vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-03 20:07:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
722 commits 1 branch 0 tags 3.2 MiB
Commit graph

722 commits

This branch
This branch
All branches
Author SHA1 Message Date
William Ballenthin
cdc286d253 add driver/disable-driver-code-integrity 2021-05-01 10:08:00 -06:00
William Ballenthin
ccab1ab5b4 add bootloader/manipulate-boot-configuration 2021-05-01 10:07:42 -06:00
William Ballenthin
b6b9407f62 add bootloader/disable-code-signing 2021-05-01 10:07:27 -06:00
William Ballenthin
e139b36c2e appinit: add reference to enable/disable reg key 2021-05-01 10:05:54 -06:00
Willi Ballenthin
9ef1f7e62d
Merge pull request #340 from fireeye/mr-tz-patch-1 
Update terminate-process.yml
 2021-04-27 09:02:10 -06:00
Moritz
62f28b55fe
Update terminate-process.yml 2021-04-27 08:19:05 +02:00
Capa Bot
4b61a49aa3 Update rules number badge 2021-04-26 16:20:17 +00:00
Willi Ballenthin
dc14661e99
Merge pull request #337 from re-fox/master 
Stealer rules targeting file-manager software
 2021-04-26 10:20:02 -06:00
Capa Bot
c99f610279 Update rules number badge 2021-04-26 16:18:06 +00:00
Willi Ballenthin
7c2c2e1821
Merge pull request #338 from recvfrom/master 
Add rules from Egregor ransomware DLL
 2021-04-26 10:17:50 -06:00
Andrew
8a513b280b Add rules from Egregor ransomware DLL 2021-04-26 11:56:25 -04:00
re-fox
a3899f67dc
Update gather-cuteftp-information.yml 2021-04-26 10:11:20 -04:00
re-fox
790e13a874
Update gather-alftp-information.yml 2021-04-26 10:08:53 -04:00
Moritz
f3ccebcd91
Merge pull request #339 from Ana06/fix-vm 
Fix execute anti-VM instructions
 2021-04-26 14:25:52 +02:00
Ana Maria Martinez Gomez
a429ae8eda
Fix execute anti-VM instructions 
Fix typo: `s/sdit/sidt`
 2021-04-26 12:30:27 +02:00
Capa Bot
db65accbf3 Update rules number badge 2021-04-23 22:49:56 +00:00
Willi Ballenthin
26678b12d4
Merge pull request #333 from gormaniac/new/amber 
New rules related to the amber packer
 2021-04-23 16:49:44 -06:00
re-fox
9578fdc684
Add files via upload 2021-04-23 11:14:27 -04:00
re-fox
3d03714f5d
Create gather-3d-ftp-information.yml 2021-04-23 11:13:43 -04:00
gormaniac
7295de56a3
Update anti-analysis/packer/amber/packed-with-amber.yml 
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
 2021-04-23 09:09:11 -06:00
John Gorman
8a97d4141e Fix formatting for packed-with-amber.yml 2021-04-22 11:13:20 -06:00
John Gorman
0b4d620da8 remove load-code/pe/potential-shellcode-loader.yml 2021-04-22 11:12:27 -06:00
John Gorman
8be4d14348 Fix namespace in potential-shellcode-loader.yml 2021-04-22 10:35:22 -06:00
John Gorman
1f06f9748c New rules related to amber packer 2021-04-22 10:33:54 -06:00
Ana Maria Martinez Gomez
f81a35263f
github: Add tag to rule idea issue template 
Add automatically the tag as we do in the other issues templates.
 2021-04-16 16:18:11 +02:00
Willi Ballenthin
b21ca8d120
embedded pe: via strings 
closes #319
 2021-04-14 12:34:57 -06:00
Moritz
faefbdbacd
Merge pull request #317 from fireeye/fix-att-mbc-mappings 
update ATT&CK and MBC mappings
 2021-04-14 08:22:57 +02:00
William Ballenthin
0f28d4a763 capafmt 2021-04-13 09:49:02 -06:00
William Ballenthin
f1b450edf0 update ATT&CK and MBC mappings 
thanks to Regina Elwell @ FireEye and @evandrix
closes #316
 2021-04-13 09:37:10 -06:00
Capa Bot
d64f520623 Update rules number badge 2021-04-09 11:19:23 +00:00
Moritz
1ef0730f7b
Merge pull request #313 from fireeye/add-rules-fboldewin 
add rules from fboldewin
 2021-04-09 13:19:10 +02:00
Moritz Raabe
aedf47d971 remove unneeded or, fix offset 2021-04-09 11:24:48 +02:00
Moritz Raabe
8cde760ec4 graduate EC rule 2021-04-09 11:24:47 +02:00
Moritz Raabe
30db0cddb8 add rules from fboldewin 
Co-authored-by: Frank Boldewin <frank.boldewin@gmx.de>
 2021-04-09 11:24:47 +02:00
Moritz
dcf31b54c0
Merge pull request #315 from Ana06/python3 
ci: run tests with Python3
 2021-04-09 11:20:25 +02:00
Ana Maria Martinez Gomez
6b21508760
ci: run tests with Python3 
Capa master doesn't support Python 2 anymore. Update the test.yml
workflow to use Python 3 to run the rule linter.
 2021-04-09 10:53:17 +02:00
Capa Bot
93ea28dd32 Update rules number badge 2021-04-01 16:44:39 +00:00
Willi Ballenthin
941de77335
Merge pull request #312 from dandonov/master 
Adding an initial rule for detecting Curve25519 algorithms
 2021-04-01 10:44:23 -06:00
dandonov
31d479061a
Update nursery/encrypt-data-using-curve25519.yml 
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
 2021-04-01 12:40:27 -04:00
dandonov
85566e7699
Update nursery/encrypt-data-using-curve25519.yml 
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
 2021-04-01 12:34:24 -04:00
dandonov
3c22d8669b
Update nursery/encrypt-data-using-curve25519.yml 
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
 2021-04-01 12:34:11 -04:00
Dimiter Andonov
b5a9d88943 Adding an initial rule for detecting Curve25519 algorithms 2021-03-31 20:55:31 -04:00
Capa Bot
55c914a5db Update rules number badge 2021-03-29 16:24:58 +00:00
Ana María Martínez Gómez
7c77da3204
Merge pull request #308 from Ana06/reflective-dll-injection 2021-03-29 18:24:40 +02:00
Ana Maria Martinez Gomez
e0cefa438d
update translate-characteristic-into-permission.yml 
- rename it to `inspect section memory permissions` and add a
description so it is clear what it is meant.
- use the `3 or more` feature to improve the rule. Note that `optional`
doesn't behave as you may expect for this feature. Use `and` to ensure
`optional` behaves as we want.
 2021-03-29 11:04:42 +02:00
Capa Bot
5448a5c3e1 Update rules number badge 2021-03-26 11:17:25 +00:00
johnk3r
af177de173
Create offline-registry-manipulation.yml (#287) 
* Create offline-registry-manipulation.yml

