52 weeks of capa rules

[mr-tz]

Willi

• 01 - 01/02/23
  • execute via .NET startup hook
  • compiled with Nuitka
  • authenticate data with MD5-MAC
• 02 - 01/09/23
  • more SHA1 constants #657
  • SHA256, SHA386, SHA512 updates
• 03 - 01/16/23
  • add whirlpool hash #665
  • rc5/6: more constants #666
  • add TEA encryption #667
• 04 - 01/23/23
  • add base58 #669
  • des: add more constants from libtomcrypt #672
  • add create-mailslot #673
• 05 - 01/30/23
  • add create tcp socket via raw AFD driver #680
  • add section access/map rules #681
• 06 - 02/06/23
  • generate random numbers via RtlGenRandom #698
• 07 - 02/13/23
  • add get http content length #704
• 08 - 02/20/23
  • add get http query uri #714
• 09 - 02/27/23
• 10 - 03/06/23
• 11 - 03/13/23
• 12 - 03/20/23
• 13 - 03/27/23
• 14 - 04/03/23
• 15 - 04/10/23
• 16 - 04/17/23
• 17 - 04/24/23
• 18 - 05/01/23
• 19 - 05/08/23
• 20 - 05/15/23
• 21 - 05/22/23
• 22 - 05/29/23
• 23 - 06/05/23
• 24 - 06/12/23
• 25 - 06/19/23
• 26 - 06/26/23
• 27 - 07/03/23
• 28 - 07/10/23
• 29 - 07/17/23
• 30 - 07/24/23
• 31 - 07/31/23
• 32 - 08/07/23
• 33 - 08/14/23
• 34 - 08/21/23
• 35 - 08/28/23
• 36 - 09/04/23
• 37 - 09/11/23
• 38 - 09/18/23
• 39 - 09/25/23
• 40 - 10/02/23
• 41 - 10/09/23
• 42 - 10/16/23
• 43 - 10/23/23
• 44 - 10/30/23
• 45 - 11/06/23
• 46 - 11/13/23
• 47 - 11/20/23
• 48 - 11/27/23
• 49 - 12/04/23
• 50 - 12/11/23
• 51 - 12/18/23
• 52 - 12/25/23

[mr-tz]

Moritz

• 01 - 01/02/23 Rules 2023 01 #644
• 02 - 01/09/23 improve rules that often match #655, Adjusted rules for the ELF BEACON sample shared by Intezer #654
• 03 - 01/16/23 add stack strings MBC #668, add upper limit for basic block count #661, add library rule and new api #662
• 04 - 01/23/23 - add stack strings MBC #668, Rules for the week #671
• 05 - 01/30/23 - LZO compression / decompression rules continued #677
• 06 - 02/06/23 - add rule: convert IP address #697
• 07 - 02/13/23 - add HTTP User-Agent rule #702
• 08 - 02/20/23 - DNS and crypto rule tweaks #713
• 09 - 02/27/23 - specify offset operand to reduce FPs #716
• 10 - 03/06/23 - improve debug detection features #721
• 11 - 03/13/23 - update and add rules #726
• 12 - 03/20/23 - Update read-clipboard-data.yml #732
• 13 - 03/27/23 - add rule to detect cx_Freeze compiled binaries #740
• 14 - 04/03/23 - add AES constant variants #743
• 15 - 04/10/23 - Update reference-public-rsa-key.yml #745
• 16 - 04/17/23 - AES MixColumns detection #749
• 17 - 04/24/23 - loosen locality of features #750
• 18 - 05/01/23 - Rules based on Practical Malware Analysis Labs #296
• 19 - 05/08/23 - match on create or open file library rule #758
• 20 - 05/15/23 - remove very common .rsrc section rule #761
• 21 - 05/22/23 - Improve clipboard rules #763
• 22 - 05/29/23 - Add LZ* functions #769
• 23 - 06/05/23 - add rule enumerate devices by category #773
• 24 - 06/12/23 - Update CLSID and add two service-related rules #774
• 25 - 06/19/23 - query service configuration #777
• 26 - 06/26/23 - Add two imports #780
• 27 - 07/03/23 - add winmm wave functions #791
• 28 - 07/10/23 - Update act-as-credential-manager-dll.yml #799
• 29 - 07/17/23 - Update self-delete.yml #802
• 30 - 07/24/23 - Create enumerate-device-drivers-on-windows.yml #803
• 31 - 07/31/23 - Create enumerate-device-drivers-on-linux.yml #804
• 32 - 08/07/23 - Update .NET JSON detections #813
• 33 - 08/14/23 - fix example function address #815
• 34 - 08/21/23 - add send SMS on Android #818
• 35 - 08/28/23 - add get ntoskrnl base address #822
• 36 - 09/04/23 - add xxProtectVirtualMemory apis #826
• 37 - 09/11/23 - Update generate-random-numbers-via-rtlgenrandom.yml #828
• 38 - 09/18/23 - Create add-value-to-global-atom-table.yml #831
• 39 - 09/25/23 - Create capture-process-snapshot.yml #833
• 40 - 10/02/23 - Create log-keystrokes-via-input-method-manager.yml #834
• 41 - 10/09/23 - Update and refactor memory allocation/permission rules #836
• 42 - 10/16/23 - Upgrade rules for static and dynamic scopes #837
• 43 - 10/23/23 - Upgrade rules for static and dynamic scopes #837
• 44 - 10/30/23 - upgrade rules using updated script #839
• 45 - 11/06/23 - upgrade rules using updated script #839
• 46 - 11/13/23 - Update encode-data-using-base64-via-winapi.yml #845
• 47 - 11/20/23 - upgrade rules using updated script #839
• 48 - 11/27/23 - upgrade rules using updated script #839
• 49 - 12/04/23 - fix logic after dynamic update #857
• 50 - 12/11/23 - Update TLS namespaces #863
• 51 - 12/18/23 - Use COM instead of bytes features #864
• 52 - 12/25/23 - Pull out .NET features #866

