vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
1948 commits 1 branch 0 tags 3.2 MiB
Commit graph

58 commits

Author SHA1 Message Date
Mustafa Günel
ec9e1c5efe
updated broken link 2025-05-06 14:25:43 +03:00
Willi Ballenthin
c1d20764ad
use "span of calls" scope (#973) 
* use sequence scope instead of thread scope for "static: function" rules

* use sequence scope instead of thread scope for "static: basic block" rules

* make runtime linking rules more concise

* doc: describe sequence scope

* rename "sequence" scope to "span of calls" scope

* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/get-geographical-location.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/file-managers/gather-classicftp-information.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/database/wmi/reference-wmi-statements.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/database/sql/reference-sql-statements.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

---------

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
 2025-01-29 10:27:13 +01:00
Willi Ballenthin
bdf01d6243
update rule format documentation with dynamic details (#851) 
* wip: update rule format documentation with dynamic details

* format: add example links

* format: reorganize features vs scopes

* Update doc/format.md

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

* Update doc/format.md

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

* Update doc/format.md

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

* Update doc/format.md

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

* Update doc/format.md

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

* Update doc/format.md

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

* Update doc/format.md

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

* Update doc/format.md

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

* format: table formatting

* format: try to express scoping for features

* Update doc/format.md

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

* Update doc/format.md

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2023-11-29 14:24:41 +01:00
Moritz
65eae8a7d6
Update doc apis no dlls (#838) 
* document ignoring of DLL name for API feature matching

* document DLL name for import features
 2023-10-20 11:49:39 +02:00
Aayush Goel
b47c3a7be6 Update format.md 2023-08-30 01:02:00 +05:30
Aayush Goel
2b5eb58a47
Update format.md 2023-08-28 16:24:38 +05:30
Aayush Goel
1a8a45b99f
Apply suggestions from code review 
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2023-08-28 16:23:41 +05:30
Aayush Goel
cdfb01762b Update format.md 2023-08-25 22:07:36 +05:30
Aayush Goel
9f163b0cee Update format.md 
Documentation for COM feature addition in https://github.com/mandiant/capa/pull/1738
 2023-08-25 22:01:29 +05:30
Ronnie Salomonsen
8b5e3217fa
Update doc/format.md 
Co-authored-by: Willi Ballenthin <wballenthin@google.com>
 2023-07-19 14:54:47 +02:00
Ronnie Salomonsen
658b16f47d
Update doc/format.md 
Co-authored-by: Willi Ballenthin <wballenthin@google.com>
 2023-07-19 14:54:25 +02:00
Ronnie Salomonsen
a8d00309c3
Add new rule for forwarded exports and update doc to with new characteristic and examples under export feature 2023-07-19 12:40:20 +02:00
Elliot Chernofsky
2ca29bf517 updated table of contents 2023-03-21 14:42:23 -04:00
Elliot Chernofsky
e882571908 updated format doc to clarify acceptable comments in capa-rules 2023-03-21 14:36:45 -04:00
Mike Hunhoff
8310355528
update rule documentation and improve .NET detection for OS gather (#724) 
* add documentation for property feature and .NET constructors

* add API to detect OS version read in .NET

* fix capitalization of Windows
 2023-03-16 17:40:48 +00:00
Mike Hunhoff
64e524f9d6
update doc for OS_ANY (#712) 2023-02-24 07:52:27 -07:00
Moritz
51bd7f55d7
update HTTP User-Agent rules (#702) 2023-02-20 09:04:36 +01:00
Moritz
cad482b294
Consolidate c2 and communication namespaces (#692) 
* move c2 under communication

