mandiant/capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules.git synced 2026-10-12 02:18:39 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,982 Commits 5 Branches 42 Tags
master
Commit Graph
58 Commits
Author SHA1 Message Date
Mustafa Günel ec9e1c5efe updated broken link 2025-05-06 14:25:43 +03:00
Willi BallenthinandMike Hunhoff c1d20764ad use "span of calls" scope (#973) 
* use sequence scope instead of thread scope for "static: function" rules

* use sequence scope instead of thread scope for "static: basic block" rules

* make runtime linking rules more concise

* doc: describe sequence scope

* rename "sequence" scope to "span of calls" scope

* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update collection/get-geographical-location.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update collection/file-managers/gather-classicftp-information.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update collection/database/wmi/reference-wmi-statements.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update collection/database/sql/reference-sql-statements.yml

Co-authored-by: Mike Hunhoff <[email protected]>

---------

Co-authored-by: Mike Hunhoff <[email protected]>
 2025-01-29 10:27:13 +01:00
Willi BallenthinandMoritz bdf01d6243 update rule format documentation with dynamic details (#851) 
* wip: update rule format documentation with dynamic details

* format: add example links

* format: reorganize features vs scopes

* Update doc/format.md

Co-authored-by: Moritz <[email protected]>

* Update doc/format.md

Co-authored-by: Moritz <[email protected]>

* Update doc/format.md

Co-authored-by: Moritz <[email protected]>

* Update doc/format.md

Co-authored-by: Moritz <[email protected]>

* Update doc/format.md

Co-authored-by: Moritz <[email protected]>

* Update doc/format.md

Co-authored-by: Moritz <[email protected]>

* Update doc/format.md

Co-authored-by: Moritz <[email protected]>

* Update doc/format.md

Co-authored-by: Moritz <[email protected]>

* format: table formatting

* format: try to express scoping for features

* Update doc/format.md

Co-authored-by: Moritz <[email protected]>

* Update doc/format.md

Co-authored-by: Moritz <[email protected]>

---------

Co-authored-by: Moritz <[email protected]>
 2023-11-29 14:24:41 +01:00
Moritz 65eae8a7d6 Update doc apis no dlls (#838) 
* document ignoring of DLL name for API feature matching

* document DLL name for import features
 2023-10-20 11:49:39 +02:00
Aayush Goel b47c3a7be6 Update format.md 2023-08-30 01:02:00 +05:30
Aayush Goel 2b5eb58a47 Update format.md 2023-08-28 16:24:38 +05:30
Aayush GoelandMoritz 1a8a45b99f Apply suggestions from code review 
Co-authored-by: Moritz <[email protected]>
 2023-08-28 16:23:41 +05:30
Aayush Goel cdfb01762b Update format.md 2023-08-25 22:07:36 +05:30
Aayush Goel 9f163b0cee Update format.md 
Documentation for COM feature addition in https://github.com/mandiant/capa/pull/1738
 2023-08-25 22:01:29 +05:30
Ronnie SalomonsenandWilli Ballenthin 8b5e3217fa Update doc/format.md 
Co-authored-by: Willi Ballenthin <[email protected]>
 2023-07-19 14:54:47 +02:00
Ronnie SalomonsenandWilli Ballenthin 658b16f47d Update doc/format.md 
Co-authored-by: Willi Ballenthin <[email protected]>
 2023-07-19 14:54:25 +02:00
Ronnie Salomonsen a8d00309c3 Add new rule for forwarded exports and update doc to with new characteristic and examples under export feature 2023-07-19 12:40:20 +02:00
Elliot Chernofsky 2ca29bf517 updated table of contents 2023-03-21 14:42:23 -04:00
Elliot Chernofsky e882571908 updated format doc to clarify acceptable comments in capa-rules 2023-03-21 14:36:45 -04:00
Mike Hunhoff 8310355528 update rule documentation and improve .NET detection for OS gather (#724) 
* add documentation for property feature and .NET constructors

* add API to detect OS version read in .NET

* fix capitalization of Windows
 2023-03-16 17:40:48 +00:00
Mike Hunhoff 64e524f9d6 update doc for OS_ANY (#712) 2023-02-24 07:52:27 -07:00
Moritz 51bd7f55d7 update HTTP User-Agent rules (#702) 2023-02-20 09:04:36 +01:00
Moritz cad482b294 Consolidate c2 and communication namespaces (#692) 
* move c2 under communication

