admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,201 Commits 5 Branches 42 Tags
e5f56c84500372cf12ad06eeb841c3da1663be2a
Commit Graph

46 Commits

Author SHA1 Message Date
Willi Ballenthin 88c9c786ca *: use meta.authors everywhere 2022-05-26 11:56:31 -06:00
idiom 49ac35dbe7 Update rules to use a list item instead of a string value for references. 2022-05-11 10:39:42 -04:00
William Ballenthin d43a6ee544 Revert "Merge pull request #548 from mandiant/feature-remove-flavors" 
This reverts commit bc28847dd9, reversing
changes made to 82308c4109.
 2022-04-27 06:23:36 -06:00
Willi Ballenthin 904bf3ef00 *: remove /x32 and /x64 flavors and use instruction scope 2022-04-05 12:25:14 -06:00
Desiree Beck ed3661b379 add mbc and att&ck tags 2021-12-14 16:16:07 -05:00
Michael Hunhoff e7c2100400 updating download-url-to-file.yml 2021-12-06 10:35:03 -07:00
Desiree Beck e190179ffd Merge pull request #1 from MBCProject/ryan-patches1 
Update patch-process-command-line.yml
 2021-11-22 11:27:15 -05:00
William Ballenthin 18e48620b6 send file via http: fix example 2021-10-22 11:20:00 -06:00
Moritz Raabe 25938ca10c change to mandiant.com 2021-09-28 12:21:11 +02:00
Moritz Raabe a69581c0a5 rule additions and updates 2021-09-10 16:04:25 +02:00
jlepore-fe 92972fd988 update function ptr size comments 2021-09-08 10:05:27 -04:00
jlepore-fe 9d1338113b transmitpackets callback function via wsaioctl (#456) 
* transmitpackets callback function via wsaioctl

* Update communication/socket/tcp/send/wsaioctl_transmitpackets_callbackfunc.yml

Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>

* Update and rename wsaioctl_transmitpackets_callbackfunc.yml to obtain-transmitpackets-callback-function-via-wsaioctl

* Rename obtain-transmitpackets-callback-function-via-wsaioctl to obtain-transmitpackets-callback-function-via-wsaioctl.yml

* Update obtain-transmitpackets-callback-function-via-wsaioctl.yml

* Update obtain-transmitpackets-callback-function-via-wsaioctl.yml

Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
 2021-08-30 18:30:14 +02:00
Joakim Kennedy ad95ee4032 Fix linting error 2021-08-26 14:43:06 +01:00
Joakim Kennedy 5678afad06 Fix some FPs in ELF files by adding os requirement 2021-08-26 11:40:35 +01:00
Ryan Xu 70f2af8563 Update create-bits-job.yml 2021-08-23 10:55:20 -05:00
Ryan Xu 9951415d5d Update reference-dns-over-https-endpoints.yml 2021-08-23 10:15:26 -05:00
Joakim Kennedy 78fbf5f3c5 Fix linting errors 2021-08-05 15:35:27 +01:00
Joakim Kennedy 765e182553 A set of rules for Linux ELFs 2021-08-04 15:47:00 +01:00
Moritz Raabe 057f06d85b minor updates 2021-06-08 14:36:22 +02:00
William Ballenthin d7dde41304 graduate "create BITS job" 2021-06-04 12:09:01 -06:00
Michael Hunhoff a18ea071ba adding new rules for keylogging, HTTP comms, network collection 2021-05-26 14:58:20 -06:00
William Ballenthin 6e501e8151 rules: convert inline comments to descriptions 
closes #1
 2021-05-18 10:45:41 -06:00
Michael Hunhoff 1107f35fdb updating rules + new rules 2021-03-25 13:10:42 -06:00
Moritz Raabe 77b737fcf0 rule tweaks based on PMA Lab 03-02.dll 
see #296
 2021-03-22 19:05:08 +01:00
Willi Ballenthin 1f48bd02a6 whitespace 2021-02-04 16:38:09 -07:00
Willi Ballenthin ebb14294b1 whitespace 2021-02-04 16:28:13 -07:00
Willi Ballenthin 06984304e4 connect-tcp-socket: add SO_UPDATE_CONNECT_CONTEXT 2021-02-04 16:25:44 -07:00
Willi Ballenthin b7809dae41 connect-tcp-socket: add SIO_GET_EXTENSION_FUNCTION_POINTER 2021-02-04 16:22:51 -07:00
Willi Ballenthin 0f6e2dacb3 connect-tcp-socket: fix lint issue 2021-02-04 16:20:27 -07:00
Willi Ballenthin f44903cb53 connect-tcp-socket: add ConnectEx via WSAID_CONNECTEX 2021-02-04 16:18:01 -07:00
Moritz Raabe 387334a603 reformated using capafmt 2021-01-27 15:30:59 +01:00
William Ballenthin f8a3de9367 update attack mappings 2021-01-02 11:46:20 -07:00
Moritz Raabe 15911402d8 comms and shellcode technique rules 2020-12-15 21:49:18 +01:00
Moritz Raabe 47c1b485c0 fix mbc objective 2020-10-01 10:30:08 +02:00
Desiree Beck 69e7479e40 mapping capa rule updates 2020-09-29 15:05:11 -04:00
Michael Hunhoff 6ccc9a736f fresh rules from al-khaser project 2020-08-13 09:39:42 -06:00
William Ballenthin b878effef7 fix rules as documented in #49 2020-07-24 15:49:52 -06:00
Moritz Raabe b585c0ef73 update to basic block scope 2020-07-11 14:02:30 +02:00
William Ballenthin 54cfb05bd0 rules: address comments in #14 2020-06-26 17:45:56 -06:00
William Ballenthin 7b4f4d10fb rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better 2020-06-21 17:54:01 -06:00
William Ballenthin 5f57dbdbc9 rules: reorganize rule names, namespaces, and ATT&CK mappings 2020-06-21 17:25:43 -06:00
William Ballenthin 7f5fb71a5d rules: use meta.references over meta.reference 
closes #13
 2020-06-21 16:41:18 -06:00
William Ballenthin 34417a4709 rules: reformat with 'description' order 2020-06-21 16:30:05 -06:00
William Ballenthin e9ad899b0f rules: add trailing newline to end of each file 2020-06-21 15:50:42 -06:00
William Ballenthin 69507875b0 rules: reformat all rules using capafmt 2020-06-21 15:47:02 -06:00
William Ballenthin eaae0e89a7 import existing rules, forgetting about 938 prior commits 2020-06-18 07:27:35 -06:00