Mike Hunhoff
|
dda76eadde
|
new/update rules using .NET ctor method (#626)
|
2022-10-13 08:36:31 -06:00 |
|
Capa Bot
|
019c246827
|
Update rules number badge
|
2022-10-07 15:40:11 +00:00 |
|
Mike Hunhoff
|
96a1abddca
|
new/update .NET rules (#625)
|
2022-10-07 09:39:57 -06:00 |
|
Capa Bot
|
8778004e7a
|
Update rules number badge
|
2022-10-03 15:28:18 +00:00 |
|
Anushka Virgaonkar
|
1fbee15a3c
|
Add dotnet rules having property features (#601)
|
2022-10-03 09:28:05 -06:00 |
|
Moritz
|
5611296a1f
|
ci: only check latest release compat with vX branch (#621)
|
2022-10-03 09:16:23 -06:00 |
|
David Cannings
|
e1301b25c7
|
Improve UAC bypass rule based on sample in the wild (#616)
* Improve UAC bypass rule based on sample in the wild
* Run capafmt to pass lint
|
2022-09-09 13:20:41 +02:00 |
|
Moritz
|
28947d9f9d
|
Merge pull request #619 from ryantxu1/master
Update Mappings for MBC (part 9)
|
2022-09-09 13:19:30 +02:00 |
|
Moritz
|
c349be6668
|
Merge pull request #618 from mandiant/fix/crc32
Improve CRC32
|
2022-09-08 10:42:19 +02:00 |
|
Moritz Raabe
|
d2d3fd30ab
|
handle more cases
closes #617
|
2022-09-05 17:58:35 +02:00 |
|
ryan
|
86f8ac6ccd
|
Update Mappings for MBC (part 9)
|
2022-08-30 09:15:15 -04:00 |
|
Capa Bot
|
d65bb1ebd6
|
Update rules number badge
|
2022-08-29 16:49:54 +00:00 |
|
johnk3r
|
3f298900d4
|
use .NET libraries (#612)
* Add files via upload
https://github.com/mandiant/capa-rules/issues/609
* Update load-suspicious-libraries.yml
* Delete load-suspicious-libraries.yml
* Create load-suspicious-libraries.yml
* Update load-suspicious-libraries.yml
* Update load-suspicious-libraries.yml
* embed dependencies as resources using Fody/Costura
https://github.com/mandiant/capa-rules/pull/612
* Delete embed-dependencies-as-resources-using-fody-costura.yml
* embed-dependencies-as-resources-using-fody-costura
https://github.com/mandiant/capa-rules/pull/612
* Rename embed-dependencies-as-resources-using-fody-costura.yml to embed-dependencies-as-resources-using-fodycostura.yml
* use-dotnet-library-encryptdecryptutils
https://github.com/mandiant/capa-rules/pull/612
* use-dotnet-library-newtonsoft.json
https://github.com/mandiant/capa-rules/pull/612
* use-dotnet-library-sharpclipboard
https://github.com/mandiant/capa-rules/pull/612
* use-dotnet-library-sharpvectors
https://github.com/mandiant/capa-rules/pull/612
* Delete load-suspicious-libraries.yml
* Rename use-dotnet-library-newtonsoft.json.yml to use-dotnet-library-newtonsoftjson.yml
* Update use-dotnet-library-newtonsoftjson.yml
* Update use-dotnet-library-sharpvectors.yml
* Update use-dotnet-library-encryptdecryptutils.yml
* Update use-dotnet-library-sharpclipboard.yml
* Rename anti-analysis/obfuscation/use-dotnet-library-encryptdecryptutils.yml to data-manipulation/encryption/aes/use-dotnet-library-encryptdecryptutils.yml
* Rename nursery/use-dotnet-library-newtonsoftjson.yml to data-manipulation/json/use-dotnet-library-newtonsoftjson.yml
* Rename nursery/use-dotnet-library-sharpvectors.yml to data-manipulation/svg/use-dotnet-library-sharpvectors.yml
* Update use-dotnet-library-sharpclipboard.yml
* Update use-dotnet-library-newtonsoftjson.yml
* Update use-dotnet-library-sharpvectors.yml
* Update use-dotnet-library-encryptdecryptutils.yml
* Update use-dotnet-library-newtonsoftjson.yml
* Update use-dotnet-library-sharpvectors.yml
* Update use-dotnet-library-encryptdecryptutils.yml
* Update embed-dependencies-as-resources-using-fodycostura.yml
* Update use-dotnet-library-encryptdecryptutils.yml
* Update use-dotnet-library-sharpvectors.yml
* Update use-dotnet-library-newtonsoftjson.yml
* Update use-dotnet-library-sharpclipboard.yml
|
2022-08-29 18:49:40 +02:00 |
|
MalwareMechanic
|
ffdb07ca8c
|
add additional MITRE ATT&CK and MBC mappings (#611)
|
2022-08-18 08:19:37 -06:00 |
|
Capa Bot
|
506e3132bc
|
Update rules number badge
|
2022-08-15 08:39:34 +00:00 |
|
Moritz
|
759c740c49
|
Merge pull request #608 from jtothej/vsobfuscation
Adding obfuscated-with-vs-obfuscation.yml
|
2022-08-15 10:38:43 +02:00 |
|
jtothej
|
f7faca3287
|
Adding obfuscated-with-vs-obfuscation.yml
|
2022-08-13 14:29:20 +02:00 |
|
Moritz
|
7e250d27f9
|
Merge pull request #607 from mandiant/fix/606
rules: fix invalid rule metadata
|
2022-08-12 11:29:23 +02:00 |
|
Mike Hunhoff
|
ac4a9edb3b
|
rules: fix invalid rule metadata
|
2022-08-11 16:12:49 -06:00 |
|
Capa Bot
|
ad4da12d90
|
Update rules number badge
|
2022-08-09 10:50:30 +00:00 |
|
Moritz
|
84e8b73492
|
Merge pull request #600 from jtothej/httpsrv
Updated start-http-server.yml with .Net API
|
2022-08-09 12:37:40 +02:00 |
|
Moritz
|
59d3949bb4
|
Merge pull request #599 from jtothej/ps2exe
Updated compiled-with-ps2exe.yml to match on files build using recent…
|
2022-08-09 12:36:28 +02:00 |
|
Moritz
|
a2a6c3dd88
|
Merge pull request #598 from jtothej/dotnetobf
Adding .Net obfuscation rules.
