admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,966 Commits 5 Branches 42 Tags
master
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Willi Ballenthin 6a0d506713 add encrypt-data-using-hc-256 (#1097) 2026-01-06 10:01:44 -07:00
Willi Ballenthin 00684bbf4a add "change registry key timestamp" (#1003) 
closes #1000

graduate change-registry-key-timestamp with example

typo

add references
 2025-02-21 09:29:10 -07:00
Willi Ballenthin 8d5e7e2ac4 internal-dotnet-file-limitation.yml: make it valid for static scope too (#990) 2025-02-04 21:47:59 +01:00
Willi Ballenthin 79afc557f1 remove testing rule (#989) 2025-02-04 10:23:23 +01:00
Willi Ballenthin 0ea3394942 graduate onedrive rule 
closes #943
 2025-01-29 18:54:25 +01:00
Willi Ballenthin 36bf945aee fix scopes from lint errors 
ref https://github.com/mandiant/capa/pull/2579
 2025-01-29 18:54:25 +01:00
Willi BallenthinandMike Hunhoff c1d20764ad use "span of calls" scope (#973) 
* use sequence scope instead of thread scope for "static: function" rules

* use sequence scope instead of thread scope for "static: basic block" rules

* make runtime linking rules more concise

* doc: describe sequence scope

* rename "sequence" scope to "span of calls" scope

* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/get-geographical-location.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/file-managers/gather-classicftp-information.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/database/wmi/reference-wmi-statements.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/database/sql/reference-sql-statements.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

---------

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
 2025-01-29 10:27:13 +01:00
Willi Ballenthin 896d9121ee add packed-with-nmm-protect (#940) 
* add packed-with-nmm-protect

* nmm-protect: add os and description
 2024-09-30 14:05:37 +02:00
Willi Ballenthin 5b288a527d add linked against SQLCipher 2024-09-13 07:29:52 +00:00
Willi Ballenthin e6befc9b53 fix the scope of some rules with dependencies 
ref: https://github.com/mandiant/capa/issues/2124
 2024-06-06 09:39:53 +02:00
Willi Ballenthin 2c5c0ae60b add API features for ws2_32 ordinals (#893) 2024-04-23 14:20:28 +02:00
Willi Ballenthin 33feff1e46 add rules for volume interaction via IOCTLs (#879) 
* add rules for volume interaction via IOCTLs

* rename interact with driver

* factor out IOCTL handling

* fix 'set-system-properties' for 'install driver'

* fmt
 2024-02-14 14:56:47 +01:00
Willi Ballenthin f50b80d530 add delete drive layout via ioctl (#878) 2024-02-05 10:34:13 +01:00
Willi Ballenthin 1c6168d3f0 add new linux rules to nursery (#870) 
* add new linux rules to nursery

* file file name

* Update nursery/get-current-process-command-line.yml

* Update nursery/get-current-process-file-path.yml

* Update nursery/hook-routines-via-dlsym-rtld_next.yml
 2024-01-11 15:20:02 +01:00
Willi BallenthinandMoritz bdf01d6243 update rule format documentation with dynamic details (#851) 
* wip: update rule format documentation with dynamic details

