admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,782 Commits 5 Branches 42 Tags
4e50e50bad8c33d05ab634e0e5bce91ef1b8ade3
Commit Graph

1782 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
jtothej 4e50e50bad Add hide-graphical-window-from-taskbar.yml rule 2024-06-02 20:23:13 +08:00
Moritz 4c2dec582b Merge pull request #904 from jtothej/timeprovider 
Add new rule act-as-time-provider-dll.yml
 2024-06-01 12:22:53 +02:00
jtothej bdb6997cd5 Add new rule act-as-time-provider-dll.yml 2024-06-01 12:14:24 +08:00
Moritz b0b9da3288 Merge pull request #902 from jtothej/shareprovider 
Add two new CAPA rules: act-as-share-provider-dll.yml and act-as-windbg-extension.yml
 2024-05-31 22:25:24 +02:00
Mike Hunhoff ded2744733 adding new and updating linux / android rules (#903) 
* adding new and updating linux / android rules

* fix lints
 2024-05-31 13:24:19 -04:00
jtothej 93b9c62944 Add two new CAPA rules: act-as-share-provider-dll.yml and act-as-windbg-extension.yml 2024-05-31 16:20:01 +08:00
Moritz c0de9d7c38 Merge pull request #901 from Still34/patches/callback-add-prop 
Add EnumProps to callback shellcode execution rule
 2024-05-23 13:37:12 +02:00
Still Hsu f665d2a2ca Add EnumProps 
Signed-off-by: Still Hsu <dev@stillu.cc>
 2024-05-23 13:45:00 +08:00
JJ 7f8216f2f2 Update encrypt-data-using-dpapi.yml rule (#900) 
* Update encrypt-data-using-dpapi.yml rule
 2024-05-21 09:58:07 +02:00
Moritz 7128cdbdd1 Merge pull request #896 from Still34/patches/callback-add-more 
Add additional shellcode execution callback functions
 2024-05-03 10:42:01 +02:00
Still Hsu cf3d77f540 Add more callback functions 
Signed-off-by: Still Hsu <dev@stillu.cc>
 2024-05-03 16:23:35 +08:00
Daniel Stepanic 017124154b Create self-delete-using-alternate-data-streams.yml (#895) 
* Create self-delete-using-alternate-data-streams.yml
 2024-04-29 11:48:36 +02:00
Moritz 82316f7d91 reduce FPs by adjusting go1. substring feature (#891) 
* reduce FPs by adjusting `go1.` substring feature
 2024-04-24 13:38:06 +02:00
Moritz a83ad9d367 Merge pull request #892 from mandiant/android-mr 
add android OS where applicable
 2024-04-23 17:04:22 +02:00
Willi Ballenthin 2c5c0ae60b add API features for ws2_32 ordinals (#893) 2024-04-23 14:20:28 +02:00
mr-tz f344af3327 add android OS where applicable 2024-04-23 13:49:05 +02:00
Daniel Stepanic c454ffb661 Create encrypt-data-using-rc4-via-systemfunction033.yml (#890) 
* Create encrypt-data-using-rc4-via-systemfunction033.yml

Similar to SystemFunction032, this undocumented API allows encryption/decryption using RC4 algo
 2024-04-22 10:32:38 +02:00
Moritz ec366561ad Merge pull request #886 from mandiant/fix/encrypt-data-using-salsa20-or-chacha 
fix encrypt-data-using-salsa20-or-chacha.yml
 2024-03-04 10:27:30 +01:00
Mike Hunhoff df7c6f3b2a add additional bytes matches 2024-03-01 17:45:40 -07:00
Mike Hunhoff 01f44288db update description 2024-03-01 16:39:28 -07:00
Mike Hunhoff a66c07009c fix encrypt-data-using-salsa20-or-chacha.yml 2024-03-01 16:16:39 -07:00
Ana María Martínez Gómez ce3e6d74b1 Merge pull request #885 from Ana06/token 
[CI] Correct token used to update badge
 2024-02-27 06:56:21 -05:00
Ana Maria Martinez Gomez 3ab0b8fdc1 [CI] Correct token used to update badge 2024-02-27 12:41:29 +01:00
Moritz cc5d7e4423 Merge pull request #883 from Ana06/update-actions 
[CI] Update GitHub actions to versions using Node 20
 2024-02-25 14:25:03 +01:00
Ana Maria Martinez Gomez a13aaa1628 [CI] Update ncipollo/release-action 
The old version was using a deprecated version of Node.# Please enter the commit message for your changes. Lines starting
 2024-02-23 15:14:41 +01:00
Ana Maria Martinez Gomez 9888713807 [CI] Update Ana06/get-changed-files 
Update Ana06/get-changed-files to the latest version that I released
yesterday using Node 20. The old version was using a deprecated version
of Node.
 2024-02-23 15:14:40 +01:00
Ana Maria Martinez Gomez d5a979a11c [CI] Update actions/setup-python to latest version 
The old version was using a deprecated version of Node.
 2024-02-23 15:14:37 +01:00
Ana Maria Martinez Gomez 36b8681271 [CI] Update actions/checkout to latest version 
The old version was using a deprecated version of Node.
 2024-02-23 14:59:05 +01:00
Ana María Martínez Gómez 9c6281e78c Merge pull request #882 from Ana06/gist_badge 
[CI] Use badge in gist for rules number in README
 2024-02-23 14:55:35 +01:00
Ana Maria Martinez Gomez 4c03f00b4b [CI] Use badge in gist for rules number in README 
This simplifies the workflow code and remove the need for the noisy
commits in capa-rules. We still need the commits in capa to sync the
submodule.
 2024-02-23 14:50:28 +01:00
Capa Bot 34e3755624 Update rules number badge 2024-02-14 13:56:59 +00:00
Willi Ballenthin 33feff1e46 add rules for volume interaction via IOCTLs (#879) 
* add rules for volume interaction via IOCTLs

