Releases: mandiant/capa-rules
Releases · mandiant/capa-rules
v6.0.0
Summary
Added: 32 rules
Modified: 22 rules
Renamed: 3 rules
Deleted: 3 rules
Detailed release changes: rules v5.1.0...v6.0.0
Added rules (32)
- anti-analysis/anti-av/patch-event-tracing-for-windows-function.yml
- anti-analysis/anti-vm/vm-detection/detect-vm-via-disk-hardware-wmi-queries.yml
- anti-analysis/anti-vm/vm-detection/detect-vm-via-motherboard-hardware-wmi-queries.yml
- communication/mailslot/read-from-mailslot.yml
- communication/socket/create-vmci-socket.yml
- compiler/cx_freeze/compiled-with-cx_freeze.yml
- data-manipulation/encryption/aes/encrypt-data-using-aes-mixcolumns-step.yml
- host-interaction/file-system/create-virtual-file-system-in-dotnet.yml
- host-interaction/filter/enumerate-minifilter-drivers.yml
- host-interaction/gui/switch-active-desktop.yml
- host-interaction/hardware/enumerate-devices-by-category.yml
- host-interaction/memory/create-new-application-domain-in-dotnet.yml
- host-interaction/process/inject/inject-shellcode-using-extra-window-memory.yml
- host-interaction/process/inject/inject-shellcode-using-window-subclass-procedure.yml
- host-interaction/service/continue-service.yml
- host-interaction/service/pause-service.yml
- host-interaction/service/query-service-configuration.yml
- linking/runtime-linking/resolve-function-by-brute-ratel-badger-hash.yml
- linking/static/aplib/linked-against-aplib.yml
- load-code/shellcode/execute-shellcode-via-windows-callback-function.yml
- nursery/check-for-sandbox-via-mac-address-ouis-in-dotnet.yml
- nursery/compiled-with-exescript.yml
- nursery/covertly-decode-and-write-data-to-windows-directory-using-indirect-calls.yml
- nursery/hash-data-using-sha512managed-in-dotnet.yml
- persistence/act-as-dhcp-server-callout-dll.yml
- persistence/act-as-dns-server-plugin-dll.yml
- persistence/authentication-process/act-as-security-support-provider-dll.yml
- persistence/authentication-process/act-as-subauthentication-package-dll.yml
- persistence/exchange/act-as-exchange-transport-agent.yml
- persistence/office/act-as-excel-xll-add-in.yml
- persistence/office/act-as-office-com-add-in.yml
- persistence/office/act-as-word-wll-add-in.yml
Modified rules (22)
- anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml
- anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
- collection/microphone/capture-microphone-audio.yml
- communication/http/reference-http-user-agent-string.yml
- communication/socket/create-raw-socket.yml
- data-manipulation/compression/compress-data-via-zlib-inflate-or-deflate.yml
- data-manipulation/encryption/rsa/reference-public-rsa-key.yml
- data-manipulation/hashing/fnv/hash-data-using-fnv.yml
- executable/resource/extract-resource-via-kernel32-functions.yml
- host-interaction/clipboard/read-clipboard-data.yml
- host-interaction/clipboard/write-clipboard-data.yml
- host-interaction/file-system/copy/copy-file.yml
- host-interaction/file-system/get-common-file-path.yml
- host-interaction/file-system/read/read-file-on-windows.yml
- host-interaction/file-system/reference-absolute-stream-path-on-windows.yml
- host-interaction/file-system/write/write-file-on-windows.yml
- host-interaction/service/stop/stop-service.yml
- impact/wipe-disk/wipe-mbr/overwrite-master-boot-record-mbr.yml
- lib/create-or-open-file.yml
- lib/get-os-version.yml
- load-code/pe/enumerate-pe-sections.yml
- nursery/encrypt-data-using-aes.yml
Renamed rules (3)
- anti-analysis/anti-debugging/debugger-evasion/hide-thread-from-debugger.yml (was nursery/hide-thread-from-debugger.yml)
- [host-interaction/file-system/get-windows-directory-from-kuser_shared_data.yml](https://github.com/mandiant/capa-rules/blob/v6.0.0/ho...
