Releases: mandiant/capa-rules
Releases · mandiant/capa-rules
v7.4.0
Summary
Added: 14 rules
Modified: 2 rules
Renamed: 0 rules
Deleted: 0 rules
Detailed release changes: rules v7.3.0...v7.4.0
Added rules (14)
- anti-analysis/packer/nmm-protect/packed-with-nmm-protect.yml
- host-interaction/driver/complete-processing-asynchronous-io-request.yml
- host-interaction/firewall/modify/access-firewall-policy-via-inetfwpolicy2.yml
- host-interaction/firewall/modify/access-firewall-rule-properties-via-inetfwrule.yml
- host-interaction/os/hide-shutdown-actions-via-policy.yml
- host-interaction/process/get-process-filename.yml
- host-interaction/registry/open-recentdocs-registry-key.yml
- linking/runtime-linking/populate-syswhispers2-syscall-list.yml
- nursery/access-unmanaged-com-objects-in-dotnet.yml
- nursery/implement-ui-automation-client-in-dotnet.yml
- nursery/interact-with-shortcut-via-iwshshortcut-in-dotnet.yml
- nursery/interact-with-windows-scripting-host-in-dotnet.yml
- nursery/use-dotnet-library-simplejson.yml
- nursery/use-dotnet-library-websocket-sharp.yml
Modified rules (2)
v7.3.0
Summary
Added: 6 rules
Modified: 1 rule
Renamed: 1 rule
Deleted: 0 rules
Detailed release changes: rules v7.2.0...v7.3.0
Added rules (6)
- host-interaction/network/traffic/filter/delete-network-filter-via-wfp-api.yml
- host-interaction/network/traffic/filter/enumerate-network-filters-via-wfp-api.yml
- linking/static/minhook/linked-against-minhook.yml
- linking/static/sqlite3/linked-against-sqlcipher.yml
- nursery/check-thread-suspend-count-exceeded.yml
- nursery/create-thread-bypassing-process-freeze.yml
Modified rules (1)
Renamed rules (1)
v7.2.0
Summary
Added: 5 rules
Modified: 6 rules
Renamed: 0 rules
Deleted: 0 rules
Detailed release changes: rules v7.1.0...v7.2.0
Added rules (5)
- anti-analysis/anti-av/overwrite-dll-text-section-to-remove-hooks.yml
- communication/socket/attach-bpf-to-socket-on-linux.yml
- nursery/decode-data-using-base64-via-vbmi-lookup-table.yml
- nursery/delete-file-on-linux.yml
- nursery/upload-file-to-onedrive.yml
Modified rules (6)
- anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml
- host-interaction/file-system/write/write-file-on-linux.yml
- host-interaction/log/debug/write-event/print-debug-messages.yml
- lib/calculate-modulo-256-via-x86-assembly.yml
- load-code/shellcode/execute-shellcode-via-windows-callback-function.yml
- nursery/invoke-dotnet-assembly-method.yml
v7.1.0
Summary
Added: 24 rules
Modified: 42 rules
Renamed: 2 rules
Deleted: 0 rules
Detailed release changes: rules v7.0.1...v7.1.0
Added rules (24)
- anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml
- compiler/dart/compiled-with-dart.yml
- data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-systemfunction033.yml
- host-interaction/driver/interact-with-driver-via-ioctl.yml
- host-interaction/gui/window/hide/hide-graphical-window-from-taskbar.yml
- impact/wipe-disk/delete-drive-layout-via-ioctl.yml
- nursery/bypass-hidden-api-restrictions-via-jni-on-android.yml
- nursery/change-memory-permission-on-linux.yml
- nursery/check-file-permission-on-linux.yml
- nursery/check-if-process-is-running-under-android-emulator-on-android.yml
- nursery/get-current-process-filesystem-mounts-on-linux.yml
- nursery/get-current-process-memory-mapping-on-linux.yml
- nursery/get-disk-information-via-ioctl.yml
- nursery/get-system-property-on-android.yml
- nursery/get-volume-information-via-ioctl.yml
- nursery/hook-routines-via-lsplant.yml
- nursery/load-packed-dex-via-jiagu-on-android.yml
- nursery/map-or-unmap-memory-on-linux.yml
- nursery/modify-api-blacklist-or-denylist-via-jni-on-android.yml
- nursery/truncate-file-on-linux.yml
- nursery/unmount-volume-via-ioctl.yml
- persistence/act-as-share-provider-dll.yml
- persistence/act-as-time-provider-dll.yml
- persistence/act-as-windbg-extension.yml
Modified rules (42)
- collection/keylog/log-keystrokes-via-application-hook.yml
- communication/dns/resolve-dns.yml
- communication/socket/create-raw-socket.yml
- communication/socket/get-socket-status.yml
- communication/socket/initialize-winsock-library.yml
- communication/socket/receive/receive-data-on-socket.yml
- communication/socket/send/send-data-on-socket.yml
- communication/socket/set-socket-configuration.yml
- communication/socket/tcp/connect-tcp-socket.yml
- communication/socket/tcp/create-tcp-socket.yml
