mandiant/capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules.git synced 2026-10-12 02:18:39 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,982 Commits 5 Branches 42 Tags
master
Commit Graph
1982 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
ninadgowdru 805f9eaccf rule: graduate .NET time delay rule (#1196) 
Resolves #1178 by moving the final rule out of nursery.
 2026-09-08 15:06:23 -06:00
Moritz c7f3df25b1 Merge pull request #1195 from ninadgowdru/graduate-rules-1178 2026-09-06 11:41:41 +02:00
ninadgowdru 9b81293a81 rule: graduate four rules from nursery 
Fixes #1178 by moving the .NET time delay and three thread pool injection rules out of the nursery.
 2026-08-31 19:30:33 +05:30
Willi Ballenthin 801a792c60 get-process-heap-flags: use GetProcessHeap (#1184) 
closes #1183

P
 2026-08-14 14:55:43 -06:00
Willi Ballenthin 781fe373db get-number-of-processors: add GetSystemInfo method (#1190) 
closes #1186
 2026-08-14 14:54:27 -06:00
Willi Ballenthin b6e0986417 get-process-heap-flags: use offset, not number 
closes #1183
 2026-08-14 16:53:24 +01:00
w3lld1 a49d066055 feat: add SearchPath rule coverage (#1175) 
* feat: add SearchPath rule coverage

* fix: address SearchPath rule review

* fix: address final SearchPath rule review

* fix: align SearchPath rule filename
 2026-08-10 10:49:22 -06:00
Still / Azaka 67f626eecb Detect assembly loading via nLoadImage (#1172) 
* Initial support for nLoadImage

Signed-off-by: Still Hsu <[email protected]>

* Merge 'invoke .NET assembly method' rule match into condition

Signed-off-by: Still Hsu <[email protected]>

* Update dynamic scope per requested changes

https://github.com/mandiant/capa-rules/pull/1172#discussion_r3647155878
Signed-off-by: Still Hsu <[email protected]>

---------

Signed-off-by: Still Hsu <[email protected]>
 2026-07-28 10:59:09 -06:00
Shreethaar Arunagirinathan 48c6cd1b11 rules: detect ps2exe binaries compiled with current MainApp/MainModule naming (#1168) 
* rules: detect ps2exe binaries compiled with current MainApp/MainModule naming

* rules: add capa-testfiles example for current ps2exe naming variant

* rules: add @shreethaar to authors
 2026-07-27 10:00:32 -06:00
Stefano De Rosa 8a79036718 Fix dynamic unsupported (#1169) 2026-07-24 12:12:05 -06:00
Still / Azaka d672a8d3bf Improve .NET AoT detection logic (#1170) 
* Refactor existing .NET AoT detection logic

Signed-off-by: Still Hsu <[email protected]>

* Add StackTraceMetadata and move assembly into their own OR check

Signed-off-by: Still Hsu <[email protected]>

---------

Signed-off-by: Still Hsu <[email protected]>
 2026-07-24 12:08:06 -06:00
Moritz aed45e2571 Merge pull request #1166 from CaptWake/fix-namespace 2026-06-19 23:15:28 +02:00
CaptWake 524cbaa5b6 Fix namespace typo error 2026-06-19 10:12:44 +02:00
Willi Ballenthin 788a997cfa anti-analysis/reference-analysis-tools-strings: fix negative lookbehind 
anti-analysis/reference-analysis-tools-strings.yml — Pattern
(?<!\w)ida[gqtuw]?(\.exe)?$ uses a lookbehind assertion (?<!\w) not
supported by Rust's regex crate. The other ~70 patterns in this file
work fine.

closes #1164
 2026-06-12 15:09:53 +02:00
Willi Ballenthin 97f800e26d fix invalid regex syntax 
nursery/disable-automatic-windows-recovery-features.yml — Patterns
contain {default} which some regex engines interprets as a repetition
quantifier. fix: escape as \{default\}.

nursery/persist-via-hhctrl-com-hijack.yml — Pattern contains
{52A2AAAE-085D-4187-97EA-8C30DB990436} (a GUID). fix: escape as
\{52A2AAAE-085D-4187-97EA-8C30DB990436\}

closes #1163
 2026-06-12 15:09:53 +02:00
Willi Ballenthin 3daf2b21d4 reference-absolute-stream-path-on-windows: remove negative lookbehind 
closes #1162
 2026-06-12 15:09:53 +02:00
Ange Albertini e240160da4 Fix: remove warnings for reference_wmi_statements 
Closes #1161
 2026-05-22 16:14:25 +02:00
Ange Albertini acd90afa11 Merge pull request #1120 from devarjya27/improve-self-deletion-rule 
add word boundary to del regex to prevent false positives
 2026-05-22 11:42:10 +00:00
Moritz b1bfb12936 Merge pull request #1160 from corkamig/odin 
Add rule for binaries compiled with Odin
 2026-05-21 09:01:54 +02:00
Ange Albertini 6c1ea457dd Add rule for binaries compiled with Odin 2026-05-20 12:43:08 +00:00
Moritz 1d90df0a8b Merge pull request #1159 from corkamig/crystal 
Add rule for samples compiled by Crystal
 2026-05-20 11:08:02 +02:00
Ange Albertini 0f38d0b488 Add rule for samples compiled by Crystal 2026-05-20 09:29:10 +02:00
Ange Albertini 2a7f18b12e Add rule for PE stored as UUID (#1158) 2026-05-20 09:09:00 +02:00
Aryan KhandhadiyaandMike Hunhoff 89637fba22 Add .NET Environment.TickCount timing anti-debug rule (#1137) 
* Passing all the lint rules and the test