v5.1.0
Summary
Added: 24 rules
Modified: 38 rules
Renamed: 7 rules
Deleted: 0 rules
Detailed release changes: rules v5.0.0...v5.1.0
Added rules (24)
- communication/http/get-http-content-length.yml
- communication/http/reference-http-user-agent-string.yml
- communication/ip/convert-ip-address-from-string.yml
- communication/socket/create-raw-socket.yml
- data-manipulation/compression/compress-data-via-zlib-inflate-or-deflate.yml
- data-manipulation/encryption/xtea/encrypt-data-using-xtea.yml
- data-manipulation/encryption/xxtea/encrypt-data-using-xxtea.yml
- data-manipulation/prng/generate-random-numbers-via-rtlgenrandom.yml
- executable/installer/dotnet/packaged-as-single-file-dotnet-application.yml
- nursery/check-for-minimum-number-of-windows-on-screen.yml
- nursery/check-for-windows-sandbox-via-subdirectory.yml
- nursery/compiled-with-cx_freeze.yml
- nursery/contain-a-thread-local-storage-tls-section-in-dotnet.yml
- nursery/create-zip-archive-in-dotnet.yml
- nursery/destroy-software-breakpoint-capability.yml
- nursery/enumerate-pe-sections-in-dotnet.yml
- nursery/get-http-request-uri.yml
- nursery/hash-data-using-ripemd128.yml
- nursery/hash-data-using-ripemd256.yml
- nursery/hash-data-using-ripemd320.yml
- nursery/move-directory.yml
- nursery/send-data-to-internet.yml
- nursery/set-web-proxy-in-dotnet.yml
- persistence/scheduled-tasks/schedule-task-via-at.yml
Modified rules (38)
- anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml
- anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
- anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml
- anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-genuine-state.yml
- anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-process-name.yml
- anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-registry.yml
- anti-analysis/reference-analysis-tools-strings.yml
- collection/get-geographical-location.yml
- collection/network/get-mac-address-on-windows.yml
- communication/http/client/check-http-status-code.yml
- communication/http/set-http-header.yml
- communication/named-pipe/connect/connect-pipe.yml
- communication/named-pipe/create/create-pipe.yml
- communication/send-data.yml
- communication/socket/receive/receive-data-on-socket.yml
- communication/socket/send/send-data-on-socket.yml
- communication/socket/udp/send/create-udp-socket.yml
- compiler/rust/compiled-with-rust.yml
- data-manipulation/hashing/md5/hash-data-with-md5.yml
- data-manipulation/hashing/sha1/hash-data-using-sha1.yml
- host-interaction/clipboard/read-clipboard-data.yml
- host-interaction/file-system/create/create-directory.yml
- host-interaction/file-system/delete/delete-file.yml
- host-interaction/file-system/exists/check-if-file-exists.yml
- host-interaction/file-system/files/list/enumerate-files-on-windows.yml
- host-interaction/file-system/files/list/enumerate-files-recursively.yml
- host-interaction/file-system/reference-absolute-stream-path-on-windows.yml
- host-interaction/process/list/enumerate-processes-via-ntquerysysteminformation.yml
- host-interaction/registry/create/set-registry-value.yml
- host-interaction/registry/query-or-enumerate-registry-key.yml
- host-interaction/registry/query-or-enumerate-registry-value.yml
- linking/runtime-linking/link-function-at-runtime-on-windows.yml
- load-code/pe/enumerate-pe-sections.yml
- load-code/pe/parse-pe-header.yml
- nursery/check-for-process-debug-object.yml
- [nursery/check-for-wi...
