Skip to content

Pull requests: mandiant/capa-rules

New pull request New
13 Open 723 Closed
13 Open 723 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

Powershell expression
#1118 opened Feb 12, 2026 by saniyafatima07 Loading…
1
1
Add new rule persist-via-shellserviceobjectdelayload-registry-key.yml
#1117 opened Feb 12, 2026 by xpzhxhm Loading…
1
fix: escape + in Base64 string regex pattern
#1116 opened Feb 11, 2026 by vishwaksen-1 Loading…
1
4
Refine Speck detection using variant-specific rotation constants
#1115 opened Feb 10, 2026 by devarjya27 Loading…
1
Fix/persistence service registry fp
#1113 opened Jan 30, 2026 by AdityaSkhorne Loading…
5
rules: add QUIC / msquic detection rule
#1108 opened Jan 28, 2026 by AdityaSkhorne Loading…
6
add WinSock variants for UDP socket creation
#1104 opened Jan 25, 2026 by AdityaSkhorne Loading…
2
add WinSock variants for TCP socket creation
#1103 opened Jan 25, 2026 by AdityaSkhorne Loading…
3
feat(targeting): add cloud and container collection/interaction rules
#1098 opened Jan 19, 2026 by Maijin • Draft
8
Rename architecture-specific rules and update rule names inside YAML files
#1011 opened Feb 28, 2025 by akh7177 Loading…
1
44
Improve Screenshot Detection by Modifying capture-screenshot.yml
#1007 opened Feb 24, 2025 by akh7177 Loading…
1
19
warn if latest release and rules are not compatible
#933 opened Sep 24, 2024 by mr-tz Loading…
Additional rules to support capa-scripts. dont merge Indicate a PR that is still being worked on
#603 opened Aug 4, 2022 by adamstorek Loading…
19
ProTip! Type g p on any issue or pull request to go back to the pull request listing page.