* format: add example links

* format: reorganize features vs scopes

* Update doc/format.md

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

* Update doc/format.md

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

* Update doc/format.md

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

* Update doc/format.md

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

* Update doc/format.md

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

* Update doc/format.md

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

* Update doc/format.md

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

* Update doc/format.md

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

* format: table formatting

* format: try to express scoping for features

* Update doc/format.md

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

* Update doc/format.md

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2023-11-29 14:24:41 +01:00
Willi Ballenthin 696287da05 vmci: tweak required vs optional APIs 2023-11-24 11:35:08 +01:00
Willi Ballenthin 3ce798ba59 fmt 2023-11-24 11:35:07 +01:00
Willi Ballenthin a6f3e4110a further dynamic scope tweaks 2023-11-24 11:35:06 +01:00
Willi Ballenthin 1b8b2dbc85 Merge pull request #843 from mandiant/fix/issue-842 
PLUGX: make more restrictive to fix FP
 2023-11-15 10:24:37 +01:00
Willi BallenthinandMoritz 60b39810e1 Update malware-family/plugx/match-known-plugx-module.yml 
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2023-11-15 10:23:00 +01:00
Willi Ballenthin 5d53af0793 Update match-known-plugx-module.yml 2023-11-14 12:04:24 +01:00
Willi Ballenthin 6733ddc9ad PLUGX: make more restrictive to fix FP 2023-11-13 12:38:58 +01:00
Willi Ballenthin bc63b328dc Merge pull request #817 from Aayush-Goel-04/Aayush-Goel-04/#Issue322-COMfeature 
Documentation for COM feature addition
 2023-10-18 17:01:01 +02:00
Willi Ballenthin 2d615e2386 Merge pull request #832 from MBCProject/9/2023-mbc-update 
Update Mappings for MBC (part 11)
 2023-09-27 22:40:22 +02:00
Willi Ballenthin 7685a232d9 forwarded export: fmt 2023-08-02 14:41:35 +02:00
Willi Ballenthin 48d755d248 Merge pull request #809 from jtothej/uefi 
Add get-uefi-variable.yml and set-uefi-variable.yml
 2023-08-02 13:03:24 +02:00
Willi Ballenthin 3f39a45465 Merge pull request #807 from jtothej/shortcut 
Update metadata and promote create-shortcut-via-ishelllink.yml
 2023-08-01 13:21:05 +02:00
Willi Ballenthin 6691e9bdbe Merge pull request #806 from sara-rn/master 
updated translation tables
 2023-08-01 13:15:37 +02:00
Willi Ballenthin c9cd572601 Merge pull request #801 from RonnieSalomonsen/forwarded_export 
Add new rule for forwarded exports and update doc to with new charact…
 2023-07-19 15:49:24 +02:00
Willi Ballenthin 85a980a6cc Merge pull request #796 from mandiant/feat/ci-latest-python 
ci: use latest python for best performance
 2023-07-13 10:45:33 +02:00
Willi Ballenthin 1da385ca2d ci: use latest python for best performance 2023-07-13 10:29:53 +02:00
Willi Ballenthin 7e100e1863 Merge pull request #795 from mandiant/fix-20230713-lints 
fix lints
 2023-07-13 10:15:11 +02:00
Willi Ballenthin 800186a7ce un-promote covertly decode data rule 2023-07-13 04:11:32 +02:00
Willi Ballenthin 601ac47953 fix lints for WMI query rules 2023-07-13 04:11:16 +02:00
Willi Ballenthin 959e77daa3 add comments about locations of API functions for 'patch event tracing 
for windows function'
 2023-07-13 04:10:30 +02:00
Willi Ballenthin fd6cd94bee graduate get windows directory from kuser_shared data 2023-07-13 04:10:07 +02:00
Willi Ballenthin 94ecadce03 encrypt data using AES: remove nonexistant example 2023-07-13 04:09:40 +02:00
Willi Ballenthin 3fcc3cf562 Merge pull request #762 from dkelly2e/newrule 
Create covertly decode and write data to Windows directory using indirect calls
 2023-07-12 11:03:38 +02:00
Willi Ballenthin c3da5ee5c0 Merge pull request #765 from anders-v/master 
adding rules for vm detection through wmi calls to drive and motherbo…
 2023-07-12 11:02:41 +02:00
Willi Ballenthin 3a483a931c Merge pull request #778 from jaxxpnd/jaxxpnd-enum-minifilter 
Create enumerate-minifilter-drivers.yml
 2023-07-12 11:01:34 +02:00
Willi Ballenthin c5ca71cca2 Merge pull request #789 from jtothej/windowsc 
Add inject-shellcode-using-extra-window-memory.yml and inject-shellco…
 2023-07-12 11:00:04 +02:00
Willi Ballenthin 73eddfd231 Merge pull request #794 from jtothej/persistence-auth-server 
Add act-as-dhcp-server-callout-dll.yml act-as-dns-server-plugin-dll.y…
 2023-07-12 10:59:45 +02:00
Willi Ballenthin e1c0ac2f1c Merge pull request #776 from MBCProject/6/2023-mbc-update 2023-06-22 09:11:29 +02:00
Willi Ballenthin a40d4c86cd Merge pull request #768 from jlmndt/master 
Add rule compiled-with-exescript.yml
 2023-06-02 09:13:25 +02:00
Willi Ballenthin f361c2d2fc Merge pull request #767 from jlmndt/master 
Add rule hash-data-using-sha512managed-in-dotnet.yml
 2023-05-31 20:15:42 +02:00
Willi Ballenthin 0554a8be12 Merge pull request #766 from crowface28/master 
Update read-from-mailslot.yml
 2023-05-30 16:37:30 +02:00
Willi Ballenthin 0ecfa21340 Merge pull request #764 from crowface28/master 
Create read-from-mailslot.yml
 2023-05-30 16:31:08 +02:00
Willi Ballenthin e9767fc8ae Update anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings---wmi-motherboard-model-contains-virtual.yml 2023-05-30 16:27:36 +02:00
Willi Ballenthin 165865c69b Update anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings---wmi-disk-drive-model-contains-virtual.yml 2023-05-30 16:27:26 +02:00
Willi Ballenthin 927cd8ee7f Merge pull request #756 from Still34/patches/aplib-linking 
Add static linking aPLib detection
 2023-05-11 10:06:04 +02:00
Willi Ballenthin d44049056d Merge pull request #751 from bkojusner/stream-path-update 
Update reference-absolute-stream-path-on-windows.yml
 2023-05-02 11:43:22 +02:00
Willi Ballenthin f53ac8973b Merge pull request #734 from emtuls/destroy-software-breakpoint-capability 
adding new rule for destroying capability of adding software breakpoints
 2023-03-28 09:19:37 +02:00
Willi Ballenthin 72f2f8f475 Merge pull request #731 from emtuls/check-for-minimum-number-of-windows-on-screen 
Adding new anti-vm technique from guloader - minimum windows on screen check
 2023-03-28 09:19:16 +02:00
Willi Ballenthin 4ca8023363 Merge pull request #735 from emtuls/mac-address-windows 
Adding rule for getting a mac address on windows
 2023-03-26 11:28:25 +02:00
Willi Ballenthin 232af1ca4c Merge pull request #732 from mandiant/add-data-formats 
Update read-clipboard-data.yml
 2023-03-24 09:55:18 +01:00
Willi Ballenthin aa2dc1137d Merge pull request #729 from emtuls/updates-to-format-readme 
Updates to format readme
 2023-03-21 22:03:58 +01:00
Willi BallenthinBlasMoritz
 		6bd733a2e3 absolute stream path: fix slow regex (#718) 
* absolute stream path: fix slow regex

