admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
e882571908ce6b1ffc0f95dc8a60b81cb79cf7b2
mandiant-capa-rules/host-interaction
T
History
Mike Hunhoff 8310355528 update rule documentation and improve .NET detection for OS gather (#724) 
* add documentation for property feature and .NET constructors

* add API to detect OS version read in .NET

* fix capitalization of Windows
2023-03-16 17:40:48 +00:00
..
bootloader
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
cli
Update Mappings for MBC (part 10) (#674)
2023-02-01 10:09:34 +01:00
clipboard
Add new dotnet rules that capture capabilites typically found in backdoors. (#579)
2022-07-07 13:39:51 -06:00
console
add new and update existing .NET rules (#639)
2023-01-03 07:58:11 -07:00
driver
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
environment-variable
Update Mappings for MBC (part 10) (#674)
2023-02-01 10:09:34 +01:00
file-system
update rule documentation and improve .NET detection for OS gather (#724)
2023-03-16 17:40:48 +00:00
filter
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
firewall/modify
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
gui
update ATT&CK/MBC meta data (#675)
2023-02-01 10:08:58 +01:00
hardware
Update Mappings for MBC (part 10) (#674)
2023-02-01 10:09:34 +01:00
log
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
mutex
Adjusted rules for the ELF BEACON sample shared by Intezer (#654)
2023-01-09 14:37:51 +01:00
network
DNS and crypto rule tweaks (#713)
2023-02-27 09:59:21 +01:00
os
Update Mappings for MBC (part 10) (#674)
2023-02-01 10:09:34 +01:00
process
improve debug detection features (#721)
2023-03-14 19:30:12 +01:00
recycle-bin
update ATT&CK/MBC meta data (#675)
2023-02-01 10:08:58 +01:00
registry
improve .NET detections for registry access and web proxy usage (#723)
2023-03-14 10:25:17 -06:00
service
52 Weeks of capa Rules - 2 (#663)
2023-01-18 08:10:09 -07:00
session
Add dotnet rules having property features (#601)
2022-10-03 09:28:05 -06:00
software
Update get-installed-programs.yml (#584)
2022-07-05 09:52:52 +02:00
thread
new/update rules using .NET ctor method (#626)
2022-10-13 08:36:31 -06:00
uac/bypass
Add initial UAC bypass with RPC rule
2022-09-20 13:59:49 +01:00
wmi
Rules 2023 01 (#644)
2023-01-04 17:59:08 +01:00