vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-03 11:57:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
1948 commits 1 branch 0 tags 3.2 MiB
Commit graph

42 commits

Author SHA1 Message Date
JJ
1a065e6dea
Move get-routing-table.yml out of nursery. Add enumerate-tcp-connecti… (#1074) 
* Move get-routing-table.yml out of nursery. Add enumerate-tcp-connections-via-wmi-com-api.yml and create-routing-table-entry.yml

* Update scopes in enumerate-tcp-connections-via-wmi-com-api.yml, create-routing-table-entry.yml, get-routing-table.yml
 2025-09-09 13:21:48 -06:00
Mike Hunhoff
edabdffa8c
use call scope for get-local-ipv4-addresses (#1052) 2025-06-02 13:16:36 -06:00
Mike Hunhoff
2676846e77
tighten subscope for get-local-ipv4-addresses (#1051) 2025-06-02 12:46:52 -06:00
Willi Ballenthin
c1d20764ad
use "span of calls" scope (#973) 
* use sequence scope instead of thread scope for "static: function" rules

* use sequence scope instead of thread scope for "static: basic block" rules

* make runtime linking rules more concise

* doc: describe sequence scope

* rename "sequence" scope to "span of calls" scope

* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/get-geographical-location.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/file-managers/gather-classicftp-information.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/database/wmi/reference-wmi-statements.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/database/sql/reference-sql-statements.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

---------

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
 2025-01-29 10:27:13 +01:00
JJ
123d6f73dc
Add delete-network-filter-via-wfp-api.yml and enumerate-network-filters-via-wfp-api.yml (#930) 
* Add host-interaction/network/traffic/filter/delete-network-filter-via-wfp-api.yml and host-interaction/network/traffic/filter/enumerate-network-filters-via-wfp-api.yml
 2024-09-16 14:43:28 +02:00
mr-tz
784c9dca53 upgrade rules using updated script 2023-11-24 11:34:28 +01:00
johnk3r
b33f95c9ca
set state tcp connection (#829) 
* Add rule

---------

Co-authored-by: Willi Ballenthin <wballenthin@google.com>
 2023-10-06 17:19:47 +02:00
Moritz
abf75509fa
DNS and crypto rule tweaks (#713) 
* update rule
 2023-02-27 09:59:21 +01:00
Mike Hunhoff
63a4c6d5db
improve .NET detections incl. sockets, files, directories (#708) 2023-02-23 09:45:49 +01:00
Mike Hunhoff
c046b59a74
add new and update existing .NET rules (#639) 2023-01-03 07:58:11 -07:00
Anushka Virgaonkar
1fbee15a3c
Add dotnet rules having property features (#601) 2022-10-03 09:28:05 -06:00
Anushka Virgaonkar
dcc2e74c84
Update with dotnet capabilities (#590) 2022-07-07 15:22:39 -06:00
Willi Ballenthin
57e1732f5c
Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors"" 
This reverts commit d43a6ee544.
 2022-06-28 15:23:20 -06:00
Willi Ballenthin
88c9c786ca
*: use meta.authors everywhere 2022-05-26 11:56:31 -06:00
William Ballenthin
d43a6ee544 Revert "Merge pull request #548 from mandiant/feature-remove-flavors" 
This reverts commit bc28847dd9, reversing
changes made to 82308c4109.
 2022-04-27 06:23:36 -06:00
Willi Ballenthin
904bf3ef00
*: remove /x32 and /x64 flavors and use instruction scope 2022-04-05 12:25:14 -06:00
Baptistin Boilot
4f4914d572
Fix Mitre Att&ck technique naming 2022-01-22 16:59:27 +01:00
William Ballenthin
bedfba7abe enumerate domain computers via LDAP: add references to COM GUIDs 2021-10-22 11:08:40 -06:00
Moritz Raabe
25938ca10c change to mandiant.com 2021-09-28 12:21:11 +02:00
William Ballenthin
ea3ea14c22 minor reorg linux rules and logic 
ref #442
 2021-08-25 15:31:51 -06:00
Willi Ballenthin
6f582bd395
Merge pull request #442 from TcM1911/linux-rules 
A set of rules for Linux ELFs
 2021-08-25 14:33:25 -06:00
William Ballenthin
0ef69c4fbd *: use substring features rather than unreadable regexes 
closes #450
 2021-08-24 12:47:26 -06:00
Joakim Kennedy
78fbf5f3c5 Fix linting errors 2021-08-05 15:35:27 +01:00
Joakim Kennedy
765e182553 A set of rules for Linux ELFs 2021-08-04 15:47:00 +01:00
Willi Ballenthin
cbc1098993
register-network-filter-via-wfp-api: fix ATT&CK mapping 
closes #424
 2021-07-12 21:08:09 -06:00
Andrew
fbafd732e7 Update rule metadata for rules written by @recvfrom 
Mostly just changes @recvfrom to awillia2@cisco.com, but
also updates the descriptions in a few places to be
more precise (I don't think I initially realized that
`api` has function scope and is for API calls whereas
`import` has file level scope and is just for the import)
 2021-06-06 23:30:34 -04:00
Andrew
0603577a7d Add enumerate-domain-computers-via-LDAP 2021-06-06 10:12:06 -04:00
Andrew
27a08abcfa Add get-domain-controller-name 2021-06-06 10:10:51 -04:00
Michael Hunhoff
a18ea071ba adding new rules for keylogging, HTTP comms, network collection 2021-05-26 14:58:20 -06:00
Michael Hunhoff
e4734454c2 adding check-internet-connectivity-via-wininet.yml 2021-05-07 15:37:47 -06:00
Andrew
8a513b280b Add rules from Egregor ransomware DLL 2021-04-26 11:56:25 -04:00
johnk3r
842c864471
Update resolve-dns.yml 2021-02-12 21:53:44 -03:00
johnk3r
88b87c672c
Update resolve-dns.yml 2021-02-12 10:29:53 -03:00
johnk3r
581a28645a
Update resolve-dns.yml 
https://github.com/fireeye/capa-rules/issues/239
 2021-02-11 20:52:52 -03:00
William Ballenthin
f8a3de9367 update attack mappings 2021-01-02 11:46:20 -07:00
Desiree Beck
c5d24c671a added mbc mappings in the host-interaction namespace 2020-12-16 15:30:06 -05:00
Chris Gardner
c7839894a0
Fix #115 
See #115 for explanation of the issue
 2020-09-02 12:17:01 -04:00
William Ballenthin
b878effef7 fix rules as documented in #49 2020-07-24 15:49:52 -06:00
William Ballenthin
0d77564785 merge 2020-06-26 17:47:37 -06:00
William Ballenthin
54cfb05bd0 rules: address comments in #14 2020-06-26 17:45:56 -06:00
William Ballenthin
7b4f4d10fb rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better 2020-06-21 17:54:01 -06:00
William Ballenthin
5f57dbdbc9 rules: reorganize rule names, namespaces, and ATT&CK mappings 2020-06-21 17:25:43 -06:00