* Update nursery/check-for-time-delay-in-dotnet.yml

* Update nursery/check-for-time-delay-in-dotnet.yml

---------

Co-authored-by: Mike Hunhoff <[email protected]>
 2026-05-15 13:11:58 -06:00
ömürandMike Hunhoff 54a9981f7a add rule for GetIsNetworkAvailable (#1155) 
* add rule for getisnetworkavailable

* Update host-interaction/network/connectivity/check-internet-connectivity-via-getisnetworkavailable-in-dotnet.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update host-interaction/network/connectivity/check-internet-connectivity-via-getisnetworkavailable-in-dotnet.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* description removed

* Renaming rule file

---------

Co-authored-by: Mike Hunhoff <[email protected]>
 2026-05-15 12:22:25 -06:00
Mike Hunhoff 2adb480e41 add new .NET rules (#1157) 2026-05-15 08:05:49 -06:00
Ange Albertini 3839c06e79 Merge pull request #1156 from corkamig/patch-1 
Add rule for payload stored as IPv6 strings
 2026-05-15 12:32:33 +02:00
Moritz be59710ad9 Merge pull request #1154 from mandiant/fix-3058 2026-05-07 12:49:45 +02:00
Willi Ballenthin 15f01df0ad fix: add example offsets to a few rules 
ref https://github.com/mandiant/capa/issues/3058
 2026-05-07 12:13:02 +02:00
msanchit-dev 2af9fbfc1c add get http custom header (#1147) 
* add get http custom header

* Rename rule as per review feedback

* rename rule file to fix linting error
v9.4.0 		2026-03-31 10:39:02 -06:00
Aryan Khandhadiya 7bb186f6d6 Add nursery rules for Linux kernel rootkit techniques (#1136) 
* Add nursery rules for Linux kernel rootkit techniques

* Address review comments: update scopes, namespace, and authors
 2026-03-27 11:03:16 -06:00
Tarang 03a20f69ae Split .NET features from windows file & process rules (#1130) 
* remove .NET features

* create separate read-file-in-dotnet.yml

* remove .NET features

* create separate write-file-dotnet.yml

* split create process rule into windows & .NET

* change static scope to instruction

* change static scope to insn and add dotnet match

* change static & dynamic scope to insn & call and add dotnet match

* change static scope to insn
 2026-03-12 11:41:24 -06:00
Akshat Pal 3ce071c2f9 broaden ITaskService scheduled-task detection for .NET TaskService usage (#1133) 
* broaden ITaskService scheduled-task detection for .NET TaskService usage

* requested-changes
 2026-03-12 11:08:16 -06:00
Tarang 5c346a3389 Add get HTTP Query date (#1128) 
* rule: add get http query date

* change to github username
 2026-03-12 11:04:32 -06:00
Moritz cd272f5b11 Merge pull request #1129 from EclipseAditya/fix/escape-plus-in-base64-regex-1101 
fix: escape + and / in Base64 string regex pattern
 2026-03-04 21:29:39 +01:00
Aditya Pandey bd29ed4563 fix: escape + and / in Base64 string regex, add URL-safe variant 2026-03-05 00:09:35 +05:30
Moritz 35498e9dae Merge pull request #1124 from CosmoWorker/scexe-create 
Extend create-service rule to detect sc.exe usage patterns
 2026-03-03 08:48:00 +01:00
xpzhxhm 5da642668e Add new rule persist-via-shellserviceobjectdelayload-registry-key.yml (#1117) 
* Create persist-via-shellserviceobjectdelayload-registry-key.yml

* Update persist-via-shellserviceobjectdelayload-registry-key.yml

Update rules and description, improve scope to function/basic block by adding HKLM constant, remove blank line.

* Update persist-via-shellserviceobjectdelayload-registry-key.yml

* Change the scope to function
 2026-02-26 09:44:06 -07:00
Devarjya d0291900af add word boundaries around del in both regexes 2026-02-25 00:04:33 +05:30
Saniya Fatima 9609e19ddb Powershell expression (#1118) 
* Fix: Reduce the false positive in Powershell expression

* Enhance powershell execution detection
 2026-02-23 13:51:19 -07:00
CosmoWorker 19380b704e update create-service to detect sc.exe usage 2026-02-23 22:50:55 +05:30
Maijin f0292fc977 feat(targeting): add cloud and container collection/interaction rules (#1098) 
This adds rules for:

- enumerating AWS resources (CloudFormation, CloudTrail, DirectConnect, EC2, IAM, S3, Support)

- stealing credentials for AWS, GCP, Cloudflare

- stealing credentials for Docker and Kubernetes

Rules are categorized into host-interaction and collection namespaces.
 2026-02-23 09:32:32 -07:00
Moritz 2e72aa5536 Merge pull request #1121 from mandiant/lsc-1771433323.1682847 
Refactor Github Action per b/485167538
 2026-02-19 21:33:18 +01:00
Ben Knutson e91dc056cb Refactor Github Action per b/485167538 2026-02-18 16:48:44 +00:00
devarjya27 ae67a26af6 add word boundary to del regex to prevent false positives 2026-02-18 18:29:27 +05:30
Devarjya 2a55a30478 Refine Speck detection using variant-specific rotation constants (#1115) 2026-02-17 14:18:46 -07:00
Saniya Fatima 7f70ec18ff Flexible version of send HTTP request (#1110) 
* Flexible version of send HTTP request

* Fix lint errors
 2026-01-30 10:40:47 -07:00
Saniya Fatima 94e855bebc Fix: False positive in UDP socket (#1111) 2026-01-30 10:04:39 -07:00
Moritz 98c1e9de5a Merge pull request #1107 from mandiant/anti-llm-anthropic 2026-01-28 17:42:47 +00:00
Willi Ballenthin b6c8ad8175 add terminate-anthropic-session-via-magic-strings 2026-01-28 11:30:14 +01:00