admin/mandiant-capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules synced 2026-06-08 15:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
ffdb07ca8ccd315907751dc9d3b6084a38e89f10
mandiant-capa-rules/nursery
T
History
MalwareMechanic ffdb07ca8c add additional MITRE ATT&CK and MBC mappings (#611)
2022-08-18 08:19:37 -06:00
..
add-file-to-cabinet-file.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
add-user-account-group.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
add-user-account-to-group.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
add-user-account.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
append-data-to-clfs-log-container.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
build-docker-image.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
bypass-uac-via-scheduled-task-environment-variable.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
capture-network-configuration-via-ifconfig.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
capture-screenshot-in-go.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
capture-webcam-video.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
change-user-account-password.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
check-clipboard-data.yml
Add new dotnet rules that capture capabilites typically found in backdoors. (#579)
2022-07-07 13:39:51 -06:00
check-for-process-debug-object.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
check-for-windows-sandbox-via-mutex.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
check-if-directory-exists.yml
dotnet rule updates (#566)
2022-06-28 15:16:24 -06:00
check-license-value.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
check-processdebugflags.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
check-systemkerneldebuggerinformation.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
check-thread-yield-allowed.yml
Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""
2022-06-28 15:23:20 -06:00
clear-clipboard-data.yml
Add new dotnet rules that capture capabilites typically found in backdoors. (#579)
2022-07-07 13:39:51 -06:00
collect-ssh-keys.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
compare-security-identifiers.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
compile-dotnet-assembly.yml
Add new dotnet rules that capture capabilites typically found in backdoors. (#579)
2022-07-07 13:39:51 -06:00
compiled-from-epl.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
connect-network-resource.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
create-container.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
create-process-via-wmi.yml
Add new dotnet rules that capture capabilites typically found in backdoors. (#579)
2022-07-07 13:39:51 -06:00
create-registry-key-via-stdregprov.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
create-restart-manager-session.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
create-shortcut-via-ishelllink.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
debug-build.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
decrypt-data-using-rsa.yml
add additional MITRE ATT&CK and MBC mappings (#611)
2022-08-18 08:19:37 -06:00
decrypt-data-via-sspi.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
delete-internet-cache.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
delete-registry-key-via-offline-registry-library.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
delete-registry-key-via-stdregprov.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
delete-registry-value-via-stdregprov.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
delete-user-account-from-group.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
delete-user-account-group.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
delete-user-account.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
delete-windows-backup-catalog.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
disable-automatic-windows-recovery-features.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
display-service-notification-message-box.yml
fix: rule logic (#592)
2022-07-12 18:09:51 +02:00
empty-the-recycle-bin.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
enable-safe-mode-boot.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
encrypt-data-using-aes-via-x86-extensions.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
encrypt-data-using-fakem-cipher.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
encrypt-data-using-rsa.yml
add additional MITRE ATT&CK and MBC mappings (#611)
2022-08-18 08:19:37 -06:00
encrypt-data-using-salsa20-or-chacha.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
encrypt-data-via-sspi.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
encrypt-or-decrypt-data-via-bcrypt.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
enumerate-browser-history.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
enumerate-disk-volumes.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
enumerate-drives.yml
dotnet rule updates (#566)
2022-06-28 15:16:24 -06:00
enumerate-internet-cache.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
enumerate-network-shares.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
enumerate-processes-via-procfs.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
enumerate-system-firmware-tables.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
execute-dotnet-assembly.yml
Add execute .NET assembly rules (#576)
2022-06-29 11:54:41 -06:00
execute-shell-command-via-windows-remote-management.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
execute-syscall-instruction.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
find-process-by-name.yml
Add new dotnet rules that capture capabilites typically found in backdoors. (#579)
2022-07-07 13:39:51 -06:00
flush-cabinet-file.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
generate-random-numbers-in-dotnet.yml
Add new dotnet rules that capture capabilites typically found in backdoors. (#579)
2022-07-07 13:39:51 -06:00
generate-random-numbers-using-the-delphi-lcg.yml
Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""
2022-06-28 15:23:20 -06:00
get-client-handle-via-schannel.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
get-inbound-credentials-handle-via-credssp.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
get-mac-address-on-linux.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
get-networking-parameters.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
get-os-information-via-kuser_shared_data.yml
add additional MITRE ATT&CK and MBC mappings (#611)
2022-08-18 08:19:37 -06:00
get-process-image-filename.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
get-proxy.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
get-remote-cert-context-via-schannel.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
get-routing-table.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
get-session-information.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
get-socket-information.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
get-storage-device-properties.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
get-system-firmware-table.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
get-system-information-on-linux.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
get-system-web-proxy.yml
add additional MITRE ATT&CK and MBC mappings (#611)
2022-08-18 08:19:37 -06:00
get-thread-local-storage-value.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
get-token-privileges.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
hash-data-using-aphash.yml
Create hash-data-using-aphash.yml (#587)
2022-07-06 21:35:56 +02:00
hash-data-using-crc32b.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
hash-data-using-jshash.yml
Create hash-data-using-jshash.yml
2022-07-07 10:36:06 -04:00
hash-data-using-md4.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
hash-data-using-murmur2.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
hash-data-using-rshash.yml
Create hash-data-using-rshash.yml (#589)
2022-07-07 15:24:08 -06:00
hash-data-using-sha1-via-wincrypt.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
hash-data-using-sha1-via-x86-extensions.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
hash-data-using-sha256-via-x86-extensions.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
hash-data-via-bcrypt.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
hide-thread-from-debugger.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
hook-routines-via-microsoft-detours.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
hooked-by-api-override.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
impersonate-user.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
initialize-hashing-via-wincrypt.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
