mandiant-capa-rules

admin/mandiant-capa-rules

Fork 0

mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00

Commit Graph

Select branches

Hide Pull Requests

ci/warn-latest-release

copilot/categorize-capa-rules-script

dynamic-syntax

master

revert-918-patches/add-b64-vbmi

#100

#1001

#1003

#1004

#1005

#1006

#1007

#1009

#101

#1010

#1011

#1012

#1013

#1014

#1015

#1016

#1017

#1018

#1019

#102

#1021

#1022

#1024

#1025

#1026

#1027

#1028

#1029

#103

#1031

#1033

#1034

#1038

#1039

#104

#1040

#1044

#1045

#1046

#1047

#1049

#1051

#1052

#1055

#1058

#106

#1061

#1062

#1063

#1064

#1065

#1066

#1067

#1068

#1069

#107

#1070

#1071

#1072

#1073

#1074

#1075

#1076

#1077

#1078

#1079

#1080

#1082

#1084

#1085

#1086

#1087

#109

#1094

#1097

#1098

#1099

#110

#1103

#1104

#1105

#1106

#1107

#1108

#111

#1110

#1111

#1112

#1113

#1115

#1116

#1117

#1118

#1119

#112

#1120

#1121

#1122

#1122

#1123

#1123

#1124

#1125

#1125

#1126

#1126

#1127

#1128

#1129

#113

#1130

#1131

#1132

#1132

#1133

#1134

#1135

#1136

#1137

#1138

#1139

#114

#1140

#1141

#1142

#1142

#1143

#1146

#1147

#1148

#1148

#1149

#1150

#1151

#1152

#1152

#1154

#1155

#1156

#1157

#1158

#1159

#116

#1160

#118

#12

#120

#121

#122

#123

#124

#126

#129

#130

#133

#134

#135

#136

#137

#138

#139

#14

#140

#142

#143

#144

#145

#146

#147

#149

#15

#150

#152

#153

#154

#155

#156

#157

#158

#159

#161

#163

#164

#165

#166

#167

#168

#169

#170

#171

#172

#173

#180

#182

#183

#184

#186

#189

#190

#191

#192

#193

#195

#196

#197

#198

#2

#20

#200

#201

#202

#204

#206

#207

#208

#209

#210

#214

#215

#216

#217

#218

#219

#22

#221

#224

#225

#227

#229

#23

#230

#232

#234

#235

#236

#237

#238

#24

#242

#243

#244

#245

#253

#254

#255

#256

#257

#258

#262

#263

#264

#265

#266

#269

#273

#275

#276

#277

#280

#281

#283

#284

#287

#288

#29

#290

#297

#298

#300

#301

#302

#304

#305

#306

#308

#309

#310

#311

#312

#313

#314

#315

#317

#33

#333

#337

#338

#339

#340

#341

#35

#36

#365

#366

#367

#368

#369

#37

#372

#374

#375

#376

#377

#378

#379

#38

#381

#385

#386

#387

#388

#389

#39

#390

#392

#393

#394

#395

#397

#398

#399

#40

#400

#403

#404

#405

#406

#407

#408

#409

#41

#411

#412

#413

#414

#415

#419

#42

#420

#421

#422

#425

#429

#43

#433

#436

#437

#438

#44

#440

#441

#442

#443

#444

#445

#447

#448

#449

#45

#451

#452

#454

#456

#458

#459

#460

#461

#463

#466

#467

#468

#47

#472

#48

#482

#483

#485

#486

#487

#488

#489

#490

#491

#492

#493

#498

#500

#501

#502

#503

#504

#505

#506

#507

#508

#51

#510

#511

#512

#513

#514

#515

#516

#518

#52

#522

#523

#524

#525

#526

#529

#53

#530

#535

#536

#538

#54

#540

#542

#543

#544

#545

#546

#547

#548

#549

#550

#553

#557

#558

#559

#56

#560

#561

#562

#563

#564

#565

#566

#567

#568

#569

#57

#571

#572

#573

#574

#575

#576

#577

#578

#579

#58

#580

#581

#582

#584

#586

#587

#588

#589

#59

#590

#592

#594

#597

#598

