mandiant / mandiant/capa-rules

rules for ELF/Linux sample

Open
#736 14 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
No language data
Stars
736
Forks
245
Avg merge
4d 53m
Merged PRs (30d)
2

Description

even when the OS is specified manually, we don't get many results. we should spend some time writing rules that match the interesting behavior for this ELF/Linux sample:

```
capa tests/data/72f1b91327ffda4cf18a2bf64913b673d39ebbff8cbe50c9cd354b1dcd312bcc --os linux
matching: 100%|████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 297/297 [00:04<00:00, 63.43 functions/s, skipped 0 library functions]
+------------------------+------------------------------------------------------------------------------------+
| md5 | 2bf18d0403677378adad9001b1243211 |
| sha1 | 21693bf5c29c5dbc973047e0c1607ebdd000de9b |
| sha256 | 72f1b91327ffda4cf18a2bf64913b673d39ebbff8cbe50c9cd354b1dcd312bcc |
| os | linux |
| format | elf |
| arch | amd64 |
| path | tests/data/72f1b91327ffda4cf18a2bf64913b673d39ebbff8cbe50c9cd354b1dcd312bcc |
+------------------------+------------------------------------------------------------------------------------+

+------------------------------------------------------+------------------------------------------------------+
| CAPABILITY | NAMESPACE |
|------------------------------------------------------+------------------------------------------------------|
| reference Google Public DNS server | communication/dns |
+------------------------------------------------------+------------------------------------------------------+
```

_Originally posted by @williballenthin in https://github.com/mandiant/capa/issues/1402#issuecomment-1484040810_

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by running capa on tests/data/72f1b91327ffda4cf18a2bf64913b673d39ebbff8cbe50c9cd354b1dcd312bcc with --os linux and review the current capability output, which only identifies a Google Public DNS reference. Study the sample's interesting behavior and add matching rules; done means the sample reports those capabilities in addition to the existing DNS result.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux
Domain
reverse-engineering, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.