vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
1772 commits 1 branch 0 tags 3.2 MiB
Commit graph

20 commits

Author SHA1 Message Date
Still Hsu
cf3d77f540
Add more callback functions 
Signed-off-by: Still Hsu <dev@stillu.cc>
 2024-05-03 16:23:35 +08:00
mr-tz
784c9dca53 upgrade rules using updated script 2023-11-24 11:34:28 +01:00
mr-tz
66f58dffa0 update match rule name 2023-10-11 11:20:23 +02:00
mr-tz
ed791c9b17 separate allocate and change memory protection 2023-10-11 11:14:14 +02:00
Ervin Ocampo
708b06dd0a
Add capa rule load-code/shellcode/execute-shellcode-via-windows-callback-function.yml (#744) 
* Add capa rule load-code/shellcode/execute-shellcode-via-callback-functions.yml

* Update load-code/shellcode/execute-shellcode-via-callback-functions.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update load-code/shellcode/execute-shellcode-via-callback-functions.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update load-code/shellcode/execute-shellcode-via-callback-functions.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update execute-shellcode-via-callback-functions.yml

Omitted A and W on WinAPI function names since capa handles this automatically.

* Update execute-shellcode-via-callback-functions.yml

Added EnumTimeFormats and deduplicated EnumSystemCodePages

* Update and rename execute-shellcode-via-callback-functions.yml to execute-shellcode-via-windows-callback-function.yml

Renamed file to execute-shellcode-via-windows-callback-function.yml and merged https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml

* Delete execute-shellcode-via-enumuilanguages.yml

Delete rule due to merge with execute-shellcode-via-windows-callback-function.yml

---------

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
 2023-04-19 09:56:15 -06:00
Willi Ballenthin
57e1732f5c
Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors"" 
This reverts commit d43a6ee544.
 2022-06-28 15:23:20 -06:00
Willi Ballenthin
88c9c786ca
*: use meta.authors everywhere 2022-05-26 11:56:31 -06:00
William Ballenthin
d43a6ee544 Revert "Merge pull request #548 from mandiant/feature-remove-flavors" 
This reverts commit bc28847dd9, reversing
changes made to 82308c4109.
 2022-04-27 06:23:36 -06:00
Willi Ballenthin
904bf3ef00
*: remove /x32 and /x64 flavors and use instruction scope 2022-04-05 12:25:14 -06:00
Willi Ballenthin
7b91f0ceee
Merge pull request #514 from jtothej/shellcode-via-copyfile2 
Adding execute-shellcode-via-copyfile2.yml
 2021-12-14 14:51:17 -07:00
Willi Ballenthin
26d216249f
Merge pull request #516 from dzbeck/capa-3-mbc-updates 
update mappings for mbc (part 7)
 2021-12-14 14:45:25 -07:00
Desiree Beck
1294158df2 fix formatting 2021-12-14 16:37:31 -05:00
Desiree Beck
ed3661b379 add mbc and att&ck tags 2021-12-14 16:16:07 -05:00
jtothej
4ea6e93ed9 Adding execute-shellcode-via-copyfile2.yml 2021-12-12 18:19:18 +08:00
jtothej
c0b42ae17d Adding execute-shellcode-via-createthreadpoolwait.yml 2021-12-11 22:07:29 +08:00
Willi Ballenthin
ad56aeb0e0
Merge pull request #505 from jtothej/shellcode-via-enumuilanguages 
Adding execute-shellcode-via-enumuilanguages.yml
 2021-12-06 10:57:12 -07:00
jtothej
ee2bf8a2cd Adding execute-shellcode-via-windows-fibers.yml 2021-12-04 19:51:35 +08:00
jtothej
e431c428f0 Adding execute-shellcode-via-enumuilanguages.yml 2021-12-04 18:46:44 +08:00
Moritz Raabe
25938ca10c change to mandiant.com 2021-09-28 12:21:11 +02:00
Moritz Raabe
d81e757728 adding rules based on more PMA labs 2021-06-30 23:38:17 +02:00