mandiant

mandiant/capa-rules

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

12 good first / help-wanted issues · last activity Jul 28, 2026

726 stars 238 forks 726 watchers Apache License 2.0
View on GitHub Website
12 Open Issues Need Help Last updated: Jul 28, 2026

Open Issues Need Help

View All on GitHub
add rule coverage for SearchPathA/W 3 months ago
good first issue help wanted rule idea
mandiant/capa-rules
726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

dotnet: NetworkInterface.GetIsNetworkAvailable 6 months ago
good first issue rule idea
mandiant/capa-rules
726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

check coverage of anti-profiling techniques used by ConfuserEx .NET obfuscator 7 months ago
good first issue rule idea
mandiant/capa-rules
726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

rule idea: zlib fast inflate 7 months ago
good first issue rule idea
mandiant/capa-rules
726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

check .NET-Anti-Debug coverage 8 months ago
good first issue rule idea
mandiant/capa-rules
726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

Linux kernel rootkit techniques 8 months ago
good first issue help wanted rule idea
mandiant/capa-rules
726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

use word boundaries to reduce FPs when detecting strings using regular expressions 8 months ago
good first issue help wanted false positive
mandiant/capa-rules
726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

Add sc.exe command to the create-service.yml rule 8 months ago
good first issue
mandiant/capa-rules
726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

persist via Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 8 months ago
good first issue help wanted rule idea
mandiant/capa-rules
726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

persist via Windows service 9 months ago
good first issue help wanted false positive
mandiant/capa-rules
726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

dotnet: add coverage for HttpClient class 12 months ago
good first issue help wanted rule idea
mandiant/capa-rules
726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

add ZwTerminateProcess about 1 year ago

AI Summary: This GitHub issue proposes adding a new rule to the `capa-rules` repository. The new rule would specifically detect the use of the `ZwTerminateProcess` native API function. This enhancement aims to broaden the `terminate-process.yml` rule set to identify more methods of process termination.

Complexity: 1/5
good first issue help wanted rule idea
mandiant/capa-rules
726

Standard collection of rules for capa: the tool for enumerating the capabilities of programs