Willi Ballenthin 15f01df0ad fix: add example offsets to a few rules ...

ref https://github.com/mandiant/capa/issues/3058

2026-05-07 12:13:02 +02:00

..

bootloader

Update manipulate-boot-configuration.yml (#1026)

2025-03-16 09:15:10 -06:00

cli

fix call/thread scopes manually

2023-11-24 11:35:00 +01:00

clipboard

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

console

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

driver

fix: escape "." that are not expected to be dot operators (#1028)

2025-03-18 15:01:39 -06:00

environment-variable

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

file-system

Split .NET features from windows file & process rules (#1130)

2026-03-12 11:41:24 -06:00

filter

Update enumerate-minifilter-drivers.yml (#1075)

2025-09-03 10:08:36 -06:00

firewall/modify

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

gui

reduce scopes to remove _find-taskbar_ fps

2025-03-14 16:11:53 -06:00

hardware

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

log

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

memory

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

mutex

add APIs to "check mutex on windows" and "create or open mutex on windows" to reduce FNs (#1031)

2025-03-20 09:00:29 -06:00

network

Move get-routing-table.yml out of nursery. Add enumerate-tcp-connecti… (#1074)

2025-09-09 13:21:48 -06:00

os

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

powershell

Add disable-powershell-transcription.yml and access-powershell-lockdo… (#1065)

2025-08-20 10:04:29 -06:00

process

Split .NET features from windows file & process rules (#1130)

2026-03-12 11:41:24 -06:00

recycle-bin

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

registry

fix: add example offsets to a few rules

2026-05-07 12:13:02 +02:00

service

update create-service to detect sc.exe usage

2026-02-23 22:50:55 +05:30

session

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

software

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

thread

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

uac/bypass

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

user

Move impersonate user from nursery (#1072)

2025-09-03 10:27:04 -06:00

wmi

move WMI persistence rule to WMI usage detection rule

2024-11-22 16:12:11 +01:00