vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-02 11:27:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
1948 commits 1 branch 0 tags 3.2 MiB
Commit graph

92 commits

Author SHA1 Message Date
Zeze
9e4cc28265
feat: log keystrokes via rawinput (#1078) 
* feat: log keystrokes via directx

* fix: williballenthin review

* move register-raw-input-devices from nursery

* use original rule name
 2025-10-28 09:20:39 -06:00
Zeze
14dcc55c32
Merge pull request #1079 from zeze-zeze/zeze/feat/DirectInput 
feat: log keystrokes via direct input
 2025-10-28 14:12:07 +01:00
Willi Ballenthin
c1d20764ad
use "span of calls" scope (#973) 
* use sequence scope instead of thread scope for "static: function" rules

* use sequence scope instead of thread scope for "static: basic block" rules

* make runtime linking rules more concise

* doc: describe sequence scope

* rename "sequence" scope to "span of calls" scope

* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/get-geographical-location.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/file-managers/gather-classicftp-information.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/database/wmi/reference-wmi-statements.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/database/sql/reference-sql-statements.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

---------

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
 2025-01-29 10:27:13 +01:00
Still / Azaka
993785dae5
Add rules for various stealer techniques (#960) 
* Add rules for various stealer techniques

Signed-off-by: Still Hsu <dev@stillu.cc>

* Add bytes and replace string with substring

Signed-off-by: Still Hsu <dev@stillu.cc>

* Fix scope for get-steam-token

Signed-off-by: Still Hsu <dev@stillu.cc>

* Add Microsoft Edge in IID/CLSID detection & rename rule to broaden scope of the target

Signed-off-by: Still Hsu <dev@stillu.cc>

* Remove bytes representation of the string as substring supercedes it

Signed-off-by: Still Hsu <dev@stillu.cc>

* Replace string with substring for Steam token rule

Signed-off-by: Still Hsu <dev@stillu.cc>

---------

Signed-off-by: Still Hsu <dev@stillu.cc>
 2024-11-15 11:12:01 +01:00
Willi Ballenthin
e6befc9b53 fix the scope of some rules with dependencies 
ref: https://github.com/mandiant/capa/issues/2124
 2024-06-06 09:39:53 +02:00
Moritz
591d1c3ce4
Fix linter fail 2024-01-12 10:21:31 +01:00
Still / Azaka
b65339be52
Add additional domains for known IP obtaining services (#867) 
* Add additional links for known IP obtaining services

Signed-off-by: Still Hsu <dev@stillu.cc>

* Update capture-public-ip.yml

---------

Signed-off-by: Still Hsu <dev@stillu.cc>
 2024-01-04 14:06:57 +01:00
Moritz
5b9b497103
Pull out .NET features (#866) 
* pull out .NET features

* Create get-mac-address-in-net.yml

* pull out .NET features

* Create enumerate-files-in-net.yml

* rename file

* rename file
 2024-01-03 09:32:11 -07:00
mr-tz
b4dfc1ab4a use number to support 32 and 64 bit, add support for dynamic analysis 2023-11-24 11:35:05 +01:00
mr-tz
2d3be8ec38 fix some dynamic unsupported rules 2023-11-24 11:35:05 +01:00
mr-tz
8a36231025 fix scopes for rules with subscopes 2 2023-11-24 11:35:03 +01:00
mr-tz
5076cf4b6c fix scopes for rules with subscopes 2023-11-24 11:35:01 +01:00
mr-tz
e18704545a fix call/thread scopes manually 2023-11-24 11:35:00 +01:00
mr-tz
784c9dca53 upgrade rules using updated script 2023-11-24 11:34:28 +01:00
Mike Hunhoff
2a37df98f5
adding new rules based on private Linux sample(s) (#821) 
* adding new rules based on private Linux sample(s)

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2023-10-09 18:27:33 +02:00
Moritz
6f17b655f3
Merge pull request #810 from jtothej/sharppcap 
Add capture-packets-using-sharppcap.yml
 2023-10-09 18:21:55 +02:00
Still / Azaka
037ca83cb3
Improve browser stealer & add SQLite lib detection (#757) 
* Improve regex for existing browser data gathering detection

- Fix erroneous regex capture
+ Add detections for cookies gathering
+ Add generic browser detection (some webkit browser for some reason uses the same chromium-based paths?)

