Skip to content

Issues: mandiant/capa-rules

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

101 Open 229 Closed
101 Open 229 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Assignee
Filter by who’s assigned
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Issues list

Review rules for sequence scope adjustments
#975 opened Dec 18, 2024 by mr-tz
7 tasks
extend "check for sandbox username or hostname" good first issue Good for newcomers rule idea
#974 opened Dec 17, 2024 by mike-hunhoff
detect socks5 proxy capabilities good first issue Good for newcomers rule idea
#971 opened Dec 6, 2024 by mike-hunhoff
extend terminate-process.yml to include exit_group good first issue Good for newcomers rule idea
#970 opened Dec 4, 2024 by mike-hunhoff
derive capa rules from yara-rules capabilities rule idea
#968 opened Nov 25, 2024 by williballenthin
detect BITS usage in general good first issue Good for newcomers rule idea
#967 opened Nov 25, 2024 by mr-tz
create separate rule to match socket connects good first issue Good for newcomers rule idea
#965 opened Nov 20, 2024 by mike-hunhoff
improve TCP/UDP socket creation matching good first issue Good for newcomers rule idea
#964 opened Nov 20, 2024 by mike-hunhoff
RSA & bigint rule idea
#962 opened Nov 15, 2024 by Ana06
@Ana06
1
dotnet: create new scheduled task via TaskService good first issue Good for newcomers rule idea
#959 opened Nov 7, 2024 by mike-hunhoff
dotnet: Process.EnterDebugMode good first issue Good for newcomers rule idea
#958 opened Nov 5, 2024 by mike-hunhoff
dotnet: TripleDESCryptoServiceProvider Class good first issue Good for newcomers rule idea
#957 opened Nov 5, 2024 by mike-hunhoff
access PEB ldr_data false positive False positive rule hit
#946 opened Oct 21, 2024 by mr-tz
reconsider att&ck classification for get/set-uefi-variable.yml att&ck false positive False positive rule hit
#944 opened Oct 7, 2024 by mike-hunhoff
graduate upload file to onedrive rule
#943 opened Oct 4, 2024 by mr-tz
reference anti-VM strings targeting VirtualBox false positive False positive rule hit
#934 opened Sep 24, 2024 by mr-tz
delay execution: add Beep WinAPI rule idea
#915 opened Jul 26, 2024 by fariss
rule idea: modify PendingFileRenameOperations to delete, rename, or move file across reboots rule idea
#911 opened Jul 11, 2024 by mike-hunhoff
Create new rule with LoadLibrary, etc. APIs
#909 opened Jun 14, 2024 by mr-tz
Rules to find interesting code rule idea
#898 opened May 16, 2024 by mr-tz
parse-credit-card-information -> mimikatz.exe_:0x444E02 false positive False positive rule hit
#897 opened May 3, 2024 by mike-hunhoff
[obfuscated-with-litcrypt] rule idea
#889 opened Mar 23, 2024 by lulzc
Support ATT&CK v14.1 Techniques
#887 opened Mar 6, 2024 by mr-tz
7 tasks
3
find/reference Explorer window rule idea
#881 opened Feb 13, 2024 by mr-tz
TLS client via OpenSSL rule idea
#880 opened Feb 7, 2024 by williballenthin
ProTip! Adding no:label will show everything without a label.