vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 10:58:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
1948 commits 1 branch 0 tags 3.2 MiB
Commit graph

106 commits

Author SHA1 Message Date
Saniya Fatima
7f70ec18ff
Flexible version of send HTTP request (#1110) 
* Flexible version of send HTTP request

* Fix lint errors
 2026-01-30 10:40:47 -07:00
Saniya Fatima
8caf489d8c
Fix false positive in send HTTP request (#1099) 2026-01-26 09:40:58 -07:00
Still / Azaka
fb3737b90a
Loosen AFD driver usage detection (#1086) 
* Move CreateEvent to optional

Signed-off-by: Still Hsu <dev@stillu.cc>
 2025-12-04 13:10:46 +01:00
Mike Hunhoff
7a52b6f9c0
dotnet: adding new rules based on recent samples (#1082) 
* dotnet: adding new rules based on recent samples
 2025-11-07 08:39:46 +01:00
Mike Hunhoff
ebdd6b85d5
update reference-http-user-agent-string.yml (#1067) 
* update reference-http-user-agent-string.yml

* update rule documentation
 2025-08-14 14:59:09 -06:00
Mike Hunhoff
e85887a875
fix: escape "." that are not expected to be dot operators (#1028) 2025-03-18 15:01:39 -06:00
Dhruva Kumar Kaushal
6697513245
improve TCP/UDP socket creation matching #964 (#993) 
* improve TCP/UDP socket creation matching #964

* Adding references

* adding IPPROTO_UDP

* relax rule

* function -> basic block

* adding bytes for indirect(0)

* adding bytes for indirect(0)

* back to default changes

* moved to nursery

* final change

* resolving comment

* indentation error
 2025-03-14 11:45:36 -06:00
Hafiz Farhad
77f06fd049
Addresses #965: Create separate rules for socket connects (TCP/UDP) (#1017) 
* Separate socket connection rules for TCP and UDP

- Introduce a generic "connect socket" rule capturing common connection APIs (connect, ws2_32.connect, WSAConnect, ConnectEx, and related ConnectEx setup patterns).
- Refactor the TCP connect rule to require a match on "create TCP socket" and the generic rule, preserving TCP-specific behaviors while maximizing reuse.
- Add a new UDP connect rule that requires a match on "create UDP socket" and the generic connect rule.

Closes #965.

* Update socket rule examples with correct offsets for UDP/TCP

* Updated suggested changes
 2025-03-10 14:38:43 -06:00
Mike Hunhoff
5fb8cee820
tighten receive-http-request (#1015) 2025-03-05 13:56:15 -07:00
Willi Ballenthin
0ea3394942 graduate onedrive rule 
closes #943
 2025-01-29 18:54:25 +01:00
Willi Ballenthin
36bf945aee fix scopes from lint errors 
ref https://github.com/mandiant/capa/pull/2579
 2025-01-29 18:54:25 +01:00
Willi Ballenthin
c1d20764ad
use "span of calls" scope (#973) 
* use sequence scope instead of thread scope for "static: function" rules

* use sequence scope instead of thread scope for "static: basic block" rules

* make runtime linking rules more concise

* doc: describe sequence scope

* rename "sequence" scope to "span of calls" scope

* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/get-geographical-location.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/file-managers/gather-classicftp-information.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/database/wmi/reference-wmi-statements.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/database/sql/reference-sql-statements.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

---------

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
 2025-01-29 10:27:13 +01:00
vibhatsu
b4e0c8cdf8
remove duplicate features from some rules (#984) 
* remove duplicate features from some rules

* keep commented hex values to show AfdOpenPacketX structure

Signed-off-by: vibhatsu <maulikbarot2915@gmail.com>

---------

Signed-off-by: vibhatsu <maulikbarot2915@gmail.com>
 2025-01-28 12:54:17 +01:00
JJ
99e100db28
Add new rule attach-bpf-to-socket-on-linux.yml (#922) 
* Add new rule attach-bpf-to-socket-on-linux.yml

---------

Co-authored-by: Willi Ballenthin <wballenthin@google.com>
 2024-08-14 10:48:04 +02:00
Willi Ballenthin
2c5c0ae60b
add API features for ws2_32 ordinals (#893) 2024-04-23 14:20:28 +02:00
Moritz
4e725638a6
fix logic after dynamic update (#857) 
* fix logic after dynamic update

