mandiant / mandiant/capa-rules
communicate via Twitter
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 736
- Forks
- 245
- Avg merge
- 4d 53m
- Merged PRs (30d)
- 2
Description
## Rule name
`communicate via Twitter`
## Summary
Use legitimate Twitter service or web site as part of the binary's command and control (C2) communications.
## Possible test samples
Publicly available samples that may contain the capability this rule should detect (MD5 hashes):
- 32bb43f8847ecf158c1e96891ed9a28c
- d1ce79089578da2d41f1ad901f7b1014
## References
Links or references to additional information on the capability (can also be included in the rule):
- https://attack.mitre.org/techniques/T1102/
## Namespace
Proposed namespace: `communication/web-service`. More details in https://github.com/fireeye/capa-rules/blob/master/doc/format.md#rule-namespace
## att&ck
`aka.mitre.att&ck.t1102`
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the rule format guidance in doc/format.md and review the ATT&CK T1102 reference. Use the two listed MD5 hashes as sample references while determining how the rule should identify Twitter or another legitimate web service used for C2; done means the proposed communication/web-service rule detects the stated capability.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100