mandiant/capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules.git synced 2026-10-12 02:18:39 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,982 Commits 5 Branches 42 Tags
master
Commit Graph
333 Commits
Author SHA1 Message Date
ninadgowdru 9b81293a81 rule: graduate four rules from nursery 
Fixes #1178 by moving the .NET time delay and three thread pool injection rules out of the nursery.
 2026-08-31 19:30:33 +05:30
Willi Ballenthin 801a792c60 get-process-heap-flags: use GetProcessHeap (#1184) 
closes #1183

P
 2026-08-14 14:55:43 -06:00
Willi Ballenthin 781fe373db get-number-of-processors: add GetSystemInfo method (#1190) 
closes #1186
 2026-08-14 14:54:27 -06:00
Willi Ballenthin b6e0986417 get-process-heap-flags: use offset, not number 
closes #1183
 2026-08-14 16:53:24 +01:00
Willi Ballenthin 3daf2b21d4 reference-absolute-stream-path-on-windows: remove negative lookbehind 
closes #1162
 2026-06-12 15:09:53 +02:00
ömürandMike Hunhoff 54a9981f7a add rule for GetIsNetworkAvailable (#1155) 
* add rule for getisnetworkavailable

* Update host-interaction/network/connectivity/check-internet-connectivity-via-getisnetworkavailable-in-dotnet.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update host-interaction/network/connectivity/check-internet-connectivity-via-getisnetworkavailable-in-dotnet.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* description removed

* Renaming rule file

---------

Co-authored-by: Mike Hunhoff <[email protected]>
 2026-05-15 12:22:25 -06:00
Mike Hunhoff 2adb480e41 add new .NET rules (#1157) 2026-05-15 08:05:49 -06:00
Willi Ballenthin 15f01df0ad fix: add example offsets to a few rules 
ref https://github.com/mandiant/capa/issues/3058
 2026-05-07 12:13:02 +02:00
Tarang 03a20f69ae Split .NET features from windows file & process rules (#1130) 
* remove .NET features

* create separate read-file-in-dotnet.yml

* remove .NET features

* create separate write-file-dotnet.yml

* split create process rule into windows & .NET

* change static scope to instruction

* change static scope to insn and add dotnet match

* change static & dynamic scope to insn & call and add dotnet match

* change static scope to insn
 2026-03-12 11:41:24 -06:00
CosmoWorker 19380b704e update create-service to detect sc.exe usage 2026-02-23 22:50:55 +05:30
Mike Hunhoff 3b42582539 adding/updating rules based on recent samples (#1085) 2025-11-25 13:38:55 -07:00
JJ 7ae786cf70 Add new rule use-io_uring-io-interface-on-linux.yml (#1080) 2025-10-20 09:27:16 -06:00
Paul fa246a4a9b terminate process with RestartMgr.RmShutdown (#1077) 
* terminate process with RestartMgr.RmShutdown

* fix 'and' to 'api'
 2025-09-23 14:17:49 -06:00
JJ 1a065e6dea Move get-routing-table.yml out of nursery. Add enumerate-tcp-connecti… (#1074) 
* Move get-routing-table.yml out of nursery. Add enumerate-tcp-connections-via-wmi-com-api.yml and create-routing-table-entry.yml

* Update scopes in enumerate-tcp-connections-via-wmi-com-api.yml, create-routing-table-entry.yml, get-routing-table.yml
 2025-09-09 13:21:48 -06:00
Elad Levi 5d990adef2 Move impersonate user from nursery (#1072) 
* Move and update impersonate-user rule

Renamed impersonate-user.yml from nursery to host-interaction/user and added an examples section with a sample hash.

* Simplify API checks in impersonate-user rule

Removed optional and or conditions for GetUserName and DuplicateToken APIs

* Bring the Ex back
 2025-09-03 10:27:04 -06:00
JJ 4026d60a48 Update enumerate-minifilter-drivers.yml (#1075) 2025-09-03 10:08:36 -06:00
JJ 1874535449 Add disable-powershell-transcription.yml and access-powershell-lockdo… (#1065) 
* Add disable-powershell-transcription.yml and access-powershell-lockdown-policy.yml

* Update disable-powershell-transcription.yml and bypass-powershell-constrained-language-mode-via-getsystemlockdownpolicy-patch.yml
 2025-08-20 10:04:29 -06:00
Mike Hunhoff 7a719809d1 new/updated rules from recent malware samples (#1063) 2025-08-12 10:21:05 -06:00
Mike Hunhoff edabdffa8c use call scope for get-local-ipv4-addresses (#1052) 2025-06-02 13:16:36 -06:00
Mike Hunhoff 2676846e77 tighten subscope for get-local-ipv4-addresses (#1051) 2025-06-02 12:46:52 -06:00
Elad Levi 61092d21b5 Unload minifilter drivers (#1047) 
* Update unload-driver.yml

* moved rule to unload-minifilter-driver

* removed author

* removed example
 2025-05-19 12:21:19 -06:00
Elad Levi 83fe95befc Deleting file content via truncation (#1040) 
* Update delete-file.yml

