Commit graph

Select branches

Hide pull requests

master

Mono Color

• 8e9985c72e restructured yaml master Lakshit Verma 2026-03-09 21:33:49 +05:30
• 2654d5c1bd fix rc4 false negative in #1043 Lakshit Verma 2026-03-09 19:56:07 +05:30
• cd272f5b11
  Merge pull request #1129 from EclipseAditya/fix/escape-plus-in-base64-regex-1101 Moritz 2026-03-04 21:29:39 +01:00
• bd29ed4563 fix: escape + and / in Base64 string regex, add URL-safe variant Aditya Pandey 2026-02-28 22:20:28 +05:30
• 35498e9dae
  Merge pull request #1124 from CosmoWorker/scexe-create Moritz 2026-03-03 08:48:00 +01:00
• 5da642668e
  Add new rule persist-via-shellserviceobjectdelayload-registry-key.yml (#1117) xpzhxhm 2026-02-26 11:44:06 -05:00
• 9609e19ddb
  Powershell expression (#1118) Saniya Fatima 2026-02-24 02:21:19 +05:30
• 19380b704e update create-service to detect sc.exe usage CosmoWorker 2026-02-23 20:10:04 +05:30
• f0292fc977
  feat(targeting): add cloud and container collection/interaction rules (#1098) Maijin 2026-02-24 00:32:32 +08:00
• 2e72aa5536
  Merge pull request #1121 from mandiant/lsc-1771433323.1682847 Moritz 2026-02-19 21:33:18 +01:00
• e91dc056cb Refactor Github Action per b/485167538 Ben Knutson 2026-02-18 16:48:44 +00:00
• 2a55a30478
  Refine Speck detection using variant-specific rotation constants (#1115) Devarjya 2026-02-18 02:48:46 +05:30
• 7f70ec18ff
  Flexible version of send HTTP request (#1110) Saniya Fatima 2026-01-30 23:10:47 +05:30
• 94e855bebc
  Fix: False positive in UDP socket (#1111) Saniya Fatima 2026-01-30 22:34:39 +05:30
• 98c1e9de5a
  Merge pull request #1107 from mandiant/anti-llm-anthropic Moritz 2026-01-28 17:42:47 +00:00
• b6c8ad8175 add terminate-anthropic-session-via-magic-strings Willi Ballenthin 2026-01-28 11:27:44 +01:00
• 8caf489d8c
  Fix false positive in send HTTP request (#1099) Saniya Fatima 2026-01-26 22:10:58 +05:30
• 6a0d506713
  add encrypt-data-using-hc-256 (#1097) Willi Ballenthin 2026-01-06 18:01:44 +01:00
• a4411edeea
  Add RtlRegisterWait API to shellcode exec callback (#1094) Still / Azaka 2025-12-30 02:20:58 +09:00
• 6120dfb6e0
  Add Thread Pool injection techniques (#1087) Still / Azaka 2025-12-05 02:17:27 +09:00
• fb3737b90a
  Loosen AFD driver usage detection (#1086) Still / Azaka 2025-12-04 21:10:46 +09:00
• 3b42582539
  adding/updating rules based on recent samples (#1085) Mike Hunhoff 2025-11-25 13:38:55 -07:00
• b0b486fe0c
  updated broken link (#1045) Moritz 2025-11-12 11:26:26 +01:00
• 7a52b6f9c0
  dotnet: adding new rules based on recent samples (#1082) Mike Hunhoff 2025-11-07 00:39:46 -07:00
• 9e4cc28265
  feat: log keystrokes via rawinput (#1078) Zeze 2025-10-28 23:20:39 +08:00
• 14dcc55c32
  Merge pull request #1079 from zeze-zeze/zeze/feat/DirectInput Zeze 2025-10-28 21:12:07 +08:00
• 7ae786cf70
  Add new rule use-io_uring-io-interface-on-linux.yml (#1080) JJ 2025-10-20 23:27:16 +08:00
• fa246a4a9b
  terminate process with RestartMgr.RmShutdown (#1077) Paul 2025-09-23 16:17:49 -04:00
• 277540ac24
  Add LdrCallEnclave in execute-shellcode-via-windows-callback-function.yml (#1076) JJ 2025-09-10 03:21:58 +08:00
• 1a065e6dea
  Move get-routing-table.yml out of nursery. Add enumerate-tcp-connecti… (#1074) JJ 2025-09-10 03:21:48 +08:00
• 5d990adef2
  Move impersonate user from nursery (#1072) Elad Levi 2025-09-03 16:27:04 +00:00
• 4026d60a48
  Update enumerate-minifilter-drivers.yml (#1075) JJ 2025-09-04 00:08:36 +08:00
• 19d48abd05
  Add rules linked-against-funchook.yml and linked-against-plthook.yml (#1073) JJ 2025-09-04 00:05:13 +08:00
• 13e8622f8a
