search

mandiant / capa-rules

Standard collection of rules for capa: the tool for enumerating the capabilities of programs
https://github.com/mandiant/capa/
Apache License 2.0
517 stars 157 forks source link

set state tcp connection #829

Closed johnk3r closed 11 months ago

johnk3r commented 12 months ago

Rule to detect the use of the "SetTcpEntry" API, commonly used by TA to disable EDR.

mr-tz commented 11 months ago

please rename to set-tcp-connection-state.yml then good to merge