* update namespace

* reduce false positives
 2023-02-07 15:49:08 +01:00
Anushka Virgaonkar 95dc5eb27f Add new dotnet rules that capture capabilites typically found in backdoors. (#579) 2022-07-07 13:39:51 -06:00
Moritz 2b33378f9e Update format.md 2022-07-01 12:17:24 +02:00
Mike Hunhoff 5f7e1fb514 update documentation for .NET (#574) 2022-06-29 11:54:04 -06:00
Willi Ballenthin f5e83ce953 Revert "Revert "Merge pull request #549 from mandiant/feature-doc-updates"" 
This reverts commit 056a6c2f28.
 2022-06-28 15:26:03 -06:00
Willi Ballenthin d5c2709049 Revert "Revert "call $+5 update rule and doc"" 
This reverts commit 6728fb0d5a.
 2022-06-28 15:20:15 -06:00
Willi Ballenthin 88c9c786ca *: use meta.authors everywhere 2022-05-26 11:56:31 -06:00
idiom d9dfb69125 Update references to define it as a list of related information. 2022-05-11 10:47:15 -04:00
William Ballenthin 6728fb0d5a Revert "call $+5 update rule and doc" 
This reverts commit c5368ed9a2.
 2022-04-27 06:28:04 -06:00
William Ballenthin 056a6c2f28 Revert "Merge pull request #549 from mandiant/feature-doc-updates" 
This reverts commit afd356e046, reversing
changes made to 9967d225a6.
 2022-04-27 05:34:39 -06:00
Willi Ballenthin 79f7012aa9 format: remove /x32 and /x64, add operand features 2022-04-06 11:39:55 -06:00
Moritz Raabe c5368ed9a2 call $+5 update rule and doc 2022-03-01 08:46:58 +01:00
Moritz Raabe 1307be35d5 s/fireeye/mandiant 2021-09-27 21:47:49 +02:00
Willi Ballenthin 50a5b10621 format: add substring to section titles 2021-08-24 16:36:05 -06:00
Willi Ballenthin 542d1628f3 doc: format: string: tweak quoting 2021-08-24 11:44:06 -06:00
Willi Ballenthin 9fdaf7a10f format: document substring features 2021-08-24 11:42:32 -06:00
William Ballenthin 7bfafc6aed Merge branch 'master' of github.com:fireeye/capa-rules into feature-701 2021-08-18 14:31:01 -06:00
William Ballenthin 6bcd6d5e88 format: document the format feature 2021-08-16 17:34:42 -06:00
William Ballenthin 7ae2d3942d format: document OS and Arch features 2021-08-16 17:32:17 -06:00
Moritz Raabe 6c01d1e81e clarify verbatim string matching 2021-06-10 13:24:57 +02:00
William Ballenthin 002700dad9 format: document function-name feature 2021-05-27 08:39:19 -06:00
Arnim Rupp 3a565c6ffd fix URLs & formatting 2021-05-12 12:52:06 +02:00
Michael Hunhoff 7d5080b4d4 updating rule format README 2021-03-25 10:17:54 -06:00
Michael Hunhoff 20e1b8fd4c enforce string formatting with double quotes + escaped special characters 2021-03-24 14:14:38 -06:00
Moritz Raabe 873ed713e8 rule updates based on PMA labs 
see #296
 2021-03-22 09:45:56 +01:00
Moritz Raabe ed04be796a dos2unix 2021-03-19 08:13:26 +01:00
MoritzandWilli Ballenthin 7afd7de057 Apply suggestions from code review 
Co-authored-by: Willi Ballenthin <[email protected]>
 2021-02-23 16:30:39 +01:00
Moritz c23bc2195d Update format.md 2021-02-23 10:21:08 +01:00
Moritz 355a1845c6 document example syntax 
closes #205
 2021-01-07 08:45:24 +01:00
Moritz Raabe 2611789b46 update documentation on descriptions 2020-09-25 18:45:10 +02:00
Moritz Raabe 1fcec06e7e comment out description blocks for statements 
discussed in #312
 2020-09-14 11:53:01 +02:00
0ssigeno 8dd3821274 fixed key, and added x32 and x64 flavours 2020-08-20 10:22:00 +02:00
Ana María Martínez Gómez cf0dedfc38 Remove characteristic(switch) from the documentation 
The `characteristic(switch)` feature has been removed in:
https://github.com/fireeye/capa/pull/232
 2020-08-13 16:51:47 +02:00