inspect-load-icon-resource.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
interact-with-iptables.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
invoke-dotnet-assembly-method.yml
Add new dotnet rules that capture capabilites typically found in backdoors. (#579)
2022-07-07 13:39:51 -06:00
link-function-at-runtime-on-linux.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
linked-against-cpp-http-library.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
linked-against-cpp-json-library.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
linked-against-cpp-regex-library.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
linked-against-go-process-enumeration-library.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
linked-against-go-registry-library.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
linked-against-go-static-asset-library.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
linked-against-go-wmi-library.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
linked-against-xzip.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
list-containers.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
list-domain-servers.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
list-drag-and-drop-files.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
list-groups-for-user-account.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
list-tcp-connections-and-listeners.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
list-udp-connections-and-listeners.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
list-user-account-groups.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
list-user-accounts-for-group.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
list-user-accounts.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
listen-for-remote-procedure-calls.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
load-dotnet-assembly.yml
Update nursery/load-dotnet-assembly.yml
2022-06-28 10:48:29 -07:00
load-windows-common-language-runtime.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
log-keystrokes-via-raw-input-data.yml
Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""
2022-06-28 15:23:20 -06:00
make-an-http-request-with-a-cookie.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
migrate-process-to-active-window-station.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
mine-cryptocurrency.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
mixed-mode.yml
linter
2022-06-28 15:30:57 -06:00
monitor-clipboard-content.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
monitor-local-ipv4-address-changes.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
open-cabinet-file.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
packaged-as-a-createinstall-installer.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
packaged-as-a-nsis-installer.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
packaged-as-a-pintool.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
packaged-as-a-winzip-self-extracting-archive.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
packaged-as-a-wise-installer.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
packaged-as-an-installshield-installer.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
packed-with-ccg.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
packed-with-crunch.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
packed-with-dragon-armor.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
packed-with-enigma.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
packed-with-epack.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
packed-with-maskpe.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
packed-with-mew.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
packed-with-mpress.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
packed-with-neolite.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
packed-with-pepack.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
packed-with-perplex.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
packed-with-procrypt.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
packed-with-rpcrypt.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
packed-with-seausfx.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
packed-with-shrinker.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
packed-with-simple-pack.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
packed-with-starforce.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
packed-with-svkp.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
packed-with-tsuloader.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
packed-with-vprotect.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
packed-with-wwpack.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
parse-url.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
power-down-monitor.yml
add power-down-monitor.yml, update read-process-memory.yml
2022-07-05 08:44:29 -06:00
prompt-user-for-credentials.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
query-or-enumerate-registry-key-via-stdregprov.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
query-or-enumerate-registry-value-via-stdregprov.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
query-remote-server-for-available-data.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
read-and-send-data-from-client-to-server.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
read-process-memory.yml
add power-down-monitor.yml, update read-process-memory.yml
2022-07-05 08:44:29 -06:00
read-raw-disk-data.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
rebuilt-by-imprec.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
receive-and-write-data-from-server-to-client.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
reference-114dns-dns-server.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
reference-aes-constants.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
reference-alidns-dns-server.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
reference-cloudflare-dns-server.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
reference-comodo-secure-dns-server.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
reference-google-public-dns-server.yml
Update reference-google-public-dns-server.yml
2022-06-28 15:38:49 +02:00
reference-hurricane-electric-dns-server.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
reference-kornet-dns-server.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
reference-l3-dns-server.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
reference-opendns-dns-server.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
reference-processor-manufacturer-constants.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
reference-quad9-dns-server.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
reference-screen-saver-executable.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
reference-startup-folder.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
reference-the-vmware-io-port.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
reference-verisign-dns-server.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
register-http-server-url.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
register-raw-input-devices.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
resize-volume-shadow-copy-storage.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
resolve-function-by-fnv-1a-hash.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
resolve-function-by-hash.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
run-in-container.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
schedule-task-via-itaskservice.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
search-for-credit-card-data.yml
Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""
2022-06-28 15:23:20 -06:00
send-http-request-with-host-header.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
send-keystrokes.yml
Add new dotnet rules that capture capabilites typically found in backdoors. (#579)
2022-07-07 13:39:51 -06:00
send-request-in-dotnet.yml
add additional MITRE ATT&CK and MBC mappings (#611)
2022-08-18 08:19:37 -06:00
set-current-directory.yml
dotnet rule updates (#566)
2022-06-28 15:16:24 -06:00
set-global-application-hook.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
set-http-cookie.yml
add additional MITRE ATT&CK and MBC mappings (#611)
2022-08-18 08:19:37 -06:00
set-registry-value-via-stdregprov.yml
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
terminate-process-by-name-in-dotnet.yml
Add new dotnet rules that capture capabilites typically found in backdoors. (#579)
2022-07-07 13:39:51 -06:00
terminate-process-by-name.yml
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
unmanaged-call.yml
linter
2022-06-28 15:30:57 -06:00