-
Notifications
You must be signed in to change notification settings - Fork 235
Pull requests: mandiant/capa-rules
Author
Label
Projects
Milestones
Reviews
Assignee
Sort
Pull requests list
rule: reference ConfuserEx anti-profiling (fixes #602)
#1150
opened Mar 28, 2026 by
Nitezio
Loading…
update screenshot rule: add display regex and GDI+ routines
#1148
opened Mar 23, 2026 by
cipherBT
Loading…
add rule for detecting opening of service by ransomwares
#1146
opened Mar 21, 2026 by
cipherBT
Loading…
rules: add nursery rule for systemd CLI interaction on Linux
#1141
opened Mar 14, 2026 by
akshat4703
Contributor
Loading…
rules: add nursery rule for shellcode execution via ReadDirectoryChanges
#1140
opened Mar 14, 2026 by
akshat4703
Contributor
Loading…
add ProcDump-based LSASS memory dump detection
#1139
opened Mar 13, 2026 by
akshat4703
Contributor
Loading…
Add .NET Environment.TickCount timing anti-debug rule
#1137
opened Mar 12, 2026 by
aryanyk
Contributor
Loading…
improve Heaven's Gate detection for computed selector variants
#1127
opened Feb 26, 2026 by
akshat4703
Contributor
Loading…
persistence: restrict registry-based service detection to service-specific values (fix #1100)
#1126
opened Feb 25, 2026 by
reyyanxahmed
Loading…
add word boundaries to regex patterns to reduce false positives
#1125
opened Feb 24, 2026 by
Shaktisinhchavda
Loading…
reduce false positives in credential manager, credit-card parsing, an…
#1123
opened Feb 23, 2026 by
akshat4703
Contributor
Loading…
Add new rule to detect ransomware disabling backup/recovery services
#1122
opened Feb 22, 2026 by
0ameyasr
Loading…
add word boundary to del regex to prevent false positives
#1120
opened Feb 18, 2026 by
devarjya27
Contributor
Loading…
warn if latest release and rules are not compatible
#933
opened Sep 24, 2024 by
mr-tz
Collaborator
Loading…
Additional rules to support capa-scripts.
dont merge
Indicate a PR that is still being worked on
#603
opened Aug 4, 2022 by
adamstorek
Loading…
ProTip!
Type g i on any issue or pull request to go back to the issue listing page.