closes #717

* absolute stream path: better doc

Co-authored-by: Blas <bkojusner@ufl.edu>

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
Co-authored-by: Blas <bkojusner@ufl.edu>
 2023-03-14 19:35:07 +01:00
Willi Ballenthin 274d72e1bf Merge pull request #714 from mandiant/http-query-uri 
add get http query uri
 2023-02-28 11:40:29 +01:00
Willi Ballenthin ba2cc497f9 http request uri: move to nursery 2023-02-28 09:29:09 +01:00
Willi Ballenthin bd1aeefd2d Update and rename get-http-query-uri.yml to get-http-request-uri.yml 2023-02-28 09:10:27 +01:00
Willi Ballenthin 07f16e846d Update communication/http/get-http-query-uri.yml 2023-02-28 09:09:53 +01:00
Willi Ballenthin 65105466c0 Merge pull request #704 from mandiant/http-content-length 
add get http content length
 2023-02-21 11:45:47 +01:00
Willi BallenthinandMoritz 59bae867c6 Update communication/http/get-http-content-length.yml 
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2023-02-21 11:45:42 +01:00
Willi Ballenthin 23f47b8d25 http content length: fix mbc 2023-02-18 21:39:52 +01:00
Willi Ballenthin 5d6247143a http content length: fix MBC 2023-02-18 21:37:47 +01:00
Willi Ballenthin ef15bf0e06 add get http content length 2023-02-18 21:36:35 +01:00
Willi Ballenthin 9cda994949 Merge pull request #701 from wballenthin/patch-1 
rust: add more strings
 2023-02-15 11:55:19 +01:00
Willi Ballenthin aec19f3a95 add generate random numbers via rtlgenrandom (#698) 
closes #318
 2023-02-13 10:46:33 +01:00
Willi Ballenthin 8d8a36723f Merge pull request #691 from bkojusner/win-file-stream 
Rule for reference file/folder stream path on Windows
 2023-02-07 15:48:06 +01:00
Willi Ballenthin a65d7336bd Merge pull request #689 from bkojusner/exec-script-mem 
Rule for in-memory execution of VBScript, JavaScript or JScript
 2023-02-07 10:58:44 +01:00
Willi BallenthinandMoritz 5941a484b5 add section access/map rules (#681) 
* add section access/map rules