[mr-tz]

Mike

• 01 - 01/02/23 new + updated .NET rules #639
• 02 - 01/09/23 52 Weeks of capa Rules - 2 #663
• 03 - 01/16/23
• 04 - 01/23/23
• 05 - 01/30/23 adding rules to detect .NET reflection techniques #690
• 06 - 02/06/23 adding "packaged as single-file .NET application" #699
• 07 - 02/13/23 update .NET detections #703
• 08 - 02/20/23 update recieve-data-on-socket for .NET #707, improve .NET detections incl. sockets, files, directories #708
• 09 - 02/27/23 improve .NET detections for ZIP compression and OS detection #715
• 10 - 03/06/23 improve .NET detections for registry access and web proxy usage #723
• 11 - 03/13/23 update rule documentation and improve .NET detection for OS gather #724
• 12 - 03/20/23 improve geo collection and .NET data upload detections #738
• 13 - 03/27/23 improve detections for pipe creation/connection in .NET #739 add new rule to detect .NET files w/ uncommon TLS section #741
• 14 - 04/03/23
• 15 - 04/10/23
• 16 - 04/17/23
• 17 - 04/24/23
• 18 - 05/01/23
• 19 - 05/08/23
• 20 - 05/15/23
• 21 - 05/22/23
• 22 - 05/29/23
• 23 - 06/05/23
• 24 - 06/12/23
• 25 - 06/19/23
• 26 - 06/26/23
• 27 - 07/03/23
• 28 - 07/10/23
• 29 - 07/17/23
• 30 - 07/24/23
• 31 - 07/31/23
• 32 - 08/07/23
• 33 - 08/14/23
• 34 - 08/21/23
• 35 - 08/28/23 adding new rules based on private Linux sample(s) #821
• 36 - 09/04/23 init add of Xamarin rules #824
• 37 - 09/11/23
• 38 - 09/18/23
• 39 - 09/25/23
• 40 - 10/02/23
• 41 - 10/09/23
• 42 - 10/16/23
• 43 - 10/23/23
• 44 - 10/30/23
• 45 - 11/06/23
• 46 - 11/13/23
• 47 - 11/20/23
• 48 - 11/27/23
• 49 - 12/04/23
• 50 - 12/11/23
• 51 - 12/18/23
• 52 - 12/25/23