- communication/socket/udp/send/create-udp-socket.yml
- compiler/go/compiled-with-go.yml
- data-manipulation/encryption/dpapi/encrypt-data-using-dpapi.yml
- host-interaction/driver/install-driver.yml
- host-interaction/file-system/change-file-permission-on-linux.yml
- host-interaction/file-system/files/list/enumerate-files-on-linux.yml
- host-interaction/file-system/files/list/enumerate-files-recursively.yml
- host-interaction/file-system/read/read-file-on-linux.yml
- host-interaction/file-system/write/write-file-on-linux.yml
- host-interaction/gui/set-application-hook.yml
- host-interaction/hardware/memory/get-memory-information.yml
- host-interaction/hardware/storage/get-disk-size.yml
- host-interaction/mutex/create-semaphore-on-linux.yml
- host-interaction/mutex/lock-file.yml
- host-interaction/mutex/lock-semaphore-on-linux.yml
- host-interaction/mutex/unlock-semaphore-on-linux.yml
- host-interaction/process/create/create-process-on-linux.yml
- host-interaction/session/get-current-user-on-linux.yml
- host-interaction/thread/create/create-thread.yml
- lib/delay-execution.yml
- lib/duplicate-stdin-and-stdout.yml
- linking/runtime-linking/link-function-at-runtime-on-windows.yml
- linking/runtime-linking/link-many-functions-at-runtime.yml
- load-code/shellcode/execute-shellcode-via-windows-callback-function.yml
- nursery/encrypt-data-using-salsa20-or-chacha.yml
- nursery/get-current-pid-on-linux.yml
- nursery/get-password-database-entry-on-linux.yml
- [nursery/get-socket-information.yml](https://gi...
v7.0.1
v7.0.0
Summary
Added: 37 rules
Modified: 820 rules
Renamed: 9 rules
Deleted: 2 rules
Detailed release changes: rules v6.1.0...v7.0.0
Added rules (37)
- anti-analysis/anti-av/patch-antimalware-scan-interface-function.yml
- collection/network/capture-packets-using-sharppcap.yml
- data-manipulation/compression/create-cabinet-on-windows.yml
- data-manipulation/compression/extract-cabinet-on-windows.yml
- data-manipulation/encoding/encode-data-using-add-xor-sub-operations.yml
- data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-systemfunction032.yml
- executable/dotnet-singlefile/bundled-with-dotnet-single-file-deployment.yml
- host-interaction/network/connectivity/set-tcp-connection-state.yml
- host-interaction/process/inject/process-ghostly-hollowing.yml
- internal/limitation/file/internal-dotnet-single-file-deployment-limitation.yml
- lib/change-memory-protection.yml
- load-code/dotnet/load-windows-common-language-runtime.yml
- nursery/access-camera-in-dotnet-on-android.yml
- nursery/add-value-to-global-atom-table.yml
- nursery/capture-microphone-audio-in-dotnet-on-android.yml
- nursery/capture-process-snapshot-data.yml
- nursery/capture-screenshot-in-dotnet-on-android.yml
- nursery/check-for-incoming-call-in-dotnet-on-android.yml
- nursery/check-for-outgoing-call-in-dotnet-on-android.yml
- nursery/communicate-with-kernel-module-via-netlink-socket-on-linux.yml
- nursery/compiled-with-xamarin.yml
- nursery/enumerate-files-in-dotnet.yml
- nursery/enumerate-processes-that-use-resource.yml
- nursery/get-current-pid-on-linux.yml
- nursery/get-current-process-command-line.yml
- nursery/get-current-process-file-path.yml
- nursery/get-mac-address-in-dotnet.yml
- nursery/get-ntoskrnl-base-address.yml
- nursery/get-os-version-in-dotnet-on-android.yml
- nursery/get-password-database-entry-on-linux.yml
- nursery/hook-routines-via-dlsym-rtld_next.yml
- nursery/linked-against-hp-socket.yml
- nursery/log-keystrokes-via-input-method-manager.yml
- nursery/mark-thread-detached-on-linux.yml
- nursery/persist-via-gnome-autostart-on-linux.yml
- nursery/send-sms-on-android.yml
- nursery/set-thread-name-on-linux.yml
Modified rules (820)
- anti-analysis/anti-av/block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml
- anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
- anti-analysis/anti-av/patch-event-tracing-for-windows-function.yml
- anti-analysis/anti-av/protect-spawned-processes-with-mitigation-policies.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-outputdebugstring-error.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-protected-handle-exception.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-unexpected-memory-writes.yml
- [anti-analysis/anti-debugging/debugger-detection/check-process-job-object.yml](https://github.com/mandiant/capa-rules/blob/v7.0.0/anti-analysis/anti-debugging/debugger-detection...
