c88979a1bc
fmt
2023-10-17 12:28:12 +00:00
05ee3df679
update scope syntax
2023-10-17 11:34:31 +00:00
9cb8848b03
Merge branch 'master' into dynamic-syntax
2023-10-17 10:29:30 +00:00
a39a2c0b52
Merge branch 'master' into update-alloc-rules
2023-10-11 12:03:42 +02:00
66f58dffa0
update match rule name
2023-10-11 11:20:23 +02:00
ed791c9b17
separate allocate and change memory protection
2023-10-11 11:14:14 +02:00
23cfa23626
Merge execute-dotnet-assembly-via-clr-host.yml with load-windows-common-language-runtime.yml and promote load-windows-common-language-runtime.yml ( #797 )
2023-10-09 11:59:52 -06:00
d20a7e0a48
add elaborative comment
2023-08-29 21:32:37 +02:00
d5f05f4e88
initial commit
2023-08-29 21:23:55 +02:00
5b73ddcd24
manual pass
2023-08-22 09:40:13 +02:00
0aea484e04
updated rules
2023-08-21 19:14:45 +02:00
c4cdd9bae7
fix improper scope for rules containing a subscope in and
2023-08-21 14:27:45 +02:00
a55d769da8
fix author quoting
2023-08-21 09:10:33 +02:00
8d851f3343
updated rules
2023-08-20 15:39:29 +02:00
850909bd82
update
2023-08-17 11:07:02 +02:00
e937af1ee6
initial commit
2023-08-17 10:41:11 +02:00
616fd90aac
loosen locality of features
2023-04-25 21:06:39 +02:00
708b06dd0a
Add capa rule load-code/shellcode/execute-shellcode-via-windows-callback-function.yml ( #744 )
...
* Add capa rule load-code/shellcode/execute-shellcode-via-callback-functions.yml
* Update load-code/shellcode/execute-shellcode-via-callback-functions.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com >
* Update load-code/shellcode/execute-shellcode-via-callback-functions.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com >
* Update load-code/shellcode/execute-shellcode-via-callback-functions.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com >
* Update execute-shellcode-via-callback-functions.yml
Omitted A and W on WinAPI function names since capa handles this automatically.
* Update execute-shellcode-via-callback-functions.yml
Added EnumTimeFormats and deduplicated EnumSystemCodePages
* Update and rename execute-shellcode-via-callback-functions.yml to execute-shellcode-via-windows-callback-function.yml
Renamed file to execute-shellcode-via-windows-callback-function.yml and merged https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml
* Delete execute-shellcode-via-enumuilanguages.yml
Delete rule due to merge with execute-shellcode-via-windows-callback-function.yml
---------
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com >
2023-04-19 09:56:15 -06:00
f81d04729a
specify offset operand to reduce FPs ( #716 )
...
* specify offset operand to reduce FPs
* add instruction specifics
2023-03-01 16:08:17 +01:00
06c3803bdd
Create execute-vbscript-javascript-or-jscript-in-memory.yml
2023-02-06 13:31:07 -05:00
ffe68a3051
Delete execute-vbscript-javascript-or-jscript-in-memory.yml
2023-02-06 13:30:56 -05:00
5a2ac59d15
Added in memory execution rule
2023-02-06 12:44:27 -05:00
75d5170065
Create execute-dotnet-assembly-via-clr-host.yml ( #688 )
2023-02-06 10:12:02 -07:00
761ccbab47
update ATT&CK/MBC meta data ( #675 )
...
* update ATT&CK/MBC meta data
2023-02-01 10:08:58 +01:00
86f8ac6ccd
Update Mappings for MBC (part 9)
2022-08-30 09:15:15 -04:00
9083a1950c
linter
2022-06-28 15:30:57 -06:00
57e1732f5c
Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""
...
This reverts commit d43a6ee544
2022-06-28 15:23:20 -06:00
7011634b0c
Merge pull request #553 from sara-rn/master
...
added parse-pe-export-data rule
2022-06-28 14:26:17 -06:00
504a94444e
resolve-function-by-parsing-pe-exports: fix linter suggestions
2022-06-28 14:25:11 -06:00
2d66aace99
*: add APIs used by .NET samples for basic interactions
2022-06-08 11:18:23 -06:00
88c9c786ca
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
d43a6ee544
Revert "Merge pull request #548 from mandiant/feature-remove-flavors"
...
This reverts commit bc28847dd982308c4109
2022-04-27 06:23:36 -06:00
904bf3ef00
*: remove /x32 and /x64 flavors and use instruction scope
2022-04-05 12:25:14 -06:00
efea9a37d9
Fix MBC names and IDs
2022-02-06 11:13:23 +01:00
7b91f0ceee
Merge pull request #514 from jtothej/shellcode-via-copyfile2
...
Adding execute-shellcode-via-copyfile2.yml
2021-12-14 14:51:17 -07:00
26d216249f
Merge pull request #516 from dzbeck/capa-3-mbc-updates
...
update mappings for mbc (part 7)
2021-12-14 14:45:25 -07:00
1294158df2
fix formatting
2021-12-14 16:37:31 -05:00
ed3661b379
add mbc and att&ck tags
2021-12-14 16:16:07 -05:00
4ea6e93ed9
Adding execute-shellcode-via-copyfile2.yml
2021-12-12 18:19:18 +08:00
c0b42ae17d
Adding execute-shellcode-via-createthreadpoolwait.yml
2021-12-11 22:07:29 +08:00
ad56aeb0e0
Merge pull request #505 from jtothej/shellcode-via-enumuilanguages
...
Adding execute-shellcode-via-enumuilanguages.yml
2021-12-06 10:57:12 -07:00
ee2bf8a2cd
Adding execute-shellcode-via-windows-fibers.yml
2021-12-04 19:51:35 +08:00
e431c428f0
Adding execute-shellcode-via-enumuilanguages.yml
2021-12-04 18:46:44 +08:00
e190179ffd
Merge pull request #1 from MBCProject/ryan-patches1
...
Update patch-process-command-line.yml
2021-11-22 11:27:15 -05:00
1cf2dbb47d
Delete parse-pe-exports.yml
2021-11-22 11:26:06 -05:00
33cdd98446
Update rebuild-import-table.yml
...
Resolve comment
2021-11-12 08:56:54 -06:00
6a02bdae83
Update parse-pe-exports.yml
...
Resolve comment
2021-11-12 08:56:27 -06:00
7a80910739
Update inspect-section-memory-permissions.yml
...
Resolve comment
2021-11-12 08:55:39 -06:00
2cf204d959
Update enumerate-pe-sections.yml
...
Resolving comment
2021-11-12 08:55:07 -06:00
1116322059
Merge pull request #487 from mandiant/williballenthin-patch-4
...
Delete parse-pe-exports.yml
2021-10-27 09:27:13 -06:00
Willi Ballenthin