 Willi Ballenthin
|
c1d20764ad
|
use "span of calls" scope (#973)
* use sequence scope instead of thread scope for "static: function" rules
* use sequence scope instead of thread scope for "static: basic block" rules
* make runtime linking rules more concise
* doc: describe sequence scope
* rename "sequence" scope to "span of calls" scope
* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/get-geographical-location.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/file-managers/gather-classicftp-information.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/wmi/reference-wmi-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/sql/reference-sql-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
---------
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
|
2025-01-29 10:27:13 +01:00 |
|
|
mr-tz
|
784c9dca53
|
upgrade rules using updated script
|
2023-11-24 11:34:28 +01:00 |
|
|
Moritz
|
915c1f5e07
|
remove very common .rsrc section rule (#761)
* remove very common rule
|
2023-05-26 10:34:25 +02:00 |
|
|
Moritz
|
106123eb61
|
Rules for the week (#671)
* add rules
* avoid FPs via mnemonics to ignore
* correct number logic
* add --onefile option strings
|
2023-01-27 09:56:12 +01:00 |
|
|
Moritz
|
b48fcd5dd8
|
improve rules that often match (#655)
* improve rules that often match
|
2023-01-09 14:07:53 +01:00 |
|
|
johnk3r
|
3f298900d4
|
use .NET libraries (#612)
* Add files via upload
https://github.com/mandiant/capa-rules/issues/609
* Update load-suspicious-libraries.yml
* Delete load-suspicious-libraries.yml
* Create load-suspicious-libraries.yml
* Update load-suspicious-libraries.yml
* Update load-suspicious-libraries.yml
* embed dependencies as resources using Fody/Costura
https://github.com/mandiant/capa-rules/pull/612
* Delete embed-dependencies-as-resources-using-fody-costura.yml
* embed-dependencies-as-resources-using-fody-costura
https://github.com/mandiant/capa-rules/pull/612
* Rename embed-dependencies-as-resources-using-fody-costura.yml to embed-dependencies-as-resources-using-fodycostura.yml
* use-dotnet-library-encryptdecryptutils
https://github.com/mandiant/capa-rules/pull/612
* use-dotnet-library-newtonsoft.json
https://github.com/mandiant/capa-rules/pull/612
* use-dotnet-library-sharpclipboard
https://github.com/mandiant/capa-rules/pull/612
* use-dotnet-library-sharpvectors
https://github.com/mandiant/capa-rules/pull/612
* Delete load-suspicious-libraries.yml
* Rename use-dotnet-library-newtonsoft.json.yml to use-dotnet-library-newtonsoftjson.yml
* Update use-dotnet-library-newtonsoftjson.yml
* Update use-dotnet-library-sharpvectors.yml
* Update use-dotnet-library-encryptdecryptutils.yml
* Update use-dotnet-library-sharpclipboard.yml
* Rename anti-analysis/obfuscation/use-dotnet-library-encryptdecryptutils.yml to data-manipulation/encryption/aes/use-dotnet-library-encryptdecryptutils.yml
* Rename nursery/use-dotnet-library-newtonsoftjson.yml to data-manipulation/json/use-dotnet-library-newtonsoftjson.yml
* Rename nursery/use-dotnet-library-sharpvectors.yml to data-manipulation/svg/use-dotnet-library-sharpvectors.yml
* Update use-dotnet-library-sharpclipboard.yml
* Update use-dotnet-library-newtonsoftjson.yml
* Update use-dotnet-library-sharpvectors.yml
* Update use-dotnet-library-encryptdecryptutils.yml
* Update use-dotnet-library-newtonsoftjson.yml
* Update use-dotnet-library-sharpvectors.yml
* Update use-dotnet-library-encryptdecryptutils.yml
* Update embed-dependencies-as-resources-using-fodycostura.yml
* Update use-dotnet-library-encryptdecryptutils.yml
* Update use-dotnet-library-sharpvectors.yml
* Update use-dotnet-library-newtonsoftjson.yml
* Update use-dotnet-library-sharpclipboard.yml
|
2022-08-29 18:49:40 +02:00 |
|
|
Willi Ballenthin
|
88c9c786ca
|
*: use meta.authors everywhere
|
2022-05-26 11:56:31 -06:00 |
|
|
Moritz Raabe
|
25938ca10c
|
change to mandiant.com
|
2021-09-28 12:21:11 +02:00 |
|
|
Michael Hunhoff
|
750e164a41
|
removing ntdll requirement from function features exported by both ntdll and ntoskrnl
|
2021-02-16 18:28:05 -07:00 |
|
|
William Ballenthin
|
54cfb05bd0
|
rules: address comments in #14
|
2020-06-26 17:45:56 -06:00 |
|
|
William Ballenthin
|
7b4f4d10fb
|
rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better
|
2020-06-21 17:54:01 -06:00 |
|
|
William Ballenthin
|
5f57dbdbc9
|
rules: reorganize rule names, namespaces, and ATT&CK mappings
|
2020-06-21 17:25:43 -06:00 |
|