|
2022-08-09 12:36:02 +02:00 |
|
Capa Bot
|
c7671df924
|
Update rules number badge
|
2022-08-09 10:35:11 +00:00 |
|
Moritz
|
6a64ffb102
|
Merge pull request #597 from jtothej/auth
Add act-as-credential-manager-dll.yml and act-as-password-filter-dll.yml
|
2022-08-09 12:34:57 +02:00 |
|
jtothej
|
d5b014127e
|
Updated start-http-server.yml with .Net API
|
2022-07-27 11:19:25 +02:00 |
|
jtothej
|
f75b401014
|
Updated compiled-with-ps2exe.yml to match on files build using recent versions of ps2exe available @ https://github.com/MScholtes/PS2EXE
|
2022-07-26 13:46:23 +02:00 |
|
jtothej
|
af900ae93b
|
Adding .Net obfuscation rules.
|
2022-07-26 11:33:01 +02:00 |
|
jtothej
|
0b64b6e89b
|
Add act-as-credential-manager-dll.yml and act-as-password-filter-dll.yml
|
2022-07-25 17:21:23 +02:00 |
|
Moritz
|
e88db21de4
|
fix: rule logic (#592)
* fix: rule logic
* fix: rule logic
|
2022-07-12 18:09:51 +02:00 |
|
Capa Bot
|
9d74812a5f
|
Update rules number badge
|
2022-07-07 21:24:21 +00:00 |
|
re-fox
|
e09ddd6242
|
Create hash-data-using-rshash.yml (#589)
|
2022-07-07 15:24:08 -06:00 |
|
Anushka Virgaonkar
|
dcc2e74c84
|
Update with dotnet capabilities (#590)
|
2022-07-07 15:22:39 -06:00 |
|
Capa Bot
|
cd3d7d81b7
|
Update rules number badge
|
2022-07-07 19:40:27 +00:00 |
|
Anushka Virgaonkar
|
95dc5eb27f
|
Add new dotnet rules that capture capabilites typically found in backdoors. (#579)
|
2022-07-07 13:39:51 -06:00 |
|
Capa Bot
|
de6dbc9aa6
|
Update rules number badge
|
2022-07-07 17:38:02 +00:00 |
|
Willi Ballenthin
|
4f72756346
|
Merge pull request #588 from re-fox/master
Create hash-data-using-jshash.yml
|
2022-07-07 11:37:50 -06:00 |
|
re-fox
|
c75b11c5b6
|
Create hash-data-using-jshash.yml
|
2022-07-07 10:36:06 -04:00 |
|
Capa Bot
|
14953f80c1
|
Update rules number badge
|
2022-07-06 19:36:11 +00:00 |
|
re-fox
|
52b0a9a152
|
Create hash-data-using-aphash.yml (#587)
* Create hash-data-using-aphash.yar
* Rename hash-data-using-aphash.yar to hash-data-using-aphash.yml
|
2022-07-06 21:35:56 +02:00 |
|
Capa Bot
|
c4ca94dd32
|
Update rules number badge
|
2022-07-05 15:36:57 +00:00 |
|
Moritz
|
9524b011f6
|
Merge pull request #586 from mandiant/new/20220418
add power-down-monitor.yml, update read-process-memory.yml
|
2022-07-05 17:36:37 +02:00 |
|
Michael Hunhoff
|
59b881c006
|
add power-down-monitor.yml, update read-process-memory.yml
|
2022-07-05 08:44:29 -06:00 |
|
Moritz
|
020a0763af
|
Update get-installed-programs.yml (#584)
|
2022-07-05 09:52:52 +02:00 |
|
Moritz
|
489068bb96
|
ci: lint thorough on PR text (#581)
* ci: lint thorough on PR text
* ci: document thorough lint option
|
2022-07-05 09:09:05 +02:00 |
|
Willi Ballenthin
|
c669a778ab
|
Merge pull request #582 from re-fox/master
Graduate get-installed-programs.yml
|
2022-07-01 10:15:31 -06:00 |
|
re-fox
|
4383e9aa5b
|
Graduate get-installed-programs.yml
|
2022-07-01 11:14:28 -04:00 |
|
Willi Ballenthin
|
1bdaa1123f
|
Merge pull request #580 from mandiant/mr-tz-patch-1
Update format.md
|
2022-07-01 08:49:57 -06:00 |
|
Moritz
|
2b33378f9e
|
Update format.md
|
2022-07-01 12:17:24 +02:00 |
|
Capa Bot
|
13a765ce4e
|
Update rules number badge
|
2022-06-30 15:17:09 +00:00 |
|