admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,154 Commits 5 Branches 42 Tags
51de2eb8189d20127e2800a066594bcd2a8a7331
Commit Graph

1154 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Mike Hunhoff 51de2eb818 Merge pull request #545 from mandiant/new/20222303 
adding get-process-image-filename
 2022-03-23 11:48:38 -06:00
Mike Hunhoff a458d0d70a Merge pull request #544 from mandiant/update/hijack-thread-execution 
update hijack-thread-execution.yml to match additional scenarios
 2022-03-23 11:48:24 -06:00
Michael Hunhoff dddf45baa9 adding get-process-image-filename 2022-03-23 11:34:36 -06:00
Michael Hunhoff 94f1639cb4 update hijack-thread-execution.yml to match additional scenarios 2022-03-23 09:01:25 -06:00
Capa Bot bc0b2d6fb0 Update rules number badge 2022-03-16 09:43:25 +00:00
Moritz 0e4d7071a0 Merge pull request #542 from htnhan/master 
Issue #539: Sample manually build AES/Rijndael boxes
 2022-03-16 10:43:11 +01:00
htnhan cae4aa28ae Issue #539: Sample manually build AES/Rijndael boxes 2022-03-14 14:01:07 -05:00
Willi Ballenthin 3a0d0811f6 Merge pull request #538 from mwilliams31/anti-debug-gettickcount 
Minor update to anti-debug GetTickCount rule
 2022-03-10 11:20:53 -07:00
Matt Williams ce41016e8d Minor update to anti-debug GetTickCount rule 
Added `sub` and `cmp` mnemonics in an attempt to reduce FPs.
 2022-03-10 09:43:27 -05:00
Moritz 27123103e2 Merge pull request #536 from mandiant/call5-update 
call $+5 update rule and doc
v3.2.0 		2022-03-03 10:26:16 +01:00
Moritz Raabe c5368ed9a2 call $+5 update rule and doc 2022-03-01 08:46:58 +01:00
Willi Ballenthin 6f27fef6ea Merge pull request #530 from kn0wl3dge/fix/mbc-names 
Fix MBC names and IDs
 2022-02-06 11:48:41 -07:00
Baptistin Boilot 95e7bc8496 Update MBC names and IDs with the latest release 2022-02-06 11:27:09 +01:00
Baptistin Boilot efea9a37d9 Fix MBC names and IDs 2022-02-06 11:13:23 +01:00
Willi Ballenthin b01bd14e59 Merge pull request #529 from mandiant/mike-hunhoff-patch-1 
update capture-screenshot.yml
 2022-02-04 12:26:29 -07:00
Mike Hunhoff c4b509594d Update collection/screenshot/capture-screenshot.yml 
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
 2022-02-04 12:23:32 -07:00
Mike Hunhoff 22fe14008f Update capture-screenshot.yml 2022-02-04 11:43:32 -07:00
Capa Bot ca1dab21d4 Update rules number badge 2022-01-24 17:09:31 +00:00
Willi Ballenthin 4d39abedc6 Merge pull request #526 from jtothej/advobfuscator 
Adding obfuscated-with-advobfuscator.yml
 2022-01-24 10:06:34 -07:00
Willi Ballenthin 85e2129874 Merge pull request #525 from jtothej/arbitrary-code-guard 
Adding block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml
 2022-01-24 10:06:26 -07:00
Willi Ballenthin 3b6d3501a7 Merge pull request #523 from jtothej/process-mitigation-policies 
Adding protect-spawned-processes-with-mitigation-policies.yml
 2022-01-24 10:06:18 -07:00
Willi Ballenthin cc7ccad4e5 Merge pull request #524 from kn0wl3dge/fix/attack-names 
Fix Mitre Att&ck technique naming
 2022-01-24 09:56:24 -07:00
Willi Ballenthin afb71239da Merge pull request #522 from jtothej/spoof-parent-pid 
Updated and graduated spoof-parent-pid.yml
 2022-01-24 09:50:36 -07:00
jtothej a75281c25c Adding obfuscated-with-advobfuscator.yml 2022-01-24 11:21:49 +07:00
jtothej 68d6a15152 Adding block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml 2022-01-23 18:32:03 +07:00
Baptistin Boilot 4f4914d572 Fix Mitre Att&ck technique naming 2022-01-22 16:59:27 +01:00
jtothej 8c29232bb2 Adding protect-spawned-processes-with-mitigation-policies.yml 2022-01-22 16:53:36 +07:00
jtothej 1f3fb133cc Added example and attack mapping to spoof-parent-pid.yml. Moved to anti-analysis/anti-forensic from nursery. 2022-01-22 15:38:40 +07:00
Stephen Eckels 954f22acd8 Add golang runtime pattern (#518) 
* Add golang runtime pattern

