admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
71 Commits 5 Branches 42 Tags
2395b4eaf501f7bdb9817cb71fa4c3cdcaffe3ff
Commit Graph

71 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Capa Bot 2395b4eaf5 Update rules number badge 2020-07-22 18:44:48 +00:00
Willi Ballenthin 3366b282f9 Merge pull request #43 from re-fox/master 
Adding QueryWorkingSet from psapi to be used in ReadProcessMemory rule and second NtQuerySystemInformation rule.
 2020-07-22 12:44:33 -06:00
Capa Bot 1be99c9014 Update rules number badge 2020-07-19 21:56:13 +00:00
Willi Ballenthin d497b4472c Merge pull request #44 from BitsOfBinary/master 
Adding anti-vm rule to check for an unmoving mouse cursor
 2020-07-19 15:55:59 -06:00
BitsOfBinary 963432fcf4 Moved to nursery 2020-07-18 21:26:47 +01:00
BitsOfBinary 2c4f1b41fb Create check-for-unmoving-mouse-cursor.yml 2020-07-18 21:24:36 +01:00
re-fox 5d86cdeecd Create enumerate-processes-via-ntquerysysteminformation.yml 
Adds support for listing processes using NtQuerySystemInformation.

A mapping of SystemInformationClass constants can be found here -> http://www.exploit-monday.com/2013/06/undocumented-ntquerysysteminformation.html, which SYSTEM_PROCESS_INFORMATION maps to 0x5.

This can be observed the sample 31bd8dd48ac0de3d4da340bf29f4d280 where NtQuerySystemInformation is used to obtain a list of processes and that is passed along to functions that will even ReadProcessMemory.
 2020-07-17 16:34:07 -04:00
re-fox 30131a38f1 Merge pull request #1 from re-fox/re-fox-patch-1 
Update read-process-memory
 2020-07-17 14:59:37 -04:00
re-fox 640af3b3b0 Update read-process-memory 
QueryWorkingSet from psapi will also work in a similar fashion to VirtualQueryEx.  

PoC code is on github for using QueryWorkingSet or VirtualQueryEx  -> https://github.com/SpiderLabs/malware-analysis/blob/master/C/queryWorkingSet.c 

A blog post with full instructions can be found here -> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/new-memory-scraping-technique-in-cherry-picker-pos-malware/

Both calls will ultimately land at NtQueryVirtualMemory.

