render output with prevalence for (v) verbose

mandiant · Oct 20, 2023 · fe4af5c · fe4af5c
1 parent e4bb521
commit fe4af5c
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 0 deletions.
diff --git a/assets/rules_prevalence.json.gz → ..._prevalence_data/rules_prevalence.json.gz b/assets/rules_prevalence.json.gz → ..._prevalence_data/rules_prevalence.json.gz
diff --git a/capa/render/verbose.py b/capa/render/verbose.py
@@ -115,6 +115,7 @@ def render_rules(ostream, doc: rd.ResultDocument):
                      0x10003797
     """
     had_match = False
+    rules_prevalence = rutils.load_rules_prevalence()
     for rule in rutils.capability_rules(doc):
         count = len(rule.matches)
         if count == 1:
@@ -139,6 +140,8 @@ def render_rules(ostream, doc: rd.ResultDocument):
 
             rows.append((key, v))
 
+        rows.append(("prevalence", rules_prevalence.get(rule.meta.name, "unknown")))
+
         if rule.meta.scope != capa.rules.FILE_SCOPE:
             locations = [m[0] for m in doc.rules[rule.meta.name].matches]
             rows.append(("matches", "\n".join(map(format_address, locations))))

diff --git a/capa/render/vverbose.py b/capa/render/vverbose.py
@@ -278,6 +278,8 @@ def render_rules(ostream, doc: rd.ResultDocument):
 
     had_match = False
 
+    rules_prevalence = rutils.load_rules_prevalence()
+
     for _, _, rule in sorted((rule.meta.namespace or "", rule.meta.name, rule) for rule in doc.rules.values()):
         # default scope hides things like lib rules, malware-category rules, etc.
         # but in vverbose mode, we really want to show everything.
@@ -325,6 +327,8 @@ def render_rules(ostream, doc: rd.ResultDocument):
 
         rows.append(("scope", rule.meta.scope.value))
 
+        rows.append(("prevalence", rules_prevalence.get(rule.meta.name, "unknown")))
+
         if rule.meta.attack:
             rows.append(("att&ck", ", ".join([rutils.format_parts_id(v) for v in rule.meta.attack])))