v5.0.0
Summary
Added: 68 rules
Modified: 81 rules
Renamed: 10 rules
Deleted: 1 rule
Detailed release changes: rules v4.0.1...v5.0.0
Added rules (68)
- collection/use-dotnet-library-sharpclipboard.yml
- communication/mailslot/create-mailslot.yml
- communication/socket/tcp/create-tcp-socket-via-raw-afd-driver.yml
- compiler/nuitka/compiled-with-nuitka.yml
- data-manipulation/compression/compress-data-using-lzo.yml
- data-manipulation/compression/decompress-data-using-lzo.yml
- data-manipulation/encryption/aes/use-dotnet-library-encryptdecryptutils.yml
- data-manipulation/hashing/sha384/hash-data-using-sha384.yml
- data-manipulation/hashing/sha512/hash-data-using-sha512.yml
- data-manipulation/json/use-dotnet-library-newtonsoftjson.yml
- data-manipulation/svg/use-dotnet-library-sharpvectors.yml
- executable/resource/access-dotnet-resource.yml
- executable/resource/embed-dependencies-as-resources-using-fodycostura.yml
- host-interaction/file-system/reference-absolute-stream-path-on-windows.yml
- host-interaction/mutex/create-semaphore-on-linux.yml
- host-interaction/mutex/lock-semaphore-on-linux.yml
- host-interaction/mutex/unlock-semaphore-on-linux.yml
- host-interaction/process/map-section-object.yml
- host-interaction/uac/bypass/bypass-uac-via-rpc.yml
- lib/create-or-open-section-object.yml
- lib/get-os-version.yml
- linking/static/linked-against-cpp-standard-library.yml
- load-code/dotnet/execute-dotnet-assembly-via-clr-host.yml
- load-code/execute-vbscript-javascript-or-jscript-in-memory.yml
- nursery/access-wmi-data-in-dotnet.yml
- nursery/allocate-unmanaged-memory-in-dotnet.yml
- nursery/authenticate-data-with-md5-mac.yml
- nursery/check-file-extension-in-dotnet.yml
- nursery/check-for-vm-using-instruction-vpcext.yml
- nursery/compile-csharp-in-dotnet.yml
- nursery/compile-visual-basic-in-dotnet.yml
- nursery/compress-data-using-gzip-in-dotnet.yml
- nursery/decode-data-using-base64-in-dotnet.yml
- nursery/decode-data-using-url-encoding.yml
- nursery/decrypt-data-using-tea.yml
- nursery/deserialize-json-in-dotnet.yml
- nursery/encrypt-data-using-aes.yml
- nursery/encrypt-data-using-openssl-dsa.yml
- nursery/encrypt-data-using-openssl-ecdsa.yml
- nursery/encrypt-data-using-openssl-rsa.yml
- nursery/encrypt-data-using-tea.yml
- nursery/execute-sqlite-statement-in-dotnet.yml
- nursery/execute-via-asynchronous-task-in-dotnet.yml
- nursery/execute-via-timer-in-dotnet.yml
- nursery/extract-zip-archive.yml
- nursery/find-data-using-regex-in-dotnet.yml
- nursery/generate-method-via-reflection-in-dotnet.yml
- nursery/generate-random-bytes-in-dotnet.yml
- nursery/generate-random-filename-in-dotnet.yml
- nursery/get-os-version-in-dotnet.yml
- nursery/get-windows-directory-from-kuser_shared_data.yml
- nursery/hash-data-using-whirlpool.yml
- nursery/implement-com-dll.yml
- nursery/linked-against-libsodium.yml
- nursery/load-xml-in-dotnet.yml
- nursery/manipulate-console-window.yml
- nursery/manipulate-network-credentials-in-dotnet.yml
- nursery/manipulate-unmanaged-memory-in-dotnet.yml
- nursery/manipulate-user-privileges.yml
- nursery/obfuscated-with-koivm.yml
- nursery/reference-base58-string.yml
- nursery/resolve-function-by-djb2-hash.yml
- nursery/save-image-in-dotnet.yml
- nursery/send-email-in-dotnet.yml
- nursery/serialize-json-in-dotnet.yml
- [nursery/set-http-user-agent-in-dotnet.yml](https://github.com/mandiant/capa-rules/blob/v5.0.0/nurser...