  Add rule execute-jscript-via-vsaengine-in-dotnet.yml (#1071) JJ 2025-08-26 03:07:56 +08:00
• 35b17b676e
  Merge linking/static/hp-socket/linked-against-hp-socket.yml and nursery/linked-against-hp-socket.yml (#1070) JJ 2025-08-22 22:57:57 +08:00
• 6859d7c688
  Add rule linked-against-hp-socket.yml (#1069) JJ 2025-08-21 22:56:38 +08:00
• 6d6495a16c
  Add linking/static/grpc/linked-against-grpc.yml (#1068) JJ 2025-08-21 22:56:28 +08:00
• 1874535449
  Add disable-powershell-transcription.yml and access-powershell-lockdo… (#1065) JJ 2025-08-21 00:04:29 +08:00
• ebdd6b85d5
  update reference-http-user-agent-string.yml (#1067) Mike Hunhoff 2025-08-14 14:59:09 -06:00
• c783febdc5
  Add linked-against-eclipse-paho-mqtt-c.yml and linked-against-qmqtt.yml (#1066) JJ 2025-08-14 23:11:33 +08:00
• 760c214299
  Update patch-antimalware-scan-interface-function.yml - include additional functions that can be patched (#1064) JJ 2025-08-13 22:39:59 +08:00
• 7a719809d1
  new/updated rules from recent malware samples (#1063) Mike Hunhoff 2025-08-12 10:21:05 -06:00
• c76ef7fb9b
  Add patch-bitdefender-hooking-dll-function.yml rule (#1061) JJ 2025-08-12 23:43:24 +08:00
• b18e5f1046
  Add CAPA rule packed-with-dxpack.yml (#1062) JJ 2025-08-12 23:42:37 +08:00
• 2f09b4d471
  add create executable heap rule (#1058) Moritz 2025-08-04 20:40:42 +02:00
• 47ee3a8777
  Add rule to detect advanced mouse movement analysis references issue … (#1055) Teva JEANDIDIER 2025-06-20 18:16:06 +02:00
• edabdffa8c
  use call scope for get-local-ipv4-addresses (#1052) Mike Hunhoff 2025-06-02 13:16:36 -06:00
• 2676846e77
  tighten subscope for get-local-ipv4-addresses (#1051) Mike Hunhoff 2025-06-02 12:46:52 -06:00
• 834981fcfe
  Unload Sysmon (#1049) Elad Levi 2025-05-28 23:44:20 +03:00
• e6df480758
  add first set of exploit detection rules (#1046) zdw@ 2025-05-22 14:53:30 -04:00
• 61092d21b5
  Unload minifilter drivers (#1047) Elad Levi 2025-05-19 21:21:19 +03:00
• 83fe95befc
  Deleting file content via truncation (#1040) Elad Levi 2025-05-19 21:20:50 +03:00
• ec9e1c5efe
  updated broken link Mustafa Günel 2025-05-06 14:25:43 +03:00
• d64c2c91ea
  add new rules to detect disabling system features via registry on Windows (#1034) Mike Hunhoff 2025-03-24 10:38:19 -06:00
• 7269873b0c
  Add rules for detecting donut-related features (#997) Still / Azaka 2025-03-22 00:15:28 +08:00
• 2800fd34de
  add disable-system-features-via-registry-on-windows (#1033) Mike Hunhoff 2025-03-21 08:39:42 -06:00
• af09ec07d0
  detect usage of TripleDesCryptoServiceProvider (#1021) Tanmay R K 2025-03-20 20:36:27 +05:30
• 9acd31998f
  add APIs to "check mutex on windows" and "create or open mutex on windows" to reduce FNs (#1031) Mike Hunhoff 2025-03-20 09:00:29 -06:00
• 48a553e1ca
  add more APIs to "link function at runtime on Windows" to remove FNs (#1029) Mike Hunhoff 2025-03-19 11:29:07 -06:00
• e85887a875
  fix: escape "." that are not expected to be dot operators (#1028) Mike Hunhoff 2025-03-18 15:01:39 -06:00
• c002c5cd96
  remove FPs from allocate-or-change-rwx-memory.yml (#1027) Mike Hunhoff 2025-03-18 08:01:36 -06:00
• 4e6fc23354
  Update manipulate-boot-configuration.yml (#1026) Elad Levi 2025-03-16 17:15:10 +02:00
• 95bcf669da
  Merge pull request #1024 from mandiant/fix/find-taskbar/fp Moritz 2025-03-15 14:03:37 +01:00
• 86484920a0 reduce scopes to remove _find-taskbar_ fps Mike Hunhoff 2025-03-14 16:11:53 -06:00
• 6697513245
  improve TCP/UDP socket creation matching #964 (#993) Dhruva Kumar Kaushal 2025-03-14 23:15:36 +05:30
• 740d47393e
