CosmoWorker
19380b704e
update create-service to detect sc.exe usage
2026-02-23 22:50:55 +05:30
Mike Hunhoff
3b42582539
adding/updating rules based on recent samples ( #1085 )
2025-11-25 13:38:55 -07:00
JJ
7ae786cf70
Add new rule use-io_uring-io-interface-on-linux.yml ( #1080 )
2025-10-20 09:27:16 -06:00
Paul
fa246a4a9b
terminate process with RestartMgr.RmShutdown ( #1077 )
...
* terminate process with RestartMgr.RmShutdown
* fix 'and' to 'api'
2025-09-23 14:17:49 -06:00
JJ
1a065e6dea
Move get-routing-table.yml out of nursery. Add enumerate-tcp-connecti… ( #1074 )
...
* Move get-routing-table.yml out of nursery. Add enumerate-tcp-connections-via-wmi-com-api.yml and create-routing-table-entry.yml
* Update scopes in enumerate-tcp-connections-via-wmi-com-api.yml, create-routing-table-entry.yml, get-routing-table.yml
2025-09-09 13:21:48 -06:00
Elad Levi
5d990adef2
Move impersonate user from nursery ( #1072 )
...
* Move and update impersonate-user rule
Renamed impersonate-user.yml from nursery to host-interaction/user and added an examples section with a sample hash.
* Simplify API checks in impersonate-user rule
Removed optional and or conditions for GetUserName and DuplicateToken APIs
* Bring the Ex back
2025-09-03 10:27:04 -06:00
JJ
4026d60a48
Update enumerate-minifilter-drivers.yml ( #1075 )
2025-09-03 10:08:36 -06:00
JJ
1874535449
Add disable-powershell-transcription.yml and access-powershell-lockdo… ( #1065 )
...
* Add disable-powershell-transcription.yml and access-powershell-lockdown-policy.yml
* Update disable-powershell-transcription.yml and bypass-powershell-constrained-language-mode-via-getsystemlockdownpolicy-patch.yml
2025-08-20 10:04:29 -06:00
Mike Hunhoff
7a719809d1
new/updated rules from recent malware samples ( #1063 )
2025-08-12 10:21:05 -06:00
Mike Hunhoff
edabdffa8c
use call scope for get-local-ipv4-addresses ( #1052 )
2025-06-02 13:16:36 -06:00
Mike Hunhoff
2676846e77
tighten subscope for get-local-ipv4-addresses ( #1051 )
2025-06-02 12:46:52 -06:00
Elad Levi
61092d21b5
Unload minifilter drivers ( #1047 )
...
* Update unload-driver.yml
* moved rule to unload-minifilter-driver
* removed author
* removed example
2025-05-19 12:21:19 -06:00
Elad Levi
83fe95befc
Deleting file content via truncation ( #1040 )
...
* Update delete-file.yml
* Create clear-content.yml
* Update delete-file.yml
* Rename clear-content.yml to clear-file-content.yml
* Added example
2025-05-19 12:20:50 -06:00
Mike Hunhoff
9acd31998f
add APIs to "check mutex on windows" and "create or open mutex on windows" to reduce FNs ( #1031 )
2025-03-20 09:00:29 -06:00
Mike Hunhoff
e85887a875
fix: escape "." that are not expected to be dot operators ( #1028 )
2025-03-18 15:01:39 -06:00
Mike Hunhoff
c002c5cd96
remove FPs from allocate-or-change-rwx-memory.yml ( #1027 )
2025-03-18 08:01:36 -06:00
Elad Levi
4e6fc23354
Update manipulate-boot-configuration.yml ( #1026 )
2025-03-16 09:15:10 -06:00
Mike Hunhoff
86484920a0
reduce scopes to remove _find-taskbar_ fps
2025-03-14 16:11:53 -06:00
Elad Levi
3bd8cf7646
Improve Accuracy of Various Detections ( #1010 )
...
* Update impersonate-user.yml
* Update enumerate-processes-on-remote-desktop-session-host.yml
* Update enumerate-processes-on-remote-desktop-session-host.yml
* Update enumerate-processes-on-remote-desktop-session-host.yml
* Update nursery/impersonate-user.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update host-interaction/process/list/enumerate-processes-on-remote-desktop-session-host.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
---------
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
2025-03-10 14:19:23 -06:00
Mike Hunhoff
6221d9b72b
add more APIs to remove use-process-replacement FNs ( #1009 )
2025-02-25 08:59:09 -07:00
Mike Hunhoff
71dd21d88e
tighten Windows mutex related rules ( #1004 )
2025-02-21 12:37:01 -07:00
Willi Ballenthin
00684bbf4a
add "change registry key timestamp" ( #1003 )
...
closes #1000
graduate change-registry-key-timestamp with example
typo
add references
2025-02-21 09:29:10 -07:00
Mike Hunhoff
b444a585ca
additional APIs to remove FNs for inject apc
2025-02-20 15:08:04 -07:00
Dhruva Kumar Kaushal
c0aa922f20
extend terminate-process.yml to include exit_group #970 ( #991 )
2025-02-04 21:49:39 +01:00
Mike Hunhoff
75c16e4b14
remove redundant matches for dynamic scope ( #987 )
...
