admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,704 Commits 5 Branches 42 Tags
dynamic-syntax
Commit Graph

32 Commits

Author SHA1 Message Date
Willi Ballenthin 9cb8848b03 Merge branch 'master' into dynamic-syntax 2023-10-17 10:29:30 +00:00
Mike Hunhoff 2a37df98f5 adding new rules based on private Linux sample(s) (#821) 
* adding new rules based on private Linux sample(s)

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2023-10-09 18:27:33 +02:00
Yacine Elhamer 5b73ddcd24 manual pass 2023-08-22 09:40:13 +02:00
Yacine Elhamer 0aea484e04 updated rules 2023-08-21 19:14:45 +02:00
Yacine Elhamer c4cdd9bae7 fix improper scope for rules containing a subscope in and 2023-08-21 14:27:45 +02:00
Yacine Elhamer a55d769da8 fix author quoting 2023-08-21 09:10:33 +02:00
Yacine Elhamer 8d851f3343 updated rules 2023-08-20 15:39:29 +02:00
Yacine Elhamer e937af1ee6 initial commit 2023-08-17 10:41:11 +02:00
Mike Hunhoff dda76eadde new/update rules using .NET ctor method (#626) 2022-10-13 08:36:31 -06:00
Anushka Virgaonkar 95dc5eb27f Add new dotnet rules that capture capabilites typically found in backdoors. (#579) 2022-07-07 13:39:51 -06:00
Willi Ballenthin 88c9c786ca *: use meta.authors everywhere 2022-05-26 11:56:31 -06:00
Desiree Beck e190179ffd Merge pull request #1 from MBCProject/ryan-patches1 
Update patch-process-command-line.yml
 2021-11-22 11:27:15 -05:00
Moritz Raabe 25938ca10c change to mandiant.com 2021-09-28 12:21:11 +02:00
Ryan Xu 0114138ae4 More detailed mappings 2021-08-31 11:34:09 -05:00
William Ballenthin f6b9564332 *: fix ntdll/ntoskrnl lints 2021-08-26 17:52:24 -06:00
William Ballenthin ea3ea14c22 minor reorg linux rules and logic 
ref #442
 2021-08-25 15:31:51 -06:00
Willi Ballenthin 6f582bd395 Merge pull request #442 from TcM1911/linux-rules 
A set of rules for Linux ELFs
 2021-08-25 14:33:25 -06:00
Ryan Xu b4e040dc50 preliminary mapping 2021-08-23 14:11:00 -05:00
Joakim Kennedy 765e182553 A set of rules for Linux ELFs 2021-08-04 15:47:00 +01:00
Moritz Raabe d81e757728 adding rules based on more PMA labs 2021-06-30 23:38:17 +02:00
William Ballenthin c46a2b0e82 graduate "enumerate threads" 2021-06-08 10:04:14 -06:00
Moritz Raabe 0eddb61a9c rule updates 2021-01-29 13:27:29 +01:00
0x534a 29fbeec36a Adjusts test file of hijack-thread-execution.yml, resolves conflict in inject-thread.yml and removes articles from rules 2021-01-28 15:28:53 +01:00
0x534a 8c93d205a8 Improve injection detection and some refactoring of existing rules 2021-01-28 14:47:31 +01:00
Moritz Raabe 387334a603 reformated using capafmt 2021-01-27 15:30:59 +01:00
Michael Hunhoff e721348144 PR change requests 2021-01-07 13:06:35 -07:00
Michael Hunhoff cab448c6f6 new rules and rule updates from B5F85C26D7AA5A1FB4AF5821B6B5AB9B 2020-12-31 08:44:23 -07:00
Desiree Beck c5d24c671a added mbc mappings in the host-interaction namespace 2020-12-16 15:30:06 -05:00
Michael Hunhoff ae901da3a4 adding new rules to nursery, updating create-thread.yml 2020-09-17 13:35:41 -06:00
William Ballenthin 54cfb05bd0 rules: address comments in #14 2020-06-26 17:45:56 -06:00
William Ballenthin 7b4f4d10fb rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better 2020-06-21 17:54:01 -06:00
William Ballenthin 5f57dbdbc9 rules: reorganize rule names, namespaces, and ATT&CK mappings 2020-06-21 17:25:43 -06:00