admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
copilot/categorize-capa-rules-script
mandiant-capa-rules/host-interaction
T
History
JJ 7ae786cf70 Add new rule use-io_uring-io-interface-on-linux.yml (#1080)
2025-10-20 09:27:16 -06:00
..
bootloader
Update manipulate-boot-configuration.yml (#1026)
2025-03-16 09:15:10 -06:00
cli
fix call/thread scopes manually
2023-11-24 11:35:00 +01:00
clipboard
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
console
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
driver
fix: escape "." that are not expected to be dot operators (#1028)
2025-03-18 15:01:39 -06:00
environment-variable
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
file-system
Add new rule use-io_uring-io-interface-on-linux.yml (#1080)
2025-10-20 09:27:16 -06:00
filter
Update enumerate-minifilter-drivers.yml (#1075)
2025-09-03 10:08:36 -06:00
firewall/modify
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
gui
reduce scopes to remove _find-taskbar_ fps
2025-03-14 16:11:53 -06:00
hardware
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
log
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
memory
upgrade rules using updated script
2023-11-24 11:34:28 +01:00
mutex
add APIs to "check mutex on windows" and "create or open mutex on windows" to reduce FNs (#1031)
2025-03-20 09:00:29 -06:00
network
Move get-routing-table.yml out of nursery. Add enumerate-tcp-connecti… (#1074)
2025-09-09 13:21:48 -06:00
os
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
powershell
Add disable-powershell-transcription.yml and access-powershell-lockdo… (#1065)
2025-08-20 10:04:29 -06:00
process
terminate process with RestartMgr.RmShutdown (#1077)
2025-09-23 14:17:49 -06:00
recycle-bin
upgrade rules using updated script
2023-11-24 11:34:28 +01:00
registry
add "change registry key timestamp" (#1003)
2025-02-21 09:29:10 -07:00
service
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
session
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
software
upgrade rules using updated script
2023-11-24 11:34:28 +01:00
thread
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
uac/bypass
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
user
Move impersonate user from nursery (#1072)
2025-09-03 10:27:04 -06:00
wmi
move WMI persistence rule to WMI usage detection rule
2024-11-22 16:12:11 +01:00