mandiant/capa-rules

View on GitHub

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

Stars: 736
Forks: 245
Open beginner issues: 0
Indexed issues: 124
Avg merge: 4d 53m
Merged PRs (30d): 2

Dominant language: No language data
License: Apache-2.0
Last GitHub push: Sep 8, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: No code of conduct
Beginner labels: good first issue help wanted

Beginner friendly Everything

Open All

124 open issues indexed

[encrypt data using RC4 PRGA] False positive on string validators Open

false positive

Difficulty 4/5 3-5 days Newbie friendliness 45/100

mandiant/capa-rules#1193 · Opened Aug 19, 2026
`hide graphical window from taskbar` declares dynamic: call but requires a mnemonic on every path Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

mandiant/capa-rules#1191 · 1 comment · Opened Aug 15, 2026
open VM devices Open

rule idea

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

mandiant/capa-rules#1188 · Opened Aug 14, 2026
check heap flags Open

rule idea

Difficulty 4/5 3-5 days Newbie friendliness 38/100

mandiant/capa-rules#1187 · Opened Aug 14, 2026
FP: BeingDebugged flag due to offset by register Open

false negative

Difficulty 3/5 1-2 days Newbie friendliness 45/100

mandiant/capa-rules#1182 · 1 comment · Opened Aug 14, 2026
check for analysis tools listening on a local port Open

rule idea

Difficulty 2/5 1-3 hours Newbie friendliness 64/100

mandiant/capa-rules#1181 · 1 comment · Opened Aug 14, 2026
FP: check for time delay via GetTickCount Open

false positive

Difficulty 3/5 1-2 days Newbie friendliness 48/100

mandiant/capa-rules#1180 · 1 comment · Opened Aug 14, 2026
triage PATCHCORD malware for new capa rules Open

rule idea

Difficulty 4/5 3-5 days Newbie friendliness 42/100

mandiant/capa-rules#1176 · 1 comment · Opened Aug 14, 2026
PPID spoofing via PROC_THREAD_ATTRIBUTE_PARENT_PROCESS not detected Open

false negative

Difficulty 3/5 1-2 days Newbie friendliness 52/100

mandiant/capa-rules#1145 · 1 comment · Opened Mar 21, 2026
hijack DLL search order via directory manipulation + dynamic loading Open

rule idea

Difficulty 3/5 1-2 days Newbie friendliness 48/100

mandiant/capa-rules#1144 · Opened Mar 21, 2026
use word boundaries to reduce FPs when detecting strings using regular expressions Open

false positive good first issue help wanted

mandiant/capa-rules#1109 · 9 comments · 2 reactions · 1 assignee · Opened Jan 28, 2026
persist via Windows service Open

false positive good first issue help wanted

Difficulty 3/5 1-2 days Newbie friendliness 38/100

mandiant/capa-rules#1100 · 2 comments · Opened Jan 22, 2026
[64-bit execution via heavens gate] current rule misses obfuscated variants Open

false negative

Difficulty 5/5 Over a week Newbie friendliness 30/100

mandiant/capa-rules#1096 · 2 comments · Opened Jan 1, 2026
Document shellcode execution via ReadDirectoryChanges Open

rule idea

Difficulty 4/5 3-5 days Newbie friendliness 35/100

mandiant/capa-rules#1095 · Opened Dec 24, 2025
mimikatz.exe_: encrypt data using speck Open

false positive

Difficulty 3/5 1-2 days Newbie friendliness 38/100

mandiant/capa-rules#1091 · 6 comments · Opened Dec 3, 2025
mimikatz.exe_: enumerate PE sections Open

false positive

Difficulty 3/5 1-2 days Newbie friendliness 35/100

mandiant/capa-rules#1090 · Opened Dec 3, 2025
parse credit card data Open

false positive

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

mandiant/capa-rules#1088 · Opened Dec 1, 2025
fn: dynamic: "reference analysis tools strings" Open

false negative

mandiant/capa-rules#1083 · 3 comments · 1 assignee · Opened Nov 12, 2025
Capa not detecting basic meterpreter exe - no capabilities found Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

mandiant/capa-rules#1057 · 3 comments · Opened Jun 23, 2025
execute shellcode via Windows callback function Open

false positive

Difficulty 3/5 1-2 days Newbie friendliness 30/100

mandiant/capa-rules#1056 · Opened Jun 20, 2025
add detection(s) for CLRvoyance loading techniques Open

rule idea

Difficulty 4/5 3-5 days Newbie friendliness 25/100

mandiant/capa-rules#1053 · Opened Jun 4, 2025
detect mouse movement analysis for sandbox evasion Open

rule idea

Difficulty 3/5 1-2 days Newbie friendliness 30/100

mandiant/capa-rules#1050 · 1 comment · Opened May 28, 2025
detect opening of services often referenced by ransomware Open

good first issue help wanted rule idea

Difficulty 3/5 1-2 days Newbie friendliness 45/100

mandiant/capa-rules#1048 · 1 comment · Opened May 22, 2025
Support ATT&CK v17 detections for ESXi platform Open

rule idea

Difficulty 4/5 3-5 days Newbie friendliness 35/100

mandiant/capa-rules#1042 · 1 reaction · Opened Apr 24, 2025
detect journalctl/systemctl/systemd interactions on Linux Open