* remove redundant matches for dynamic scope
* fix lints
* fix lints
* tighten scopes
2025-02-04 09:32:24 +01:00
dhruvak001
13b6bc0dfe
reverting changes
2025-02-03 19:55:12 +01:00
dhruvak001
fe99a653e8
CI error:scope interchanged
2025-02-03 19:55:12 +01:00
Willi Ballenthin
36bf945aee
fix scopes from lint errors
...
ref https://github.com/mandiant/capa/pull/2579
2025-01-29 18:54:25 +01:00
Willi Ballenthin
c1d20764ad
use "span of calls" scope ( #973 )
...
* use sequence scope instead of thread scope for "static: function" rules
* use sequence scope instead of thread scope for "static: basic block" rules
* make runtime linking rules more concise
* doc: describe sequence scope
* rename "sequence" scope to "span of calls" scope
* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/get-geographical-location.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/file-managers/gather-classicftp-information.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/wmi/reference-wmi-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/sql/reference-sql-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
---------
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
2025-01-29 10:27:13 +01:00
Mike Hunhoff
ff9db74425
update create-process-suspended to include DEBUG_ONLY_THIS_PROCESS ( #978 )
2025-01-07 13:02:37 -07:00
Moritz
f3bb093ab0
Merge pull request #956 from jorik-utwente/add-miscellaneous-persistence-techniques
...
Add 4 miscellaneous persistence techniques
2024-11-25 09:21:49 +01:00
jorik
82a9d4030e
move WMI persistence rule to WMI usage detection rule
2024-11-22 16:12:11 +01:00
jorik
29dc6174b3
change scope to call for atomic operations
2024-10-31 13:30:21 +01:00
Matt Williams
9917a93ee1
get-process-filename.yml: added reference, corrected structure element
2024-10-18 19:09:05 +00:00
Matt Williams
01e45dfcf9
get-process-filename.yml: added x86 support ( #945 )
...
* Added x86 support for get-process-filename.yml
2024-10-16 18:11:11 +02:00
Matt Williams
2317949274
New rule: open-recentdocs-registry-key.yml ( #938 )
...
* Add rule get-process-filename.yml
---------
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
2024-10-03 11:38:40 +02:00
Moritz
003341b6e1
Merge pull request #932 from jtothej/netfw1
...
Add access-firewall-policy-via-inetfwpolicy2.yml and access-firewall-…
2024-10-02 10:40:56 +02:00
Moritz
109890c8c6
add rule for driver major function ID ( #939 )
...
* add rule
2024-09-30 14:05:20 +02:00
Matt Williams
627395d6f1
Add rule get-process-filename.yml ( #936 )
2024-09-26 11:36:40 -06:00
Still / Azaka
9da73becdb
Add rule for detecting hiding shutdown actions ( #935 )
...
* Add initial rule for hiding shutdown actions
Signed-off-by: Still Hsu <dev@stillu.cc>
---------
Signed-off-by: Still Hsu <dev@stillu.cc>
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
2024-09-26 14:25:02 +02:00
jtothej
c23d9f3562
Add access-firewall-policy-via-inetfwpolicy2.yml and access-firewall-rule-properties-via-inetfwrule.yml
2024-09-24 15:50:55 +08:00
JJ
123d6f73dc
Add delete-network-filter-via-wfp-api.yml and enumerate-network-filters-via-wfp-api.yml ( #930 )
...
* Add host-interaction/network/traffic/filter/delete-network-filter-via-wfp-api.yml and host-interaction/network/traffic/filter/enumerate-network-filters-via-wfp-api.yml
2024-09-16 14:43:28 +02:00
jtothej
fc708957ed
Move from nursery and update get-system-firmware-table.yml
2024-09-05 18:35:46 +02:00
Mike Hunhoff
5b8c8a63a2
update linux/android rules and reduce fps for intel-specific rules ( #927 )
...
* android: add / update rules
* intel: match intel archs to avoid fps on others
2024-08-16 12:57:08 -06:00
Mike Hunhoff
61012f7b9e
linux: remove duplicate api write-file-on-linux.yml
2024-08-01 15:59:50 -06:00
Moritz
e63c454fbb
Merge pull request #908 from mandiant/fix/dependency-scopes
...
fix the scope of some rules with dependencies
2024-06-14 11:01:35 +02:00
Mike Hunhoff
ea14b38fbf
adding / updating linux / android rules ( #907 )
...
* adding / updating linux / android rules
* update statement
* apply review feedback
* add additional android rules
* fix feedback
2024-06-11 12:10:57 -06:00
Willi Ballenthin
e6befc9b53
fix the scope of some rules with dependencies
...
ref: https://github.com/mandiant/capa/issues/2124
2024-06-06 09:39:53 +02:00
jtothej
4e50e50bad
Add hide-graphical-window-from-taskbar.yml rule
2024-06-02 20:23:13 +08:00
Mike Hunhoff
ded2744733
adding new and updating linux / android rules ( #903 )
...
* adding new and updating linux / android rules
* fix lints
2024-05-31 13:24:19 -04:00
