mandiant/capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules.git synced 2026-10-12 02:18:39 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
801a792c60fb2c8ef79e1b5d61d7e3d2cab4d405
capa-rules/host-interaction
T
History
Willi Ballenthin 801a792c60 get-process-heap-flags: use GetProcessHeap (#1184) 
closes #1183

P
2026-08-14 14:55:43 -06:00
..
bootloader
Update manipulate-boot-configuration.yml (#1026)
2025-03-16 09:15:10 -06:00
cli
fix call/thread scopes manually
2023-11-24 11:35:00 +01:00
clipboard
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
console
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
driver
fix: escape "." that are not expected to be dot operators (#1028)
2025-03-18 15:01:39 -06:00
environment-variable
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
file-system
reference-absolute-stream-path-on-windows: remove negative lookbehind
2026-06-12 15:09:53 +02:00
filter
Update enumerate-minifilter-drivers.yml (#1075)
2025-09-03 10:08:36 -06:00
firewall/modify
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
gui
reduce scopes to remove _find-taskbar_ fps
2025-03-14 16:11:53 -06:00
hardware
get-number-of-processors: add GetSystemInfo method (#1190)
2026-08-14 14:54:27 -06:00
log
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
memory
upgrade rules using updated script
2023-11-24 11:34:28 +01:00
mutex
add APIs to "check mutex on windows" and "create or open mutex on windows" to reduce FNs (#1031)
2025-03-20 09:00:29 -06:00
network
add rule for GetIsNetworkAvailable (#1155)
2026-05-15 12:22:25 -06:00
os
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
powershell
Add disable-powershell-transcription.yml and access-powershell-lockdo… (#1065)
2025-08-20 10:04:29 -06:00
process
get-process-heap-flags: use GetProcessHeap (#1184)
2026-08-14 14:55:43 -06:00
recycle-bin
upgrade rules using updated script
2023-11-24 11:34:28 +01:00
registry
fix: add example offsets to a few rules
2026-05-07 12:13:02 +02:00
service
update create-service to detect sc.exe usage
2026-02-23 22:50:55 +05:30
session
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
software
upgrade rules using updated script
2023-11-24 11:34:28 +01:00
thread
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
uac/bypass
use "span of calls" scope (#973)
2025-01-29 10:27:13 +01:00
user
Move impersonate user from nursery (#1072)
2025-09-03 10:27:04 -06:00
wmi
move WMI persistence rule to WMI usage detection rule
2024-11-22 16:12:11 +01:00