mandiant / mandiant/capa-rules
suggested rule improvements
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 736
- Forks
- 245
- Avg merge
- 4d 53m
- Merged PRs (30d)
- 2
Description
btw, here's is a loose collection of things that bumped my while converting the rules to yara. none of them is really bad but they could be improved:
* lots of regexes contain .* which yara complains about because it slows down the search. had to convert them to {,1000}
* capa accepts "string: /com/exe4j/runtime/exe4jcontroller/i" without escaping the inner slashes
* there were several regexes like e.g. string: /A09E667F3BCC908B/i which could be perfectly done with string search but there's no way to ignore casing on strings.
_Originally posted by @ruppde in https://github.com/fireeye/capa-rules/issues/384#issuecomment-842685775_
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the three concerns described in the issue: unbounded regex patterns, unescaped inner slashes, and case-insensitive literal strings. First determine which capa rule files and YARA conversion behavior are involved; done would require a specific, agreed scope and validation that the affected rules remain equivalent and performant.
Written by the indexing model from the issue text.
Assessment
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100