Search results

detect communication via NTSocket

rule idea

Status: Open.

#1059 In mandiant/capa-rules;

· Still34 opened on Jul 18, 2025

Capa not detecting basic meterpreter exe - no capabilities found

Status: Open.

#1057 In mandiant/capa-rules;

· crimsoncore opened on Jun 23, 2025

execute shellcode via Windows callback function

false positiveFalse positive rule hitFalse positive rule hit

Status: Open.

#1056 In mandiant/capa-rules;

· mike-hunhoff opened on Jun 20, 2025

dotnet: load assembly via RuntimeAssembly.nLoadImage

rule idea

Status: Open.

#1054 In mandiant/capa-rules;

· mike-hunhoff opened on Jun 16, 2025

add detection(s) for CLRvoyance loading techniques

rule idea

Status: Open.

#1053 In mandiant/capa-rules;

· mike-hunhoff opened on Jun 4, 2025

detect mouse movement analysis for sandbox evasion

rule idea

Status: Open.

#1050 In mandiant/capa-rules;

· tevjd opened on May 28, 2025

detect opening of services often referenced by ransomware

good first issueGood for newcomersGood for newcomers

help wantedExtra attention is neededExtra attention is needed

rule idea

Status: Open.

#1048 In mandiant/capa-rules;

· mike-hunhoff opened on May 22, 2025

failed to detect RC4 usage in StealcV2

false negativerule expected to match but doesntrule expected to match but doesnt

Status: Open.

#1043 In mandiant/capa-rules;

· Still34 opened on Apr 26, 2025

Support ATT&CK v17 detections for ESXi platform

rule idea

Status: Open.

#1042 In mandiant/capa-rules;

· fariss opened on Apr 24, 2025

detect journalctl/systemctl/systemd interactions on Linux

rule idea

Status: Open.

#1041 In mandiant/capa-rules;

· Still34 opened on Apr 18, 2025

persist via Run registry key

false positiveFalse positive rule hitFalse positive rule hit

Status: Open.

#1037 In mandiant/capa-rules;

· mike-hunhoff opened on Mar 25, 2025

discover Group Policy via gpresult

false positiveFalse positive rule hitFalse positive rule hit

Status: Open.

#1036 In mandiant/capa-rules;

· mike-hunhoff opened on Mar 25, 2025