Skip to content

Navigation Menu

Explore
By company size
By use case
By industry
View all solutions
Topics
- AI
- DevOps
- Security
- Software Development
- View all
Explore
- GitHub Sponsors
  Fund open source developers
- The ReadME Project
  GitHub community articles
Repositories
- Enterprise platform
  AI-powered developer platform
Available add-ons
Pricing

Search code, repositories, users, issues, pull requests...

Search

Clear

Search syntax tips

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Saved searches

Use saved searches to filter your results more quickly

Name

Query

To see all available qualifiers, see our documentation.

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

mandiant / capa-rules Public

Notifications You must be signed in to change notification settings
Fork 163
Star 543

Code
Issues 98
Pull requests 6
Discussions
Actions
Wiki
Security
Insights

Additional navigation options

Code
Issues
Pull requests
Discussions
Actions
Wiki
Security
Insights

52 weeks of capa rules #648

Unanswered

mr-tz asked this question in Show and tell

52 weeks of capa rules #648

Jan 3, 2023

· 2 comments

Return to top

Discussion options

mr-tz
Jan 3, 2023
Maintainer

-

Willi

Beta Was this translation helpful? Give feedback.

You must be logged in to vote

All reactions

Replies: 2 comments

Oldest
Newest
Top

Comment options

mr-tz
Jan 3, 2023
Maintainer Author

-

Moritz

01 - 01/02/23 Rules 2023 01 #644
02 - 01/09/23 improve rules that often match #655, Adjusted rules for the ELF BEACON sample shared by Intezer #654
03 - 01/16/23 add stack strings MBC #668, add upper limit for basic block count #661, add library rule and new api #662
04 - 01/23/23 - add stack strings MBC #668, Rules for the week #671
05 - 01/30/23 - LZO compression / decompression rules continued #677
06 - 02/06/23 - add rule: convert IP address #697
07 - 02/13/23 - add HTTP User-Agent rule #702
08 - 02/20/23 - DNS and crypto rule tweaks #713
09 - 02/27/23 - specify offset operand to reduce FPs #716
10 - 03/06/23 - improve debug detection features #721
11 - 03/13/23 - update and add rules #726
12 - 03/20/23 - Update read-clipboard-data.yml #732
13 - 03/27/23 - add rule to detect cx_Freeze compiled binaries #740
14 - 04/03/23 - add AES constant variants #743
15 - 04/10/23 - Update reference-public-rsa-key.yml #745
16 - 04/17/23 - AES MixColumns detection #749
17 - 04/24/23 - loosen locality of features #750
18 - 05/01/23 - Rules based on Practical Malware Analysis Labs #296
19 - 05/08/23 - match on create or open file library rule #758
20 - 05/15/23 - remove very common .rsrc section rule #761
21 - 05/22/23 - Improve clipboard rules #763
22 - 05/29/23 - Add LZ* functions #769
23 - 06/05/23 - add rule enumerate devices by category #773
24 - 06/12/23 - Update CLSID and add two service-related rules #774
25 - 06/19/23 - query service configuration #777
26 - 06/26/23 - Add two imports #780
27 - 07/03/23 - add winmm wave functions #791
28 - 07/10/23 - Update act-as-credential-manager-dll.yml #799
29 - 07/17/23 - Update self-delete.yml #802
30 - 07/24/23 - Create enumerate-device-drivers-on-windows.yml #803
31 - 07/31/23 - Create enumerate-device-drivers-on-linux.yml #804
32 - 08/07/23 - Update .NET JSON detections #813
33 - 08/14/23 - fix example function address #815
34 - 08/21/23 - add send SMS on Android #818
35 - 08/28/23 - add get ntoskrnl base address #822
36 - 09/04/23 - add xxProtectVirtualMemory apis #826
37 - 09/11/23 - Update generate-random-numbers-via-rtlgenrandom.yml #828
38 - 09/18/23 - Create add-value-to-global-atom-table.yml #831
39 - 09/25/23 - Create capture-process-snapshot.yml #833
40 - 10/02/23 - Create log-keystrokes-via-input-method-manager.yml #834
41 - 10/09/23 - Update and refactor memory allocation/permission rules #836
42 - 10/16/23 - Upgrade rules for static and dynamic scopes #837
43 - 10/23/23 - Upgrade rules for static and dynamic scopes #837
44 - 10/30/23 - upgrade rules using updated script #839
45 - 11/06/23 - upgrade rules using updated script #839
46 - 11/13/23 - Update encode-data-using-base64-via-winapi.yml #845
47 - 11/20/23 - upgrade rules using updated script #839
48 - 11/27/23 - upgrade rules using updated script #839
49 - 12/04/23 - fix logic after dynamic update #857
50 - 12/11/23 - Update TLS namespaces #863
51 - 12/18/23 - Use COM instead of bytes features #864
52 - 12/25/23 - Pull out .NET features #866

Beta Was this translation helpful? Give feedback.

You must be logged in to vote

All reactions

0 replies

Comment options

mr-tz
Jan 3, 2023
Maintainer Author

-

Mike

01 - 01/02/23 new + updated .NET rules #639
02 - 01/09/23 52 Weeks of capa Rules - 2 #663
03 - 01/16/23
04 - 01/23/23
05 - 01/30/23 adding rules to detect .NET reflection techniques #690
06 - 02/06/23 adding "packaged as single-file .NET application" #699
07 - 02/13/23 update .NET detections #703
08 - 02/20/23 update recieve-data-on-socket for .NET #707, improve .NET detections incl. sockets, files, directories #708
09 - 02/27/23 improve .NET detections for ZIP compression and OS detection #715
10 - 03/06/23 improve .NET detections for registry access and web proxy usage #723
11 - 03/13/23 update rule documentation and improve .NET detection for OS gather #724
12 - 03/20/23 improve geo collection and .NET data upload detections #738
13 - 03/27/23 improve detections for pipe creation/connection in .NET #739 add new rule to detect .NET files w/ uncommon TLS section #741
14 - 04/03/23
15 - 04/10/23
16 - 04/17/23
17 - 04/24/23
18 - 05/01/23
19 - 05/08/23
20 - 05/15/23
21 - 05/22/23
22 - 05/29/23
23 - 06/05/23
24 - 06/12/23
25 - 06/19/23
26 - 06/26/23
27 - 07/03/23
28 - 07/10/23
29 - 07/17/23
30 - 07/24/23
31 - 07/31/23
32 - 08/07/23
33 - 08/14/23
34 - 08/21/23
35 - 08/28/23 adding new rules based on private Linux sample(s) #821
36 - 09/04/23 init add of Xamarin rules #824
37 - 09/11/23
38 - 09/18/23
39 - 09/25/23
40 - 10/02/23
41 - 10/09/23
42 - 10/16/23
43 - 10/23/23
44 - 10/30/23
45 - 11/06/23
46 - 11/13/23
47 - 11/20/23
48 - 11/27/23
49 - 12/04/23
50 - 12/11/23
51 - 12/18/23
52 - 12/25/23

Beta Was this translation helpful? Give feedback.

You must be logged in to vote

All reactions

0 replies

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Category

Labels

None yet

1 participant

Footer

© 2024 GitHub, Inc.

Footer navigation

Terms
Privacy
Security
Status
Docs
Contact

You can’t perform that action at this time.