d33bc13fba
Merge branch 'master' of github.com:fireeye/capa-rules
2020-07-28 15:07:59 -06:00
0b04c942b3
graduate import public key
2020-07-28 15:07:48 -06:00
dbbb928740
Update rules number badge
2020-07-28 19:59:24 +00:00
1deec5c94a
Merge pull request #58 from re-fox/patch-4
...
Create encrypt-data-using-des-via-winapi.yml
2020-07-28 13:59:09 -06:00
ff739c3246
Create encrypt-data-using-des-via-winapi.yml
2020-07-28 15:17:07 -04:00
0d4c08f8c1
Update rules number badge
2020-07-28 16:42:26 +00:00
a2eb5c267f
Merge pull request #54 from fireeye/new-rules-20200727
...
add a couple new rules derived from Cl0p ransomware
2020-07-28 10:42:10 -06:00
36bbb25da8
import public key: add example and fix logic
2020-07-28 10:40:47 -06:00
95d6d534b1
acquire debug privs: add optional match for modify access privs
2020-07-28 10:23:24 -06:00
c39eb84962
Merge pull request #52 from re-fox/patch-1
...
Update validate-credit-card-number-with-luhn-algorithm.yml
2020-07-28 10:17:53 -06:00
1deaa5c9a8
Update rules number badge
2020-07-28 16:02:02 +00:00
12340c2a2c
Merge pull request #57 from Ana06/document-desc-stat
...
doc: Document descriptions for statement nodes
2020-07-28 10:00:46 -06:00
2d54b6aed2
Merge pull request #56 from re-fox/patch-3
...
Create encrypt-data-using-des.yml
2020-07-28 10:00:01 -06:00
170993b2ae
doc: Document descriptions for statement nodes
...
Introduced in:
https://github.com/fireeye/capa/pull/209
2020-07-28 16:26:00 +02:00
b4e531a10b
Create encrypt-data-using-des.yml
2020-07-28 10:04:22 -04:00
341a2fca5c
Modify sync action to include all commits
...
The default `ref` is the one which triggers the action. Consequently the
` Update rules number badge` commit from the `update_num_rules` job is
not synchronized.
2020-07-28 14:03:39 +02:00
b76f4363dc
add a couple new rules derived from Cl0p ransomware
...
unfortunately, haven't found a public sample of the ransomware yet
2020-07-27 15:48:11 -06:00
f97151021f
Update rules number badge
2020-07-27 21:06:14 +00:00
4bc1a003f6
Merge pull request #53 from re-fox/patch-2
...
Create change-the-wallpaper.yml
2020-07-27 15:05:58 -06:00
1dd321d285
Create change-the-wallpaper.yml
...
Initial support for SystemParametersInfo & SPI_SETDESKWALLPAPER
2020-07-27 14:50:40 -04:00
f634c27772
update support for negative offsets
2020-07-27 20:14:42 +02:00
4c9cb02949
fix links
2020-07-27 18:01:56 +02:00
7f94cf106d
Move 'reference processor manufacturer constants' to nursery
...
The example has been removed and this make the rule linter fail.
2020-07-27 15:15:16 +02:00
dac7837749
Update rules number badge
2020-07-24 21:51:11 +00:00
b878effef7
fix rules as documented in #49
2020-07-24 15:49:52 -06:00
8649184a88
Update validate-credit-card-number-with-luhn-algorithm.yml
...
Added in additional check for a compiler optimized version of `% 10` that was `61b8a9dee90cc494cfeebe9467b8085cde4563f307620e73040f48bd9140f00c` a POSeidon binary.
2020-07-24 15:56:18 -04:00
9719dd3570
Update validate-credit-card-number-with-luhn-algorithm.yml
...
Added loop modifier now that https://github.com/fireeye/capa/pull/192 is pulled.
Added case where a sample (`af13e7583ed1b27c4ae219e344a37e2b`) was using a `lea eax,[eax + -0x30]` rather than a `sub`.
2020-07-24 11:27:19 -04:00
5aaf6b4aee
Merge branch 'master' of github.com:fireeye/capa-rules
2020-07-23 17:30:49 -06:00
1c39bd8349
graduate rules that pass the linter
2020-07-23 17:30:37 -06:00
029bbbbaf6
Update rules number badge
2020-07-23 19:33:10 +00:00
f3208e78de
Merge pull request #51 from re-fox/master
...
Adding luhn credit card validation routine
2020-07-23 13:32:54 -06:00
00325979ba
Update and rename luhn-credit-card-validation.yml to validate-credit-card-number-with-luhn-algorithm.yml
2020-07-23 15:28:48 -04:00
fabaddaf6d
updated with luhn credit card algo
2020-07-23 14:59:43 -04:00
4350ffad33
fix rule paths thanks to linter
2020-07-23 11:58:23 -06:00
5a8c50879d
Update rules number badge
2020-07-23 17:49:34 +00:00
8c8950601d
Merge pull request #48 from re-fox/patch-2
...
Create read-initialization-file.yml
2020-07-23 11:49:15 -06:00
fa59341f39
Update read-ini-file.yml
2020-07-23 13:47:34 -04:00
34b02a3572
Update read-ini-file.yml
...
linter fix
2020-07-23 13:39:54 -04:00
6eb8099123
Update and rename read-initialization-file.yml to read-ini-file.yml
...
Updated to `ini` file for readability
2020-07-23 13:38:04 -04:00
1796e41d61
graduate murmur3 hash
2020-07-23 11:29:42 -06:00
6b41f1e76b
parse-credit-card-information: fix examples location
2020-07-23 11:10:06 -06:00
eb2ffe5b68
Create read-initialization-file.yml
2020-07-23 13:07:16 -04:00
d7a30cb933
Merge branch 'master' of github.com:fireeye/capa-rules
2020-07-23 11:02:39 -06:00
8434256938
graduate credit card parsing
2020-07-23 11:02:29 -06:00
bbc389af48
Update rules number badge
2020-07-23 17:01:06 +00:00
e08812e760
Merge pull request #47 from re-fox/patch-1
...
Create credit-card-feature-parsing.yml
2020-07-23 11:00:51 -06:00
53130761fb
Create credit-card-feature-parsing.yml
2020-07-23 10:32:22 -04:00
8c5f841266
Update rules number badge
2020-07-22 21:39:14 +00:00
2b2178908c
Merge pull request #45 from re-fox/master
...
Create check-mutex-and-exit.yml
2020-07-22 15:39:00 -06:00
be1088f709
Update check-mutex-and-exit.yml
2020-07-22 17:37:21 -04:00
William Ballenthin