v4.0.1
Summary
Added: 1 rule
Modified: 41 rules
Renamed: 0 rules
Deleted: 0 rules
Detailed release changes: rules v4.0.0...v4.0.1
Added rules (1)
Modified rules (41)
- data-manipulation/encryption/rc6/encrypt-data-using-rc6.yml
- nursery/build-docker-image.yml
- nursery/create-container.yml
- nursery/hash-data-using-murmur2.yml
- nursery/hook-routines-via-microsoft-detours.yml
- nursery/list-containers.yml
- nursery/packed-with-ccg.yml
- nursery/packed-with-crunch.yml
- nursery/packed-with-dragon-armor.yml
- nursery/packed-with-enigma.yml
- nursery/packed-with-epack.yml
- nursery/packed-with-maskpe.yml
- nursery/packed-with-mew.yml
- nursery/packed-with-mpress.yml
- nursery/packed-with-neolite.yml
- nursery/packed-with-pepack.yml
- nursery/packed-with-perplex.yml
- nursery/packed-with-procrypt.yml
- nursery/packed-with-rpcrypt.yml
- nursery/packed-with-seausfx.yml
- nursery/packed-with-shrinker.yml
- nursery/packed-with-simple-pack.yml
- nursery/packed-with-starforce.yml
- nursery/packed-with-svkp.yml
- nursery/packed-with-tsuloader.yml
- nursery/packed-with-vprotect.yml
- nursery/packed-with-wwpack.yml
- nursery/reference-114dns-dns-server.yml
- nursery/reference-alidns-dns-server.yml
- nursery/reference-cloudflare-dns-server.yml
- nursery/reference-comodo-secure-dns-server.yml
- nursery/reference-hurricane-electric-dns-server.yml
- nursery/reference-kornet-dns-server.yml
- nursery/reference-l3-dns-server.yml
- nursery/reference-opendns-dns-server.yml
- nursery/reference-quad9-dns-server.yml
- nursery/reference-verisign-dns-server.yml
- nursery/resolve-function-by-fnv-1a-hash.yml
- nursery/resolve-function-by-hash.yml
- nursery/run-in-container.yml
- nursery/terminate-process-by-name.yml
v4.0.0
Summary
Added: 20 rules
Modified: 36 rules
Renamed: 1 rule
Deleted: 1 rule
Detailed release changes: rules v3.2.1...v4.0.0
Added rules (20)
- anti-analysis/obfuscation/obfuscated-with-babel-obfuscator.yml
- anti-analysis/obfuscation/obfuscated-with-deepsea-obfuscator.yml
- anti-analysis/obfuscation/obfuscated-with-dotfuscator.yml
- anti-analysis/obfuscation/obfuscated-with-smartassembly.yml
- anti-analysis/obfuscation/obfuscated-with-spicesdotnet-obfuscator.yml
- anti-analysis/obfuscation/obfuscated-with-yano.yml
- nursery/check-clipboard-data.yml
- nursery/clear-clipboard-data.yml
- nursery/compile-dotnet-assembly.yml
- nursery/create-process-via-wmi.yml
- nursery/display-service-notification-message-box.yml
- nursery/find-process-by-name.yml
- nursery/generate-random-numbers-in-dotnet.yml
- nursery/hash-data-using-jshash.yml
- nursery/hash-data-using-rshash.yml
- nursery/send-keystrokes.yml
- nursery/send-request-in-dotnet.yml
- nursery/terminate-process-by-name-in-dotnet.yml
- persistence/authentication-process/act-as-credential-manager-dll.yml
- persistence/authentication-process/act-as-password-filter-dll.yml
Modified rules (36)
- anti-analysis/packer/themida/packed-with-themida.yml
- communication/http/client/create-http-request.yml
- communication/http/client/download-url.yml
- communication/http/client/read-data-from-internet.yml
- communication/http/server/start-http-server.yml
- communication/socket/send/send-data-on-socket.yml
- compiler/ps2exe/compiled-with-ps2exe.yml
- data-manipulation/encoding/base64/encode-data-using-base64.yml
- data-manipulation/hashing/md5/hash-data-with-md5.yml
- data-manipulation/hashing/sha256/hash-data-using-sha256.yml
- host-interaction/cli/accept-command-line-arguments.yml
- host-interaction/clipboard/read-clipboard-data.yml
- host-interaction/clipboard/write-clipboard-data.yml
- host-interaction/file-system/files/list/enumerate-files-recursively.yml
- host-interaction/file-system/meta/get-file-attributes.yml
- host-interaction/file-system/meta/get-file-version-info.yml
- host-interaction/file-system/meta/set-file-attributes.yml
- host-interaction/file-system/read/read-file-on-windows.yml
- host-interaction/file-system/write/write-file-on-windows.yml
