ninadgowdru
805f9eaccf
rule: graduate .NET time delay rule ( #1196 )
...
Resolves #1178 by moving the final rule out of nursery.
2026-09-08 15:06:23 -06:00
ninadgowdru
9b81293a81
rule: graduate four rules from nursery
...
Fixes #1178 by moving the .NET time delay and three thread pool injection rules out of the nursery.
2026-08-31 19:30:33 +05:30
w3lld1
a49d066055
feat: add SearchPath rule coverage ( #1175 )
...
* feat: add SearchPath rule coverage
* fix: address SearchPath rule review
* fix: address final SearchPath rule review
* fix: align SearchPath rule filename
2026-08-10 10:49:22 -06:00
Still / Azaka
67f626eecb
Detect assembly loading via nLoadImage ( #1172 )
...
* Initial support for nLoadImage
Signed-off-by: Still Hsu <[email protected] [email protected] https://github.com/mandiant/capa-rules/pull/1172#discussion_r3647155878
Signed-off-by: Still Hsu <[email protected] [email protected]
2026-07-28 10:59:09 -06:00
CaptWake
524cbaa5b6
Fix namespace typo error
2026-06-19 10:12:44 +02:00
Willi Ballenthin
97f800e26d
fix invalid regex syntax
...
nursery/disable-automatic-windows-recovery-features.yml — Patterns
contain {default} which some regex engines interprets as a repetition
quantifier. fix: escape as \{default\}.
nursery/persist-via-hhctrl-com-hijack.yml — Pattern contains
{52A2AAAE-085D-4187-97EA-8C30DB990436} (a GUID). fix: escape as
\{52A2AAAE-085D-4187-97EA-8C30DB990436\}
closes #1163
2026-06-12 15:09:53 +02:00
Ange Albertini
2a7f18b12e
Add rule for PE stored as UUID ( #1158 )
2026-05-20 09:09:00 +02:00
Aryan Khandhadiya and Mike Hunhoff
89637fba22
Add .NET Environment.TickCount timing anti-debug rule ( #1137 )
...
* Passing all the lint rules and the test
* Update nursery/check-for-time-delay-in-dotnet.yml
* Update nursery/check-for-time-delay-in-dotnet.yml
---------
Co-authored-by: Mike Hunhoff <[email protected]
2026-05-15 13:11:58 -06:00
Mike Hunhoff
2adb480e41
add new .NET rules ( #1157 )
2026-05-15 08:05:49 -06:00
Ange Albertini
3839c06e79
Merge pull request #1156 from corkamig/patch-1
...
Add rule for payload stored as IPv6 strings
2026-05-15 12:32:33 +02:00
msanchit-dev
2af9fbfc1c
add get http custom header ( #1147 )
...
* add get http custom header
* Rename rule as per review feedback
* rename rule file to fix linting error
2026-03-31 10:39:02 -06:00
Aryan Khandhadiya
7bb186f6d6
Add nursery rules for Linux kernel rootkit techniques ( #1136 )
...
* Add nursery rules for Linux kernel rootkit techniques
* Address review comments: update scopes, namespace, and authors
2026-03-27 11:03:16 -06:00
Tarang
03a20f69ae
Split .NET features from windows file & process rules ( #1130 )
...
* remove .NET features
* create separate read-file-in-dotnet.yml
* remove .NET features
* create separate write-file-dotnet.yml
* split create process rule into windows & .NET
* change static scope to instruction
* change static scope to insn and add dotnet match
* change static & dynamic scope to insn & call and add dotnet match
* change static scope to insn
2026-03-12 11:41:24 -06:00
Akshat Pal
3ce071c2f9
broaden ITaskService scheduled-task detection for .NET TaskService usage ( #1133 )
...
* broaden ITaskService scheduled-task detection for .NET TaskService usage
* requested-changes
2026-03-12 11:08:16 -06:00
Tarang
5c346a3389
Add get HTTP Query date ( #1128 )
...
* rule: add get http query date
* change to github username
2026-03-12 11:04:32 -06:00
Maijin
f0292fc977
feat(targeting): add cloud and container collection/interaction rules ( #1098 )
...
This adds rules for:
- enumerating AWS resources (CloudFormation, CloudTrail, DirectConnect, EC2, IAM, S3, Support)
- stealing credentials for AWS, GCP, Cloudflare
- stealing credentials for Docker and Kubernetes
Rules are categorized into host-interaction and collection namespaces.
2026-02-23 09:32:32 -07:00
Saniya Fatima
94e855bebc
Fix: False positive in UDP socket ( #1111 )
2026-01-30 10:04:39 -07:00
Still / Azaka
6120dfb6e0
Add Thread Pool injection techniques ( #1087 )
...