* Create clear-content.yml

* Update delete-file.yml

* Rename clear-content.yml to clear-file-content.yml

* Added example
 2025-05-19 12:20:50 -06:00
Mike Hunhoff 9acd31998f add APIs to "check mutex on windows" and "create or open mutex on windows" to reduce FNs (#1031) 2025-03-20 09:00:29 -06:00
Mike Hunhoff e85887a875 fix: escape "." that are not expected to be dot operators (#1028) 2025-03-18 15:01:39 -06:00
Mike Hunhoff c002c5cd96 remove FPs from allocate-or-change-rwx-memory.yml (#1027) 2025-03-18 08:01:36 -06:00
Elad Levi 4e6fc23354 Update manipulate-boot-configuration.yml (#1026) 2025-03-16 09:15:10 -06:00
Mike Hunhoff 86484920a0 reduce scopes to remove _find-taskbar_ fps 2025-03-14 16:11:53 -06:00
Elad LeviandMike Hunhoff 3bd8cf7646 Improve Accuracy of Various Detections (#1010) 
* Update impersonate-user.yml

* Update enumerate-processes-on-remote-desktop-session-host.yml

* Update enumerate-processes-on-remote-desktop-session-host.yml

* Update enumerate-processes-on-remote-desktop-session-host.yml

* Update nursery/impersonate-user.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update host-interaction/process/list/enumerate-processes-on-remote-desktop-session-host.yml

Co-authored-by: Mike Hunhoff <[email protected]>

---------

Co-authored-by: Mike Hunhoff <[email protected]>
 2025-03-10 14:19:23 -06:00
Mike Hunhoff 6221d9b72b add more APIs to remove use-process-replacement FNs (#1009) 2025-02-25 08:59:09 -07:00
Mike Hunhoff 71dd21d88e tighten Windows mutex related rules (#1004) 2025-02-21 12:37:01 -07:00
Willi Ballenthin 00684bbf4a add "change registry key timestamp" (#1003) 
closes #1000

graduate change-registry-key-timestamp with example

typo

add references
 2025-02-21 09:29:10 -07:00
Mike Hunhoff b444a585ca additional APIs to remove FNs for inject apc 2025-02-20 15:08:04 -07:00
Dhruva Kumar Kaushal c0aa922f20 extend terminate-process.yml to include exit_group #970 (#991) 2025-02-04 21:49:39 +01:00
Mike Hunhoff 75c16e4b14 remove redundant matches for dynamic scope (#987) 
* remove redundant matches for dynamic scope

* fix lints

* fix lints

* tighten scopes
 2025-02-04 09:32:24 +01:00
dhruvak001 13b6bc0dfe reverting changes 2025-02-03 19:55:12 +01:00
dhruvak001 fe99a653e8 CI error:scope interchanged 2025-02-03 19:55:12 +01:00
Willi Ballenthin 36bf945aee fix scopes from lint errors 
ref https://github.com/mandiant/capa/pull/2579
 2025-01-29 18:54:25 +01:00
Willi BallenthinandMike Hunhoff c1d20764ad use "span of calls" scope (#973) 
* use sequence scope instead of thread scope for "static: function" rules

* use sequence scope instead of thread scope for "static: basic block" rules

* make runtime linking rules more concise

* doc: describe sequence scope

* rename "sequence" scope to "span of calls" scope

* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update collection/get-geographical-location.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update collection/file-managers/gather-classicftp-information.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update collection/database/wmi/reference-wmi-statements.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update collection/database/sql/reference-sql-statements.yml

Co-authored-by: Mike Hunhoff <[email protected]>

---------

Co-authored-by: Mike Hunhoff <[email protected]>
 2025-01-29 10:27:13 +01:00
Mike Hunhoff ff9db74425 update create-process-suspended to include DEBUG_ONLY_THIS_PROCESS (#978) 2025-01-07 13:02:37 -07:00
Moritz f3bb093ab0 Merge pull request #956 from jorik-utwente/add-miscellaneous-persistence-techniques 
Add 4 miscellaneous persistence techniques
 2024-11-25 09:21:49 +01:00
jorik 82a9d4030e move WMI persistence rule to WMI usage detection rule 2024-11-22 16:12:11 +01:00
jorik 29dc6174b3 change scope to call for atomic operations 2024-10-31 13:30:21 +01:00
Matt Williams 9917a93ee1 get-process-filename.yml: added reference, corrected structure element 2024-10-18 19:09:05 +00:00
Matt Williams 01e45dfcf9 get-process-filename.yml: added x86 support (#945) 
* Added x86 support for get-process-filename.yml
 2024-10-16 18:11:11 +02:00
Matt WilliamsandMoritz 2317949274 New rule: open-recentdocs-registry-key.yml (#938) 
* Add rule get-process-filename.yml

---------

Co-authored-by: Moritz <[email protected]>
 2024-10-03 11:38:40 +02:00
Moritz 003341b6e1 Merge pull request #932 from jtothej/netfw1 
Add access-firewall-policy-via-inetfwpolicy2.yml and access-firewall-…
 2024-10-02 10:40:56 +02:00
Moritz 109890c8c6 add rule for driver major function ID (#939) 
* add rule
 2024-09-30 14:05:20 +02:00
Matt Williams 627395d6f1 Add rule get-process-filename.yml (#936) 2024-09-26 11:36:40 -06:00
Still / AzakaandMoritz 9da73becdb Add rule for detecting hiding shutdown actions (#935) 
* Add initial rule for hiding shutdown actions

Signed-off-by: Still Hsu <[email protected]>

---------

Signed-off-by: Still Hsu <[email protected]>
Co-authored-by: Moritz <[email protected]>
 2024-09-26 14:25:02 +02:00
jtothej c23d9f3562 Add access-firewall-policy-via-inetfwpolicy2.yml and access-firewall-rule-properties-via-inetfwrule.yml 2024-09-24 15:50:55 +08:00