- host-interaction/hardware/storage/enumerate-disk-properties.yml
- host-interaction/mutex/check-mutex.yml
- host-interaction/network/interface/get-networking-interfaces.yml
- host-interaction/process/create/create-process-on-windows.yml
- host-interaction/process/list/find-process-by-pid.yml
- host-interaction/process/terminate/terminate-process.yml
- host-interaction/registry/create-or-open-registry-key.yml
- host-interaction/registry/delete/delete-registry-value.yml
- host-interaction/registry/query-or-enumerate-registry-value.yml
- host-interaction/session/get-session-integrity-level.yml
- host-interaction/session/get-session-user-name.yml
- host-interaction/thread/create/create-thread.yml
- host-interaction/thread/resume/resume-thread.yml
- host-interaction/thread/suspend/suspend-thread.yml
- host-interaction/thread/terminate/terminate-thread.yml
- nursery/invoke-dotnet-assembly-method.yml
- runtime/dotnet/compiled-to-the-dotnet-platform.yml
Renamed rules (1)
- host-interaction/file-system/files/list/enumerate-files-on-windows.yml (was host-interaction/file-system/files/list/enumerate-files-via-ntdll-functions.yml)
Deleted rules (1)
v3.2.1
Summary
Added: 23 rules
Modified: 656 rules
Renamed: 4 rules
Deleted: 1 rule
Detailed release changes: rules v3.2.0...v3.2.1
Added rules (23)
- anti-analysis/packer/huan/packed-with-huan.yml
- collection/browser/gather-chrome-based-browser-login-information.yml
- collection/screenshot/capture-screenshot-via-keybd-event.yml
- compiler/v/compiled-with-v.yml
- compiler/zig/compiled-with-zig.yml
- data-manipulation/encryption/aes/manually-build-aes-constants.yml
- load-code/pe/resolve-function-by-parsing-pe-exports.yml
- nursery/check-if-directory-exists.yml
- nursery/decrypt-data-using-rsa.yml
- nursery/encrypt-data-using-rsa.yml
- nursery/enumerate-drives.yml
- nursery/execute-dotnet-assembly.yml
- nursery/get-os-information-via-kuser_shared_data.yml
- nursery/get-process-image-filename.yml
- nursery/get-system-web-proxy.yml
- nursery/hash-data-using-aphash.yml
- nursery/invoke-dotnet-assembly-method.yml
- nursery/load-dotnet-assembly.yml
- nursery/mixed-mode.yml
- nursery/power-down-monitor.yml
- nursery/set-current-directory.yml
- nursery/set-http-cookie.yml
- nursery/unmanaged-call.yml
Modified rules (656)
- anti-analysis/anti-av/block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml
- anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
- anti-analysis/anti-av/protect-spawned-processes-with-mitigation-policies.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-outputdebugstring-error.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-protected-handle-exception.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-unexpected-memory-writes.yml
- anti-analysis/anti-debugging/debugger-detection/check-process-job-object.yml
- anti-analysis/anti-debugging/debugger-detection/check-processdebugport.yml
- anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml
- anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml
- anti-analysis/anti-disasm/contain-anti-disasm-techniques.yml
- anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml
- anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs.yml
- anti-analysis/anti-forensic/crash-the-windows-event-logging-service.yml
- anti-analysis/anti-forensic/impersonate-file-version-information.yml
- anti-analysis/anti-forensic/patch-process-command-line.yml
- anti-analysis/anti-forensic/self-deletion/self-delete.yml
- anti-analysis/anti-forensic/spoof-parent-pid.yml
- anti-analysis/anti-forensic/timestomp/timestomp-file.yml
- anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml
- anti-analysis/anti-vm/vm-detection/check-for-sandbox-username.yml
- anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml
- [anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml](https://github.com/mandiant/capa-rules/blob/v3.2.1/anti-analysis...