* rename interact with driver

* factor out IOCTL handling

* fix 'set-system-properties' for 'install driver'

* fmt
 2024-02-14 14:56:47 +01:00
Capa Bot 0c32d65705 Update rules number badge 2024-02-05 09:34:25 +00:00
Willi Ballenthin f50b80d530 add delete drive layout via ioctl (#878) 2024-02-05 10:34:13 +01:00
Capa Bot 48dfd001d8 Update rules number badge v7.0.1 v7.0.0 v7.0.0-beta 2024-01-23 09:55:46 +00:00
sara-rn 4f27bfe758 Ghostly Hollowing process injection rule (#865) 
* ghostly hollowing process injection rule

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2024-01-23 10:55:34 +01:00
Moritz e09a22d9f3 Merge pull request #861 from ruppde/master 
Update reference-analysis-tools-strings.yml
 2024-01-23 10:55:06 +01:00
Capa Bot 44a60c0d31 Update rules number badge 2024-01-23 09:42:00 +00:00
Still / Azaka 8bbae03ee9 Add detection rule for hp-socket linking (#848) 
* Add initial detection rule

Signed-off-by: Still Hsu <dev@stillu.cc>

---------

Signed-off-by: Still Hsu <dev@stillu.cc>
Co-authored-by: Yacine <16624109+yelhamer@users.noreply.github.com>
 2024-01-23 10:41:49 +01:00
Moritz bbd86906e1 Merge pull request #871 from mandiant/mr-tz-patch-1 
Fix linter fail
 2024-01-22 20:21:17 +01:00
Moritz 9161f73a78 Merge pull request #874 from mandiant/revert-862-master 
Revert "Update Mappings for MBC (Q4 2023)"
 2024-01-17 09:21:34 +01:00
Moritz c61d7a7b95 Revert "Update Mappings for MBC (Q4 2023)" 2024-01-17 09:16:30 +01:00
Moritz eff071701b Merge pull request #862 from MBCProject/master 
Update Mappings for MBC (Q4 2023)
 2024-01-17 09:09:43 +01:00
Moritz 591d1c3ce4 Fix linter fail 2024-01-12 10:21:31 +01:00
Capa Bot c2f0c7bb68 Update rules number badge 2024-01-11 14:20:16 +00:00
Willi Ballenthin 1c6168d3f0 add new linux rules to nursery (#870) 
* add new linux rules to nursery

* file file name

* Update nursery/get-current-process-command-line.yml

* Update nursery/get-current-process-file-path.yml

* Update nursery/hook-routines-via-dlsym-rtld_next.yml
 2024-01-11 15:20:02 +01:00
Still / Azaka b65339be52 Add additional domains for known IP obtaining services (#867) 
* Add additional links for known IP obtaining services

Signed-off-by: Still Hsu <dev@stillu.cc>

* Update capture-public-ip.yml

---------

Signed-off-by: Still Hsu <dev@stillu.cc>
 2024-01-04 14:06:57 +01:00
Capa Bot 103fafa004 Update rules number badge 2024-01-03 16:32:24 +00:00
Moritz 5b9b497103 Pull out .NET features (#866) 
* pull out .NET features

* Create get-mac-address-in-net.yml

* pull out .NET features

* Create enumerate-files-in-net.yml

* rename file

* rename file
 2024-01-03 09:32:11 -07:00
Moritz 047b4c2a83 Use COM instead of bytes features (#864) 
* use com instead of byte features
 2023-12-18 07:54:14 +01:00