https://github.com/fireeye/capa-rules/issues/211

* Update offline-registry-manipulation.yml

* Update offline-registry-manipulation.yml

* Delete offline-registry-manipulation.yml

* Add files via upload

* Update and rename offline-create-registry.yml to create-registry-key-via-offline-registry-library.yml

* Update and rename offline-open-registry to open-registry-key-via-offline-registry-library.yml

* Update and rename offline-query-registry to query-registry-key-via-offline-registry-library.yml

* Update and rename offline-set-registry.yml to set-registry-key-via-offline-registry-library.yml

* Update create-registry-key-via-offline-registry-library.yml

* Update open-registry-key-via-offline-registry-library.yml

* Update query-registry-key-via-offline-registry-library.yml

* Update set-registry-key-via-offline-registry-library.yml

* Create delete-registry-key-via-offline-registry-library.yml

* Add files via upload

* Delete delete-registry-key-via-offline-registry-library.yml

* Add files via upload

* Delete create-registry-key-via-offline-registry-library.yml

* Delete open-registry-key-via-offline-registry-library.yml

* Delete query-registry-key-via-offline-registry-library.yml

* Delete set-registry-key-via-offline-registry-library.yml

* Add files via upload
 2021-03-26 12:17:08 +01:00
Capa Bot
f56616f0f9 Update rules number badge 2021-03-25 20:48:22 +00:00
mike-hunhoff
f6c6ff286c
Merge pull request #311 from fireeye/rules/20210325 
updating rules + new rules
 2021-03-25 14:48:08 -06:00
mike-hunhoff
02298378eb
Rename query-remote-server-for-availible-data.yml to query-remote-server-for-available-data.yml 2021-03-25 14:44:51 -06:00