mandiant / mandiant/capa-rules
create process suspended
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 736
- Forks
- 245
- Avg merge
- 4d 53m
- Merged PRs (30d)
- 2
Description
## Summary
`create process suspended`: a sample with a large basic block that includes `CreateProcessAsUserW` and the number `4` is resulting in a FP for this rule.
## Examples
`574f3513f6d7e15f102e82e4d35bf164:0x404E4F`
## Possible improvements
Identify function arguments and refine rules so that, in this case, one could specify the number must be an argument to the function. Another thought: the ability to state a rule element (e.g., number) must be within X bytes (before, after, or both) of the API call.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by examining the `create process suspended` rule and the sample `574f3513f6d7e15f102e82e4d35bf164:0x404E4F`, focusing on the `CreateProcessAsUserW` call and the number `4`. Investigate how function arguments and byte proximity can be represented in the rule system. Done means this sample no longer produces a false positive while intended detections remain covered.
Written by the indexing model from the issue text.
Assessment
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100