admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
mandiant-capa-rules/host-interaction
T
History
ömür 54a9981f7a add rule for GetIsNetworkAvailable (#1155) 
* add rule for getisnetworkavailable

* Update host-interaction/network/connectivity/check-internet-connectivity-via-getisnetworkavailable-in-dotnet.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update host-interaction/network/connectivity/check-internet-connectivity-via-getisnetworkavailable-in-dotnet.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* description removed

* Renaming rule file

---------

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
2026-05-15 12:22:25 -06:00
..
bootloader
Update manipulate-boot-configuration.yml (#1026)
2025-03-16 09:15:10 -06:00
cli
fix call/thread scopes manually
2023-11-24 11:35:00 +01:00
clipboard
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
console
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
driver
fix: escape "." that are not expected to be dot operators (#1028)
2025-03-18 15:01:39 -06:00
environment-variable
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
file-system
Split .NET features from windows file & process rules (#1130)
2026-03-12 11:41:24 -06:00
filter
Update enumerate-minifilter-drivers.yml (#1075)
2025-09-03 10:08:36 -06:00
firewall/modify
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
gui
reduce scopes to remove _find-taskbar_ fps
2025-03-14 16:11:53 -06:00
hardware
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
log
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
memory
upgrade rules using updated script
2023-11-24 11:34:28 +01:00
mutex
add APIs to "check mutex on windows" and "create or open mutex on windows" to reduce FNs (#1031)
2025-03-20 09:00:29 -06:00
network
add rule for GetIsNetworkAvailable (#1155)
2026-05-15 12:22:25 -06:00
os
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
powershell
Add disable-powershell-transcription.yml and access-powershell-lockdo… (#1065)
2025-08-20 10:04:29 -06:00
process
Split .NET features from windows file & process rules (#1130)
2026-03-12 11:41:24 -06:00
recycle-bin
upgrade rules using updated script
2023-11-24 11:34:28 +01:00
registry
fix: add example offsets to a few rules
2026-05-07 12:13:02 +02:00
service
update create-service to detect sc.exe usage
2026-02-23 22:50:55 +05:30
session
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
software
upgrade rules using updated script
2023-11-24 11:34:28 +01:00
thread
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
uac/bypass
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
user
Move impersonate user from nursery (#1072)
2025-09-03 10:27:04 -06:00
wmi
move WMI persistence rule to WMI usage detection rule
2024-11-22 16:12:11 +01:00