admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,201 Commits 5 Branches 42 Tags
e5f56c84500372cf12ad06eeb841c3da1663be2a
Commit Graph

57 Commits

Author SHA1 Message Date
Willi Ballenthin 88c9c786ca *: use meta.authors everywhere 2022-05-26 11:56:31 -06:00
William Ballenthin d43a6ee544 Revert "Merge pull request #548 from mandiant/feature-remove-flavors" 
This reverts commit bc28847dd9, reversing
changes made to 82308c4109.
 2022-04-27 06:23:36 -06:00
Willi Ballenthin 904bf3ef00 *: remove /x32 and /x64 flavors and use instruction scope 2022-04-05 12:25:14 -06:00
Michael Hunhoff 94f1639cb4 update hijack-thread-execution.yml to match additional scenarios 2022-03-23 09:01:25 -06:00
Baptistin Boilot efea9a37d9 Fix MBC names and IDs 2022-02-06 11:13:23 +01:00
jtothej bffb8e1233 Renaming inject-shellcode-using-mapping-injection.yml 2021-12-14 10:44:32 +08:00
jtothej b70a876a26 Adding inject-shellcode-using-mapping-injection.yml 2021-12-12 16:07:58 +08:00
Ryan Xu 607a06e184 Adding changes suggested by Mandiant 2021-11-23 09:01:53 -05:00
Desiree Beck e190179ffd Merge pull request #1 from MBCProject/ryan-patches1 
Update patch-process-command-line.yml
 2021-11-22 11:27:15 -05:00
William Ballenthin 8b8b584e2d injection: add ATT&CK Reflective Code Loading 
closes #477
 2021-10-22 12:43:30 -06:00
Moritz Raabe 25938ca10c change to mandiant.com 2021-09-28 12:21:11 +02:00
William Ballenthin f6b9564332 *: fix ntdll/ntoskrnl lints 2021-08-26 17:52:24 -06:00
William Ballenthin c0fa8a2318 linux: add examples 2021-08-26 17:48:20 -06:00
William Ballenthin ea3ea14c22 minor reorg linux rules and logic 
ref #442
 2021-08-25 15:31:51 -06:00
Willi Ballenthin 6f582bd395 Merge pull request #442 from TcM1911/linux-rules 
A set of rules for Linux ELFs
 2021-08-25 14:33:25 -06:00
William Ballenthin 0ef69c4fbd *: use substring features rather than unreadable regexes 
closes #450
 2021-08-24 12:47:26 -06:00
Ryan Xu b4e040dc50 preliminary mapping 2021-08-23 14:11:00 -05:00
Willi Ballenthin cfb95cf5c9 Merge pull request #422 from fireeye/pma-2021-06-30 
adding rules based on more PMA labs
 2021-08-18 14:46:21 -06:00
William Ballenthin 39e87e6cb4 execute-command: use better example 2021-08-18 14:45:48 -06:00
Joakim Kennedy 776bcd34dd Move rules without examples to nursery 2021-08-05 15:52:17 +01:00
Joakim Kennedy b8d4b0cf0c A few more lint fixes 2021-08-05 15:48:48 +01:00
Joakim Kennedy 78fbf5f3c5 Fix linting errors 2021-08-05 15:35:27 +01:00
Joakim Kennedy 765e182553 A set of rules for Linux ELFs 2021-08-04 15:47:00 +01:00
Willi Ballenthin c720882519 use process Doppelgänging: fix diacritic 
closes #427
 2021-07-13 12:32:36 -06:00
Moritz Raabe d81e757728 adding rules based on more PMA labs 2021-06-30 23:38:17 +02:00
mike-hunhoff 281eec1c60 Merge pull request #403 from fireeye/new/20210602 
adding create-process-memory-minidump.yml
 2021-06-10 08:42:19 -06:00
Michael Hunhoff 2c8d54b611 graduate create-process-memory-minidump.yml 2021-06-10 08:35:25 -06:00
William Ballenthin e6e16d7b85 graduate "acquire debug privileges" 2021-06-04 11:56:44 -06:00
William Ballenthin 913cebdb38 Merge branch 'master' into fix-1 2021-05-18 10:48:06 -06:00
William Ballenthin 6e501e8151 rules: convert inline comments to descriptions 
closes #1
 2021-05-18 10:45:41 -06:00
Moritz c24ab23bc1 ATT&CK v9 updates (#341) 
* update rules

* add example

* update namespace and move

* add rule

* remove HKCU

* update rules

* update rule
 2021-05-06 20:06:24 +02:00
Moritz 62f28b55fe Update terminate-process.yml 2021-04-27 08:19:05 +02:00
Andrew 8a513b280b Add rules from Egregor ransomware DLL 2021-04-26 11:56:25 -04:00
mike-hunhoff eb8221d9ad Merge pull request #305 from fireeye/enfore-string-format 
enforce string formatting
 2021-03-25 12:36:51 -06:00
Michael Hunhoff 20e1b8fd4c enforce string formatting with double quotes + escaped special characters 2021-03-24 14:14:38 -06:00
Moritz Raabe 77b737fcf0 rule tweaks based on PMA Lab 03-02.dll 
see #296
 2021-03-22 19:05:08 +01:00
Michael Hunhoff 750e164a41 removing ntdll requirement from function features exported by both ntdll and ntoskrnl 2021-02-16 18:28:05 -07:00
Moritz Raabe 7ee2c63e83 capafmted rules 2021-01-28 17:26:25 +01:00
0x534a cf84ebe7d3 Fixes rule logic of inject-thread.yml to also match allocation of RW memory 2021-01-28 16:46:20 +01:00
0x534a bfd063c8ab Fixes rule logic of inject-thread.yml to also match allocation of RW memory 2021-01-28 16:38:56 +01:00
0x534a 29fbeec36a Adjusts test file of hijack-thread-execution.yml, resolves conflict in inject-thread.yml and removes articles from rules 2021-01-28 15:28:53 +01:00
0x534a 8c93d205a8 Improve injection detection and some refactoring of existing rules 2021-01-28 14:47:31 +01:00
William Ballenthin f1f0b4a1b6 merge 2021-01-02 11:06:53 -07:00
William Ballenthin d99c02aca7 update ATT&CK mappings 2021-01-02 11:06:02 -07:00
Desiree Beck 499308b3e9 update based on comments 2020-12-16 16:33:22 -05:00
Desiree Beck c5d24c671a added mbc mappings in the host-interaction namespace 2020-12-16 15:30:06 -05:00
re-fox edb3e1290d Update and rename nursery/inject-apc.yml to host-interaction/process/inject/inject-apc.yml 2020-12-11 13:51:26 -05:00
Michael Hunhoff d569817bdf adding new rules for Gh0st 2020-12-02 08:14:20 -07:00
re-fox 7d3ab51ab0 Create terminate-process-via-fastfail.yml 2020-10-05 12:14:27 -04:00
Michael Hunhoff febacd30b0 PR changes additional 2020-08-27 09:45:06 -06:00