---------

Co-authored-by: Yacine <16624109+yelhamer@users.noreply.github.com>
 2023-12-08 22:40:40 +01:00
mr-tz
5e2dae155f update scopes 2023-11-24 11:35:09 +01:00
Willi Ballenthin
696287da05 vmci: tweak required vs optional APIs 2023-11-24 11:35:08 +01:00
Willi Ballenthin
a6f3e4110a further dynamic scope tweaks 2023-11-24 11:35:06 +01:00
mr-tz
8a36231025 fix scopes for rules with subscopes 2 2023-11-24 11:35:03 +01:00
mr-tz
e18704545a fix call/thread scopes manually 2023-11-24 11:35:00 +01:00
mr-tz
784c9dca53 upgrade rules using updated script 2023-11-24 11:34:28 +01:00
Mike Hunhoff
20d2218df7
init add of Xamarin rules (#824) 
* init add of Xamarin rules

* Update and rename get-system-information-in-dotnet-on-android.yml to get-os-version-in-dotnet-on-android.yml
 2023-11-22 11:05:26 -07:00
Mike Hunhoff
2a37df98f5
adding new rules based on private Linux sample(s) (#821) 
* adding new rules based on private Linux sample(s)

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2023-10-09 18:27:33 +02:00
jtothej
098dacbae1 Add create-vmci-socket.yml 2023-07-04 14:24:29 +08:00
ryan
153d4c0d2c Update Mappings for MBC 2023-06-21 10:45:01 -04:00
Crowface28
c85260c9c0 Update read-from-mailslot.yml 2023-05-30 10:33:49 -04:00
Crowface28
7510e2707a uploaded new example to capa-testfiles repo, should now pass linting. 2023-05-30 10:17:39 -04:00
Crowface28
ae9d2cca0c removed example ref and moved to nursery 2023-05-29 10:49:59 -04:00
Nick Simonian
e8a6dc7c5e Create read-from-mailslot.yml 2023-05-26 10:52:13 -04:00
Mike Hunhoff
8635a31c89
improve detection for pipe creation/connection in .NET (#739) 2023-03-31 08:03:17 -06:00
Mike Hunhoff
ca0fea4361
improve geo collection and .NET data upload detections (#738) 2023-03-28 08:07:11 -06:00
Willi Ballenthin
274d72e1bf
Merge pull request #714 from mandiant/http-query-uri 
add get http query uri
 2023-02-28 11:40:29 +01:00
Willi Ballenthin
ba2cc497f9 http request uri: move to nursery 2023-02-28 09:29:09 +01:00
Willi Ballenthin
bd1aeefd2d
Update and rename get-http-query-uri.yml to get-http-request-uri.yml 2023-02-28 09:10:27 +01:00
Willi Ballenthin
07f16e846d
Update communication/http/get-http-query-uri.yml 2023-02-28 09:09:53 +01:00
Moritz
abf75509fa
DNS and crypto rule tweaks (#713) 
* update rule
 2023-02-27 09:59:21 +01:00
William Ballenthin
876af5fa37 add get http query uri 
ref #3
 2023-02-26 21:14:13 +01:00
Mike Hunhoff
63a4c6d5db
improve .NET detections incl. sockets, files, directories (#708) 2023-02-23 09:45:49 +01:00
Mike Hunhoff
c9f7f685dd
update recieve-data-on-socket for .NET (#707) 2023-02-22 12:24:16 -07:00
Willi Ballenthin
65105466c0
Merge pull request #704 from mandiant/http-content-length 
add get http content length
 2023-02-21 11:45:47 +01:00
Willi Ballenthin
59bae867c6
Update communication/http/get-http-content-length.yml 
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2023-02-21 11:45:42 +01:00
Moritz
51bd7f55d7
update HTTP User-Agent rules (#702) 2023-02-20 09:04:36 +01:00
Willi Ballenthin
23f47b8d25 http content length: fix mbc 2023-02-18 21:39:52 +01:00
Willi Ballenthin
5d6247143a http content length: fix MBC 2023-02-18 21:37:47 +01:00
Willi Ballenthin
ef15bf0e06 add get http content length 2023-02-18 21:36:35 +01:00
Blas
005f9ced10
Rule for raw socket creation (#696) 
* Create create-raw-socket-in-windows.yml

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2023-02-15 17:45:38 +01:00
Moritz
c341449506
add rule: convert IP address (#697) 
* add rule

---------

Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
 2023-02-13 10:50:07 +01:00
Moritz
cad482b294
Consolidate c2 and communication namespaces (#692) 
* move c2 under communication

* update namespace

* reduce false positives
 2023-02-07 15:49:08 +01:00
Willi Ballenthin
4658e8dd4c add create tcp socket via raw AFD driver 
closes #537
 2023-02-01 11:47:52 +01:00