vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-04 20:37:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
1948 commits 1 branch 0 tags 3.2 MiB
Commit graph

40 commits

Author SHA1 Message Date
Mike Hunhoff
86484920a0 reduce scopes to remove _find-taskbar_ fps 2025-03-14 16:11:53 -06:00
Willi Ballenthin
c1d20764ad
use "span of calls" scope (#973) 
* use sequence scope instead of thread scope for "static: function" rules

* use sequence scope instead of thread scope for "static: basic block" rules

* make runtime linking rules more concise

* doc: describe sequence scope

* rename "sequence" scope to "span of calls" scope

* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/get-geographical-location.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/file-managers/gather-classicftp-information.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/database/wmi/reference-wmi-statements.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/database/sql/reference-sql-statements.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

---------

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
 2025-01-29 10:27:13 +01:00
Moritz
e63c454fbb
Merge pull request #908 from mandiant/fix/dependency-scopes 
fix the scope of some rules with dependencies
 2024-06-14 11:01:35 +02:00
Willi Ballenthin
e6befc9b53 fix the scope of some rules with dependencies 
ref: https://github.com/mandiant/capa/issues/2124
 2024-06-06 09:39:53 +02:00
jtothej
4e50e50bad Add hide-graphical-window-from-taskbar.yml rule 2024-06-02 20:23:13 +08:00
mr-tz
8a36231025 fix scopes for rules with subscopes 2 2023-11-24 11:35:03 +01:00
mr-tz
e18704545a fix call/thread scopes manually 2023-11-24 11:35:00 +01:00
mr-tz
784c9dca53 upgrade rules using updated script 2023-11-24 11:34:28 +01:00
jtothej
f99fd950b6 Update switch-active-desktop.yml and move to host-interaction/gui 2023-07-06 21:21:07 +08:00
Moritz
761ccbab47
update ATT&CK/MBC meta data (#675) 
* update ATT&CK/MBC meta data
 2023-02-01 10:08:58 +01:00
Anushka Virgaonkar
1fbee15a3c
Add dotnet rules having property features (#601) 2022-10-03 09:28:05 -06:00
Willi Ballenthin
88c9c786ca
*: use meta.authors everywhere 2022-05-26 11:56:31 -06:00
Desiree Beck
e190179ffd
Merge pull request #1 from MBCProject/ryan-patches1 
Update patch-process-command-line.yml
 2021-11-22 11:27:15 -05:00
Moritz Raabe
25938ca10c change to mandiant.com 2021-09-28 12:21:11 +02:00
William Ballenthin
0ef69c4fbd *: use substring features rather than unreadable regexes 
closes #450
 2021-08-24 12:47:26 -06:00
Ryan Xu
b4e040dc50 preliminary mapping 2021-08-23 14:11:00 -05:00
Moritz Raabe
d81e757728 adding rules based on more PMA labs 2021-06-30 23:38:17 +02:00
William Ballenthin
034ad9cf7c graduate "set console window title" 2021-06-04 12:30:09 -06:00
Michael Hunhoff
20e1b8fd4c enforce string formatting with double quotes + escaped special characters 2021-03-24 14:14:38 -06:00
johnk3r
6180321f51
Update enumerate-gui-resources.yml 2021-01-05 09:35:12 -03:00
johnk3r
a8ae2e2cd9
Update enumerate-gui-resources.yml 2020-12-30 22:33:16 -03:00
johnk3r
4e1c15bb86
Update enumerate-gui-resources.yml 2020-12-30 22:33:08 -03:00
johnk3r
c12233d5ae
Update and rename enumerate-GUI-resources.yml to enumerate-gui-resources.yml 2020-12-30 18:59:11 -03:00
johnk3r
08b5124069
Rename host-interaction/gui/window/..enumerate GUI resources.yml to host-interaction/gui/enumerate-GUI-resources.yml 2020-12-30 18:57:57 -03:00
johnk3r
e0748e5db2
Rename enumerate GUI resources.yml to ..enumerate GUI resources.yml 2020-12-30 18:56:26 -03:00
johnk3r
c9ca55d4a1
Update enumerate GUI resources.yml 2020-12-30 18:54:57 -03:00
johnk3r
5ec67552d9
Update and rename get-enumeration-functions.yml to enumerate GUI resources.yml 2020-12-30 18:54:24 -03:00
johnk3r
332e5e2489
Rename get-enumeration-function.yml to get-enumeration-functions.yml 2020-12-29 21:53:33 -03:00
johnk3r
642ccf0cc4 Create get-enumeration-function.yml 2020-12-29 21:40:36 -03:00
Desiree Beck
499308b3e9 update based on comments 2020-12-16 16:33:22 -05:00
Desiree Beck
c5d24c671a added mbc mappings in the host-interaction namespace 2020-12-16 15:30:06 -05:00
re-fox
89d73e7e48
Create references-logon-banner.yml 2020-09-17 11:02:37 -04:00
re-fox
f7f2eaf012
Delete references-logon-banner.yml 2020-09-17 11:01:22 -04:00
re-fox
741be1b8ac
Create references-logon-banner.yml 2020-09-17 11:00:48 -04:00
Michael Hunhoff
5684b976ed adding misc new rules and rule updates 2020-08-03 16:39:53 -06:00
re-fox
1dd321d285
Create change-the-wallpaper.yml 
Initial support for SystemParametersInfo & SPI_SETDESKWALLPAPER
 2020-07-27 14:50:40 -04:00
William Ballenthin
b878effef7 fix rules as documented in #49 2020-07-24 15:49:52 -06:00
William Ballenthin
54cfb05bd0 rules: address comments in #14 2020-06-26 17:45:56 -06:00
William Ballenthin
7b4f4d10fb rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better 2020-06-21 17:54:01 -06:00
William Ballenthin
5f57dbdbc9 rules: reorganize rule names, namespaces, and ATT&CK mappings 2020-06-21 17:25:43 -06:00