admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,704 Commits 5 Branches 42 Tags
94de0355cde729b13b4313377d27f17a3ddf2567
Commit Graph

184 Commits

Author SHA1 Message Date
Willi Ballenthin 9cb8848b03 Merge branch 'master' into dynamic-syntax 2023-10-17 10:29:30 +00:00
Moritz 6d7191fac6 Update generate-random-numbers-via-rtlgenrandom.yml 2023-10-10 11:53:01 +02:00
Moritz e454699082 Update generate-random-numbers-via-rtlgenrandom.yml (#828) 2023-10-09 12:07:38 -06:00
Yacine Elhamer d20a7e0a48 add elaborative comment 2023-08-29 21:32:37 +02:00
Yacine Elhamer d5f05f4e88 initial commit 2023-08-29 21:23:55 +02:00
Yacine Elhamer 5b73ddcd24 manual pass 2023-08-22 09:40:13 +02:00
Yacine Elhamer 0aea484e04 updated rules 2023-08-21 19:14:45 +02:00
Yacine Elhamer c4cdd9bae7 fix improper scope for rules containing a subscope in and 2023-08-21 14:27:45 +02:00
Yacine Elhamer a55d769da8 fix author quoting 2023-08-21 09:10:33 +02:00
Yacine Elhamer 8d851f3343 updated rules 2023-08-20 15:39:29 +02:00
Yacine Elhamer 850909bd82 update 2023-08-17 11:07:02 +02:00
Yacine Elhamer e937af1ee6 initial commit 2023-08-17 10:41:11 +02:00
sara-rn 7cc3bb46aa Update decode-data-using-base64-via-dword-translation-table.yml 2023-07-30 15:22:48 +02:00
sara-rn 04c77aedce Update decode-data-using-base64-via-dword-translation-table.yml 2023-07-30 15:09:13 +02:00
sara-rn d57a618076 Update decode-data-using-base64-via-dword-translation-table.yml 
fixed hash
 2023-07-30 14:59:38 +02:00
sara-rn aa2da89c34 Update decode-data-using-base64-via-dword-translation-table.yml 
additional translation tables
 2023-07-28 19:51:54 +02:00
sara-rn cda22165c6 Update hash-data-using-fnv.yml 
didn't match the old example, it's fixed
 2023-07-11 17:18:35 +02:00
sara-rn 358b666459 Update hash-data-using-fnv.yml 2023-07-10 21:04:13 +02:00
ryan 153d4c0d2c Update Mappings for MBC 2023-06-21 10:45:01 -04:00
Moritz e44f57c035 AES MixColumns detection (#749) 
* add rule
 2023-04-25 21:18:51 +02:00
Moritz 54d357a201 Update reference-public-rsa-key.yml (#745) 2023-04-17 09:59:19 -06:00
raymondlleong 32dc1ea9e8 Adding rules for TEA, XTEA, XXTEA and RIPEMD hashing (#700) 
* Adding rules for TEA, XTEA, XXTEA and RIPEMD hashing

Adding to current rules for TEA encrypt & decrypt
Adding rules for XTEA, XXTEA, RIPEMD-128, 160, 256, 320

* Description edited for clarity

* byte pattern correction

* updates

- rules with examples moved out of nursery
- unneeded examples removed from rules and their example files removed from the PR for capa-testfiles
- DS_store files deleted
- Descriptions edited to reflect shared magic constants with SHA1

* ripemd128 update

updated to include magic array not present in MD5

* MD5 & SHA1 documentation update + RIPEMD160 removal

Updating MD5 & SHA1 rules to document magic constants shared with other hashing routines.

Removing RIPEMD160 rule using magic constants due to likelihood of false positives with SHA1 routines

* ripemd320 description update
 2023-03-14 08:33:42 +01:00
Mike Hunhoff e5ae505682 update .NET detections (#703) 2023-02-21 14:38:03 -07:00
Blas b7a95a37f7 Rule for zlib inflate/deflate (#695) 
* Create compress-data-via-zlib-inflate-or-deflate.yml
 2023-02-15 11:56:28 +01:00
Willi Ballenthin aec19f3a95 add generate random numbers via rtlgenrandom (#698) 
closes #318
 2023-02-13 10:46:33 +01:00
Moritz 613536dd1d LZO compression / decompression rules continued (#677) 
* Add rule for lzo compression

* Add matching decompression rule

---------

Co-authored-by: David Cannings <david.cannings@pwc.com>
 2023-02-01 15:12:45 +01:00
Ryan Xu 74596020b8 Update Mappings for MBC (part 10) (#674) 
* Update capa mappings 01/2023

---------

Co-authored-by: Desiree Beck <dbeck@mitre.org>
 2023-02-01 10:09:34 +01:00
Moritz 761ccbab47 update ATT&CK/MBC meta data (#675) 
* update ATT&CK/MBC meta data
 2023-02-01 10:08:58 +01:00
Moritz 106123eb61 Rules for the week (#671) 
* add rules

* avoid FPs via mnemonics to ignore

* correct number logic

* add --onefile option strings
 2023-01-27 09:56:12 +01:00
Willi Ballenthin 07c10dd26b des: add more constants from libtomcrypt 2023-01-24 12:13:46 +01:00
Moritz 2a997f5d0c add upper limit for basic block count (#661) 
* add upper limit for basic block count

Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
 2023-01-19 13:11:45 +01:00
Willi Ballenthin f59538a9e2 rc5/6: more constants 2023-01-19 11:37:32 +01:00
Willi Ballenthin 3b06639fc9 sha* rules and updates (#658) 
* sha256: try to avoid matching sha512 constants