#599

#60

#600

#601

#603

#603

#607

#608

#61

#610

#611

#612

#614

#616

#618

#619

#621

#622

#623

#624

#625

#626

#627

#630

#631

#637

#638

#639

#64

#643

#644

#645

#647

#649

#65

#650

#651

#652

#653

#654

#655

#656

#657

#658

#659

#66

#660

#661

#662

#663

#665

#666

#667

#668

#669

#67

#671

#672

#673

#674

#675

#677

#68

#680

#681

#684

#685

#686

#687

#688

#689

#69

#690

#691

#692

#694

#695

#696

#697

#698

#699

#70

#700

#701

#702

#703

#704

#705

#707

#708

#71

#712

#713

#714

#715

#716

#718

#72

#721

#723

#724

#726

#728

#729

#73

#730

#731

#732

#733

#734

#735

#738

#739

#74

#740

#741

#743

#744

#745

#748

#749

#75

#750

#751

#756

#757

#758

#76

#761

#762

#763

#764

#765

#766

#767

#768

#769

#77

#770

#771

#773

#774

#775

#776

#777

#778

#779

#78

#780

#781

#782

#783

#784

#785

#786

#787

#788

#789

#790

#791

#792

#793

#794

#795

#796

#797

#798

#799

#800

#801

#802

#803

#804

#805

#806

#807

#808

#809

#810

#811

#812

#813

#814

#815

#816

#817

#818

#820

#821

#822

#823

#824

#825

#826

#828

#829

#831

#832

#833

#834

#835

#836

#837

#838

#839

#841

#843

#845

#846

#847

#848

#851

#852

#854

#857

#858

#859

#860

#861

#862

#863

#864

#865

#866

#867

#870

#871

#874

#878

#879

#882

#883

#885

#886

#888

#890

#891

#892

#893

#895

#896

#900

#901

#902

#903

#904

#905

#906

#907

#908

#912

#913

#914

#916

#917

#918

#919

#92

#920

#921

#922

#924

#925

#926

#927

#928

#929

#93

#930

#931

#932

#933

#933

#935

#936

#937

#938

#939

#94

#940

#942

#945

#947

#948

#949

#95

#950

#952

#953

#954

#955

#956

#96

#960

#961

#963

#969

#97

#972

#973

#978

#98

#980

#982

#983

#984

#985

#986

#987

#988

#989

#99

#990

#991

#992

#993

#995

#997

#999

v1.0.0

v1.1.0

v1.2.0

v1.3.0

v1.4.0

v1.5.0

v1.5.1

v1.6.0

v1.6.1

v2.0.0

v3.0.0

v3.0.1

v3.0.2

v3.0.3

v3.1.0

v3.2.0

v3.2.1

v4.0.0

v4.0.1

v5.0.0

v5.1.0

v6.0.0

v6.0.0a1

v6.0.0a2

v6.0.0a3

v6.1.0

v7.0.0

v7.0.0-beta

v7.0.1

v7.1.0

v7.2.0

v7.3.0

v7.4.0

v8.0.0

v8.0.1

v9.0.0

v9.1.0

v9.2.0

v9.2.1

v9.3.0

v9.3.1

v9.4.0

e240160da4 Fix: remove warnings for reference_wmi_statements master Ange Albertini 2026-05-22 16:14:25 +02:00
acd90afa11 Merge pull request #1120 from devarjya27/improve-self-deletion-rule Ange Albertini 2026-05-22 11:42:10 +00:00
b1bfb12936 Merge pull request #1160 from corkamig/odin Moritz 2026-05-21 09:01:54 +02:00
6c1ea457dd Add rule for binaries compiled with Odin Ange Albertini 2026-05-20 12:43:08 +00:00
1d90df0a8b Merge pull request #1159 from corkamig/crystal Moritz 2026-05-20 11:08:02 +02:00
0f38d0b488 Add rule for samples compiled by Crystal Ange Albertini 2026-05-20 09:29:10 +02:00
2a7f18b12e Add rule for PE stored as UUID (#1158) Ange Albertini 2026-05-20 07:09:00 +00:00
89637fba22 Add .NET Environment.TickCount timing anti-debug rule (#1137) Aryan Khandhadiya 2026-05-16 00:41:58 +05:30
54a9981f7a add rule for GetIsNetworkAvailable (#1155) ömür 2026-05-15 21:22:25 +03:00
2adb480e41 add new .NET rules (#1157) Mike Hunhoff 2026-05-15 08:05:49 -06:00