v3.2.0
Summary
Added: 3 rules
Modified: 19 rules
Renamed: 1 rule
Deleted: 0 rules
Detailed release changes: rules v3.1.0...v3.2.0
Added rules (3)
- anti-analysis/anti-av/block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml
- anti-analysis/anti-av/protect-spawned-processes-with-mitigation-policies.yml
- anti-analysis/obfuscation/obfuscated-with-advobfuscator.yml
Modified rules (19)
- anti-analysis/anti-debugging/debugger-detection/check-processdebugport.yml
- anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml
- anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml
- anti-analysis/packer/gopacker/packed-with-gopacker.yml
- anti-analysis/reference-analysis-tools-strings.yml
- collection/screenshot/capture-screenshot.yml
- host-interaction/network/domain/enumerate-domain-computers-via-ldap.yml
- host-interaction/network/domain/get-domain-controller-name.yml
- host-interaction/process/dump/create-process-memory-minidump.yml
- host-interaction/service/run-as-service.yml
- impact/inhibit-system-recovery/delete-volume-shadow-copies.yml
- load-code/pe/rebuild-import-table.yml
- nursery/check-for-process-debug-object.yml
- nursery/check-processdebugflags.yml
- nursery/check-systemkerneldebuggerinformation.yml
- nursery/check-thread-yield-allowed.yml
- nursery/list-domain-servers.yml
- nursery/monitor-local-ipv4-address-changes.yml
- nursery/schedule-task-via-itaskservice.yml
Renamed rules (1)
v3.1.0
Summary
Added: 19 rules
Modified: 32 rules
Renamed: 3 rules
Deleted: 0 rules
Detailed release changes: rules v3.0.3...v3.1.0
Added rules (19)
- anti-analysis/packer/themida/packed-with-themida.yml
- data-manipulation/compression/decompress-data-using-ucl.yml
- host-interaction/process/inject/inject-shellcode-using-a-file-mapping-object.yml
- linking/static/wolfcrypt/linked-against-wolfcrypt.yml
- linking/static/wolfssl/linked-against-wolfssl.yml
- load-code/shellcode/execute-shellcode-via-copyfile2.yml
- load-code/shellcode/execute-shellcode-via-createthreadpoolwait.yml
- load-code/shellcode/execute-shellcode-via-enumuilanguages.yml
- load-code/shellcode/execute-shellcode-via-windows-fibers.yml
- malware-family/plugx/match-known-plugx-module.yml
- nursery/capture-webcam-video.yml
- nursery/create-registry-key-via-stdregprov.yml
- nursery/delete-registry-key-via-stdregprov.yml
- nursery/delete-registry-value-via-stdregprov.yml
- nursery/delete-windows-backup-catalog.yml
- nursery/disable-automatic-windows-recovery-features.yml
- nursery/query-or-enumerate-registry-key-via-stdregprov.yml
- nursery/query-or-enumerate-registry-value-via-stdregprov.yml
- nursery/set-registry-value-via-stdregprov.yml
Modified rules (32)
- anti-analysis/anti-forensic/patch-process-command-line.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-vmware.yml
- collection/browser/gather-firefox-profile-information.yml
- collection/get-current-user-on-linux.yml
- communication/dns/reference-dns-over-https-endpoints.yml
- communication/http/client/create-bits-job.yml
- communication/receive-data.yml
- communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml
- compiler/go/compiled-with-go.yml
- data-manipulation/compression/decompress-data-using-aplib.yml
- data-manipulation/hashing/md5/hash-data-with-md5.yml
- data-manipulation/hmac/authenticate-hmac.yml
- host-interaction/driver/disable-driver-code-integrity.yml
- host-interaction/environment-variable/get-comspec-environment-variable.yml
- host-interaction/file-system/change-file-permission-on-linux.yml
- host-interaction/file-system/move/move-file.yml
- host-interaction/file-system/read/read-file-via-mapping.yml
- host-interaction/filter/register-minifilter-driver.yml
- host-interaction/filter/start-minifilter-driver.yml
- host-interaction/gui/console/set-console-window-title.yml
