issues
search
mandiant
/
capa-rules
Standard collection of rules for capa: the tool for enumerating the capabilities of programs
https://github.com/mandiant/capa/
Apache License 2.0
517
stars
157
forks
source link
issues
Newest
Newest
Most commented
Recently updated
Oldest
Least commented
Least recently updated
Move from nursery and update get-system-firmware-table.yml
#928
jtothej
closed
1 day ago
0
update linux/android rules and reduce fps for intel-specific rules
#927
mike-hunhoff
closed
3 weeks ago
0
remove sporadically failing example
#926
mr-tz
closed
3 weeks ago
0
remove example and move to nursery
#925
mr-tz
closed
3 weeks ago
0
Revert "Add Base64 VBMI lookup table detection"
#924
mr-tz
closed
3 weeks ago
6
rules fail in master
#923
mr-tz
closed
3 weeks ago
1
Add new rule attach-bpf-to-socket-on-linux.yml
#922
jtothej
closed
4 weeks ago
0
Add rule unhook-a-dll.yml
#921
jtothej
closed
4 weeks ago
0
Add new rule linked-against-minhook.yml
#920
jtothej
closed
1 day ago
0
Update execute-shellcode-via-windows-callback-function.yml
#919
jtothej
closed
3 weeks ago
1
Add Base64 VBMI lookup table detection
#918
Still34
closed
1 month ago
0
dotnet: improve dotnet invoke-dotnet-assembly-method.yml
#917
mike-hunhoff
closed
1 month ago
0
linux: remove duplicate api write-file-on-linux.yml
#916
mike-hunhoff
closed
1 month ago
0
delay execution: add Beep WinAPI
#915
s-ff
opened
1 month ago
0
Update HC-128 (variation used in Winnti malware)
#914
TakahiroHaruyama
opened
1 month ago
1
Create upload-file-to-onedrive.yml
#913
jaredscottwilson
closed
1 month ago
0
Add capa rules create-thread-bypass-freeze.yml and check-thread-suspend-count-exceeded.yml to nursery.
#912
ejfocampo
opened
1 month ago
1
rule idea: modify PendingFileRenameOperations to delete, rename, or move file across reboots
#911
mike-hunhoff
opened
2 months ago
0
rule idea: adjust process token privilege
#910
P4nD3m1CB0Y0xD
closed
2 months ago
0
Create new rule with LoadLibrary, etc. APIs
#909
mr-tz
opened
3 months ago
0
fix the scope of some rules with dependencies
#908
williballenthin
closed
3 months ago
0
adding / updating linux / android rules
#907
mike-hunhoff
closed
3 months ago
3
Add rule compiled-with-dart.yml
#906
jtothej
closed
3 months ago
0
Add hide-graphical-window-from-taskbar.yml rule
#905
jtothej
closed
3 months ago
1
Add new rule act-as-time-provider-dll.yml
#904
jtothej
closed
3 months ago
0
adding new and updating linux / android rules
#903
mike-hunhoff
closed
3 months ago
0
Add two new CAPA rules: act-as-share-provider-dll.yml and act-as-windbg-extension.yml
#902
jtothej
closed
3 months ago
0
Add EnumProps to callback shellcode execution rule
#901
Still34
closed
3 months ago
0
Update encrypt-data-using-dpapi.yml rule
#900
jtothej
closed
3 months ago
0
Rules to find interesting code
#898
mr-tz
opened
3 months ago
0
parse-credit-card-information -> mimikatz.exe_:0x444E02
#897
mike-hunhoff
opened
4 months ago
0
Add additional shellcode execution callback functions
#896
Still34
closed
4 months ago
0
Create self-delete-using-alternate-data-streams.yml
#895
dstepanic
closed
4 months ago
5
self delete using alternate data streams
#894
dstepanic
closed
4 months ago
0
add API features for ws2_32 ordinals
#893
williballenthin
closed
4 months ago
1
add android OS where applicable
#892
mr-tz
closed
4 months ago
0
reduce FPs by adjusting `go1.` substring feature
#891
mr-tz
closed
4 months ago
0
Create encrypt-data-using-rc4-via-systemfunction033.yml
#890
dstepanic
closed
4 months ago
5
[obfuscated-with-litcrypt]
#889
lulzc
opened
5 months ago
0
Add SysWhispers2 detection & add 0x2e syscall detection
#888
Still34
opened
6 months ago
0
Support ATT&CK v14.1 Techniques
#887
mr-tz
opened
6 months ago
3
fix encrypt-data-using-salsa20-or-chacha.yml
#886
mike-hunhoff
closed
6 months ago
0
[CI] Correct token used to update badge
#885
Ana06
closed
6 months ago
0
Failed to get gist: 403 Forbidden
#884
mr-tz
closed
6 months ago
1
[CI] Update GitHub actions to versions using Node 20
#883
Ana06
closed
6 months ago
0
[CI] Use badge in gist for rules number in README
#882
Ana06
closed
6 months ago
0
find/reference Explorer window
#881
mr-tz
opened
7 months ago
0
TLS client via OpenSSL
#880
williballenthin
opened
7 months ago
0
add rules for volume interaction via IOCTLs
#879
williballenthin
closed
7 months ago
2
add delete drive layout via ioctl
#878
williballenthin
closed
7 months ago
1
Next