* Add Thread Pool injection techniques
Signed-off-by: Still Hsu <[email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
2025-12-04 10:17:27 -07:00
Mike Hunhoff
3b42582539
adding/updating rules based on recent samples ( #1085 )
2025-11-25 13:38:55 -07:00
Mike Hunhoff
7a52b6f9c0
dotnet: adding new rules based on recent samples ( #1082 )
...
* dotnet: adding new rules based on recent samples
2025-11-07 08:39:46 +01:00
Zeze
9e4cc28265
feat: log keystrokes via rawinput ( #1078 )
...
* feat: log keystrokes via directx
* fix: williballenthin review
* move register-raw-input-devices from nursery
* use original rule name
2025-10-28 09:20:39 -06:00
JJ
1a065e6dea
Move get-routing-table.yml out of nursery. Add enumerate-tcp-connecti… ( #1074 )
...
* Move get-routing-table.yml out of nursery. Add enumerate-tcp-connections-via-wmi-com-api.yml and create-routing-table-entry.yml
* Update scopes in enumerate-tcp-connections-via-wmi-com-api.yml, create-routing-table-entry.yml, get-routing-table.yml
2025-09-09 13:21:48 -06:00
Elad Levi
5d990adef2
Move impersonate user from nursery ( #1072 )
...
* Move and update impersonate-user rule
Renamed impersonate-user.yml from nursery to host-interaction/user and added an examples section with a sample hash.
* Simplify API checks in impersonate-user rule
Removed optional and or conditions for GetUserName and DuplicateToken APIs
* Bring the Ex back
2025-09-03 10:27:04 -06:00
JJ
35b17b676e
Merge linking/static/hp-socket/linked-against-hp-socket.yml and nursery/linked-against-hp-socket.yml ( #1070 )
2025-08-22 08:57:57 -06:00
Mike Hunhoff
7a719809d1
new/updated rules from recent malware samples ( #1063 )
2025-08-12 10:21:05 -06:00
Moritz
2f09b4d471
add create executable heap rule ( #1058 )
2025-08-04 12:40:42 -06:00
Mike Hunhoff
d64c2c91ea
add new rules to detect disabling system features via registry on Windows ( #1034 )
...
* add new rules to detect disabling features via registry on Windows
* refactor
* refactor
* refactor
* update control registry regex to better handle multiple control sets
2025-03-24 10:38:19 -06:00
Mike Hunhoff
2800fd34de
add disable-system-features-via-registry-on-windows ( #1033 )
...
* add disable-system-tools-via-registry-on-windows
* rename to "disable system features via registry on windows"
2025-03-21 08:39:42 -06:00
Tanmay R K
af09ec07d0
detect usage of TripleDesCryptoServiceProvider ( #1021 )
...
* detect usage of TripleDESCryptoServiceProvider
* detect usage of TripleDes via dotnet api
* detect usage of TripleDesCryptoServiceProvider
* removed duplicate file
* seperate encrypt and decrypt methods
* changed file names to match desc
* lint fix
* lint fix
* small fixes
2025-03-20 09:06:27 -06:00
Mike Hunhoff
e85887a875
fix: escape "." that are not expected to be dot operators ( #1028 )
2025-03-18 15:01:39 -06:00
Dhruva Kumar Kaushal
6697513245
improve TCP/UDP socket creation matching #964 ( #993 )
...
* improve TCP/UDP socket creation matching #964
* Adding references
* adding IPPROTO_UDP
* relax rule
* function -> basic block
* adding bytes for indirect(0)
* adding bytes for indirect(0)
* back to default changes
* moved to nursery
* final change
* resolving comment
* indentation error
2025-03-14 11:45:36 -06:00
vibhatsu
740d47393e
Enter debug mode rule ( #1022 )
...
* add rule for enterdebugmode in nursery
Signed-off-by: vibhatsu <[email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
2025-03-14 11:41:19 -06:00
Elad Levi and Mike Hunhoff
3bd8cf7646
Improve Accuracy of Various Detections ( #1010 )
...
* Update impersonate-user.yml
* Update enumerate-processes-on-remote-desktop-session-host.yml
* Update enumerate-processes-on-remote-desktop-session-host.yml
* Update enumerate-processes-on-remote-desktop-session-host.yml
* Update nursery/impersonate-user.yml
Co-authored-by: Mike Hunhoff <[email protected] [email protected] [email protected]
2025-03-10 14:19:23 -06:00
Mike Hunhoff
71dd21d88e
tighten Windows mutex related rules ( #1004 )
2025-02-21 12:37:01 -07:00
Mike Hunhoff
8c62595952
use "span of calls" scope for registry operations that span multiple calls, e.g. open registry key and set value ( #999 )
...
