Closed mr-tz closed 9 months ago
See https://github.com/mandiant/capa-rules/pull/839/commits/409da0b775bd467d70826e5149974f3b2fffdbc3 for some first updates to rules with subscopes. Is that what you had in mind @williballenthin @yelhamer?
I think all rules have been upgraded now.
I did not use the process scope in any rule so far.
The linter needs to use the changes from the dynamic-feature-extraction
branch to pass.
If you've looked at a dozen or so changes from each commit (as they roughly group changes) I'm fairly confident in these updates and don't think we need a detailed review of each rule.
ah, that's a great way to group changes. i'll do this review tomorrow. thanks!
@mr-tz please see dbefb55
Is VMCI_SOCKETS_GET_AF_VALUE
a valid argument to socket
?
The other changes look good, thank you!
an instruction
subscope acts implicitly like an and:
so we can save a line/indentation by not adding those. same with call
. maybe we can do a cleanup of all the rules in another PR.
Is VMCI_SOCKETS_GET_AF_VALUE a valid argument to socket?
ah, you're right, this is only passed to DeviceIoControl
/ioctl
. updated the logic to look like:
- and:
- os: windows
- api: DeviceIoControl
- number: 0x81032068 = VMCI_SOCKETS_GET_AF_VALUE
- optional:
- api: socket
- and:
- os: linux
- api: ioctl
- number: 0x7B8 = VMCI_SOCKETS_GET_AF_VALUE
- optional:
- api: socket
scope: basic block/call
For call
scope the optional socket
would never match and the scopes should still be thread (and function) IMO.
an
instruction
subscope acts implicitly like anand:
so we can save a line/indentation by not adding those. same withcall
. maybe we can do a cleanup of all the rules in another PR.
I don't see that implemented for call, but think we should add and simplify the rules.
rebased to master and:
837 and all the comments broke the GitHub web UI...
Repeating the work now here using a script and fixing things locally - for the most part.