Releases: mandiant/capa-rules
Releases · mandiant/capa-rules
v1.2.0
Summary
Added: 48 rules
Modified: 12 rules
Renamed: 2 rules
Deleted: 0 rules
Detailed release changes: rules v1.1.0...v1.2.0
Added rules (48)
- anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-protected-handle-exception.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-unexpected-memory-writes.yml
- anti-analysis/anti-debugging/debugger-detection/check-process-job-object.yml
- anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml
- anti-analysis/anti-vm/vm-detection/check-for-sandbox-username.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-parallels.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-qemu.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualbox.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualpc.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-vmware.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-xen.yml
- anti-analysis/packer/aspack/packed-with-aspack.yml
- anti-analysis/reference-analysis-tools-strings.yml
- collection/database/wmi/reference-wmi-statements.yml
- communication/icmp/send-icmp-echo-request.yml
- data-manipulation/checksum/luhn/validate-credit-card-number-using-luhn-algorithm.yml
- data-manipulation/encryption/rsa/reference-public-rsa-key.yml
- host-interaction/hardware/cpu/get-number-of-processor-cores.yml
- host-interaction/hardware/cpu/get-number-of-processors.yml
- host-interaction/hardware/storage/enumerate-disk-properties.yml
- host-interaction/hardware/storage/get-disk-size.yml
- host-interaction/process/get-process-heap-flags.yml
- host-interaction/process/get-process-heap-force-flags.yml
- host-interaction/process/list/get-explorer-pid.yml
- host-interaction/uac/bypass/bypass-uac-via-appinfo-alpc.yml
- host-interaction/uac/bypass/bypass-uac-via-token-manipulation.yml
- lib/delay-execution.yml
- lib/peb-access.yml
- lib/validate-credit-card-number-using-luhn-algorithm-with-no-lookup-table.yml
- linking/runtime-linking/link-many-functions-at-runtime.yml
- nursery/check-for-process-debug-object.yml
- nursery/check-license-value.yml
- nursery/check-processdebugflags.yml
- nursery/check-processdebugport.yml
- nursery/check-systemkerneldebuggerinformation.yml
- nursery/check-thread-yield-allowed.yml
- nursery/delete-internet-cache.yml
- nursery/enumerate-internet-cache.yml
- nursery/enumerate-system-firmware-tables.yml
- nursery/get-system-firmware-table.yml
- nursery/hash-data-using-fnv.yml
- nursery/hide-thread-from-debugger.yml
Modified rules (12)
- anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings.yml
- data-manipulation/compression/decompress-data-via-iencodingfilterfactory.yml
- data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml
- data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml
- [data-manipulation/encryption/rc4/encry...
v1.1.0
Summary
Added: 33 rules
Modified: 11 rules
Renamed: 9 rules
Deleted: 1 rule
Detailed release changes: rules v1.0.0...v1.1.0
Added rules (33)
- anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml
- collection/browser/gather-firefox-profile-information.yml
- collection/credit-card/parse-credit-card-information.yml
- collection/network/capture-network-configuration-via-ipconfig.yml
- data-manipulation/checksum/luhn/validate-credit-card-number-with-luhn-algorithm.yml
- data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml
- data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml
- data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml
- data-manipulation/encryption/des/encrypt-data-using-des.yml
- data-manipulation/encryption/import-public-key.yml
- data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml
- data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml
- data-manipulation/hashing/hash-data-via-wincrypt.yml
- data-manipulation/hashing/tiger/hash-data-using-tiger.yml
- host-interaction/file-system/meta/get-file-attributes.yml
- host-interaction/file-system/read/read-ini-file.yml
- host-interaction/gui/session/wallpaper/change-the-wallpaper.yml
- host-interaction/gui/window/hide/hide-graphical-window.yml
- host-interaction/mutex/check-mutex-and-exit.yml
- host-interaction/process/allocate-thread-local-storage.yml
- host-interaction/process/list/enumerate-processes-via-ntquerysysteminformation.yml
- host-interaction/process/set-thread-local-storage-value.yml
- host-interaction/session/get-session-integrity-level.yml
- nursery/acquire-debug-privileges.yml
- nursery/add-file-to-cabinet-file.yml
- nursery/flush-cabinet-file.yml
- nursery/get-socket-information.yml
- nursery/get-thread-local-storage-value.yml
- nursery/hash-data-using-sha1-via-x86-extensions.yml
- nursery/hash-data-using-sha256-via-x86-extensions.yml
- nursery/open-cabinet-file.yml
- nursery/set-graphical-window-text.yml