I'm not sure if there is a process to modify authors of these rules as contributors commit up changes, so I'm leaving the author field as is.
 2020-07-17 14:58:38 -04:00
Moritz 8fd670b16a Merge pull request #42 from Ana06/rule_linter2 
Improve capa checkout in sync workflow
 2020-07-17 19:35:23 +02:00
Ana María Martínez Gómez 6fa768bbef Improve capa checkout in sync workflow 
Do not checkout `tests/data` submodule. Instead checkout only
`capa-rules`. This also automatically checkouts the correct version
without needing to update the submodule after the checkout (as it uses
`$GITHUB_SHA`).
 2020-07-17 18:42:10 +02:00
Moritz 13d9615191 Merge pull request #41 from fireeye/revert-40-improve-sync-workflow 
Revert "Improve capa checkout in sync workflow"
 2020-07-17 17:51:22 +02:00
Moritz 7392cae22d Revert "Improve capa checkout in sync workflow" 2020-07-17 17:49:31 +02:00
Moritz 0c84eba9b4 Merge pull request #40 from Ana06/improve-sync-workflow 
Improve capa checkout in sync workflow
 2020-07-17 17:42:09 +02:00
Ana María Martínez Gómez 8d09c86980 Improve capa checkout in sync workflow 
- Do not include `CAPA_TOKEN` token as capa is a public repo and token
is not needed for checkout.
- Do not checkout `tests/data` submodule. Instead checkout only
`capa-rules`. This also automatically checkouts the correct version
without needing to update the submodule after the checkout (as it uses
`$GITHUB_SHA`).
 2020-07-17 16:03:13 +02:00
Moritz 9b75d2556e Merge pull request #39 from Ana06/rule_linter 
Run rules linter in master and PRs
 2020-07-17 15:52:33 +02:00
Ana María Martínez Gómez 3bca1fb1e5 doc: Add CI badge to README 
Show rule linter status in master.
 2020-07-17 15:37:28 +02:00
Ana María Martínez Gómez 56d13c9549 ci: Run rules linter in master and PRs 
Create a CI GitHub action with a `rule_linter` job similar to the one in
capa.
 2020-07-17 15:37:22 +02:00
Moritz 928e19c740 Merge pull request #38 from fireeye/ana-improve-readme 
doc: fix/improve rule format documentation
 2020-07-16 19:29:27 +02:00
Ana María Martínez Gómez c1c0bfb510 doc: fix/improve rule format documentation 
- fix broken link
- fix wrong example
- add description example for regular expression.
- remove limitations from index (it is not in this file)
 2020-07-16 19:21:43 +02:00
Moritz 97db6ffeb8 Merge pull request #37 from fireeye/ana-license-badge 
Add license badge to README
 2020-07-16 17:32:23 +02:00
Ana María Martínez Gómez 0894ae259d Add license badge to README 
Use shields.io/category/license
 2020-07-16 17:26:56 +02:00
Moritz Raabe c54ee3d611 add license 2020-07-16 17:02:50 +02:00
Ana María Martínez Gómez 0357195d66 Merge pull request #36 from fireeye/ana-action 2020-07-14 19:54:03 +02:00
Ana María Martínez Gómez 29feee7e83 Update capa rules submodule 
Add a GitHub action that for every new commit updates the rules
submodule reference in the capa repository and the number of rules in
the capa README.
 2020-07-14 19:27:48 +02:00
Ana María Martínez Gómez b9d9a42844 Add rules number badge to README 
Includes a GitHub actions which updates the number every time new rules
are pushed to master.
 2020-07-14 19:27:22 +02:00
Willi Ballenthin fc44175ead Merge pull request #35 from fireeye/doc/mr-issue-templates 
doc: add issue templates
v1.0.0 		2020-07-13 09:16:22 -06:00
Moritz Raabe 302c0da8de doc: add issue templates 2020-07-13 11:54:31 +02:00
Willi Ballenthin b3d65b4002 Merge pull request #33 from fireeye/update/bb-scopes 
update to basic block scope
 2020-07-12 16:58:31 -06:00
Moritz 1a6ac08cd1 Update format.md 2020-07-11 16:12:11 +02:00
Moritz 4e83c359ea Update README.md 2020-07-11 15:40:45 +02:00
Moritz Raabe b585c0ef73 update to basic block scope 2020-07-11 14:02:30 +02:00
Moritz 123341cf6b Merge pull request #29 from fireeye/mumur 
add murmur hash constants
 2020-07-10 10:07:12 +02:00
William Ballenthin 0a6f913a49 add murmur hash constants 2020-07-09 16:05:46 -06:00
Moritz Raabe a8621978cf change tight loop scope to function 2020-07-06 12:36:21 +02:00
William Ballenthin 5488530055 fix ATT&CK categories 
closes #25
 2020-07-03 09:14:14 -06:00
William Ballenthin ba7843e7a8 update format doc 2020-07-03 01:21:41 -06:00
Willi Ballenthin 799b7bbf4b Merge pull request #24 from fireeye/fix/fps-rc4 
reduce RC4 FPs
 2020-07-03 10:55:47 -06:00
Moritz Raabe f0085f2116 reduce FPs 2020-07-03 14:30:33 +02:00
William Ballenthin cd88b27011 add doc/format.md 2020-07-02 17:55:53 -06:00
William Ballenthin c1c4dfc618 readme 2020-07-02 17:33:35 -06:00
Ana María Martínez Gómez bb1df0277d Merge pull request #22 from fireeye/ana-characteristic 2020-07-02 17:10:28 +02:00
Willi Ballenthin 101ef4ac0c readme: remove reference to rule-category 2020-07-01 14:30:39 -06:00
Ana María Martínez Gómez 25f1157db0 Change characteristic syntax in rules 
Get rid of `true` in characteristic as it is implicit.

The changes are the result of executing the following commands:
```
find . -type f -exec sed -i.bak "s/\(.*\)characteristic(\(.*\)): true/\1characteristic: \2/g" {} \;
find . -name "*.bak" -type f -delete
```
 2020-07-01 19:19:49 +02:00
William Ballenthin e5db226844 fix rule reference 2020-06-29 12:26:09 -06:00
William Ballenthin 973cb6b1d2 lib rules: remove namespaces 2020-06-29 06:14:59 -06:00
Willi Ballenthin 0fd2f4fd7c Merge pull request #20 from fireeye/ana-fix-note 
Fix 'unusual meta field' rule linter failure
 2020-06-29 16:26:28 -06:00
Ana María Martínez Gómez 531eda1074 Fix 'unusual meta field' rule linter failure 
Change the field `note` by a comment to fix the following failure:
```
FAIL: unusual meta field: Remove the meta field: "note"
```
 2020-06-29 22:56:32 +02:00
Willi Ballenthin 9f023a301a Merge pull request #14 from fireeye/rule-organization 
rules: apply rule reorganization
 2020-06-29 13:05:07 -06:00
William Ballenthin 0d77564785 merge 2020-06-26 17:47:37 -06:00