* Fix lints

* fix filename lint

* merge go rules

* Update compiler/go/compiled-with-go.yml

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
v3.1.0 		2021-12-23 17:34:11 +01:00
Capa Bot e09db3504d Update rules number badge 2021-12-20 12:47:59 +00:00
Moritz e2dbb349f2 Merge pull request #515 from Still34/features/plugx-module 
Add PlugX rule proposed in #469
 2021-12-20 13:47:46 +01:00
Still Hsu 1f337cc717 Update malware-family/plugx/match-known-plugx-module.yml 
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2021-12-20 21:21:50 +09:00
Still Hsu 05c08c9cc7 Update malware-family/plugx/match-known-plugx-module.yml 
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2021-12-20 21:21:37 +09:00
Still Hsu fbb511e148 Add missing command op codes 
Signed-off-by: Still Hsu <dev@stillu.cc>
 2021-12-16 16:51:37 +08:00
Still Hsu 7114d1b4cd Add scrubbed timestamp in timestamp check 
- Some samples may attempt to scrub the timestamp by replacing it with an invalid date (e.g., 0x8888888)

Signed-off-by: Still Hsu <dev@stillu.cc>
 2021-12-16 16:40:17 +08:00
Still Hsu 7cacff8ac7 Update rule per request 
Signed-off-by: Still Hsu <dev@stillu.cc>
 2021-12-16 11:10:25 +08:00
Still Hsu 58d5430ab1 Add description to PlugX rule 
Signed-off-by: Still Hsu <dev@stillu.cc>
 2021-12-15 18:08:07 +08:00
Still Hsu 6343a4ed8b Update rule namespace per suggestion 
Signed-off-by: Still Hsu <dev@stillu.cc>
 2021-12-15 16:29:46 +08:00
Capa Bot e80e9ad09c Update rules number badge 2021-12-14 21:51:29 +00:00
Willi Ballenthin 7b91f0ceee Merge pull request #514 from jtothej/shellcode-via-copyfile2 
Adding execute-shellcode-via-copyfile2.yml
 2021-12-14 14:51:17 -07:00
Capa Bot 6fd7cea0aa Update rules number badge 2021-12-14 21:46:18 +00:00
Willi Ballenthin 1b389db7a5 Merge pull request #513 from jtothej/mapping-injection 
Adding inject-shellcode-using-mapping-injection.yml
 2021-12-14 14:46:04 -07:00
Willi Ballenthin 26d216249f Merge pull request #516 from dzbeck/capa-3-mbc-updates 
update mappings for mbc (part 7)
 2021-12-14 14:45:25 -07:00
Willi Ballenthin c5d34ee255 Update host-interaction/bootloader/manipulate-boot-configuration.yml 2021-12-14 14:44:54 -07:00
Desiree Beck 1294158df2 fix formatting 2021-12-14 16:37:31 -05:00
Desiree Beck ed3661b379 add mbc and att&ck tags 2021-12-14 16:16:07 -05:00
jtothej bffb8e1233 Renaming inject-shellcode-using-mapping-injection.yml 2021-12-14 10:44:32 +08:00
Capa Bot fcdd3266d2 Update rules number badge 2021-12-13 18:47:58 +00:00
Moritz dbb157232b Merge pull request #512 from jtothej/shellcode-via-createthreadpoolwait 
Adding execute-shellcode-via-createthreadpoolwait.yml
 2021-12-13 19:47:42 +01:00
Still Hsu 8c8de61f1a Lint rule 
Signed-off-by: Still Hsu <dev@stillu.cc>
 2021-12-13 17:30:05 +08:00