d20a7e0a48
add elaborative comment
2023-08-29 21:32:37 +02:00
d5f05f4e88
initial commit
2023-08-29 21:23:55 +02:00
5b73ddcd24
manual pass
2023-08-22 09:40:13 +02:00
0aea484e04
updated rules
2023-08-21 19:14:45 +02:00
c4cdd9bae7
fix improper scope for rules containing a subscope in and
2023-08-21 14:27:45 +02:00
a55d769da8
fix author quoting
2023-08-21 09:10:33 +02:00
8d851f3343
updated rules
2023-08-20 15:39:29 +02:00
850909bd82
update
2023-08-17 11:07:02 +02:00
e937af1ee6
initial commit
2023-08-17 10:41:11 +02:00
e44f57c035
AES MixColumns detection ( #749 )
...
* add rule
2023-04-25 21:18:51 +02:00
54d357a201
Update reference-public-rsa-key.yml ( #745 )
2023-04-17 09:59:19 -06:00
32dc1ea9e8
Adding rules for TEA, XTEA, XXTEA and RIPEMD hashing ( #700 )
...
* Adding rules for TEA, XTEA, XXTEA and RIPEMD hashing
Adding to current rules for TEA encrypt & decrypt
Adding rules for XTEA, XXTEA, RIPEMD-128, 160, 256, 320
* Description edited for clarity
* byte pattern correction
* updates
- rules with examples moved out of nursery
- unneeded examples removed from rules and their example files removed from the PR for capa-testfiles
- DS_store files deleted
- Descriptions edited to reflect shared magic constants with SHA1
* ripemd128 update
updated to include magic array not present in MD5
* MD5 & SHA1 documentation update + RIPEMD160 removal
Updating MD5 & SHA1 rules to document magic constants shared with other hashing routines.
Removing RIPEMD160 rule using magic constants due to likelihood of false positives with SHA1 routines
* ripemd320 description update
2023-03-14 08:33:42 +01:00
106123eb61
Rules for the week ( #671 )
...
* add rules
* avoid FPs via mnemonics to ignore
* correct number logic
* add --onefile option strings
2023-01-27 09:56:12 +01:00
07c10dd26b
des: add more constants from libtomcrypt
2023-01-24 12:13:46 +01:00
2a997f5d0c
add upper limit for basic block count ( #661 )
...
* add upper limit for basic block count
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com >
2023-01-19 13:11:45 +01:00
f59538a9e2
rc5/6: more constants
2023-01-19 11:37:32 +01:00
48b71adb35
Update encrypt-data-using-curve25519.yml
2023-01-11 14:10:54 -05:00
96a1abddca
new/update .NET rules ( #625 )
2022-10-07 09:39:57 -06:00
3f298900d4
use .NET libraries ( #612 )
...
* Add files via upload
https://github.com/mandiant/capa-rules/issues/609
* Update load-suspicious-libraries.yml
* Delete load-suspicious-libraries.yml
* Create load-suspicious-libraries.yml
* Update load-suspicious-libraries.yml
* Update load-suspicious-libraries.yml
* embed dependencies as resources using Fody/Costura
https://github.com/mandiant/capa-rules/pull/612
* Delete embed-dependencies-as-resources-using-fody-costura.yml
* embed-dependencies-as-resources-using-fody-costura
https://github.com/mandiant/capa-rules/pull/612
* Rename embed-dependencies-as-resources-using-fody-costura.yml to embed-dependencies-as-resources-using-fodycostura.yml
* use-dotnet-library-encryptdecryptutils
https://github.com/mandiant/capa-rules/pull/612
* use-dotnet-library-newtonsoft.json
https://github.com/mandiant/capa-rules/pull/612
* use-dotnet-library-sharpclipboard
https://github.com/mandiant/capa-rules/pull/612
* use-dotnet-library-sharpvectors
https://github.com/mandiant/capa-rules/pull/612
* Delete load-suspicious-libraries.yml
* Rename use-dotnet-library-newtonsoft.json.yml to use-dotnet-library-newtonsoftjson.yml
* Update use-dotnet-library-newtonsoftjson.yml
* Update use-dotnet-library-sharpvectors.yml
* Update use-dotnet-library-encryptdecryptutils.yml
* Update use-dotnet-library-sharpclipboard.yml
* Rename anti-analysis/obfuscation/use-dotnet-library-encryptdecryptutils.yml to data-manipulation/encryption/aes/use-dotnet-library-encryptdecryptutils.yml
* Rename nursery/use-dotnet-library-newtonsoftjson.yml to data-manipulation/json/use-dotnet-library-newtonsoftjson.yml
* Rename nursery/use-dotnet-library-sharpvectors.yml to data-manipulation/svg/use-dotnet-library-sharpvectors.yml
* Update use-dotnet-library-sharpclipboard.yml
* Update use-dotnet-library-newtonsoftjson.yml
* Update use-dotnet-library-sharpvectors.yml
* Update use-dotnet-library-encryptdecryptutils.yml
* Update use-dotnet-library-newtonsoftjson.yml
* Update use-dotnet-library-sharpvectors.yml
* Update use-dotnet-library-encryptdecryptutils.yml
* Update embed-dependencies-as-resources-using-fodycostura.yml
* Update use-dotnet-library-encryptdecryptutils.yml
* Update use-dotnet-library-sharpvectors.yml
* Update use-dotnet-library-newtonsoftjson.yml
* Update use-dotnet-library-sharpclipboard.yml
2022-08-29 18:49:40 +02:00
ac4a9edb3b
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
57e1732f5c
Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""
...
