mandiant/capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules.git synced 2026-10-12 02:18:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

remove duplicate features from some rules (#984)

Browse Source 
* remove duplicate features from some rules

* keep commented hex values to show AfdOpenPacketX structure

Signed-off-by: vibhatsu <[email protected]>

---------

Signed-off-by: vibhatsu <[email protected]>
This commit is contained in:
vibhatsu
2025-01-28 12:54:17 +01:00
committed by GitHub
parent 70851020c5
commit b4e0c8cdf8
6 changed files with 2 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualbox.yml
-1
View File
@@ -55,7 +55,6 @@ rule:
- string: /\\\\.\\pipe\\VBoxTrayIPC/i
- string: /VBoxTrayToolWndClass/i
- string: /VBoxTrayToolWnd/i
- string: /vboxservice\.exe/i
- string: /vboxtray.exe/i
- string: /vboxvideo/i
- string: /VBoxVideoW8/i
anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-vmware.yml
-1
View File
@@ -56,7 +56,6 @@ rule:
- string: /vmx86/i
- string: /VMwareVMware/i
- string: /vmGuestLib\.dll/i
- string: /vmGuestLib\.dll/i
- string: /Applications\\VMwareHostOpen\.exe/i
- string: /vm3dgl\.dll/i
- string: /vmdum\.dll/i
anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-xen.yml
-1
View File
@@ -20,5 +20,4 @@ rule:
- string: /^Xen/i
- string: /XenVMMXenVMM/i
- string: /xenservice.exe/i
- string: /XenVMMXenVMM/i
- string: /HVM domU/i
communication/socket/tcp/create-tcp-socket-via-raw-afd-driver.yml
+2 -2
View File
@@ -41,7 +41,7 @@ rule:
- number: 0x64 = d
- number: 0x4F = O
- number: 0x70 = p
- number: 0x65 = e
# - number: 0x65 = e
- number: 0x6E = n
- number: 0x50 = P
- number: 0x61 = a
@@ -53,7 +53,7 @@ rule:
- number: 0x02
- number: 0x01
- number: 0x06
- number: 0x00
# - number: 0x00
- number: 0x60
- number: 0xEF
- number: 0x3D
nursery/send-data-to-internet.yml
-1
View File
@@ -24,6 +24,5 @@ rule:
- api: System.Net.WebClient::UploadString
- api: System.Net.WebClient::UploadStringAsync
- api: System.Net.WebClient::UploadStringTaskAsync
- api: System.Net.WebClient::UploadValues
- api: System.Net.WebClient::UploadValuesAsync
- api: System.Net.WebClient::UploadValuesTaskAsync
persistence/office/act-as-office-com-add-in.yml
-1
View File
@@ -19,7 +19,6 @@ rule:
- format: dotnet
- class: Extensibility.IDTExtensibility2
- or:
- string: "OnAddInsUpdate"
- string: "OnAddInsUpdate"
- string: "OnBeginShutdown"
- string: "OnConnection"