- host-interaction/log/clfs/read-data-from-clfs-log-container.yml
- host-interaction/os/shutdown-system.yml
- host-interaction/process/dump/create-process-memory-minidump.yml
- host-interaction/recycle-bin/empty-recycle-bin-quietly.yml
- host-interaction/thread/list/enumerate-threads.yml
- lib/open-process.yml
- lib/open-thread.yml
- linking/runtime-linking/resolve-function-by-fin8-fasthash.yml
- load-code/pe/enumerate-pe-sections.yml
- load-code/pe/inspect-section-memory-permissions.yml
- load-code/pe/rebuild-import-table.yml
- load-code/shellcode/spawn-thread-to-rwx-shellcode.yml
Renamed rules (3)
- anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs.yml (was anti-analysis/anti-forensic/clear-logs/clear-the-windows-event-log.yml)
- anti-analysis/packer/pespin/packed-with-pespin.yml (was nursery/packed-with-themida.yml)
- communication/http/client/download-url.yml (was communication/http/client/download-url-to-file.yml)
v3.0.3
Summary
Added: 8 rules
Modified: 446 rules
Renamed: 3 rules
Deleted: 2 rules
Detailed release changes: rules v3.0.2...v3.0.3
Added rules (8)
- collection/group-policy/discover-group-policy-via-gpresult.yml
- data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml
- host-interaction/bootloader/manipulate-safe-mode-programs.yml
- nursery/enable-safe-mode-boot.yml
- nursery/resolve-function-by-fnv-1a-hash.yml
- persistence/iis/persist-via-iis-module.yml
- persistence/iis/persist-via-isapi-extension.yml
- targeting/language/identify-system-language-via-api.yml
Modified rules (446)
- anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-outputdebugstring-error.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-protected-handle-exception.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-unexpected-memory-writes.yml
- anti-analysis/anti-debugging/debugger-detection/check-process-job-object.yml
- anti-analysis/anti-debugging/debugger-detection/check-processdebugport.yml
- anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml
- anti-analysis/anti-disasm/contain-anti-disasm-techniques.yml
- anti-analysis/anti-forensic/clear-logs/clear-the-windows-event-log.yml
- anti-analysis/anti-forensic/crash-the-windows-event-logging-service.yml
- anti-analysis/anti-forensic/patch-process-command-line.yml
- anti-analysis/anti-forensic/self-deletion/self-delete.yml
- anti-analysis/anti-forensic/timestomp/timestomp-file.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-parallels.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-qemu.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualbox.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualpc.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-vmware.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-xen.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings.yml
- anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml
- anti-analysis/packer/amber/packed-with-amber.yml
- anti-analysis/packer/aspack/packed-with-aspack.yml
- anti-analysis/packer/confuser/packed-with-confuser.yml
- anti-analysis/packer/generic/packed-with-generic-packer.yml
- anti-analysis/packer/gopacker/packed-with-gopacker.yml
- anti-analysis/packer/pecompact/packed-with-pecompact.yml
- anti-analysis/packer/upx/packed-with-upx.yml
- anti-analysis/packer/vmprotect/packed-with-vmprotect.yml
- anti-analysis/reference-analysis-tools-strings.yml
- c2/file-transfer/download-and-write-a-file.yml
- c2/file-transfer/write-and-execute-a-file.yml
- c2/shell/create-reverse-shell.yml
- c2/shell/execute-shell-command-and-capture-output.yml
- [collection/acquire-credentials-from-windows-credential-manager.yml](https://github.com/mandiant/capa-rules/blob/v3.0.3/collection/acquire-credentials-fr...
v3.0.2
Summary
Added: 0 rules
Modified: 0 rules
Renamed: 0 rules
Deleted: 0 rules
Detailed release changes: rules v3.0.1...v3.0.2