mandiant/capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules.git synced 2026-10-11 21:39:59 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
capa-rules/load-code
T
History
Still / Azaka 67f626eecb Detect assembly loading via nLoadImage (#1172) 
* Initial support for nLoadImage

Signed-off-by: Still Hsu <[email protected]>

* Merge 'invoke .NET assembly method' rule match into condition

Signed-off-by: Still Hsu <[email protected]>

* Update dynamic scope per requested changes

https://github.com/mandiant/capa-rules/pull/1172#discussion_r3647155878
Signed-off-by: Still Hsu <[email protected]>

---------

Signed-off-by: Still Hsu <[email protected]>
2026-07-28 10:59:09 -06:00
..
dotnet
Detect assembly loading via nLoadImage (#1172)
2026-07-28 10:59:09 -06:00
pe
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
powershell
Powershell expression (#1118)
2026-02-23 13:51:19 -07:00
shellcode
Add RtlRegisterWait API to shellcode exec callback (#1094)
2025-12-29 10:20:58 -07:00
execute-jscript-via-vsaengine-in-dotnet.yml
Add rule execute-jscript-via-vsaengine-in-dotnet.yml (#1071)
2025-08-25 13:07:56 -06:00
execute-vbscript-javascript-or-jscript-in-memory.yml
upgrade rules using updated script
2023-11-24 11:34:28 +01:00