vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
1948 commits 1 branch 0 tags 3.2 MiB
Commit graph

64 commits

Author SHA1 Message Date
JJ
19d48abd05
Add rules linked-against-funchook.yml and linked-against-plthook.yml (#1073) 2025-09-03 10:05:13 -06:00
JJ
35b17b676e
Merge linking/static/hp-socket/linked-against-hp-socket.yml and nursery/linked-against-hp-socket.yml (#1070) 2025-08-22 08:57:57 -06:00
JJ
6859d7c688
Add rule linked-against-hp-socket.yml (#1069) 
* Add rule linked-against-hp-socket.yml

* Update linking/static/hp-socket/linked-against-hp-socket.yml
 2025-08-21 08:56:38 -06:00
JJ
6d6495a16c
Add linking/static/grpc/linked-against-grpc.yml (#1068) 
* Add linking/static/grpc/linked-against-grpc.yml

* Update linking/static/grpc/linked-against-grpc.yml
 2025-08-21 08:56:28 -06:00
JJ
c783febdc5
Add linked-against-eclipse-paho-mqtt-c.yml and linked-against-qmqtt.yml (#1066) 
* Add linked-against-eclipse-paho-mqtt-c.yml and linked-against-qmqtt.yml

* Update examples - swapping for much smaller files
 2025-08-14 09:11:33 -06:00
Mike Hunhoff
48a553e1ca
add more APIs to "link function at runtime on Windows" to remove FNs (#1029) 2025-03-19 11:29:07 -06:00
dhruvak001
fe99a653e8 CI error:scope interchanged 2025-02-03 19:55:12 +01:00
Willi Ballenthin
c1d20764ad
use "span of calls" scope (#973) 
* use sequence scope instead of thread scope for "static: function" rules

* use sequence scope instead of thread scope for "static: basic block" rules

* make runtime linking rules more concise

* doc: describe sequence scope

* rename "sequence" scope to "span of calls" scope

* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/get-geographical-location.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/file-managers/gather-classicftp-information.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/database/wmi/reference-wmi-statements.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/database/sql/reference-sql-statements.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

---------

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
 2025-01-29 10:27:13 +01:00
Still / Azaka
16492182a3
Add .NET AoT & TouchSocket linking detection (#948) 
* Add initial two rules

Signed-off-by: Still Hsu <dev@stillu.cc>

* Swap sample for a smaller custom compiled one

Signed-off-by: Still Hsu <dev@stillu.cc>

---------

Signed-off-by: Still Hsu <dev@stillu.cc>
 2024-11-28 11:33:53 +01:00
Matt Williams
60fcf98741
access-peb-ldr_data.yml: reference update 2024-10-15 15:03:46 +00:00
Still / Azaka
1fd0d8e141
Add SysWhispers2 detection & add 0x2e syscall detection (#888) 
* Add SysWhisper2 detection & add int 2e to syscall detection

---------

Signed-off-by: Still Hsu <dev@stillu.cc>
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2024-09-24 13:24:52 +02:00
Willi Ballenthin
5b288a527d add linked against SQLCipher 2024-09-13 07:29:52 +00:00
jtothej
d2d77916d7 Add export features in linking/static/minhook/linked-against-minhook.yml 2024-09-05 18:06:16 +02:00
jtothej
887563556f Add new rule linked-against-minhook.yml 2024-08-11 12:49:06 +02:00
Moritz
e63c454fbb
Merge pull request #908 from mandiant/fix/dependency-scopes 
fix the scope of some rules with dependencies
 2024-06-14 11:01:35 +02:00
mr-tz
0c7d1bdfac remove optional block with LoadLibrary APIs and indirect call 2024-06-14 08:59:18 +00:00
Willi Ballenthin
e6befc9b53 fix the scope of some rules with dependencies 
ref: https://github.com/mandiant/capa/issues/2124
 2024-06-06 09:39:53 +02:00
mr-tz
f344af3327 add android OS where applicable 2024-04-23 13:49:05 +02:00
mr-tz
8a36231025 fix scopes for rules with subscopes 2 2023-11-24 11:35:03 +01:00
mr-tz
e18704545a fix call/thread scopes manually 2023-11-24 11:35:00 +01:00
mr-tz
784c9dca53 upgrade rules using updated script 2023-11-24 11:34:28 +01:00
ryan
6fbf5187e5 Update Mappings for MBC (part 11) 2023-09-27 15:01:03 -04:00
Still / Azaka
037ca83cb3
Improve browser stealer & add SQLite lib detection (#757) 
* Improve regex for existing browser data gathering detection

- Fix erroneous regex capture
+ Add detections for cookies gathering
+ Add generic browser detection (some webkit browser for some reason uses the same chromium-based paths?)