This reverts commit d43a6ee544
2022-06-28 15:23:20 -06:00
3fc7309b5c
Merge branch 'master' into existing-dn-rules
2022-06-28 14:06:51 -06:00
d62ed7f2d9
rename .NET rule paths
2022-06-28 11:08:54 -06:00
3152b98ccd
use .NET features for existing .NET rules
2022-06-06 15:56:31 -06:00
20c46c64c8
Merge pull request #562 from ryantxu1/master
...
Update Mappings for MBC (part 8)
2022-06-03 11:15:49 -06:00
92eef819bb
Update Mappings for MBC (part 8)
2022-06-03 09:43:39 -05:00
88c9c786ca
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
49ac35dbe7
Update rules to use a list item instead of a string value for references.
2022-05-11 10:39:42 -04:00
d43a6ee544
Revert "Merge pull request #548 from mandiant/feature-remove-flavors"
...
This reverts commit bc28847dd982308c4109
2022-04-27 06:23:36 -06:00
904bf3ef00
*: remove /x32 and /x64 flavors and use instruction scope
2022-04-05 12:25:14 -06:00
cae4aa28ae
Issue #539 : Sample manually build AES/Rijndael boxes
2022-03-14 14:01:07 -05:00
ee10f6eaa4
add linux requirement
2021-10-24 18:13:50 -04:00
0d83ae971c
Add glibc memfrob rule
2021-10-23 03:40:55 -04:00
25938ca10c
change to mandiant.com
2021-09-28 12:21:11 +02:00
b2f28af082
update reference link and change comments to descriptions
2021-08-24 12:29:42 -04:00
92d4dd931d
udpate comment
2021-08-24 12:21:38 -04:00
8ee20678aa
udpate email
2021-08-24 12:21:00 -04:00
18804adef9
add rule for WolfSSL HC-128 encryption algorithm
2021-08-24 12:19:34 -04:00
656de6b7bd
create new key via CryptAcquireContext: tweak DLL name for CryptAcquireContext
2021-08-18 15:12:21 -06:00
e97867d227
Fix api and remove example
2021-07-19 13:55:57 -07:00
30b68fda00
Add rule for CryptAcquireContext CRYPT_NEWKEYSET
2021-07-19 12:32:51 -07:00
5b9f0f0787
graduate "get outbound credentials handle via CredSSP"
2021-06-08 10:08:42 -06:00
fbafd732e7
Update rule metadata for rules written by @recvfrom
...
Mostly just changes @recvfrom to awillia2@cisco.com , but
also updates the descriptions in a few places to be
more precise (I don't think I initially realized that
`api` has function scope and is for API calls whereas
`import` has file level scope and is just for the import)
2021-06-06 23:30:34 -04:00
554ffb2139
encrypt aes via x86: remove example and move to nursery
2021-05-18 13:37:40 -06:00
6e501e8151
rules: convert inline comments to descriptions
...
closes #1
2021-05-18 10:45:41 -06:00
8cde760ec4
graduate EC rule
2021-04-09 11:24:47 +02:00
20e1b8fd4c
enforce string formatting with double quotes + escaped special characters
2021-03-24 14:14:38 -06:00
7d1642122a
Update rules number badge
2021-03-22 08:40:59 +00:00
0af8107a7e
Hopefully fixed linting issues...
2021-03-18 14:12:46 -04:00
90926404a2
Updated references
2021-03-18 14:10:05 -04:00
Yacine Elhamer