mandiant-capa-rules

add-file-to-cabinet-file.yml

new rules for cabinet file manipulation

2020-07-31 09:25:56 -06:00

build-docker-image.yml

docker: fmt

2021-04-30 13:33:17 -06:00

bypass-uac-via-scheduled-task-environment-variable.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

capture-screenshot-in-go.yml

remove single child statements

2021-05-19 18:12:09 +02:00

check-for-process-debug-object.yml

update ATT&CK and MBC mappings

2021-04-13 09:37:10 -06:00

check-for-windows-sandbox-via-mutex.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

check-license-value.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

check-processdebugflags.yml

update ATT&CK and MBC mappings

2021-04-13 09:37:10 -06:00

check-systemkerneldebuggerinformation.yml

update ATT&CK and MBC mappings

2021-04-13 09:37:10 -06:00

check-thread-yield-allowed.yml

update ATT&CK and MBC mappings

2021-04-13 09:37:10 -06:00

compare-security-identifiers.yml

updating rules + new rules

2021-03-25 13:10:42 -06:00

compiled-from-epl.yml

"compiled from EPL" remove .edata section

2021-06-04 12:04:17 -06:00

connect-network-resource.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

create-container.yml

docker: fmt

2021-04-30 13:33:17 -06:00

create-restart-manager-session.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

create-shortcut-via-ishelllink.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

debug-build.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

decrypt-data-via-sspi.yml

update ATT&CK and MBC mappings

2021-04-13 09:37:10 -06:00

delete-internet-cache.yml

adding rules for interaction with internet cache

2020-08-06 17:43:18 -06:00

delete-registry-key-via-offline-registry-library.yml

update ATT&CK and MBC mappings

2021-04-13 09:37:10 -06:00

empty-recycle-bin-quietly.yml

use new description syntax

2020-09-30 17:48:02 +02:00

empty-the-recycle-bin.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

encrypt-data-using-aes-via-x86-extensions.yml

encrypt aes via x86: remove example and move to nursery

2021-05-18 13:37:40 -06:00

encrypt-data-using-fakem-cipher.yml

add encrypt-data-using-fakem-cipher

2021-05-03 16:40:13 -06:00

encrypt-data-using-salsa20-or-chacha.yml

rules: convert inline comments to descriptions

2021-05-18 10:45:41 -06:00

encrypt-data-via-sspi.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

encrypt-or-decrypt-data-via-bcrypt.yml

new BCrypt rules for encrypt/decrypt/hash

2020-11-12 20:08:29 -07:00

enumerate-browser-history.yml

rules: convert inline comments to descriptions

2021-05-18 10:45:41 -06:00

enumerate-disk-volumes.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

enumerate-internet-cache.yml

fix match: contain loop

2020-08-06 17:47:51 -06:00

enumerate-network-shares.yml

update ATT&CK and MBC mappings

2021-04-13 09:37:10 -06:00

enumerate-system-firmware-tables.yml

fresh rules from al-khaser project

2020-08-13 09:39:42 -06:00

execute-syscall-instruction.yml

add co-author

2021-05-17 12:11:54 +02:00

flush-cabinet-file.yml

rules: convert inline comments to descriptions

2021-05-18 10:45:41 -06:00

generate-random-numbers-using-the-delphi-lcg.yml

Create generate-random-numbers-using-the-delphi-lcg.yml

2021-02-03 10:26:40 -07:00

get-client-handle-via-schannel.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

get-inbound-credentials-handle-via-credssp.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

get-installed-programs.yml

PR change requests

2021-01-07 13:06:35 -07:00

get-networking-parameters.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

get-proxy.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

get-remote-cert-context-via-schannel.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

get-routing-table.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

get-session-information.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

get-socket-information.yml

update attack mappings

2021-01-02 11:46:20 -07:00

get-system-firmware-table.yml

fresh rules from al-khaser project

2020-08-13 09:39:42 -06:00

get-thread-local-storage-value.yml

rename nursery rule

2020-07-30 17:44:22 -06:00

hash-data-using-crc32b.yml

Change characteristic syntax in rules

2020-07-01 19:19:49 +02:00

hash-data-using-md4.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

hash-data-using-murmur2.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

hash-data-using-sha1-via-wincrypt.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

hash-data-using-sha1-via-x86-extensions.yml

rules: convert inline comments to descriptions

2021-05-18 10:45:41 -06:00

hash-data-using-sha256-via-x86-extensions.yml

rules: convert inline comments to descriptions

2021-05-18 10:45:41 -06:00

hash-data-via-bcrypt.yml

updating hash-data-via-bcrypt to include BCryptHash function

2020-11-13 10:41:53 -07:00

hide-thread-from-debugger.yml

hide-thread-from-debugger: fix typo

2020-09-07 12:23:27 -06:00

hook-routines-via-microsoft-detours.yml

add a couple new rules

2020-10-20 14:59:12 -06:00

hooked-by-api-override.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

impersonate-user.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

initialize-hashing-via-wincrypt.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