* add sha512

* sha: fix constant indices

* sha224: add constant names

* add sha384

* sha384: add global constant byte array

* SHA: more examples and global static array feature
 2023-01-12 14:14:52 +01:00
Matt Williams 48b71adb35 Update encrypt-data-using-curve25519.yml 2023-01-11 14:10:54 -05:00
Willi Ballenthin 9a514c7620 Merge pull request #657 from mandiant/fix/issue-632-sha1 
more SHA1 constants
 2023-01-09 16:52:22 +01:00
Willi Ballenthin 174e63ada1 sha1: author 2023-01-09 15:51:26 +01:00
Willi Ballenthin f9988635be sha1: add another example reference 2023-01-09 15:29:00 +01:00
Willi Ballenthin 6969fcdc3a add sha1 constants 2023-01-09 15:28:21 +01:00
Still Hsu 51fb2a538d Improve djb2 detection (#656) 
* Improve djb2 detection

Signed-off-by: Still Hsu <dev@stillu.cc>

* Update nursery/resolve-function-by-djb2-hash.yml

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

* Update data-manipulation/hashing/djb2/hash-data-using-djb2.yml

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

Signed-off-by: Still Hsu <dev@stillu.cc>
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2023-01-09 09:49:34 +01:00
Mike Hunhoff dda76eadde new/update rules using .NET ctor method (#626) 2022-10-13 08:36:31 -06:00
Mike Hunhoff 96a1abddca new/update .NET rules (#625) 2022-10-07 09:39:57 -06:00
Moritz Raabe d2d3fd30ab handle more cases 
closes #617
 2022-09-05 17:58:35 +02:00
johnk3r 3f298900d4 use .NET libraries (#612) 
* Add files via upload

https://github.com/mandiant/capa-rules/issues/609

* Update load-suspicious-libraries.yml

* Delete load-suspicious-libraries.yml

* Create load-suspicious-libraries.yml

* Update load-suspicious-libraries.yml

* Update load-suspicious-libraries.yml

* embed dependencies as resources using Fody/Costura

https://github.com/mandiant/capa-rules/pull/612

* Delete embed-dependencies-as-resources-using-fody-costura.yml

* embed-dependencies-as-resources-using-fody-costura

https://github.com/mandiant/capa-rules/pull/612

* Rename embed-dependencies-as-resources-using-fody-costura.yml to embed-dependencies-as-resources-using-fodycostura.yml

* use-dotnet-library-encryptdecryptutils

https://github.com/mandiant/capa-rules/pull/612

* use-dotnet-library-newtonsoft.json

https://github.com/mandiant/capa-rules/pull/612

* use-dotnet-library-sharpclipboard

https://github.com/mandiant/capa-rules/pull/612

* use-dotnet-library-sharpvectors

https://github.com/mandiant/capa-rules/pull/612

* Delete load-suspicious-libraries.yml

* Rename use-dotnet-library-newtonsoft.json.yml to use-dotnet-library-newtonsoftjson.yml

* Update use-dotnet-library-newtonsoftjson.yml

* Update use-dotnet-library-sharpvectors.yml

* Update use-dotnet-library-encryptdecryptutils.yml

* Update use-dotnet-library-sharpclipboard.yml

* Rename anti-analysis/obfuscation/use-dotnet-library-encryptdecryptutils.yml to data-manipulation/encryption/aes/use-dotnet-library-encryptdecryptutils.yml

* Rename nursery/use-dotnet-library-newtonsoftjson.yml to data-manipulation/json/use-dotnet-library-newtonsoftjson.yml

* Rename nursery/use-dotnet-library-sharpvectors.yml to data-manipulation/svg/use-dotnet-library-sharpvectors.yml

* Update use-dotnet-library-sharpclipboard.yml

* Update use-dotnet-library-newtonsoftjson.yml

* Update use-dotnet-library-sharpvectors.yml

* Update use-dotnet-library-encryptdecryptutils.yml

* Update use-dotnet-library-newtonsoftjson.yml

* Update use-dotnet-library-sharpvectors.yml

* Update use-dotnet-library-encryptdecryptutils.yml

* Update embed-dependencies-as-resources-using-fodycostura.yml

* Update use-dotnet-library-encryptdecryptutils.yml

* Update use-dotnet-library-sharpvectors.yml

* Update use-dotnet-library-newtonsoftjson.yml

* Update use-dotnet-library-sharpclipboard.yml
 2022-08-29 18:49:40 +02:00
Mike Hunhoff ac4a9edb3b rules: fix invalid rule metadata 2022-08-11 16:12:49 -06:00
Anushka Virgaonkar 95dc5eb27f Add new dotnet rules that capture capabilites typically found in backdoors. (#579) 2022-07-07 13:39:51 -06:00
Willi Ballenthin 57e1732f5c Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors"" 
This reverts commit d43a6ee544.
 2022-06-28 15:23:20 -06:00
Willi Ballenthin 3fc7309b5c Merge branch 'master' into existing-dn-rules 2022-06-28 14:06:51 -06:00
Willi Ballenthin d62ed7f2d9 rename .NET rule paths 2022-06-28 11:08:54 -06:00
Moritz e5f56c8450 Update hash-data-with-crc32.yml 2022-06-24 09:44:12 +02:00
Willi Ballenthin 3152b98ccd use .NET features for existing .NET rules 2022-06-06 15:56:31 -06:00