Signed-off-by: Still Hsu <dev@stillu.cc>

* Add rudimentary sqlite db libs detection
- Typically used along with browser data collection

Signed-off-by: Still Hsu <dev@stillu.cc>

---------

Signed-off-by: Still Hsu <dev@stillu.cc>
 2023-08-19 11:36:10 +02:00
JJ
82714cd7d0
Add resolve-function-by-brute-ratel-badger-hash.yml (#793) 
* Add resolve-function-by-brute-ratel-badger-hash.yml
 2023-07-12 12:12:42 +02:00
Still Hsu
80f1993388
Lint rule 
Signed-off-by: Still Hsu <dev@stillu.cc>
 2023-05-10 16:01:15 +08:00
Still Hsu
51a6a65f4a
Add aPLib linking detection 
Signed-off-by: Still Hsu <dev@stillu.cc>
 2023-05-10 15:55:14 +08:00
Mike Hunhoff
e5ae505682
update .NET detections (#703) 2023-02-21 14:38:03 -07:00
Moritz
106123eb61
Rules for the week (#671) 
* add rules

* avoid FPs via mnemonics to ignore

* correct number logic

* add --onefile option strings
 2023-01-27 09:56:12 +01:00
Willi Ballenthin
57e1732f5c
Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors"" 
This reverts commit d43a6ee544.
 2022-06-28 15:23:20 -06:00
Willi Ballenthin
88c9c786ca
*: use meta.authors everywhere 2022-05-26 11:56:31 -06:00
William Ballenthin
d43a6ee544 Revert "Merge pull request #548 from mandiant/feature-remove-flavors" 
This reverts commit bc28847dd9, reversing
changes made to 82308c4109.
 2022-04-27 06:23:36 -06:00
Willi Ballenthin
904bf3ef00
*: remove /x32 and /x64 flavors and use instruction scope 2022-04-05 12:25:14 -06:00
jtothej
80c6804ec1 Add linked-against-wolfssl.yml and linked-against-wolfcrypt.yml 2021-12-03 15:44:58 +08:00
Ryan Xu
5b3c56ae44
Update linking/runtime-linking/resolve-function-by-fin8-fasthash.yml 
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
 2021-11-24 11:52:41 -05:00
Ryan Xu
607a06e184 Adding changes suggested by Mandiant 2021-11-23 09:01:53 -05:00
Desiree Beck
e190179ffd
Merge pull request #1 from MBCProject/ryan-patches1 
Update patch-process-command-line.yml
 2021-11-22 11:27:15 -05:00
Moritz Raabe
25938ca10c change to mandiant.com 2021-09-28 12:21:11 +02:00
Ryan Xu
0114138ae4 More detailed mappings 2021-08-31 11:34:09 -05:00
William Ballenthin
ea3ea14c22 minor reorg linux rules and logic 
ref #442
 2021-08-25 15:31:51 -06:00
Willi Ballenthin
6f582bd395
Merge pull request #442 from TcM1911/linux-rules 
A set of rules for Linux ELFs
 2021-08-25 14:33:25 -06:00
William Ballenthin
0ef69c4fbd *: use substring features rather than unreadable regexes 
closes #450
 2021-08-24 12:47:26 -06:00
Ryan Xu
b4e040dc50 preliminary mapping 2021-08-23 14:11:00 -05:00
Joakim Kennedy
78fbf5f3c5 Fix linting errors 2021-08-05 15:35:27 +01:00
Joakim Kennedy
765e182553 A set of rules for Linux ELFs 2021-08-04 15:47:00 +01:00
Michael Hunhoff
64c8746098 adding additional detection strings to linked-against-openssl.yml 2021-07-28 15:00:29 -06:00
William Ballenthin
6e501e8151 rules: convert inline comments to descriptions 
closes #1
 2021-05-18 10:45:41 -06:00
Moritz Raabe
aedf47d971 remove unneeded or, fix offset 2021-04-09 11:24:48 +02:00
Moritz Raabe
30db0cddb8 add rules from fboldewin 
Co-authored-by: Frank Boldewin <frank.boldewin@gmx.de>
 2021-04-09 11:24:47 +02:00
Michael Hunhoff
20e1b8fd4c enforce string formatting with double quotes + escaped special characters 2021-03-24 14:14:38 -06:00
Moritz Raabe
387334a603 reformated using capafmt 2021-01-27 15:30:59 +01:00