Releases: mandiant/capa-rules
Releases · mandiant/capa-rules
v1.1.0
Summary
Added: 33 rules
Modified: 11 rules
Renamed: 9 rules
Deleted: 1 rule
Detailed release changes: rules v1.0.0...v1.1.0
Added rules (33)
- anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml
- collection/browser/gather-firefox-profile-information.yml
- collection/credit-card/parse-credit-card-information.yml
- collection/network/capture-network-configuration-via-ipconfig.yml
- data-manipulation/checksum/luhn/validate-credit-card-number-with-luhn-algorithm.yml
- data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml
- data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml
- data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml
- data-manipulation/encryption/des/encrypt-data-using-des.yml
- data-manipulation/encryption/import-public-key.yml
- data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml
- data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml
- data-manipulation/hashing/hash-data-via-wincrypt.yml
- data-manipulation/hashing/tiger/hash-data-using-tiger.yml
- host-interaction/file-system/meta/get-file-attributes.yml
- host-interaction/file-system/read/read-ini-file.yml
- host-interaction/gui/session/wallpaper/change-the-wallpaper.yml
- host-interaction/gui/window/hide/hide-graphical-window.yml
- host-interaction/mutex/check-mutex-and-exit.yml
- host-interaction/process/allocate-thread-local-storage.yml
- host-interaction/process/list/enumerate-processes-via-ntquerysysteminformation.yml
- host-interaction/process/set-thread-local-storage-value.yml
- host-interaction/session/get-session-integrity-level.yml
- nursery/acquire-debug-privileges.yml
- nursery/add-file-to-cabinet-file.yml
- nursery/flush-cabinet-file.yml
- nursery/get-socket-information.yml
- nursery/get-thread-local-storage-value.yml
- nursery/hash-data-using-sha1-via-x86-extensions.yml
- nursery/hash-data-using-sha256-via-x86-extensions.yml
- nursery/open-cabinet-file.yml
- nursery/set-graphical-window-text.yml
- nursery/terminate-process-by-name.yml
Modified rules (11)
- collection/screenshot/capture-screenshot.yml
- communication/http/client/read-data-from-internet.yml
- communication/tcp/serve/start-tcp-server.yml
- data-manipulation/encryption/encrypt-or-decrypt-via-wincrypt.yml
- host-interaction/file-system/copy/copy-file.yml
- host-interaction/gui/taskbar/hide/hide-the-windows-taskbar.yml
- host-interaction/process/terminate/terminate-process.yml
- host-interaction/service/list/enumerate-services.yml
- host-interaction/service/modify/modify-service.yml
- nursery/get-file-version-info.yml
- nursery/read-process-memory.yml
Renamed rules (9)
- data-manipulation/encryption/aes/encrypt-data-using-aes-via-net.yml (was data-manipulation/encryption/aes/encrypt-data-using-aes-via-.net.yml)
- data-manipulation/hashing/murmur/hash-data-using-murmur3.yml (was nursery/hash-data-using-murmur3.yml)
- executable/pe/section/rsrc/contain-a-resource-rsrc-section.yml (was executable/pe/section/rsrc/contain-a-resource-.rsrc-section.yml)
- executable/pe/section/tls/contain-a-thread-local-storage-tls-section.yml (was executable/pe/section/tls/contain-a-thread-local-storage-.tls-section.yml)
- nursery/get-mac-address.yml (was host-interaction/network/mac-address/get-mac-address.yml)
- nursery/reference-processor-manufacturer-constants.yml (was anti-analysis/anti-vm/vm-detection/reference-processor-manufacturer-constants.yml)
- nursery/set-global-application-hook.yml (was host-interaction/gui/set-global-application-hook.yml)
- [persistence/startup-folder/get-st...
v1.0.0
Summary
Added: 261 rules
Modified: 0 rules
Renamed: 0 rules
Deleted: 0 rules
Detailed release changes: rules 77124b5...v1.0.0
Added rules (261)
- anti-analysis/anti-debugging/debugger-detection/check-for-outputdebugstring-error.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml
- anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml
- anti-analysis/anti-forensic/self-deletion/self-delete-via-comspec-environment-variable.yml
- anti-analysis/anti-forensic/timestomp/timestomp-file.yml
- anti-analysis/anti-vm/vm-detection/execute-anti-vm-instructions.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings.yml
- anti-analysis/anti-vm/vm-detection/reference-processor-manufacturer-constants.yml
- anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml
- anti-analysis/packer/confuser/packed-with-confuser.yml
- anti-analysis/packer/generic/packed-with-generic-packer.yml
- anti-analysis/packer/upx/packed-with-upx.yml
- anti-analysis/packer/vmprotect/packed-with-vmprotect.yml
- c2/file-transfer/download-and-write-a-file.yml
- c2/file-transfer/write-and-execute-a-file.yml
- c2/shell/create-reverse-shell.yml
- c2/shell/execute-shell-command-and-capture-output.yml
- collection/database/sql/reference-sql-statements.yml
- collection/keylog/log-keystrokes-via-application-hook.yml
- collection/keylog/log-keystrokes-via-polling.yml
- collection/keylog/log-keystrokes.yml
- collection/screenshot/capture-screenshot.yml
- communication/ftp/send/send-file-using-ftp-via-wininet.yml
- communication/http/client/connect-to-http-server.yml
- communication/http/client/connect-to-url.yml
- communication/http/client/create-http-request.yml
- communication/http/client/decompress-http-response-via-iencodingfilterfactory.yml
- communication/http/client/download-url-to-file.yml
- communication/http/client/extract-http-body.yml
- communication/http/client/get-http-document-via-iwebbrowser2.yml
- communication/http/client/get-http-response-content-encoding.yml
- communication/http/client/prepare-http-request.yml
- communication/http/client/read-data-from-internet.yml
- communication/http/client/receive-http-response.yml
- communication/http/client/send-file-via-http.yml
- communication/http/client/send-http-request.yml
- communication/http/initialize-iwebbrowser2.yml
- communication/http/initialize-winhttp-library.yml
- communication/http/read-http-header.yml
- communication/http/server/receive-http-request.yml
- communication/http/server/send-http-response.yml
- communication/http/server/start-http-server.yml
- communication/http/set-http-header.yml
- communication/named-pipe/connect/connect-pipe.yml
- communication/named-pipe/create/create-pipe.yml
- communication/named-pipe/create/create-two-anonymous-pipes.yml
- communication/named-pipe/read/read-pipe.yml
- communication/named-pipe/write/write-pipe.yml
- communication/receive-data.yml
- communication/send-data.yml
- communication/socket/get-socket-status.yml
- communication/socket/initialize-winsock-library.yml
- communication/socket/receive/receive-data-on-socket.yml
- communication/socket/send/send-data-on-socket.yml
- [communication/socket/set-socket-configuration.yml](https://github.com/mandiant/capa-rules/blob/v1.0.0/communication/socket/set-socket...