v7.0.0-beta
Summary
Added: 37 rules
Modified: 820 rules
Renamed: 9 rules
Deleted: 2 rules
Detailed release changes: rules v6.1.0...v7.0.0-beta
Added rules (37)
- anti-analysis/anti-av/patch-antimalware-scan-interface-function.yml
- collection/network/capture-packets-using-sharppcap.yml
- data-manipulation/compression/create-cabinet-on-windows.yml
- data-manipulation/compression/extract-cabinet-on-windows.yml
- data-manipulation/encoding/encode-data-using-add-xor-sub-operations.yml
- data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-systemfunction032.yml
- executable/dotnet-singlefile/bundled-with-dotnet-single-file-deployment.yml
- host-interaction/network/connectivity/set-tcp-connection-state.yml
- host-interaction/process/inject/process-ghostly-hollowing.yml
- internal/limitation/file/internal-dotnet-single-file-deployment-limitation.yml
- lib/change-memory-protection.yml
- load-code/dotnet/load-windows-common-language-runtime.yml
- nursery/access-camera-in-dotnet-on-android.yml
- nursery/add-value-to-global-atom-table.yml
- nursery/capture-microphone-audio-in-dotnet-on-android.yml
- nursery/capture-process-snapshot-data.yml
- nursery/capture-screenshot-in-dotnet-on-android.yml
- nursery/check-for-incoming-call-in-dotnet-on-android.yml
- nursery/check-for-outgoing-call-in-dotnet-on-android.yml
- nursery/communicate-with-kernel-module-via-netlink-socket-on-linux.yml
- nursery/compiled-with-xamarin.yml
- nursery/enumerate-files-in-dotnet.yml
- nursery/enumerate-processes-that-use-resource.yml
- nursery/get-current-pid-on-linux.yml
- nursery/get-current-process-command-line.yml
- nursery/get-current-process-file-path.yml
- nursery/get-mac-address-in-dotnet.yml
- nursery/get-ntoskrnl-base-address.yml
- nursery/get-os-version-in-dotnet-on-android.yml
- nursery/get-password-database-entry-on-linux.yml
- nursery/hook-routines-via-dlsym-rtld_next.yml
- nursery/linked-against-hp-socket.yml
- nursery/log-keystrokes-via-input-method-manager.yml
- nursery/mark-thread-detached-on-linux.yml
- nursery/persist-via-gnome-autostart-on-linux.yml
- nursery/send-sms-on-android.yml
- nursery/set-thread-name-on-linux.yml
Modified rules (820)
- anti-analysis/anti-av/block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml
- anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
- anti-analysis/anti-av/patch-event-tracing-for-windows-function.yml
- anti-analysis/anti-av/protect-spawned-processes-with-mitigation-policies.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-outputdebugstring-error.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-protected-handle-exception.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml
- anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml
- [anti-analysis/anti-debugging/debugger-detection/check-for-unexpected-memory-writes.yml](https://github.com/mandiant/capa-rules/blob/v7.0....