* use span of calls scope for registry operations
* fix lints
2025-02-20 14:02:16 -07:00
Willi Ballenthin
79afc557f1
remove testing rule ( #989 )
2025-02-04 10:23:23 +01:00
Willi Ballenthin
0ea3394942
graduate onedrive rule
...
closes #943
2025-01-29 18:54:25 +01:00
Willi Ballenthin
36bf945aee
fix scopes from lint errors
...
ref https://github.com/mandiant/capa/pull/2579
2025-01-29 18:54:25 +01:00
Willi Ballenthin and Mike Hunhoff
c1d20764ad
use "span of calls" scope ( #973 )
...
* use sequence scope instead of thread scope for "static: function" rules
* use sequence scope instead of thread scope for "static: basic block" rules
* make runtime linking rules more concise
* doc: describe sequence scope
* rename "sequence" scope to "span of calls" scope
* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
Co-authored-by: Mike Hunhoff <[email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
2025-01-29 10:27:13 +01:00
vibhatsu
b4e0c8cdf8
remove duplicate features from some rules ( #984 )
...
* remove duplicate features from some rules
* keep commented hex values to show AfdOpenPacketX structure
Signed-off-by: vibhatsu <[email protected] [email protected]
2025-01-28 12:54:17 +01:00
Ana María Martínez Gómez
70851020c5
New rules: RSA & bigint ( #982 )
...
* Add use-bigint-function
Add new `data-manipulation/encryption/use-bigint-function.yml` rule to
identify bigint functions as these functions may help reverse engineers
identifying crypto. Example of bigint functions identified by this rule:
- `bi_copi`
- `bi_permanent`
- `bi_depermant`
- `bi_free`
Reference:
- https://github.com/ezhangle/krypton/blob/147d69429bfb03cce7113dca6dba36e77f8a9325/src/bigint.c
- https://github.com/bnoordhuis/mongrel2/blob/3e9b57d82aeb627be0aebfb346199bfdfd67e530/src/crypto/bigint.c
* Add rsa-encrypt
Add new rule `data-manipulation/encryption/rsa/rsa-encrypt.yml` that
identifies the RSA encryption implementation from:
- https://github.com/ezhangle/krypton/blob/147d69429bfb03cce7113dca6dba36e77f8a9325/src/rsa.c#L232
- https://github.com/bnoordhuis/mongrel2/blob/3e9b57d82aeb627be0aebfb346199bfdfd67e530/src/crypto/rsa.c#L233
Rename current RSA encryption/decryption rules in the nursery to add
`via WinAPI` to prevent name conflict.
2025-01-21 11:36:04 -07:00
Jorik
e033410c89
Add 38 new registry-based persistence techniques ( #954 )
...
* Add 38 new registry-based persistence techniques
* fix hhctrl com hijack match statement
* fix core_profiler_path rule
* remove optional from disk cleanup handler rule
* update dotnet_startup_hooks
* improve filter handler rule
* update persist via PATH
* merge task schedule persistence with existing rule
* update UserInitMprLogonScript rule
* merge universal app uri with default file association; add better reference
2024-12-09 11:29:56 +01:00
Jorik and Moritz
ce5e041006
Improve existing persistence rules ( #953 )
...
* Improve existing persistence rules by limiting their scope, and adding some more details.
* Update persistence/startup-folder/write-file-to-startup-folder.yml
Co-authored-by: Moritz <[email protected] [email protected] [email protected]
2024-12-09 10:51:47 +01:00
Jorik and Moritz
ed816a8e53
Add 10 file system-based persistence techniques ( #955 )
...
* Add file system based persistence techniques
---------
Co-authored-by: Moritz <[email protected]
2024-12-03 17:26:03 +01:00
Moritz
f3bb093ab0
Merge pull request #956 from jorik-utwente/add-miscellaneous-persistence-techniques
...
Add 4 miscellaneous persistence techniques
2024-11-25 09:21:49 +01:00
jorik
5873d7ff75
Remove COM usage detection from BITS jobs persistence
2024-11-22 16:16:19 +01:00
jorik
82a9d4030e
move WMI persistence rule to WMI usage detection rule
2024-11-22 16:12:11 +01:00
Moritz
cd12dbfa39
enable namespace
2024-11-18 18:45:50 +01:00
jorik
2627820f8b
add comment about overwriting .sdb files
2024-11-15 15:05:30 +01:00
jorik
d95d7b6027
add sdbinst.exe to shimming rule
2024-11-13 11:56:26 +01:00
ninadgowdru