admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,285 Commits 5 Branches 42 Tags
ffdb07ca8ccd315907751dc9d3b6084a38e89f10
Commit Graph

1285 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
MalwareMechanic ffdb07ca8c add additional MITRE ATT&CK and MBC mappings (#611) 2022-08-18 08:19:37 -06:00
Capa Bot 506e3132bc Update rules number badge v4.0.1 2022-08-15 08:39:34 +00:00
Moritz 759c740c49 Merge pull request #608 from jtothej/vsobfuscation 
Adding obfuscated-with-vs-obfuscation.yml
 2022-08-15 10:38:43 +02:00
jtothej f7faca3287 Adding obfuscated-with-vs-obfuscation.yml 2022-08-13 14:29:20 +02:00
Moritz 7e250d27f9 Merge pull request #607 from mandiant/fix/606 
rules: fix invalid rule metadata
 2022-08-12 11:29:23 +02:00
Mike Hunhoff ac4a9edb3b rules: fix invalid rule metadata 2022-08-11 16:12:49 -06:00
Capa Bot ad4da12d90 Update rules number badge v4.0.0 2022-08-09 10:50:30 +00:00
Moritz 84e8b73492 Merge pull request #600 from jtothej/httpsrv 
Updated start-http-server.yml with .Net API
 2022-08-09 12:37:40 +02:00
Moritz 59d3949bb4 Merge pull request #599 from jtothej/ps2exe 
Updated compiled-with-ps2exe.yml to match on files build using recent…
 2022-08-09 12:36:28 +02:00
Moritz a2a6c3dd88 Merge pull request #598 from jtothej/dotnetobf 
Adding .Net obfuscation rules.
 2022-08-09 12:36:02 +02:00
Capa Bot c7671df924 Update rules number badge 2022-08-09 10:35:11 +00:00
Moritz 6a64ffb102 Merge pull request #597 from jtothej/auth 
Add act-as-credential-manager-dll.yml and act-as-password-filter-dll.yml
 2022-08-09 12:34:57 +02:00
jtothej d5b014127e Updated start-http-server.yml with .Net API 2022-07-27 11:19:25 +02:00
jtothej f75b401014 Updated compiled-with-ps2exe.yml to match on files build using recent versions of ps2exe available @ https://github.com/MScholtes/PS2EXE 2022-07-26 13:46:23 +02:00
jtothej af900ae93b Adding .Net obfuscation rules. 2022-07-26 11:33:01 +02:00
jtothej 0b64b6e89b Add act-as-credential-manager-dll.yml and act-as-password-filter-dll.yml 2022-07-25 17:21:23 +02:00
Moritz e88db21de4 fix: rule logic (#592) 
* fix: rule logic

* fix: rule logic
 2022-07-12 18:09:51 +02:00
Capa Bot 9d74812a5f Update rules number badge 2022-07-07 21:24:21 +00:00
re-fox e09ddd6242 Create hash-data-using-rshash.yml (#589) 2022-07-07 15:24:08 -06:00
Anushka Virgaonkar dcc2e74c84 Update with dotnet capabilities (#590) 2022-07-07 15:22:39 -06:00
Capa Bot cd3d7d81b7 Update rules number badge 2022-07-07 19:40:27 +00:00
Anushka Virgaonkar 95dc5eb27f Add new dotnet rules that capture capabilites typically found in backdoors. (#579) 2022-07-07 13:39:51 -06:00
Capa Bot de6dbc9aa6 Update rules number badge 2022-07-07 17:38:02 +00:00
Willi Ballenthin 4f72756346 Merge pull request #588 from re-fox/master 
Create hash-data-using-jshash.yml
 2022-07-07 11:37:50 -06:00
re-fox c75b11c5b6 Create hash-data-using-jshash.yml 2022-07-07 10:36:06 -04:00
Capa Bot 14953f80c1 Update rules number badge v3.2.1 2022-07-06 19:36:11 +00:00
re-fox 52b0a9a152 Create hash-data-using-aphash.yml (#587) 
* Create hash-data-using-aphash.yar

* Rename hash-data-using-aphash.yar to hash-data-using-aphash.yml
 2022-07-06 21:35:56 +02:00
Capa Bot c4ca94dd32 Update rules number badge 2022-07-05 15:36:57 +00:00
Moritz 9524b011f6 Merge pull request #586 from mandiant/new/20220418 
add power-down-monitor.yml, update read-process-memory.yml
 2022-07-05 17:36:37 +02:00
Michael Hunhoff 59b881c006 add power-down-monitor.yml, update read-process-memory.yml 2022-07-05 08:44:29 -06:00
Moritz 020a0763af Update get-installed-programs.yml (#584) 2022-07-05 09:52:52 +02:00
Moritz 489068bb96 ci: lint thorough on PR text (#581) 
* ci: lint thorough on PR text

* ci: document thorough lint option
 2022-07-05 09:09:05 +02:00
Willi Ballenthin c669a778ab Merge pull request #582 from re-fox/master 
Graduate get-installed-programs.yml
 2022-07-01 10:15:31 -06:00
re-fox 4383e9aa5b Graduate get-installed-programs.yml 2022-07-01 11:14:28 -04:00
Willi Ballenthin 1bdaa1123f Merge pull request #580 from mandiant/mr-tz-patch-1 
Update format.md
 2022-07-01 08:49:57 -06:00
Moritz 2b33378f9e Update format.md 2022-07-01 12:17:24 +02:00
Capa Bot 13a765ce4e Update rules number badge 2022-06-30 15:17:09 +00:00
Willi Ballenthin 30ef9dab3a Merge pull request #578 from re-fox/master 
Create gather-chrome-based-browser-login-information.yml
 2022-06-30 09:16:52 -06:00
re-fox c7920113f0 Create gather-chrome-based-browser-login-information.yml 2022-06-30 10:56:52 -04:00
Capa Bot 4fa1440db9 Update rules number badge 2022-06-29 23:21:43 +00:00
Willi Ballenthin 9a4346872c Merge pull request #577 from re-fox/master 
Create capture-screenshot-via-keybd-event.yml
 2022-06-29 17:21:28 -06:00
re-fox 683a5a581b Update collection/screenshot/capture-screenshot-via-keybd-event.yml 
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
 2022-06-29 14:02:01 -04:00
Capa Bot 64464a61bd Update rules number badge 2022-06-29 17:54:55 +00:00
Anushka Virgaonkar 2465adcf1c Add execute .NET assembly rules (#576) 2022-06-29 11:54:41 -06:00
Mike Hunhoff 5f7e1fb514 update documentation for .NET (#574) 2022-06-29 11:54:04 -06:00
re-fox ac1dd7032a Create capture-screenshot-via-keybd-event.yml 2022-06-29 12:49:28 -04:00
Capa Bot d2ad3a045a Update rules number badge 2022-06-28 21:33:36 +00:00
Willi Ballenthin b65b9e80c9 Merge pull request #575 from mandiant/revert-revert-v4 
Revert revert v4 breaking changes
 2022-06-28 15:33:21 -06:00
Willi Ballenthin 9083a1950c linter 2022-06-28 15:30:57 -06:00
Willi Ballenthin 75f1602591 Revert "Revert "Update rules number badge"" 
This reverts commit a7a9833b9b.
 2022-06-28 15:27:19 -06:00