-
Notifications
You must be signed in to change notification settings - Fork 237
Issues
is:issue state:open
is:issue state:open
Issue creation is restricted in this repository
Search results
PPID spoofing via PROC_THREAD_ATTRIBUTE_PARENT_PROCESS not detected
false negativerule expected to match but doesntrule expected to match but doesntStatus: Open.#1145 In mandiant/capa-rules;- Status: Open.#1144 In mandiant/capa-rules;
use word boundaries to reduce FPs when detecting strings using regular expressions
false positiveFalse positive rule hitFalse positive rule hitgood first issueGood for newcomersGood for newcomershelp wantedExtra attention is neededExtra attention is neededStatus: Open.#1109 In mandiant/capa-rules;persist via Windows service
false positiveFalse positive rule hitFalse positive rule hitgood first issueGood for newcomersGood for newcomershelp wantedExtra attention is neededExtra attention is neededStatus: Open.#1100 In mandiant/capa-rules;[64-bit execution via heavens gate] current rule misses obfuscated variants
false negativerule expected to match but doesntrule expected to match but doesntStatus: Open.#1096 In mandiant/capa-rules;- Status: Open.#1095 In mandiant/capa-rules;
mimikatz.exe_: encrypt data using speck
false positiveFalse positive rule hitFalse positive rule hitStatus: Open.#1091 In mandiant/capa-rules;mimikatz.exe_: enumerate PE sections
false positiveFalse positive rule hitFalse positive rule hitStatus: Open.#1090 In mandiant/capa-rules;parse credit card data
false positiveFalse positive rule hitFalse positive rule hitStatus: Open.#1088 In mandiant/capa-rules;fn: dynamic: "reference analysis tools strings"
false negativerule expected to match but doesntrule expected to match but doesntStatus: Open.#1083 In mandiant/capa-rules;- Status: Open.#1057 In mandiant/capa-rules;
execute shellcode via Windows callback function
false positiveFalse positive rule hitFalse positive rule hitStatus: Open.#1056 In mandiant/capa-rules;