JJ
19d48abd05
Add rules linked-against-funchook.yml and linked-against-plthook.yml ( #1073 )
2025-09-03 10:05:13 -06:00
JJ
35b17b676e
Merge linking/static/hp-socket/linked-against-hp-socket.yml and nursery/linked-against-hp-socket.yml ( #1070 )
2025-08-22 08:57:57 -06:00
JJ
6859d7c688
Add rule linked-against-hp-socket.yml ( #1069 )
...
* Add rule linked-against-hp-socket.yml
* Update linking/static/hp-socket/linked-against-hp-socket.yml
2025-08-21 08:56:38 -06:00
JJ
6d6495a16c
Add linking/static/grpc/linked-against-grpc.yml ( #1068 )
...
* Add linking/static/grpc/linked-against-grpc.yml
* Update linking/static/grpc/linked-against-grpc.yml
2025-08-21 08:56:28 -06:00
JJ
c783febdc5
Add linked-against-eclipse-paho-mqtt-c.yml and linked-against-qmqtt.yml ( #1066 )
...
* Add linked-against-eclipse-paho-mqtt-c.yml and linked-against-qmqtt.yml
* Update examples - swapping for much smaller files
2025-08-14 09:11:33 -06:00
Mike Hunhoff
48a553e1ca
add more APIs to "link function at runtime on Windows" to remove FNs ( #1029 )
2025-03-19 11:29:07 -06:00
dhruvak001
fe99a653e8
CI error:scope interchanged
2025-02-03 19:55:12 +01:00
Willi Ballenthin and Mike Hunhoff
c1d20764ad
use "span of calls" scope ( #973 )
...
* use sequence scope instead of thread scope for "static: function" rules
* use sequence scope instead of thread scope for "static: basic block" rules
* make runtime linking rules more concise
* doc: describe sequence scope
* rename "sequence" scope to "span of calls" scope
* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
Co-authored-by: Mike Hunhoff <[email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
2025-01-29 10:27:13 +01:00
Still / Azaka
16492182a3
Add .NET AoT & TouchSocket linking detection ( #948 )
...
* Add initial two rules
Signed-off-by: Still Hsu <[email protected] [email protected] [email protected]
2024-11-28 11:33:53 +01:00
Matt Williams
60fcf98741
access-peb-ldr_data.yml: reference update
2024-10-15 15:03:46 +00:00
Still / Azaka and Moritz
1fd0d8e141
Add SysWhispers2 detection & add 0x2e syscall detection ( #888 )
...
* Add SysWhisper2 detection & add int 2e to syscall detection
---------
Signed-off-by: Still Hsu <[email protected] [email protected]
2024-09-24 13:24:52 +02:00
Willi Ballenthin
5b288a527d
add linked against SQLCipher
2024-09-13 07:29:52 +00:00
jtothej
d2d77916d7
Add export features in linking/static/minhook/linked-against-minhook.yml
2024-09-05 18:06:16 +02:00
jtothej
887563556f
Add new rule linked-against-minhook.yml
2024-08-11 12:49:06 +02:00
Moritz
e63c454fbb
Merge pull request #908 from mandiant/fix/dependency-scopes
...
fix the scope of some rules with dependencies
2024-06-14 11:01:35 +02:00
mr-tz
0c7d1bdfac
remove optional block with LoadLibrary APIs and indirect call
2024-06-14 08:59:18 +00:00
Willi Ballenthin
e6befc9b53
fix the scope of some rules with dependencies
...
ref: https://github.com/mandiant/capa/issues/2124
2024-06-06 09:39:53 +02:00
mr-tz
f344af3327
add android OS where applicable
2024-04-23 13:49:05 +02:00
mr-tz
8a36231025
fix scopes for rules with subscopes 2
2023-11-24 11:35:03 +01:00
mr-tz
e18704545a
fix call/thread scopes manually
2023-11-24 11:35:00 +01:00
mr-tz
784c9dca53
upgrade rules using updated script
2023-11-24 11:34:28 +01:00
ryan
6fbf5187e5
Update Mappings for MBC (part 11)
2023-09-27 15:01:03 -04:00
Still / Azaka
037ca83cb3
Improve browser stealer & add SQLite lib detection ( #757 )
...