3839c06e79 Merge pull request #1156 from corkamig/patch-1 Ange Albertini 2026-05-15 12:32:33 +02:00
be59710ad9 Merge pull request #1154 from mandiant/fix-3058 Moritz 2026-05-07 12:49:45 +02:00
15f01df0ad fix: add example offsets to a few rules Willi Ballenthin 2026-05-07 12:13:02 +02:00
2af9fbfc1c add get http custom header (#1147) v9.4.0 msanchit-dev 2026-03-31 22:09:02 +05:30
7bb186f6d6 Add nursery rules for Linux kernel rootkit techniques (#1136) Aryan Khandhadiya 2026-03-27 22:33:16 +05:30
03a20f69ae Split .NET features from windows file & process rules (#1130) Tarang 2026-03-12 23:11:24 +05:30
3ce071c2f9 broaden ITaskService scheduled-task detection for .NET TaskService usage (#1133) Akshat Pal 2026-03-12 22:38:16 +05:30
5c346a3389 Add get HTTP Query date (#1128) Tarang 2026-03-12 22:34:32 +05:30
cd272f5b11 Merge pull request #1129 from EclipseAditya/fix/escape-plus-in-base64-regex-1101 Moritz 2026-03-04 21:29:39 +01:00
bd29ed4563 fix: escape + and / in Base64 string regex, add URL-safe variant Aditya Pandey 2026-02-28 22:20:28 +05:30
35498e9dae Merge pull request #1124 from CosmoWorker/scexe-create Moritz 2026-03-03 08:48:00 +01:00
5da642668e Add new rule persist-via-shellserviceobjectdelayload-registry-key.yml (#1117) xpzhxhm 2026-02-26 11:44:06 -05:00
d0291900af add word boundaries around del in both regexes Devarjya 2026-02-25 00:04:33 +05:30
9609e19ddb Powershell expression (#1118) Saniya Fatima 2026-02-24 02:21:19 +05:30
19380b704e update create-service to detect sc.exe usage CosmoWorker 2026-02-23 20:10:04 +05:30
f0292fc977 feat(targeting): add cloud and container collection/interaction rules (#1098) Maijin 2026-02-24 00:32:32 +08:00
2e72aa5536 Merge pull request #1121 from mandiant/lsc-1771433323.1682847 Moritz 2026-02-19 21:33:18 +01:00
e91dc056cb Refactor Github Action per b/485167538 Ben Knutson 2026-02-18 16:48:44 +00:00
ae67a26af6 add word boundary to del regex to prevent false positives devarjya27 2026-02-18 18:29:27 +05:30
2a55a30478 Refine Speck detection using variant-specific rotation constants (#1115) Devarjya 2026-02-18 02:48:46 +05:30
7f70ec18ff Flexible version of send HTTP request (#1110) Saniya Fatima 2026-01-30 23:10:47 +05:30
94e855bebc Fix: False positive in UDP socket (#1111) Saniya Fatima 2026-01-30 22:34:39 +05:30
98c1e9de5a Merge pull request #1107 from mandiant/anti-llm-anthropic Moritz 2026-01-28 17:42:47 +00:00
b6c8ad8175 add terminate-anthropic-session-via-magic-strings Willi Ballenthin 2026-01-28 11:27:44 +01:00
8caf489d8c Fix false positive in send HTTP request (#1099) Saniya Fatima 2026-01-26 22:10:58 +05:30
6a0d506713 add encrypt-data-using-hc-256 (#1097) Willi Ballenthin 2026-01-06 18:01:44 +01:00
a4411edeea Add RtlRegisterWait API to shellcode exec callback (#1094) Still / Azaka 2025-12-30 02:20:58 +09:00
6120dfb6e0 Add Thread Pool injection techniques (#1087) Still / Azaka 2025-12-05 02:17:27 +09:00
fb3737b90a Loosen AFD driver usage detection (#1086) Still / Azaka 2025-12-04 21:10:46 +09:00
3b42582539 adding/updating rules based on recent samples (#1085) Mike Hunhoff 2025-11-25 13:38:55 -07:00