v6.1.0
Summary
Added: 8 rules
Modified: 9 rules
Renamed: 1 rule
Deleted: 0 rules
Detailed release changes: rules v6.0.0a3...v6.1.0
Added rules (8)
- anti-analysis/anti-vm/vm-detection/check-for-foreground-window-switch.yml
- executable/pe/export/forwarded-export.yml
- host-interaction/bootloader/get-uefi-variable.yml
- host-interaction/bootloader/set-uefi-variable.yml
- linking/static/sqlite3/linked-against-cppsqlite3.yml
- linking/static/sqlite3/linked-against-sqlite3.yml
- nursery/enumerate-device-drivers-on-linux.yml
- nursery/enumerate-device-drivers-on-windows.yml
Modified rules (9)
- anti-analysis/anti-forensic/self-deletion/self-delete.yml
- collection/browser/gather-chrome-based-browser-login-information.yml
- collection/browser/gather-firefox-profile-information.yml
- data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml
- host-interaction/process/inject/free-user-process-memory.yml
- lib/get-os-version.yml
- nursery/deserialize-json-in-dotnet.yml
- nursery/serialize-json-in-dotnet.yml
- persistence/authentication-process/act-as-credential-manager-dll.yml
Renamed rules (1)
v6.0.0
Summary
Added: 32 rules
Modified: 22 rules
Renamed: 3 rules
Deleted: 3 rules
Detailed release changes: rules v5.1.0...v6.0.0
Added rules (32)
- anti-analysis/anti-av/patch-event-tracing-for-windows-function.yml
- anti-analysis/anti-vm/vm-detection/detect-vm-via-disk-hardware-wmi-queries.yml
- anti-analysis/anti-vm/vm-detection/detect-vm-via-motherboard-hardware-wmi-queries.yml
- communication/mailslot/read-from-mailslot.yml
- communication/socket/create-vmci-socket.yml
- compiler/cx_freeze/compiled-with-cx_freeze.yml
- data-manipulation/encryption/aes/encrypt-data-using-aes-mixcolumns-step.yml
- host-interaction/file-system/create-virtual-file-system-in-dotnet.yml
- host-interaction/filter/enumerate-minifilter-drivers.yml
- host-interaction/gui/switch-active-desktop.yml
- host-interaction/hardware/enumerate-devices-by-category.yml
- host-interaction/memory/create-new-application-domain-in-dotnet.yml
- host-interaction/process/inject/inject-shellcode-using-extra-window-memory.yml
- host-interaction/process/inject/inject-shellcode-using-window-subclass-procedure.yml
- host-interaction/service/continue-service.yml
- host-interaction/service/pause-service.yml
- host-interaction/service/query-service-configuration.yml
- linking/runtime-linking/resolve-function-by-brute-ratel-badger-hash.yml
- linking/static/aplib/linked-against-aplib.yml
- load-code/shellcode/execute-shellcode-via-windows-callback-function.yml
- nursery/check-for-sandbox-via-mac-address-ouis-in-dotnet.yml
- nursery/compiled-with-exescript.yml
- nursery/covertly-decode-and-write-data-to-windows-directory-using-indirect-calls.yml
- nursery/hash-data-using-sha512managed-in-dotnet.yml
- persistence/act-as-dhcp-server-callout-dll.yml
- persistence/act-as-dns-server-plugin-dll.yml
- persistence/authentication-process/act-as-security-support-provider-dll.yml
- persistence/authentication-process/act-as-subauthentication-package-dll.yml
- persistence/exchange/act-as-exchange-transport-agent.yml
- persistence/office/act-as-excel-xll-add-in.yml
- persistence/office/act-as-office-com-add-in.yml
- persistence/office/act-as-word-wll-add-in.yml
Modified rules (22)
- anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml
- anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
- collection/microphone/capture-microphone-audio.yml
- communication/http/reference-http-user-agent-string.yml
- communication/socket/create-raw-socket.yml
- data-manipulation/compression/compress-data-via-zlib-inflate-or-deflate.yml
- data-manipulation/encryption/rsa/reference-public-rsa-key.yml
- data-manipulation/hashing/fnv/hash-data-using-fnv.yml
- executable/resource/extract-resource-via-kernel32-functions.yml
- host-interaction/clipboard/read-clipboard-data.yml
- host-interaction/clipboard/write-clipboard-data.yml
- host-interaction/file-system/copy/copy-file.yml
- host-interaction/file-system/get-common-file-path.yml
- host-interaction/file-system/read/read-file-on-windows.yml
- host-interaction/file-system/reference-absolute-stream-path-on-windows.yml
- host-interaction/file-system/write/write-file-on-windows.yml
- host-interaction/service/stop/stop-service.yml
- impact/wipe-disk/wipe-mbr/overwrite-master-boot-record-mbr.yml
- lib/create-or-open-file.yml
- lib/get-os-version.yml
- load-code/pe/enumerate-pe-sections.yml
- nursery/encrypt-data-using-aes.yml
Renamed rules (3)
- anti-analysis/anti-debugging/debugger-evasion/hide-thread-from-debugger.yml (was nursery/hide-thread-from-debugger.yml)
- [host-interaction/file-system/get-windows-directory-from-kuser_shared_data.yml](https://github.com/mandiant/capa-rules/blob/v6.0.0/ho...
