mandiant / mandiant/capa-rules
check for analysis tools listening on a local port
Open
Beginner friendly
Nobody has claimed this yet.
rule idea
- Dominant language
- No language data
- Stars
- 736
- Forks
- 245
- Avg merge
- 4d 53m
- Merged PRs (30d)
- 2
Description
5e17360d32e9b272bb7e1b97c8e4dca34622ec9ce08fd240fe2758cc3f67dc4a:0x1400016fb
rule:
meta:
name: check for analysis tools listening on local ports
namespace: <insert_namespace>
authors:
- wballenthin@hex-rays.com
scopes:
static: function
dynamic: unsupported
examples:
- F3D8530A2B81D1871C2F96E064291AD0:0x1400016fb
features:
- and:
- api: GetTcpTable
- instruction:
- description: pTcpTable->dwLocalPort
- operand[1].offset: 0xC
- mnemonic: movzx
- or:
- operand[1].number: 8888
- operand[1].number: 8080
- operand[1].number: 9999
- operand[1].number: 8000
- operand[1].number: 8443
- operand[1].number: 5000
- operand[1].number: 31337
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the provided YAML rule and existing capa-rules conventions for choosing the namespace. Validate the rule against example F3D8530A2B81D1871C2F96E064291AD0:0x1400016fb and confirm that it matches GetTcpTable, the local-port field access, and the listed port values without matching unsupported dynamic analysis.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- yaml
- Domain
- reverse-engineering, security
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 64/100