Mike Hunhoff
6221d9b72b
add more APIs to remove use-process-replacement FNs ( #1009 )
2025-02-25 08:59:09 -07:00
Mike Hunhoff
75c16e4b14
remove redundant matches for dynamic scope ( #987 )
...
* remove redundant matches for dynamic scope
* fix lints
* fix lints
* tighten scopes
2025-02-04 09:32:24 +01:00
Willi Ballenthin
36bf945aee
fix scopes from lint errors
...
ref https://github.com/mandiant/capa/pull/2579
2025-01-29 18:54:25 +01:00
Willi Ballenthin
c1d20764ad
use "span of calls" scope ( #973 )
...
* use sequence scope instead of thread scope for "static: function" rules
* use sequence scope instead of thread scope for "static: basic block" rules
* make runtime linking rules more concise
* doc: describe sequence scope
* rename "sequence" scope to "span of calls" scope
* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/get-geographical-location.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/file-managers/gather-classicftp-information.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/wmi/reference-wmi-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/sql/reference-sql-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
---------
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
2025-01-29 10:27:13 +01:00
Mike Hunhoff
5b8c8a63a2
update linux/android rules and reduce fps for intel-specific rules ( #927 )
...
* android: add / update rules
* intel: match intel archs to avoid fps on others
2024-08-16 12:57:08 -06:00
mr-tz
f344af3327
add android OS where applicable
2024-04-23 13:49:05 +02:00
Yacine
d19f7122ac
Fix the dynamic flavor scope for allocate-or-change-rw-memory.yml ( #860 )
...
* lib/allocate-or-change-rw-memory.yml: set `meta.scopes.dynamic` to `call` in order to enforce the rule's call locality
* lib/change-memory-protection.yml: set `meta.scopes.dynamic` to `call`
* lib/allocate-memory.yml: set `meta.scopes.dynamic` to `call`
2023-12-11 09:06:39 -07:00
mr-tz
92ddcf4de3
reorder meta fields
2023-11-29 16:22:52 +01:00
mr-tz
bebddeae1e
update scopes
2023-11-29 14:38:14 +01:00
mr-tz
e6f11c2913
Merge branch 'master' into dynamic-rules-mr-2
2023-11-29 14:34:07 +01:00
JJ
fa61e110ad
Update and add Cabinet archive related rules ( #808 )
...
* Update and add Cabinet archive related rules
2023-11-29 14:27:45 +01:00
mr-tz
2d3be8ec38
fix some dynamic unsupported rules
2023-11-24 11:35:05 +01:00
mr-tz
8a36231025
fix scopes for rules with subscopes 2
2023-11-24 11:35:03 +01:00
mr-tz
e18704545a
fix call/thread scopes manually
2023-11-24 11:35:00 +01:00
mr-tz
784c9dca53
upgrade rules using updated script
2023-11-24 11:34:28 +01:00
Moritz
b778d25292
Update allocate-memory.yml
2023-10-11 12:08:01 +02:00
Moritz
a39a2c0b52
Merge branch 'master' into update-alloc-rules
2023-10-11 12:03:42 +02:00
mr-tz
1be6720131
add runtime resolved functions
2023-10-11 11:54:50 +02:00
mr-tz
7ddf609ebc
update example
2023-10-11 11:33:20 +02:00
mr-tz
5f223ea5ce
rename rules
2023-10-11 11:17:13 +02:00
mr-tz
ed791c9b17
separate allocate and change memory protection
2023-10-11 11:14:14 +02:00
Moritz
f971df9ab2
Update allocate-memory.yml
2023-09-09 19:22:13 +02:00
jtothej
dfdd5d8fc0
Update get-os-version.yml
2023-07-22 19:33:09 +08:00
mr-tz
83d4e3bc02
add import
2023-07-02 16:23:04 +02:00
mr-tz
a8e9c6cfd0
add LZ* functions
2023-06-04 12:16:30 +02:00
Willi Ballenthin
5941a484b5
add section access/map rules ( #681 )
...
* add section access/map rules
closes #4
---------
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
2023-02-02 09:11:46 +01:00
mr-tz
5914e4a4ac
add library rule and new api
2023-01-13 12:31:03 +01:00
Moritz
3e8792dcfd
Adjusted rules for the ELF BEACON sample shared by Intezer ( #654 )
...
* Created rules for the ELF BEACON sample shared by Intezer
* removing rule that sometimes hits and sometimes doesn't
Co-authored-by: Alyssa Rahman <alyssa.rahman@mandiant.com>
2023-01-09 14:37:51 +01:00
Moritz
b48fcd5dd8
improve rules that often match ( #655 )
...
* improve rules that often match
2023-01-09 14:07:53 +01:00
Willi Ballenthin
57e1732f5c
Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""
...
This reverts commit d43a6ee544
2022-06-28 15:23:20 -06:00
Willi Ballenthin
88c9c786ca
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
William Ballenthin
d43a6ee544
Revert "Merge pull request #548 from mandiant/feature-remove-flavors"
...
This reverts commit bc28847dd982308c4109
2022-04-27 06:23:36 -06:00
Willi Ballenthin
ccf3f8fb5f
luhn no lookup table: cleanup logic
2022-04-05 17:15:22 -06:00
Willi Ballenthin
904bf3ef00
*: remove /x32 and /x64 flavors and use instruction scope
2022-04-05 12:25:14 -06:00
Ryan Xu
c80f59be8e
Update lib/open-thread.yml
...
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
2021-11-24 11:53:05 -05:00
Desiree Beck
e190179ffd
Merge pull request #1 from MBCProject/ryan-patches1
...
Update patch-process-command-line.yml
2021-11-22 11:27:15 -05:00
Moritz Raabe
25938ca10c
change to mandiant.com
2021-09-28 12:21:11 +02:00
Ryan Xu
0114138ae4
More detailed mappings
2021-08-31 11:34:09 -05:00
William Ballenthin
ea3ea14c22
minor reorg linux rules and logic
...
ref #442
2021-08-25 15:31:51 -06:00
Ryan Xu
b4e040dc50
preliminary mapping
2021-08-23 14:11:00 -05:00
Joakim Kennedy
78fbf5f3c5
Fix linting errors
2021-08-05 15:35:27 +01:00
Joakim Kennedy
765e182553
A set of rules for Linux ELFs
2021-08-04 15:47:00 +01:00
William Ballenthin
4d96b6986c
graduate "get service handle"
2021-06-08 10:18:07 -06:00
re-fox
1fd04d639f
Update validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml
2021-03-03 22:19:45 -05:00
Michael Hunhoff
750e164a41
removing ntdll requirement from function features exported by both ntdll and ntoskrnl
2021-02-16 18:28:05 -07:00
Moritz Raabe
7ee2c63e83
capafmted rules
2021-01-28 17:26:25 +01:00
0x534a
29fbeec36a
Adjusts test file of hijack-thread-execution.yml, resolves conflict in inject-thread.yml and removes articles from rules
2021-01-28 15:28:53 +01:00
0x534a
8c93d205a8
Improve injection detection and some refactoring of existing rules
2021-01-28 14:47:31 +01:00
Moritz Raabe
387334a603
reformated using capafmt
2021-01-27 15:30:59 +01:00
Desiree Beck
9037d901be
mappings for lib namespace
2021-01-21 15:27:59 -05:00