v5.1.0
Summary
Added: 24 rules
Modified: 38 rules
Renamed: 7 rules
Deleted: 0 rules
Detailed release changes: rules v5.0.0...v5.1.0
Added rules (24)
- communication/http/get-http-content-length.yml
- communication/http/reference-http-user-agent-string.yml
- communication/ip/convert-ip-address-from-string.yml
- communication/socket/create-raw-socket.yml
- data-manipulation/compression/compress-data-via-zlib-inflate-or-deflate.yml
- data-manipulation/encryption/xtea/encrypt-data-using-xtea.yml
- data-manipulation/encryption/xxtea/encrypt-data-using-xxtea.yml
- data-manipulation/prng/generate-random-numbers-via-rtlgenrandom.yml
- executable/installer/dotnet/packaged-as-single-file-dotnet-application.yml
- nursery/check-for-minimum-number-of-windows-on-screen.yml
- nursery/check-for-windows-sandbox-via-subdirectory.yml
- nursery/compiled-with-cx_freeze.yml
- nursery/contain-a-thread-local-storage-tls-section-in-dotnet.yml
- nursery/create-zip-archive-in-dotnet.yml
- nursery/destroy-software-breakpoint-capability.yml
- nursery/enumerate-pe-sections-in-dotnet.yml
- nursery/get-http-request-uri.yml
- nursery/hash-data-using-ripemd128.yml
- nursery/hash-data-using-ripemd256.yml
- nursery/hash-data-using-ripemd320.yml
- nursery/move-directory.yml
- nursery/send-data-to-internet.yml
- nursery/set-web-proxy-in-dotnet.yml
- persistence/scheduled-tasks/schedule-task-via-at.yml
Modified rules (38)
- anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml
- anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
- anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml
- anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-genuine-state.yml
- anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-process-name.yml
- anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-registry.yml
- anti-analysis/reference-analysis-tools-strings.yml
- collection/get-geographical-location.yml
- collection/network/get-mac-address-on-windows.yml
- communication/http/client/check-http-status-code.yml
- communication/http/set-http-header.yml
- communication/named-pipe/connect/connect-pipe.yml
- communication/named-pipe/create/create-pipe.yml
- communication/send-data.yml
- communication/socket/receive/receive-data-on-socket.yml
- communication/socket/send/send-data-on-socket.yml
- communication/socket/udp/send/create-udp-socket.yml
- compiler/rust/compiled-with-rust.yml
- data-manipulation/hashing/md5/hash-data-with-md5.yml
- data-manipulation/hashing/sha1/hash-data-using-sha1.yml
- host-interaction/clipboard/read-clipboard-data.yml
- host-interaction/file-system/create/create-directory.yml
- host-interaction/file-system/delete/delete-file.yml
- host-interaction/file-system/exists/check-if-file-exists.yml
- host-interaction/file-system/files/list/enumerate-files-on-windows.yml
- host-interaction/file-system/files/list/enumerate-files-recursively.yml
- host-interaction/file-system/reference-absolute-stream-path-on-windows.yml
- host-interaction/process/list/enumerate-processes-via-ntquerysysteminformation.yml
- host-interaction/registry/create/set-registry-value.yml
- host-interaction/registry/query-or-enumerate-registry-key.yml
- host-interaction/registry/query-or-enumerate-registry-value.yml
- linking/runtime-linking/link-function-at-runtime-on-windows.yml
- load-code/pe/enumerate-pe-sections.yml
- load-code/pe/parse-pe-header.yml
- nursery/check-for-process-debug-object.yml
- [nursery/check-for-wi...