admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,704 Commits 5 Branches 42 Tags
94de0355cde729b13b4313377d27f17a3ddf2567
Commit Graph

52 Commits

Author SHA1 Message Date
Yacine Elhamer d20a7e0a48 add elaborative comment 2023-08-29 21:32:37 +02:00
Yacine Elhamer d5f05f4e88 initial commit 2023-08-29 21:23:55 +02:00
Yacine Elhamer 5b73ddcd24 manual pass 2023-08-22 09:40:13 +02:00
Yacine Elhamer 0aea484e04 updated rules 2023-08-21 19:14:45 +02:00
Yacine Elhamer c4cdd9bae7 fix improper scope for rules containing a subscope in and 2023-08-21 14:27:45 +02:00
Yacine Elhamer a55d769da8 fix author quoting 2023-08-21 09:10:33 +02:00
Yacine Elhamer 8d851f3343 updated rules 2023-08-20 15:39:29 +02:00
Yacine Elhamer 850909bd82 update 2023-08-17 11:07:02 +02:00
Yacine Elhamer e937af1ee6 initial commit 2023-08-17 10:41:11 +02:00
Moritz 149cf2d133 Merge pull request #799 from mandiant/mr-tz-patch-1 
Update act-as-credential-manager-dll.yml
 2023-08-07 15:54:18 +02:00
jtothej 127330a30a Update metadata and promote create-shortcut-via-ishelllink.yml 2023-08-01 14:27:43 +08:00
Moritz 108974275d Update act-as-credential-manager-dll.yml 
closes #754
 2023-07-14 11:30:11 +02:00
jtothej 3759e261fd Add act-as-dhcp-server-callout-dll.yml act-as-dns-server-plugin-dll.yml authentication-process/act-as-security-support-provider-dll.yml authentication-process/act-as-subauthentication-package-dll.yml 2023-07-11 11:18:06 +08:00
JJ 415b40bb96 Add Office Add-ins rules. (#781) 
* Add Office Add-ins rules.
 2023-07-05 10:56:57 +02:00
JJ e6c917abeb Add act-as-exchange-transport-agent.yml (#782) 
* Add act-as-exchange-transport-agent.yml
 2023-07-05 08:39:49 +02:00
Joren Vrancken e5c07e2109 Add T1053.002 to schedule task via command line rule (#685) 2023-02-10 11:08:01 +01:00
Joren Vrancken cd10a6222a Add checks for creating a service by writing to the registry (#687) 2023-02-06 15:14:20 +01:00
Ryan Xu 74596020b8 Update Mappings for MBC (part 10) (#674) 
* Update capa mappings 01/2023

---------

Co-authored-by: Desiree Beck <dbeck@mitre.org>
 2023-02-01 10:09:34 +01:00
jtothej 0b64b6e89b Add act-as-credential-manager-dll.yml and act-as-password-filter-dll.yml 2022-07-25 17:21:23 +02:00
Willi Ballenthin 88c9c786ca *: use meta.authors everywhere 2022-05-26 11:56:31 -06:00
William Ballenthin fe1aa57334 fix lint problems 2021-10-22 13:42:00 -06:00
William Ballenthin e13beb6c0e add persist via isapi extension 
closes #478
 2021-10-22 13:02:09 -06:00
William Ballenthin ef00959f0b add persist via IIS module 
ref #478
 2021-10-22 13:01:46 -06:00
Moritz Raabe 25938ca10c change to mandiant.com 2021-09-28 12:21:11 +02:00
William Ballenthin ea3ea14c22 minor reorg linux rules and logic 
ref #442
 2021-08-25 15:31:51 -06:00
Joakim Kennedy 78fbf5f3c5 Fix linting errors 2021-08-05 15:35:27 +01:00
Joakim Kennedy 765e182553 A set of rules for Linux ELFs 2021-08-04 15:47:00 +01:00
Moritz c24ab23bc1 ATT&CK v9 updates (#341) 
* update rules

* add example

* update namespace and move

* add rule

* remove HKCU

* update rules

* update rule
 2021-05-06 20:06:24 +02:00
William Ballenthin 0e0d882ad3 lint 2021-05-01 10:20:00 -06:00
William Ballenthin d8847fa0e6 add appinit/disable code signature enforcement 2021-05-01 10:08:27 -06:00
William Ballenthin e139b36c2e appinit: add reference to enable/disable reg key 2021-05-01 10:05:54 -06:00
Moritz Raabe 387334a603 reformated using capafmt 2021-01-27 15:30:59 +01:00
William Ballenthin f8a3de9367 update attack mappings 2021-01-02 11:46:20 -07:00
0x534a 8d54ac8fa3 Make escaping consistent 2020-12-23 23:38:37 +01:00
0x534a 13a4bf1946 Consolidated setting of registry value with reg.exe command in set-registry-value.yml 2020-12-23 22:42:59 +01:00
0x534a 13e454aeba Make the linter happy 2020-12-22 16:33:13 +01:00
0x534a 7d550ecdf5 Fix logic of registry command detection and clean up 2020-12-22 16:30:08 +01:00
sja f0c2087ab5 Fixed format of att&ck string 2020-12-21 18:18:17 +01:00
sja 5d1f5f1244 Add detection by command line to AppInit_DLLs 2020-12-21 17:51:10 +01:00
sja fa4b0ab19e Changed example hashes from sha256 to md5 2020-12-21 17:35:33 +01:00
sja 2ac93f8cd2 Enhancement of persistence rules 2020-12-21 17:18:58 +01:00
re-fox 7bbaaa250b Update persist-via-run-registry-key.yml 2020-10-05 11:08:35 -04:00
Moritz Raabe 5a67716572 fix att&ck 2020-10-01 10:57:44 +02:00
William Ballenthin 1c39bd8349 graduate rules that pass the linter 2020-07-23 17:30:37 -06:00
William Ballenthin 5488530055 fix ATT&CK categories 
closes #25
 2020-07-03 09:14:14 -06:00
William Ballenthin 54cfb05bd0 rules: address comments in #14 2020-06-26 17:45:56 -06:00
William Ballenthin 0482c936fb rules: fix ATT&CK and MBC tags 2020-06-21 17:57:25 -06:00
William Ballenthin 7b4f4d10fb rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better 2020-06-21 17:54:01 -06:00
William Ballenthin 5f57dbdbc9 rules: reorganize rule names, namespaces, and ATT&CK mappings 2020-06-21 17:25:43 -06:00
William Ballenthin e9ad899b0f rules: add trailing newline to end of each file 2020-06-21 15:50:42 -06:00