mandiant/capa-rules

add rule coverage for SearchPathA/W 9 days ago

good first issue help wanted rule idea

mandiant/capa-rules

726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

dotnet: NetworkInterface.GetIsNetworkAvailable 4 months ago

good first issue rule idea

mandiant/capa-rules

726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

check coverage of anti-profiling techniques used by ConfuserEx .NET obfuscator 4 months ago

good first issue rule idea

mandiant/capa-rules

726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

rule idea: zlib fast inflate 5 months ago

good first issue rule idea

mandiant/capa-rules

726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

check .NET-Anti-Debug coverage 5 months ago

good first issue rule idea

mandiant/capa-rules

726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

Linux kernel rootkit techniques 5 months ago

good first issue help wanted rule idea

mandiant/capa-rules

726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

use word boundaries to reduce FPs when detecting strings using regular expressions 5 months ago

good first issue help wanted false positive

mandiant/capa-rules

726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

Add sc.exe command to the create-service.yml rule 5 months ago

good first issue

mandiant/capa-rules

726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

persist via Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 6 months ago

good first issue help wanted rule idea

mandiant/capa-rules

726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

persist via Windows service 6 months ago

good first issue help wanted false positive

mandiant/capa-rules

726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

dotnet: add coverage for HttpClient class 9 months ago

good first issue help wanted rule idea

mandiant/capa-rules

726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

add ZwTerminateProcess 12 months ago

AI Summary: This GitHub issue proposes adding a new rule to the `capa-rules` repository. The new rule would specifically detect the use of the `ZwTerminateProcess` native API function. This enhancement aims to broaden the `terminate-process.yml` rule set to identify more methods of process termination.

Complexity: 1/5

good first issue help wanted rule idea

mandiant/capa-rules

726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

Open Issues Need Help