Willi Ballenthin 15f01df0ad fix: add example offsets to a few rules ...

ref https://github.com/mandiant/capa/issues/3058

2026-05-07 12:13:02 +02:00

..

authentication-process

fix some dynamic unsupported rules

2023-11-24 11:35:05 +01:00

exchange

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

iis

fix some dynamic unsupported rules

2023-11-24 11:35:05 +01:00

office

remove duplicate features from some rules (#984)

2025-01-28 12:54:17 +01:00

registry

fix: add example offsets to a few rules

2026-05-07 12:13:02 +02:00

scheduled-tasks

use "span of calls" scope for registry operations that span multiple calls, e.g. open registry key and set value (#999)

2025-02-20 14:02:16 -07:00

service

add new rules to detect disabling system features via registry on Windows (#1034)

2025-03-24 10:38:19 -06:00

startup-folder

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

act-as-dhcp-server-callout-dll.yml

fix some dynamic unsupported rules

2023-11-24 11:35:05 +01:00

act-as-dns-server-plugin-dll.yml

fix some dynamic unsupported rules

2023-11-24 11:35:05 +01:00

act-as-share-provider-dll.yml

Add two new CAPA rules: act-as-share-provider-dll.yml and act-as-windbg-extension.yml

2024-05-31 16:20:01 +08:00

act-as-time-provider-dll.yml

Add new rule act-as-time-provider-dll.yml

2024-06-01 12:14:24 +08:00

act-as-windbg-extension.yml

Add two new CAPA rules: act-as-share-provider-dll.yml and act-as-windbg-extension.yml

2024-05-31 16:20:01 +08:00

create-shortcut-via-ishelllink.yml

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

persist-via-desktop-autostart.yml

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

persist-via-shell-profile-or-rc-file.yml

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00