closes #4

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2023-02-02 09:11:46 +01:00
Willi Ballenthin a281c527a8 Merge pull request #680 from mandiant/ntsockets 
add create tcp socket via raw AFD driver
 2023-02-01 16:28:28 +01:00
Willi Ballenthin 4658e8dd4c add create tcp socket via raw AFD driver 
closes #537
 2023-02-01 11:47:52 +01:00
Willi Ballenthin 01a1d949d6 add create-mailslot (#673) 2023-01-26 09:14:59 +01:00
Willi Ballenthin 78c4aacd57 Merge pull request #672 from mandiant/des-constants 
des: add more constants from libtomcrypt
 2023-01-24 15:34:31 +01:00
Willi Ballenthin 07c10dd26b des: add more constants from libtomcrypt 2023-01-24 12:13:46 +01:00
Willi Ballenthin e17c37ac06 add base58 (#669) 2023-01-23 14:53:10 +01:00
Willi Ballenthin 650a05af50 Merge pull request #665 from mandiant/whirlpool 
add whirlpool hash
 2023-01-20 13:14:49 +01:00
Willi Ballenthin bd958cdcec Merge pull request #667 from mandiant/tea 
add TEA encryption
 2023-01-20 13:14:26 +01:00
Willi Ballenthin 2a283741e5 tea: fix path 2023-01-19 14:24:08 +01:00
Willi Ballenthin 9a8f1bb258 whirlpool: update mbc mapping 2023-01-19 14:22:14 +01:00
Willi Ballenthin c473dab48e tea: encrypt vs decrypt 2023-01-19 12:40:31 +01:00
Willi Ballenthin 28e9c066ad Merge pull request #666 from mandiant/rc56 
rc5/6: more constants
 2023-01-19 12:23:09 +01:00
Willi Ballenthin c9183fcb1c whirlpool: attack and mbc 2023-01-19 11:54:05 +01:00
Willi Ballenthin 79811e6dbc add TEA encryption 2023-01-19 11:52:38 +01:00
Willi Ballenthin f59538a9e2 rc5/6: more constants 2023-01-19 11:37:32 +01:00
Willi Ballenthin 62274b467b add whirlpool hash 2023-01-19 11:25:28 +01:00
Willi Ballenthin 3b06639fc9 sha* rules and updates (#658) 
* sha256: try to avoid matching sha512 constants

* add sha512

* sha: fix constant indices

* sha224: add constant names

* add sha384

* sha384: add global constant byte array

* SHA: more examples and global static array feature
 2023-01-12 14:14:52 +01:00
Willi Ballenthin b99c247153 Merge pull request #659 from mwilliams31/curve25519-update 
Update encrypt-data-using-curve25519 rule
 2023-01-12 12:57:14 +01:00
Willi Ballenthin 9a514c7620 Merge pull request #657 from mandiant/fix/issue-632-sha1 
more SHA1 constants
 2023-01-09 16:52:22 +01:00
Willi Ballenthin 174e63ada1 sha1: author 2023-01-09 15:51:26 +01:00
Willi Ballenthin f9988635be sha1: add another example reference 2023-01-09 15:29:00 +01:00
Willi Ballenthin 6969fcdc3a add sha1 constants 2023-01-09 15:28:21 +01:00
Willi Ballenthin 58bf287115 Merge pull request #653 from mandiant/fix/issue-632-md5-mac 
add authenticate data with md5 mac
 2023-01-05 11:55:12 +01:00
Willi Ballenthin bb6dfae5c9 add authenticate data with md5 mac 2023-01-05 11:27:39 +01:00
Willi Ballenthin e0cfec7817 Merge pull request #652 from mandiant/fix/issue-635 
add compiled-with-nuitka
 2023-01-05 10:54:34 +01:00
Willi Ballenthin 4b2b42d217 add compiled-with-nuitka 2023-01-04 09:09:26 +01:00
Willi Ballenthin df3e0ffb71 Merge pull request #647 from mandiant/fix/issue-646 
add "execute via .NET startup hook"
 2023-01-03 11:42:13 +01:00
Willi Ballenthin 5ea634af7f tests: better detect rule name 
from https://github.com/mandiant/capa-rules/pull/647
 2023-01-03 11:41:04 +01:00
Willi Ballenthin e0fdd2cc30 rename rule 2023-01-03 09:35:15 +01:00