vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
1948 commits 1 branch 0 tags 3.2 MiB
Commit graph

28 commits

Author SHA1 Message Date
Willi Ballenthin
00684bbf4a
add "change registry key timestamp" (#1003) 
closes #1000

graduate change-registry-key-timestamp with example

typo

add references
 2025-02-21 09:29:10 -07:00
Willi Ballenthin
c1d20764ad
use "span of calls" scope (#973) 
* use sequence scope instead of thread scope for "static: function" rules

* use sequence scope instead of thread scope for "static: basic block" rules

* make runtime linking rules more concise

* doc: describe sequence scope

* rename "sequence" scope to "span of calls" scope

* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/get-geographical-location.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/file-managers/gather-classicftp-information.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/database/wmi/reference-wmi-statements.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/database/sql/reference-sql-statements.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

---------

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
 2025-01-29 10:27:13 +01:00
jorik
29dc6174b3 change scope to call for atomic operations 2024-10-31 13:30:21 +01:00
Matt Williams
2317949274
New rule: open-recentdocs-registry-key.yml (#938) 
* Add rule get-process-filename.yml

---------

Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2024-10-03 11:38:40 +02:00
mr-tz
e18704545a fix call/thread scopes manually 2023-11-24 11:35:00 +01:00
mr-tz
784c9dca53 upgrade rules using updated script 2023-11-24 11:34:28 +01:00
Mike Hunhoff
5ed63e3593
improve .NET detections for registry access and web proxy usage (#723) 2023-03-14 10:25:17 -06:00
Mike Hunhoff
e5ae505682
update .NET detections (#703) 2023-02-21 14:38:03 -07:00
Joren Vrancken
3596b08d6e
Split the 'reg.exe add' check into multiple strings (#686) 2023-02-06 10:12:34 -07:00
Moritz
b48fcd5dd8
improve rules that often match (#655) 
* improve rules that often match
 2023-01-09 14:07:53 +01:00
Mike Hunhoff
96a1abddca
new/update .NET rules (#625) 2022-10-07 09:39:57 -06:00
Anushka Virgaonkar
95dc5eb27f
Add new dotnet rules that capture capabilites typically found in backdoors. (#579) 2022-07-07 13:39:51 -06:00
William Ballenthin
2d66aace99 *: add APIs used by .NET samples for basic interactions 2022-06-08 11:18:23 -06:00
Willi Ballenthin
88c9c786ca
*: use meta.authors everywhere 2022-05-26 11:56:31 -06:00
Moritz Raabe
25938ca10c change to mandiant.com 2021-09-28 12:21:11 +02:00
William Ballenthin
ea3ea14c22 minor reorg linux rules and logic 
ref #442
 2021-08-25 15:31:51 -06:00
William Ballenthin
f1b450edf0 update ATT&CK and MBC mappings 
thanks to Regina Elwell @ FireEye and @evandrix
closes #316
 2021-04-13 09:37:10 -06:00
johnk3r
af177de173
Create offline-registry-manipulation.yml (#287) 
* Create offline-registry-manipulation.yml

https://github.com/fireeye/capa-rules/issues/211

* Update offline-registry-manipulation.yml

* Update offline-registry-manipulation.yml

* Delete offline-registry-manipulation.yml

* Add files via upload

* Update and rename offline-create-registry.yml to create-registry-key-via-offline-registry-library.yml

* Update and rename offline-open-registry to open-registry-key-via-offline-registry-library.yml

* Update and rename offline-query-registry to query-registry-key-via-offline-registry-library.yml

* Update and rename offline-set-registry.yml to set-registry-key-via-offline-registry-library.yml

* Update create-registry-key-via-offline-registry-library.yml

* Update open-registry-key-via-offline-registry-library.yml

* Update query-registry-key-via-offline-registry-library.yml

* Update set-registry-key-via-offline-registry-library.yml

* Create delete-registry-key-via-offline-registry-library.yml

* Add files via upload

* Delete delete-registry-key-via-offline-registry-library.yml

* Add files via upload

* Delete create-registry-key-via-offline-registry-library.yml

* Delete open-registry-key-via-offline-registry-library.yml

* Delete query-registry-key-via-offline-registry-library.yml

* Delete set-registry-key-via-offline-registry-library.yml

* Add files via upload
 2021-03-26 12:17:08 +01:00
johnk3r
eb5957b181
Update delete-registry-key.yml 2021-02-10 09:26:01 -03:00
Moritz Raabe
387334a603 reformated using capafmt 2021-01-27 15:30:59 +01:00
Desiree Beck
5d285c5651 mappings for additions to namespaces 2021-01-21 15:29:06 -05:00
Michael Hunhoff
b00cd7378c Merge branch 'master' into rules/20202912 2021-01-07 13:16:13 -07:00
Michael Hunhoff
e721348144 PR change requests 2021-01-07 13:06:35 -07:00
Michael Hunhoff
cab448c6f6 new rules and rule updates from B5F85C26D7AA5A1FB4AF5821B6B5AB9B 2020-12-31 08:44:23 -07:00
0x534a
13a4bf1946 Consolidated setting of registry value with reg.exe command in set-registry-value.yml 2020-12-23 22:42:59 +01:00
Desiree Beck
c5d24c671a added mbc mappings in the host-interaction namespace 2020-12-16 15:30:06 -05:00
William Ballenthin
7b4f4d10fb rules: remove empty ATT&CK/MBC tags, format ATT&CK tags better 2020-06-21 17:54:01 -06:00
William Ballenthin
5f57dbdbc9 rules: reorganize rule names, namespaces, and ATT&CK mappings 2020-06-21 17:25:43 -06:00