a4411edeea
Add RtlRegisterWait API to shellcode exec callback ( #1094 )
...
* Add RtlRegisterWait API to shellcode exec callback
* Require SetEvent to reduce fp
2025-12-29 10:20:58 -07:00
277540ac24
Add LdrCallEnclave in execute-shellcode-via-windows-callback-function.yml ( #1076 )
2025-09-09 13:21:58 -06:00
c1d20764ad
use "span of calls" scope ( #973 )
...
* use sequence scope instead of thread scope for "static: function" rules
* use sequence scope instead of thread scope for "static: basic block" rules
* make runtime linking rules more concise
* doc: describe sequence scope
* rename "sequence" scope to "span of calls" scope
* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com >
* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com >
* Update collection/get-geographical-location.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com >
* Update collection/file-managers/gather-classicftp-information.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com >
* Update collection/database/wmi/reference-wmi-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com >
* Update collection/database/sql/reference-sql-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com >
---------
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com >
2025-01-29 10:27:13 +01:00
99c5cf0ea7
Update execute-shellcode-via-windows-callback-function.yml - Add functions that can be used to execute shellcode
2024-08-11 12:09:18 +02:00
f665d2a2ca
Add EnumProps
...
Signed-off-by: Still Hsu <dev@stillu.cc >
2024-05-23 13:45:00 +08:00
cf3d77f540
Add more callback functions
...
Signed-off-by: Still Hsu <dev@stillu.cc >
2024-05-03 16:23:35 +08:00
784c9dca53
upgrade rules using updated script
2023-11-24 11:34:28 +01:00
66f58dffa0
update match rule name
2023-10-11 11:20:23 +02:00
ed791c9b17
separate allocate and change memory protection
2023-10-11 11:14:14 +02:00
708b06dd0a
Add capa rule load-code/shellcode/execute-shellcode-via-windows-callback-function.yml ( #744 )
...
* Add capa rule load-code/shellcode/execute-shellcode-via-callback-functions.yml
* Update load-code/shellcode/execute-shellcode-via-callback-functions.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com >
* Update load-code/shellcode/execute-shellcode-via-callback-functions.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com >
* Update load-code/shellcode/execute-shellcode-via-callback-functions.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com >
* Update execute-shellcode-via-callback-functions.yml
Omitted A and W on WinAPI function names since capa handles this automatically.
* Update execute-shellcode-via-callback-functions.yml
Added EnumTimeFormats and deduplicated EnumSystemCodePages
* Update and rename execute-shellcode-via-callback-functions.yml to execute-shellcode-via-windows-callback-function.yml
Renamed file to execute-shellcode-via-windows-callback-function.yml and merged https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml
* Delete execute-shellcode-via-enumuilanguages.yml
Delete rule due to merge with execute-shellcode-via-windows-callback-function.yml
---------
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com >
2023-04-19 09:56:15 -06:00
57e1732f5c
Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""
...
This reverts commit d43a6ee544
2022-06-28 15:23:20 -06:00
88c9c786ca
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
d43a6ee544
Revert "Merge pull request #548 from mandiant/feature-remove-flavors"
...
This reverts commit bc28847dd982308c4109
2022-04-27 06:23:36 -06:00
904bf3ef00
*: remove /x32 and /x64 flavors and use instruction scope
2022-04-05 12:25:14 -06:00
7b91f0ceee
Merge pull request #514 from jtothej/shellcode-via-copyfile2
...
Adding execute-shellcode-via-copyfile2.yml
2021-12-14 14:51:17 -07:00
26d216249f
Merge pull request #516 from dzbeck/capa-3-mbc-updates
...
update mappings for mbc (part 7)
2021-12-14 14:45:25 -07:00
1294158df2
fix formatting
2021-12-14 16:37:31 -05:00
ed3661b379
add mbc and att&ck tags
2021-12-14 16:16:07 -05:00
4ea6e93ed9
Adding execute-shellcode-via-copyfile2.yml
2021-12-12 18:19:18 +08:00
c0b42ae17d
Adding execute-shellcode-via-createthreadpoolwait.yml
2021-12-11 22:07:29 +08:00
ad56aeb0e0
Merge pull request #505 from jtothej/shellcode-via-enumuilanguages
...
Adding execute-shellcode-via-enumuilanguages.yml
2021-12-06 10:57:12 -07:00
ee2bf8a2cd
Adding execute-shellcode-via-windows-fibers.yml
2021-12-04 19:51:35 +08:00
e431c428f0
Adding execute-shellcode-via-enumuilanguages.yml
2021-12-04 18:46:44 +08:00
25938ca10c
change to mandiant.com
2021-09-28 12:21:11 +02:00
d81e757728
adding rules based on more PMA labs
2021-06-30 23:38:17 +02:00
Still / Azaka