mirror of
https://github.com/mandiant/capa-rules.git
synced 2026-10-12 02:18:39 +00:00
update linux/android rules and reduce fps for intel-specific rules (#927)
* android: add / update rules * intel: match intel archs to avoid fps on others
This commit is contained in:
@@ -13,3 +13,6 @@ rule:
|
||||
- or:
|
||||
- api: DbgPrint
|
||||
- api: kernel32.OutputDebugString
|
||||
- and:
|
||||
- os: android
|
||||
- api: __android_log_print
|
||||
|
||||
@@ -15,6 +15,9 @@ rule:
|
||||
# and ecx, 800000FFh
|
||||
# and ecx, 0FFh
|
||||
- and:
|
||||
- or:
|
||||
- arch: i386
|
||||
- arch: amd64
|
||||
- mnemonic: and
|
||||
- or:
|
||||
- number: 0x800000FF
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
rule:
|
||||
meta:
|
||||
name: delete file on Linux
|
||||
namespace: host-interaction/file-system/delete
|
||||
authors:
|
||||
- [email protected]
|
||||
scopes:
|
||||
static: basic block
|
||||
dynamic: call
|
||||
mbc:
|
||||
- File System::Delete File [C0047]
|
||||
features:
|
||||
- and:
|
||||
- or:
|
||||
- os: linux
|
||||
- os: android
|
||||
- or:
|
||||
- api: unlink
|
||||
- api: unlinkat
|
||||
Reference in New Issue
Block a user