* Improve regex for existing browser data gathering detection
- Fix erroneous regex capture
+ Add detections for cookies gathering
+ Add generic browser detection (some webkit browser for some reason uses the same chromium-based paths?)
Signed-off-by: Still Hsu <[email protected] [email protected] [email protected]
2023-08-19 11:36:10 +02:00
JJ
82714cd7d0
Add resolve-function-by-brute-ratel-badger-hash.yml ( #793 )
...
* Add resolve-function-by-brute-ratel-badger-hash.yml
2023-07-12 12:12:42 +02:00
Still Hsu
80f1993388
Lint rule
...
Signed-off-by: Still Hsu <[email protected]
2023-05-10 16:01:15 +08:00
Still Hsu
51a6a65f4a
Add aPLib linking detection
...
Signed-off-by: Still Hsu <[email protected]
2023-05-10 15:55:14 +08:00
Mike Hunhoff
e5ae505682
update .NET detections ( #703 )
2023-02-21 14:38:03 -07:00
Moritz
106123eb61
Rules for the week ( #671 )
...
* add rules
* avoid FPs via mnemonics to ignore
* correct number logic
* add --onefile option strings
2023-01-27 09:56:12 +01:00
Willi Ballenthin
57e1732f5c
Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""
...
This reverts commit d43a6ee544
2022-06-28 15:23:20 -06:00
Willi Ballenthin
88c9c786ca
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
William Ballenthin
d43a6ee544
Revert "Merge pull request #548 from mandiant/feature-remove-flavors"
...
This reverts commit bc28847dd982308c4109
2022-04-27 06:23:36 -06:00
Willi Ballenthin
904bf3ef00
*: remove /x32 and /x64 flavors and use instruction scope
2022-04-05 12:25:14 -06:00
jtothej
80c6804ec1
Add linked-against-wolfssl.yml and linked-against-wolfcrypt.yml
2021-12-03 15:44:58 +08:00
Ryan Xu and Moritz
5b3c56ae44
Update linking/runtime-linking/resolve-function-by-fin8-fasthash.yml
...
Co-authored-by: Moritz <[email protected]
2021-11-24 11:52:41 -05:00
Ryan Xu
607a06e184
Adding changes suggested by Mandiant
2021-11-23 09:01:53 -05:00
Desiree Beck
e190179ffd
Merge pull request #1 from MBCProject/ryan-patches1
...
Update patch-process-command-line.yml
2021-11-22 11:27:15 -05:00
Moritz Raabe
25938ca10c
change to mandiant.com
2021-09-28 12:21:11 +02:00
Ryan Xu
0114138ae4
More detailed mappings
2021-08-31 11:34:09 -05:00
William Ballenthin
ea3ea14c22
minor reorg linux rules and logic
...
ref #442
2021-08-25 15:31:51 -06:00
Willi Ballenthin
6f582bd395
Merge pull request #442 from TcM1911/linux-rules
...
A set of rules for Linux ELFs
2021-08-25 14:33:25 -06:00
William Ballenthin
0ef69c4fbd
*: use substring features rather than unreadable regexes
...
closes #450
2021-08-24 12:47:26 -06:00
Ryan Xu
b4e040dc50
preliminary mapping
2021-08-23 14:11:00 -05:00
Joakim Kennedy
78fbf5f3c5
Fix linting errors
2021-08-05 15:35:27 +01:00
Joakim Kennedy
765e182553
A set of rules for Linux ELFs
2021-08-04 15:47:00 +01:00
Michael Hunhoff
64c8746098
adding additional detection strings to linked-against-openssl.yml
2021-07-28 15:00:29 -06:00
William Ballenthin
6e501e8151
rules: convert inline comments to descriptions
...
closes #1
2021-05-18 10:45:41 -06:00
Moritz Raabe
aedf47d971
remove unneeded or, fix offset
2021-04-09 11:24:48 +02:00
Moritz Raabe and Frank Boldewin
30db0cddb8
add rules from fboldewin
...
Co-authored-by: Frank Boldewin <[email protected]
2021-04-09 11:24:47 +02:00
Michael Hunhoff
20e1b8fd4c
enforce string formatting with double quotes + escaped special characters
2021-03-24 14:14:38 -06:00
Moritz Raabe
387334a603
reformated using capafmt
2021-01-27 15:30:59 +01:00
JJ