mandiant / mandiant/capa-rules
rules for ELF/Linux sample
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 736
- Forks
- 245
- Avg merge
- 4d 53m
- Merged PRs (30d)
- 2
Description
even when the OS is specified manually, we don't get many results. we should spend some time writing rules that match the interesting behavior for this ELF/Linux sample:
```
capa tests/data/72f1b91327ffda4cf18a2bf64913b673d39ebbff8cbe50c9cd354b1dcd312bcc --os linux
matching: 100%|████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 297/297 [00:04<00:00, 63.43 functions/s, skipped 0 library functions]
+------------------------+------------------------------------------------------------------------------------+
| md5 | 2bf18d0403677378adad9001b1243211 |
| sha1 | 21693bf5c29c5dbc973047e0c1607ebdd000de9b |
| sha256 | 72f1b91327ffda4cf18a2bf64913b673d39ebbff8cbe50c9cd354b1dcd312bcc |
| os | linux |
| format | elf |
| arch | amd64 |
| path | tests/data/72f1b91327ffda4cf18a2bf64913b673d39ebbff8cbe50c9cd354b1dcd312bcc |
+------------------------+------------------------------------------------------------------------------------+
+------------------------------------------------------+------------------------------------------------------+
| CAPABILITY | NAMESPACE |
|------------------------------------------------------+------------------------------------------------------|
| reference Google Public DNS server | communication/dns |
+------------------------------------------------------+------------------------------------------------------+
```
_Originally posted by @williballenthin in https://github.com/mandiant/capa/issues/1402#issuecomment-1484040810_
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by running capa on tests/data/72f1b91327ffda4cf18a2bf64913b673d39ebbff8cbe50c9cd354b1dcd312bcc with --os linux and review the current capability output, which only identifies a Google Public DNS reference. Study the sample's interesting behavior and add matching rules; done means the sample reports those capabilities in addition to the existing DNS result.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- reverse-engineering, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 32/100