* update namespace

* reduce false positives
 2023-02-07 15:49:08 +01:00
Anushka Virgaonkar
95dc5eb27f
Add new dotnet rules that capture capabilites typically found in backdoors. (#579) 2022-07-07 13:39:51 -06:00
Moritz
2b33378f9e
Update format.md 2022-07-01 12:17:24 +02:00
Mike Hunhoff
5f7e1fb514
update documentation for .NET (#574) 2022-06-29 11:54:04 -06:00
Willi Ballenthin
f5e83ce953
Revert "Revert "Merge pull request #549 from mandiant/feature-doc-updates"" 
This reverts commit 056a6c2f28.
 2022-06-28 15:26:03 -06:00
Willi Ballenthin
d5c2709049
Revert "Revert "call $+5 update rule and doc"" 
This reverts commit 6728fb0d5a.
 2022-06-28 15:20:15 -06:00
Willi Ballenthin
88c9c786ca
*: use meta.authors everywhere 2022-05-26 11:56:31 -06:00
idiom
d9dfb69125 Update references to define it as a list of related information. 2022-05-11 10:47:15 -04:00
William Ballenthin
6728fb0d5a Revert "call $+5 update rule and doc" 
This reverts commit c5368ed9a2.
 2022-04-27 06:28:04 -06:00
William Ballenthin
056a6c2f28 Revert "Merge pull request #549 from mandiant/feature-doc-updates" 
This reverts commit afd356e046, reversing
changes made to 9967d225a6.
 2022-04-27 05:34:39 -06:00
Willi Ballenthin
79f7012aa9
format: remove /x32 and /x64, add operand features 2022-04-06 11:39:55 -06:00
Moritz Raabe
c5368ed9a2 call $+5 update rule and doc 2022-03-01 08:46:58 +01:00
Moritz Raabe
1307be35d5 s/fireeye/mandiant 2021-09-27 21:47:49 +02:00
Willi Ballenthin
50a5b10621
format: add substring to section titles 2021-08-24 16:36:05 -06:00
Willi Ballenthin
542d1628f3
doc: format: string: tweak quoting 2021-08-24 11:44:06 -06:00
Willi Ballenthin
9fdaf7a10f
format: document substring features 2021-08-24 11:42:32 -06:00
William Ballenthin
7bfafc6aed Merge branch 'master' of github.com:fireeye/capa-rules into feature-701 2021-08-18 14:31:01 -06:00
William Ballenthin
6bcd6d5e88 format: document the format feature 2021-08-16 17:34:42 -06:00
William Ballenthin
7ae2d3942d format: document OS and Arch features 2021-08-16 17:32:17 -06:00
Moritz Raabe
6c01d1e81e clarify verbatim string matching 2021-06-10 13:24:57 +02:00
William Ballenthin
002700dad9 format: document function-name feature 2021-05-27 08:39:19 -06:00
Arnim Rupp
3a565c6ffd fix URLs & formatting 2021-05-12 12:52:06 +02:00
Michael Hunhoff
7d5080b4d4 updating rule format README 2021-03-25 10:17:54 -06:00
Michael Hunhoff
20e1b8fd4c enforce string formatting with double quotes + escaped special characters 2021-03-24 14:14:38 -06:00
Moritz Raabe
873ed713e8 rule updates based on PMA labs 
see #296
 2021-03-22 09:45:56 +01:00
Moritz Raabe
ed04be796a dos2unix 2021-03-19 08:13:26 +01:00
Moritz
7afd7de057
Apply suggestions from code review 
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
 2021-02-23 16:30:39 +01:00
Moritz
c23bc2195d
Update format.md 2021-02-23 10:21:08 +01:00
Moritz
355a1845c6 document example syntax 
closes #205
 2021-01-07 08:45:24 +01:00
Moritz Raabe
2611789b46 update documentation on descriptions 2020-09-25 18:45:10 +02:00
Moritz Raabe
1fcec06e7e comment out description blocks for statements 
discussed in #312
 2020-09-14 11:53:01 +02:00
0ssigeno
8dd3821274 fixed key, and added x32 and x64 flavours 2020-08-20 10:22:00 +02:00
Ana María Martínez Gómez
cf0dedfc38
Remove characteristic(switch) from the documentation 
The `characteristic(switch)` feature has been removed in:
https://github.com/fireeye/capa/pull/232
 2020-08-13 16:51:47 +02:00