virgaonkar 1fbee15a3c Add dotnet rules having property features (#601) 2022-10-03 09:28:05 -06:00
Moritz e88db21de4 fix: rule logic (#592) 
* fix: rule logic

* fix: rule logic
 2022-07-12 18:09:51 +02:00
Willi Ballenthin 57e1732f5c Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors"" 
This reverts commit d43a6ee544.
 2022-06-28 15:23:20 -06:00
William Ballenthin 2d66aace99 *: add APIs used by .NET samples for basic interactions 2022-06-08 11:18:23 -06:00
Willi Ballenthin 88c9c786ca *: use meta.authors everywhere 2022-05-26 11:56:31 -06:00
William Ballenthin d43a6ee544 Revert "Merge pull request #548 from mandiant/feature-remove-flavors" 
This reverts commit bc28847dd9, reversing
changes made to 82308c4109.
 2022-04-27 06:23:36 -06:00
Willi Ballenthin 904bf3ef00 *: remove /x32 and /x64 flavors and use instruction scope 2022-04-05 12:25:14 -06:00
Moritz Raabe 25938ca10c change to mandiant.com 2021-09-28 12:21:11 +02:00
William Ballenthin c0fa8a2318 linux: add examples 2021-08-26 17:48:20 -06:00
William Ballenthin ea3ea14c22 minor reorg linux rules and logic 
ref #442
 2021-08-25 15:31:51 -06:00
Willi Ballenthin 6f582bd395 Merge pull request #442 from TcM1911/linux-rules 
A set of rules for Linux ELFs
 2021-08-25 14:33:25 -06:00
William Ballenthin 39e87e6cb4 execute-command: use better example 2021-08-18 14:45:48 -06:00
Joakim Kennedy 78fbf5f3c5 Fix linting errors 2021-08-05 15:35:27 +01:00
Joakim Kennedy 765e182553 A set of rules for Linux ELFs 2021-08-04 15:47:00 +01:00
Moritz Raabe d81e757728 adding rules based on more PMA labs 2021-06-30 23:38:17 +02:00
William Ballenthin 913cebdb38 Merge branch 'master' into fix-1 2021-05-18 10:48:06 -06:00
William Ballenthin 6e501e8151 rules: convert inline comments to descriptions 
closes #1
 2021-05-18 10:45:41 -06:00
Moritz c24ab23bc1 ATT&CK v9 updates (#341) 
* update rules

* add example

* update namespace and move

* add rule

* remove HKCU

* update rules

* update rule
 2021-05-06 20:06:24 +02:00
Moritz Raabe 77b737fcf0 rule tweaks based on PMA Lab 03-02.dll 
see #296
 2021-03-22 19:05:08 +01:00
Desiree Beck c5d24c671a added mbc mappings in the host-interaction namespace 2020-12-16 15:30:06 -05:00
William Ballenthin 54cfb05bd0 rules: address comments in #14 2020-06-26 17:45:56 -06:00
William Ballenthin 7b4f4d10fb rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better 2020-06-21 17:54:01 -06:00
William Ballenthin 5f57dbdbc9 rules: reorganize rule names, namespaces, and ATT&CK mappings 2020-06-21 17:25:43 -06:00