mandiant / capa-rules

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

https://github.com/mandiant/capa/

mandiant/capa-rules Issues

Rules to find interesting code
Updated 8 days ago
parse-credit-card-information -> mimikatz.exe_:0x444E02
Updated 20 days ago
self delete using alternate data streams
Closed 25 days ago
[obfuscated-with-litcrypt]
Updated 2 months ago
Support ATT&CK v14.1 Techniques
Updated 3 months ago3
Failed to get gist: 403 Forbidden
Closed 3 months ago1
find/reference Explorer window
Updated 3 months ago
TLS client via OpenSSL
Updated 4 months ago
delete drive layout via IOCTL
Closed 4 months ago1
resolve Microsoft.Win32.Win32Native to execute native Windows APIs in .NET
Updated 4 months ago
block system shutdown
Updated 4 months ago
Detect Safengine Shielden (limitation)
Updated 4 months ago
synchronized fn callback execution (extend create-thread.yml)?
Updated 4 months ago1
linux: get current process information
Closed 4 months ago
Linux: Hook library function using dlsym with RTLD_NEXT
Closed 4 months ago
convert rules to use new COM features
Closed 5 months ago1
Move TLS rules to `tls` namespace?
Closed 5 months ago
limit use of OS-specifics in .NET rules e.g. "... on Windows"
Updated 5 months ago4
Rules don't match on referenced example: Fix the rule logic or provide a different example
Closed 5 months ago1
discussion: organizing Android/mobile focused capa rules
Updated 6 months ago3
restrict to `os: android`? or maybe the name and API namespace are sufficient?
Updated 6 months ago
improve "encode data using Base64 via WinAPI"
Closed 6 months ago
PLUGX rule is too loose
Closed 6 months ago
null-preserving XOR not identified
Updated 7 months ago2
detect ExeScript
Closed 7 months ago1
Idea of rule modification: generate-random-numbers-via-rtlgenrandom
Closed 7 months ago
Namespaces load-code vs. host-interaction/process/inject etc.
Updated 8 months ago
Support ATT&CK Mobile techniques (linter)
Updated 9 months ago
triage ATT&CK v13
Closed 9 months ago1
ATT&CK v13: Network Provider DLL
Closed 10 months ago
ATT&CK v13: Device Driver Discovery
Closed 10 months ago
PMA ./Chapter_17L/Lab17-02.dll
Closed 10 months ago
find rule candidates from stackoverflow
Updated a year ago
rules for ELF/Linux sample
Updated a year ago14
defender evasion via hostname HAL9TH
Closed a year ago1
defender evasion via exclusion directory
Updated a year ago
CI: lint max length of bytes feature
Updated a year ago
CI: lint hex values to enforce consistent capitalization
Updated a year ago
HardHat C2 Detections
Updated a year ago2
Xamarin.Android (Build fully native Android apps using C#)
Updated a year ago1
add reference to capa install instructions to PR suggestions
Updated a year ago
detect uncommon .NET entry points
Updated a year ago1
document "property" feature
Closed a year ago
Cleanup Nt* and Zw* api definitions
Updated a year ago2
slow regex in reference-absolute-stream-path-on-windows.yml
Closed a year ago2
stream path rule: filename::$DATA (unnamed default data stream)
Updated a year ago
mine cryptocurrency
Closed a year ago
resolve DNS namespace
Closed a year ago
update OS_ANY documentation
Closed a year ago
split at.exe detection into its own rule
Closed a year ago2