inspect-load-icon-resource.yml

adding inspect-load-icon-resource.yml

2021-02-12 10:59:35 -07:00

linked-against-c-regex-library.yml

rules: convert inline comments to descriptions

2021-05-18 10:45:41 -06:00

linked-against-go-process-enumeration-library.yml

remove single child statements

2021-05-19 18:12:09 +02:00

linked-against-go-registry-library.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

linked-against-go-static-asset-library.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

linked-against-go-wmi-library.yml

remove single child statements

2021-05-19 18:12:09 +02:00

linked-against-xzip.yml

Update nursery/linked-against-xzip.yml

2021-02-23 16:18:08 +01:00

list-containers.yml

list-containers: fix ATT&CK ID

2021-05-12 08:22:40 -06:00

list-tcp-connections-and-listeners.yml

adding new rules for keylogging, HTTP comms, network collection

2021-05-26 14:58:20 -06:00

list-udp-connections-and-listeners.yml

adding new rules for keylogging, HTTP comms, network collection

2021-05-26 14:58:20 -06:00

listen-for-remote-procedure-calls.yml

updating rules + new rules

2021-03-25 13:10:42 -06:00

log-keystrokes-via-raw-input-data.yml

adding new rules for keylogging, HTTP comms, network collection

2021-05-26 14:58:20 -06:00

make-an-http-request-with-a-cookie.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

migrate-process-to-active-window-station.yml

missing example, move to nursery

2020-11-19 16:41:19 +01:00

mine-cryptocurrency.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

open-cabinet-file.yml

new rules for cabinet file manipulation

2020-07-31 09:25:56 -06:00

packaged-as-a-createinstall-installer.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packaged-as-a-nsis-installer.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packaged-as-a-pintool.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packaged-as-a-winzip-self-extracting-archive.yml

rules: add rules from Hexacorn's blog

2020-10-21 12:04:31 -06:00

packaged-as-a-wise-installer.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

packaged-as-an-installshield-installer.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

packed-with-ccg.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-crunch.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-dragon-armor.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-enigma.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-epack.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-maskpe.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-mew.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-mpress.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-neolite.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-pecompact.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-pepack.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-perplex.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-procrypt.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-rpcrypt.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-seausfx.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-shrinker.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-simple-pack.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-starforce.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-svkp.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-themida.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-tsuloader.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-vprotect.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

packed-with-wwpack.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

query-remote-server-for-available-data.yml

Rename query-remote-server-for-availible-data.yml to query-remote-server-for-available-data.yml

2021-03-25 14:44:51 -06:00

read-and-send-data-from-client-to-server.yml

update ATT&CK mappings

2021-01-02 11:06:02 -07:00

read-process-memory.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

read-raw-disk-data.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

rebuilt-by-imprec.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

receive-and-write-data-from-server-to-client.yml

update ATT&CK mappings

2021-01-02 11:06:02 -07:00

reference-114dns-dns-server.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

reference-aes-constants.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

reference-alidns-dns-server.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

reference-cloudflare-dns-server.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

reference-comodo-secure-dns-server.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

reference-google-public-dns-server.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

reference-hurricane-electric-dns-server.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

reference-kornet-dns-server.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

reference-l3-dns-server.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

reference-opendns-dns-server.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

reference-processor-manufacturer-constants.yml

rules: convert inline comments to descriptions

2021-05-18 10:45:41 -06:00

reference-quad9-dns-server.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

reference-screen-saver-executable.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

reference-startup-folder.yml

fix ATT&CK categories

2020-07-03 09:14:14 -06:00

reference-the-vmware-io-port.yml

update ATT&CK and MBC mappings

2021-04-13 09:37:10 -06:00

reference-verisign-dns-server.yml

enforce string formatting with double quotes + escaped special characters

2021-03-24 14:14:38 -06:00

register-http-server-url.yml

adding new rules for keylogging, HTTP comms, network collection

2021-05-26 14:58:20 -06:00

resolve-function-by-hash.yml

reformated using capafmt

2021-01-27 15:30:59 +01:00

run-in-container.yml

docker: fmt

2021-04-30 13:33:17 -06:00

run-powershell-expression.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

schedule-task-via-itaskservice.yml

adding new rules to nursery

2020-09-17 12:31:07 -06:00

search-for-credit-card-data.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

send-http-request-with-host-header.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

set-global-application-hook.yml

fix rules as documented in #49

2020-07-24 15:49:52 -06:00

spawn-thread-to-rwx-shellcode.yml

rules: address comments in #14

2020-06-26 17:45:56 -06:00

terminate-process-by-name.yml

dos2unix

2021-03-19 08:13:26 +01:00