- nursery/terminate-process-by-name.yml
Modified rules (11)
- collection/screenshot/capture-screenshot.yml
- communication/http/client/read-data-from-internet.yml
- communication/tcp/serve/start-tcp-server.yml
- data-manipulation/encryption/encrypt-or-decrypt-via-wincrypt.yml
- host-interaction/file-system/copy/copy-file.yml
- host-interaction/gui/taskbar/hide/hide-the-windows-taskbar.yml
- host-interaction/process/terminate/terminate-process.yml
- host-interaction/service/list/enumerate-services.yml
- host-interaction/service/modify/modify-service.yml
- nursery/get-file-version-info.yml
- nursery/read-process-memory.yml
Renamed rules (9)
- data-manipulation/encryption/aes/encrypt-data-using-aes-via-net.yml (was data-manipulation/encryption/aes/encrypt-data-using-aes-via-.net.yml)
- data-manipulation/hashing/murmur/hash-data-using-murmur3.yml (was nursery/hash-data-using-murmur3.yml)
- executable/pe/section/rsrc/contain-a-resource-rsrc-section.yml (was executable/pe/section/rsrc/contain-a-resource-.rsrc-section.yml)
- executable/pe/section/tls/contain-a-thread-local-storage-tls-section.yml (was executable/pe/section/tls/contain-a-thread-local-storage-.tls-section.yml)
- nursery/get-mac-address.yml (was host-interaction/network/mac-address/get-mac-address.yml)
- nursery/reference-processor-manufacturer-constants.yml (was anti-analysis/anti-vm/vm-detection/reference-processor-manufacturer-constants.yml)
- nursery/set-global-application-hook.yml (was host-interaction/gui/set-global-application-hook.yml)
- [persistence/startup-folder/get-st...
v1.0.0
Summary
Added: 261 rules
Modified: 0 rules
Renamed: 0 rules
Deleted: 0 rules
Detailed release changes: rules 77124b5...v1.0.0
Added rules (261)
- anti-analysis/anti-debugging/debugger-detection/check-for-outputdebugstring-error.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml
- anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml
- anti-analysis/anti-forensic/self-deletion/self-delete-via-comspec-environment-variable.yml
- anti-analysis/anti-forensic/timestomp/timestomp-file.yml
- anti-analysis/anti-vm/vm-detection/execute-anti-vm-instructions.yml
- anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings.yml
- anti-analysis/anti-vm/vm-detection/reference-processor-manufacturer-constants.yml
- anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml
- anti-analysis/packer/confuser/packed-with-confuser.yml
- anti-analysis/packer/generic/packed-with-generic-packer.yml
- anti-analysis/packer/upx/packed-with-upx.yml
- anti-analysis/packer/vmprotect/packed-with-vmprotect.yml
- c2/file-transfer/download-and-write-a-file.yml
- c2/file-transfer/write-and-execute-a-file.yml
- c2/shell/create-reverse-shell.yml
- c2/shell/execute-shell-command-and-capture-output.yml
- collection/database/sql/reference-sql-statements.yml
- collection/keylog/log-keystrokes-via-application-hook.yml
- collection/keylog/log-keystrokes-via-polling.yml
- collection/keylog/log-keystrokes.yml
- collection/screenshot/capture-screenshot.yml
- communication/ftp/send/send-file-using-ftp-via-wininet.yml
- communication/http/client/connect-to-http-server.yml
- communication/http/client/connect-to-url.yml
- communication/http/client/create-http-request.yml
- communication/http/client/decompress-http-response-via-iencodingfilterfactory.yml
- communication/http/client/download-url-to-file.yml
- communication/http/client/extract-http-body.yml
- communication/http/client/get-http-document-via-iwebbrowser2.yml
- communication/http/client/get-http-response-content-encoding.yml
- communication/http/client/prepare-http-request.yml
- communication/http/client/read-data-from-internet.yml
- communication/http/client/receive-http-response.yml
- communication/http/client/send-file-via-http.yml
- communication/http/client/send-http-request.yml
- communication/http/initialize-iwebbrowser2.yml
- communication/http/initialize-winhttp-library.yml
- communication/http/read-http-header.yml
- communication/http/server/receive-http-request.yml
- communication/http/server/send-http-response.yml
- communication/http/server/start-http-server.yml
- communication/http/set-http-header.yml
- communication/named-pipe/connect/connect-pipe.yml
- communication/named-pipe/create/create-pipe.yml
- communication/named-pipe/create/create-two-anonymous-pipes.yml
- communication/named-pipe/read/read-pipe.yml
- communication/named-pipe/write/write-pipe.yml
- communication/receive-data.yml
- communication/send-data.yml
- communication/socket/get-socket-status.yml
- communication/socket/initialize-winsock-library.yml
- communication/socket/receive/receive-data-on-socket.yml
- communication/socket/send/send-data-on-socket.yml
- [communication/socket/set-socket-configuration.yml](https://github.com/mandiant/capa-rules/blob/v1.0.0/communication/socket/set-socket...