Signed-off-by: Still Hsu <dev@stillu.cc>

* Add rudimentary sqlite db libs detection
- Typically used along with browser data collection

Signed-off-by: Still Hsu <dev@stillu.cc>

---------

Signed-off-by: Still Hsu <dev@stillu.cc>
 2023-08-19 11:36:10 +02:00
jtothej
9823ed9f3d Add capture-packets-using-sharppcap.yml 2023-08-03 16:22:39 +08:00
mr-tz
46bcd63954 add winmm wave functions 2023-07-08 10:34:13 +02:00
Mike Hunhoff
ca0fea4361
improve geo collection and .NET data upload detections (#738) 2023-03-28 08:07:11 -06:00
Elliot Chernofsky
e89d6531c6 updated getting mac address on windows with new API 2023-03-24 11:28:05 -04:00
Mike Hunhoff
96a1abddca
new/update .NET rules (#625) 2022-10-07 09:39:57 -06:00
johnk3r
3f298900d4
use .NET libraries (#612) 
* Add files via upload

https://github.com/mandiant/capa-rules/issues/609

* Update load-suspicious-libraries.yml

* Delete load-suspicious-libraries.yml

* Create load-suspicious-libraries.yml

* Update load-suspicious-libraries.yml

* Update load-suspicious-libraries.yml

* embed dependencies as resources using Fody/Costura

https://github.com/mandiant/capa-rules/pull/612

* Delete embed-dependencies-as-resources-using-fody-costura.yml

* embed-dependencies-as-resources-using-fody-costura

https://github.com/mandiant/capa-rules/pull/612

* Rename embed-dependencies-as-resources-using-fody-costura.yml to embed-dependencies-as-resources-using-fodycostura.yml

* use-dotnet-library-encryptdecryptutils

https://github.com/mandiant/capa-rules/pull/612

* use-dotnet-library-newtonsoft.json

https://github.com/mandiant/capa-rules/pull/612

* use-dotnet-library-sharpclipboard

https://github.com/mandiant/capa-rules/pull/612

* use-dotnet-library-sharpvectors

https://github.com/mandiant/capa-rules/pull/612

* Delete load-suspicious-libraries.yml

* Rename use-dotnet-library-newtonsoft.json.yml to use-dotnet-library-newtonsoftjson.yml

* Update use-dotnet-library-newtonsoftjson.yml

* Update use-dotnet-library-sharpvectors.yml

* Update use-dotnet-library-encryptdecryptutils.yml

* Update use-dotnet-library-sharpclipboard.yml

* Rename anti-analysis/obfuscation/use-dotnet-library-encryptdecryptutils.yml to data-manipulation/encryption/aes/use-dotnet-library-encryptdecryptutils.yml

* Rename nursery/use-dotnet-library-newtonsoftjson.yml to data-manipulation/json/use-dotnet-library-newtonsoftjson.yml

* Rename nursery/use-dotnet-library-sharpvectors.yml to data-manipulation/svg/use-dotnet-library-sharpvectors.yml