  Enter debug mode rule (#1022) vibhatsu 2025-03-14 23:11:19 +05:30
• 7437cfeaaf
  Remove EvtOpenLog (#1019) Elad Levi 2025-03-11 17:56:23 +02:00
• 77f06fd049
  Addresses #965: Create separate rules for socket connects (TCP/UDP) (#1017) Hafiz Farhad 2025-03-11 01:38:43 +05:00
• 3bd8cf7646
  Improve Accuracy of Various Detections (#1010) Elad Levi 2025-03-10 22:19:23 +02:00
• 650b491648
  tighten "persist via run registry key" to reduce FPs (#1016) Mike Hunhoff 2025-03-10 13:48:13 -06:00
• 5fb8cee820
  tighten receive-http-request (#1015) Mike Hunhoff 2025-03-05 13:56:15 -07:00
• 6221d9b72b
  add more APIs to remove use-process-replacement FNs (#1009) Mike Hunhoff 2025-02-25 08:59:09 -07:00
• 9c86fbef42
  Clearing Event Log with wevtapi functions (#1006) Elad Levi 2025-02-22 21:41:02 +02:00
• 71dd21d88e
  tighten Windows mutex related rules (#1004) Mike Hunhoff 2025-02-21 12:37:01 -07:00
• 00684bbf4a
  add "change registry key timestamp" (#1003) Willi Ballenthin 2025-02-21 17:29:10 +01:00
• 33ccbf2a64
  Merge pull request #1001 from mandiant/fix/fn/inject-apc Moritz 2025-02-21 13:15:39 +01:00
• b444a585ca additional APIs to remove FNs for inject apc Mike Hunhoff 2025-02-20 15:08:04 -07:00
• 8c62595952
  use "span of calls" scope for registry operations that span multiple calls, e.g. open registry key and set value (#999) Mike Hunhoff 2025-02-20 14:02:16 -07:00
• c0aa922f20
  extend terminate-process.yml to include exit_group #970 (#991) Dhruva Kumar Kaushal 2025-02-05 02:19:39 +05:30
• 1468692195
  https://github.com/mandiant/capa-rules/issues/974 (#992) Dhruva Kumar Kaushal 2025-02-05 02:19:10 +05:30
• 8d5e7e2ac4
  internal-dotnet-file-limitation.yml: make it valid for static scope too (#990) Willi Ballenthin 2025-02-04 21:47:59 +01:00
• 79afc557f1
  remove testing rule (#989) Willi Ballenthin 2025-02-04 10:23:23 +01:00
• cfd394d641
  add dotnet limitation rule for dynamic samples (#983) vibhatsu 2025-02-04 14:53:05 +05:30
• 75c16e4b14
  remove redundant matches for dynamic scope (#987) Mike Hunhoff 2025-02-04 01:32:24 -07:00
• 13b6bc0dfe reverting changes dhruvak001 2025-02-03 23:28:19 +05:30
• fe99a653e8 CI error:scope interchanged dhruvak001 2025-01-31 03:59:33 +05:30
• 0ea3394942 graduate onedrive rule Willi Ballenthin 2025-01-29 11:37:59 +00:00
• 36bf945aee fix scopes from lint errors Willi Ballenthin 2025-01-29 11:36:15 +00:00
• ff76d01d62
  Merge pull request #985 from mandiant/fix/self/delete/fp Moritz 2025-01-29 10:37:21 +01:00
• c1d20764ad
  use "span of calls" scope (#973) Willi Ballenthin 2025-01-29 02:27:13 -07:00
• 0e19c20061 reduce fps for self-delete.yml Mike Hunhoff 2025-01-28 13:45:26 -07:00
• b4e0c8cdf8
  remove duplicate features from some rules (#984) vibhatsu 2025-01-28 17:24:17 +05:30
• 70851020c5
  New rules: RSA & bigint (#982) Ana María Martínez Gómez 2025-01-21 19:36:04 +01:00
• 1aab323239
  Add CONTRIBUTING file & update ISSUE TEMPLATES (#980) Ana María Martínez Gómez 2025-01-15 22:25:29 +01:00
• ff9db74425
  update create-process-suspended to include DEBUG_ONLY_THIS_PROCESS (#978) Mike Hunhoff 2025-01-07 13:02:37 -07:00
• e033410c89
  Add 38 new registry-based persistence techniques (#954) Jorik 2024-12-09 11:29:56 +01:00
• ce5e041006
  Improve existing persistence rules (#953) Jorik 2024-12-09 10:51:47 +01:00
• ed816a8e53
  Add 10 file system-based persistence techniques (#955) Jorik 2024-12-03 17:26:03 +01:00
• 1adcf13e06
  extend rule features and rename (#969) Moritz 2024-12-03 14:12:04 +01:00
• 16492182a3
  Add .NET AoT & TouchSocket linking detection (#948) Still / Azaka 2024-11-28 18:33:53 +08:00