d0083e8899 Initial plan copilot/categorize-capa-rules-script copilot-swe-agent[bot] 2025-11-18 02:35:27 +00:00
b0b486fe0c updated broken link (#1045) v9.3.1 v9.3.0 Moritz 2025-11-12 11:26:26 +01:00
7a52b6f9c0 dotnet: adding new rules based on recent samples (#1082) Mike Hunhoff 2025-11-07 00:39:46 -07:00
9e4cc28265 feat: log keystrokes via rawinput (#1078) Zeze 2025-10-28 23:20:39 +08:00
14dcc55c32 Merge pull request #1079 from zeze-zeze/zeze/feat/DirectInput Zeze 2025-10-28 21:12:07 +08:00
7ae786cf70 Add new rule use-io_uring-io-interface-on-linux.yml (#1080) JJ 2025-10-20 23:27:16 +08:00
fa246a4a9b terminate process with RestartMgr.RmShutdown (#1077) Paul 2025-09-23 16:17:49 -04:00
277540ac24 Add LdrCallEnclave in execute-shellcode-via-windows-callback-function.yml (#1076) JJ 2025-09-10 03:21:58 +08:00
1a065e6dea Move get-routing-table.yml out of nursery. Add enumerate-tcp-connecti… (#1074) JJ 2025-09-10 03:21:48 +08:00
5d990adef2 Move impersonate user from nursery (#1072) Elad Levi 2025-09-03 16:27:04 +00:00
4026d60a48 Update enumerate-minifilter-drivers.yml (#1075) JJ 2025-09-04 00:08:36 +08:00
19d48abd05 Add rules linked-against-funchook.yml and linked-against-plthook.yml (#1073) JJ 2025-09-04 00:05:13 +08:00
13e8622f8a Add rule execute-jscript-via-vsaengine-in-dotnet.yml (#1071) JJ 2025-08-26 03:07:56 +08:00
35b17b676e Merge linking/static/hp-socket/linked-against-hp-socket.yml and nursery/linked-against-hp-socket.yml (#1070) JJ 2025-08-22 22:57:57 +08:00
6859d7c688 Add rule linked-against-hp-socket.yml (#1069) JJ 2025-08-21 22:56:38 +08:00
6d6495a16c Add linking/static/grpc/linked-against-grpc.yml (#1068) JJ 2025-08-21 22:56:28 +08:00
1874535449 Add disable-powershell-transcription.yml and access-powershell-lockdo… (#1065) JJ 2025-08-21 00:04:29 +08:00
ebdd6b85d5 update reference-http-user-agent-string.yml (#1067) Mike Hunhoff 2025-08-14 14:59:09 -06:00
c783febdc5 Add linked-against-eclipse-paho-mqtt-c.yml and linked-against-qmqtt.yml (#1066) JJ 2025-08-14 23:11:33 +08:00
760c214299 Update patch-antimalware-scan-interface-function.yml - include additional functions that can be patched (#1064) JJ 2025-08-13 22:39:59 +08:00
7a719809d1 new/updated rules from recent malware samples (#1063) Mike Hunhoff 2025-08-12 10:21:05 -06:00
c76ef7fb9b Add patch-bitdefender-hooking-dll-function.yml rule (#1061) JJ 2025-08-12 23:43:24 +08:00
b18e5f1046 Add CAPA rule packed-with-dxpack.yml (#1062) JJ 2025-08-12 23:42:37 +08:00
2f09b4d471 add create executable heap rule (#1058) Moritz 2025-08-04 20:40:42 +02:00
47ee3a8777 Add rule to detect advanced mouse movement analysis references issue … (#1055) Teva JEANDIDIER 2025-06-20 18:16:06 +02:00
edabdffa8c use call scope for get-local-ipv4-addresses (#1052) v9.2.1 v9.2.0 Mike Hunhoff 2025-06-02 13:16:36 -06:00
2676846e77 tighten subscope for get-local-ipv4-addresses (#1051) Mike Hunhoff 2025-06-02 12:46:52 -06:00
834981fcfe Unload Sysmon (#1049) Elad Levi 2025-05-28 23:44:20 +03:00
e6df480758 add first set of exploit detection rules (#1046) zdw@ 2025-05-22 14:53:30 -04:00
61092d21b5 Unload minifilter drivers (#1047) Elad Levi 2025-05-19 21:21:19 +03:00
83fe95befc Deleting file content via truncation (#1040) Elad Levi 2025-05-19 21:20:50 +03:00