* Update use-dotnet-library-sharpclipboard.yml

* Update use-dotnet-library-newtonsoftjson.yml

* Update use-dotnet-library-sharpvectors.yml

* Update use-dotnet-library-encryptdecryptutils.yml

* Update use-dotnet-library-newtonsoftjson.yml

* Update use-dotnet-library-sharpvectors.yml

* Update use-dotnet-library-encryptdecryptutils.yml

* Update embed-dependencies-as-resources-using-fodycostura.yml

* Update use-dotnet-library-encryptdecryptutils.yml

* Update use-dotnet-library-sharpvectors.yml

* Update use-dotnet-library-newtonsoftjson.yml

* Update use-dotnet-library-sharpclipboard.yml
 2022-08-29 18:49:40 +02:00
re-fox
c7920113f0
Create gather-chrome-based-browser-login-information.yml 2022-06-30 10:56:52 -04:00
re-fox
683a5a581b
Update collection/screenshot/capture-screenshot-via-keybd-event.yml 
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
 2022-06-29 14:02:01 -04:00
re-fox
ac1dd7032a
Create capture-screenshot-via-keybd-event.yml 2022-06-29 12:49:28 -04:00
Willi Ballenthin
57e1732f5c
Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors"" 
This reverts commit d43a6ee544.
 2022-06-28 15:23:20 -06:00
Willi Ballenthin
88c9c786ca
*: use meta.authors everywhere 2022-05-26 11:56:31 -06:00
William Ballenthin
d43a6ee544 Revert "Merge pull request #548 from mandiant/feature-remove-flavors" 
This reverts commit bc28847dd9, reversing
changes made to 82308c4109.
 2022-04-27 06:23:36 -06:00
Willi Ballenthin
f1a3b78555
parse credit card info: update limit 2022-04-05 17:15:08 -06:00
Willi Ballenthin
904bf3ef00
*: remove /x32 and /x64 flavors and use instruction scope 2022-04-05 12:25:14 -06:00
Mike Hunhoff
c4b509594d
Update collection/screenshot/capture-screenshot.yml 
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
 2022-02-04 12:23:32 -07:00
Mike Hunhoff
22fe14008f
Update capture-screenshot.yml 2022-02-04 11:43:32 -07:00
Desiree Beck
ed3661b379 add mbc and att&ck tags 2021-12-14 16:16:07 -05:00
William Ballenthin
0dc67ab7bf gather-firefox-profile-information: move optional to top level 2021-11-10 14:28:07 -07:00
Willi Ballenthin
6a24840f7c
discover group policy via gpresult: restrict to windows 2021-10-25 12:48:19 -06:00
William Ballenthin
fe1aa57334 fix lint problems 2021-10-22 13:42:00 -06:00
William Ballenthin
0f1d259fd7 discover group policy via gpresult: add ATT&CK mapping 2021-10-22 12:36:46 -06:00
William Ballenthin
f44e9f458f add discover group policy via gpresult 
closes #474
 2021-10-22 11:49:08 -06:00
Moritz Raabe
25938ca10c change to mandiant.com 2021-09-28 12:21:11 +02:00
William Ballenthin
ea3ea14c22 minor reorg linux rules and logic 
ref #442
 2021-08-25 15:31:51 -06:00
Willi Ballenthin
6f582bd395
Merge pull request #442 from TcM1911/linux-rules 
A set of rules for Linux ELFs
 2021-08-25 14:33:25 -06:00
William Ballenthin
0ef69c4fbd *: use substring features rather than unreadable regexes 
closes #450
 2021-08-24 12:47:26 -06:00
Joakim Kennedy
776bcd34dd Move rules without examples to nursery 2021-08-05 15:52:17 +01:00
Joakim Kennedy
78fbf5f3c5 Fix linting errors 2021-08-05 15:35:27 +01:00
Joakim Kennedy
765e182553 A set of rules for Linux ELFs 2021-08-04 15:47:00 +01:00
johnk3r
c9c2b6b7e3
Add capture webcam image (#398) 
* Add files via upload

https://github.com/fireeye/capa-rules/issues/285

* Update and rename collection/capture-webcam-image.yml to collection/webcam/capture-webcam-image.yml

* Delete capture-webcam-image.yml

* Create capture-webcam-image.yml

* Update capture-webcam-image.yml
 2021-07-22 08:55:41 +02:00
Willi Ballenthin
c2acf0d1c1
get-domain-trust-relationships: fix ATT&CK mapping 
closes #426
 2021-07-13 12:31:23 -06:00
Ana Maria Martinez Gomez
e1dc793589
ci: tighten up parse credit card rule 
I have come across a sample that compare with all ASCII characters, which
triggers this rule (although the sample doesn't parse credit card
information). Ensure that there is not a comparison with `m`, `n`, `o`
and `p` (as they are in the middle of the alphabet and not part of the
hex char set) to avoid this case.
 2021-06-07 11:31:42 +02:00
William Ballenthin
913cebdb38 Merge branch 'master' into fix-1 2021-05-18 10:48:06 -06:00