rule idea

Difficulty 3/5 1-2 days Newbie friendliness 45/100

mandiant/capa-rules#1041 · Opened Apr 18, 2025
persist via Run registry key Open

false positive

Difficulty 4/5 3-5 days Newbie friendliness 32/100

mandiant/capa-rules#1037 · 1 reaction · Opened Mar 25, 2025
discover Group Policy via gpresult Open

false positive

Difficulty 3/5 1-2 days Newbie friendliness 35/100

mandiant/capa-rules#1036 · Opened Mar 25, 2025
disable AppInit_DLLs code signature enforcement Open

false positive

Difficulty 3/5 1-2 days Newbie friendliness 35/100

mandiant/capa-rules#1035 · 2 comments · Opened Mar 25, 2025
acquire credentials from Windows credential manager Open

false positive

Difficulty 3/5 1-2 days Newbie friendliness 32/100

mandiant/capa-rules#1030 · Opened Mar 19, 2025
dynamic: "create thread bypassing process freeze" FPs Open

false positive

Difficulty 3/5 1-2 days Newbie friendliness 45/100

mandiant/capa-rules#1023 · Opened Mar 14, 2025
patch process command line Open

false negative

Difficulty 5/5 Over a week Newbie friendliness 35/100

mandiant/capa-rules#1020 · 2 reactions · Opened Mar 13, 2025
bytes feature unable to detect CLSID/RID when pushed via stack Open

false negative

Difficulty 4/5 3-5 days Newbie friendliness 28/100

mandiant/capa-rules#996 · 2 comments · Opened Feb 14, 2025
false negative for screenshot Open

false negative good first issue help wanted

mandiant/capa-rules#981 · 7 comments · 1 assignee · Opened Jan 17, 2025
consider appending "via [insert_name] assembly" to applicable rule names Open

enhancement good first issue

mandiant/capa-rules#979 · 3 comments · 1 assignee · Opened Jan 8, 2025
detect socks5 proxy capabilities Open

good first issue help wanted rule idea

mandiant/capa-rules#971 · 15 comments · 2 reactions · 1 assignee · Opened Dec 6, 2024
derive capa rules from yara-rules capabilities Open

rule idea

Difficulty 5/5 Over a week Newbie friendliness 25/100

mandiant/capa-rules#968 · Opened Nov 25, 2024
detect BITS usage in general Open

good first issue rule idea

Difficulty 4/5 3-5 days Newbie friendliness 30/100

mandiant/capa-rules#967 · 3 comments · Opened Nov 25, 2024
dotnet: create new scheduled task via TaskService Open

good first issue rule idea

Difficulty 3/5 1-2 days Newbie friendliness 35/100

mandiant/capa-rules#959 · 9 comments · Opened Nov 7, 2024
access PEB ldr_data Open

false positive

Difficulty 3/5 1-2 days Newbie friendliness 35/100

mandiant/capa-rules#946 · 1 reaction · Opened Oct 21, 2024
reconsider att&ck classification for get/set-uefi-variable.yml Open

att&ck false positive

Difficulty 4/5 3-5 days Newbie friendliness 35/100

mandiant/capa-rules#944 · 3 comments · 2 reactions · Opened Oct 7, 2024
reference anti-VM strings targeting VirtualBox Open

false positive

Difficulty 3/5 1-2 days Newbie friendliness 25/100

mandiant/capa-rules#934 · Opened Sep 24, 2024
delay execution: add Beep WinAPI Open

rule idea

Difficulty 3/5 1-2 days Newbie friendliness 38/100

mandiant/capa-rules#915 · 1 reaction · Opened Jul 26, 2024
rule idea: modify PendingFileRenameOperations to delete, rename, or move file across reboots Open

rule idea

Difficulty 4/5 3-5 days Newbie friendliness 25/100

mandiant/capa-rules#911 · Opened Jul 11, 2024
Create new rule with LoadLibrary, etc. APIs Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

mandiant/capa-rules#909 · Opened Jun 14, 2024
Rules to find interesting code Open

rule idea

Difficulty 5/5 Over a week Newbie friendliness 25/100

mandiant/capa-rules#898 · Opened May 16, 2024
parse-credit-card-information -> mimikatz.exe_:0x444E02 Open

false positive

Difficulty 4/5 3-5 days Newbie friendliness 25/100

mandiant/capa-rules#897 · 1 reaction · Opened May 3, 2024
[obfuscated-with-litcrypt] Open

rule idea

Difficulty 3/5 1-2 days Newbie friendliness 45/100

mandiant/capa-rules#889 · 1 reaction · Opened Mar 23, 2024
Support ATT&CK v14.1 Techniques Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

mandiant/capa-rules#887 · 3 comments · Opened Mar 6, 2024
find/reference Explorer window Open

rule idea

Difficulty 4/5 3-5 days Newbie friendliness 25/100

mandiant/capa-rules#881 · Opened Feb 13, 2024
TLS client via OpenSSL Open

rule idea

Difficulty 4/5 3-5 days Newbie friendliness 25/100

mandiant/capa-rules#880 · Opened Feb 7, 2024

mandiant/capa-rules

Get new issues in your inbox