ec9e1c5efe updated broken link Mustafa Günel 2025-05-06 14:25:43 +03:00
d64c2c91ea add new rules to detect disabling system features via registry on Windows (#1034) Mike Hunhoff 2025-03-24 10:38:19 -06:00
7269873b0c Add rules for detecting donut-related features (#997) Still / Azaka 2025-03-22 00:15:28 +08:00
2800fd34de add disable-system-features-via-registry-on-windows (#1033) Mike Hunhoff 2025-03-21 08:39:42 -06:00
af09ec07d0 detect usage of TripleDesCryptoServiceProvider (#1021) Tanmay R K 2025-03-20 20:36:27 +05:30
9acd31998f add APIs to "check mutex on windows" and "create or open mutex on windows" to reduce FNs (#1031) Mike Hunhoff 2025-03-20 09:00:29 -06:00
48a553e1ca add more APIs to "link function at runtime on Windows" to remove FNs (#1029) Mike Hunhoff 2025-03-19 11:29:07 -06:00
e85887a875 fix: escape "." that are not expected to be dot operators (#1028) Mike Hunhoff 2025-03-18 15:01:39 -06:00
c002c5cd96 remove FPs from allocate-or-change-rwx-memory.yml (#1027) Mike Hunhoff 2025-03-18 08:01:36 -06:00
4e6fc23354 Update manipulate-boot-configuration.yml (#1026) Elad Levi 2025-03-16 17:15:10 +02:00
95bcf669da Merge pull request #1024 from mandiant/fix/find-taskbar/fp Moritz 2025-03-15 14:03:37 +01:00
86484920a0 reduce scopes to remove _find-taskbar_ fps Mike Hunhoff 2025-03-14 16:11:53 -06:00
6697513245 improve TCP/UDP socket creation matching #964 (#993) Dhruva Kumar Kaushal 2025-03-14 23:15:36 +05:30
740d47393e Enter debug mode rule (#1022) vibhatsu 2025-03-14 23:11:19 +05:30
7437cfeaaf Remove EvtOpenLog (#1019) Elad Levi 2025-03-11 17:56:23 +02:00
77f06fd049 Addresses #965: Create separate rules for socket connects (TCP/UDP) (#1017) Hafiz Farhad 2025-03-11 01:38:43 +05:00
3bd8cf7646 Improve Accuracy of Various Detections (#1010) Elad Levi 2025-03-10 22:19:23 +02:00
650b491648 tighten "persist via run registry key" to reduce FPs (#1016) Mike Hunhoff 2025-03-10 13:48:13 -06:00
5fb8cee820 tighten receive-http-request (#1015) Mike Hunhoff 2025-03-05 13:56:15 -07:00
6221d9b72b add more APIs to remove use-process-replacement FNs (#1009) v9.1.0 Mike Hunhoff 2025-02-25 08:59:09 -07:00
9c86fbef42 Clearing Event Log with wevtapi functions (#1006) Elad Levi 2025-02-22 21:41:02 +02:00
71dd21d88e tighten Windows mutex related rules (#1004) Mike Hunhoff 2025-02-21 12:37:01 -07:00
00684bbf4a add "change registry key timestamp" (#1003) Willi Ballenthin 2025-02-21 17:29:10 +01:00
33ccbf2a64 Merge pull request #1001 from mandiant/fix/fn/inject-apc Moritz 2025-02-21 13:15:39 +01:00
b444a585ca additional APIs to remove FNs for inject apc Mike Hunhoff 2025-02-20 15:08:04 -07:00
8c62595952 use "span of calls" scope for registry operations that span multiple calls, e.g. open registry key and set value (#999) Mike Hunhoff 2025-02-20 14:02:16 -07:00
c0aa922f20 extend terminate-process.yml to include exit_group #970 (#991) v9.0.0 Dhruva Kumar Kaushal 2025-02-05 02:19:39 +05:30
1468692195 https://github.com/mandiant/capa-rules/issues/974 (#992) Dhruva Kumar Kaushal 2025-02-05 02:19:10 +05:30
8d5e7e2ac4 internal-dotnet-file-limitation.yml: make it valid for static scope too (#990) Willi Ballenthin 2025-02-04 21:47:59 +01:00

1 2 3 4 5 ...