mandiant / mandiant/capa-rules
synchronized fn callback execution (extend create-thread.yml)?
Open
rule idea
- Dominant language
- No language data
- Stars
- 736
- Forks
- 245
- Avg merge
- 4d 53m
- Merged PRs (30d)
- 2
Description
https://learn.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-initonceexecuteonce
Contributor guide
Research direction
Start with the linked Microsoft InitOnceExecuteOnce API documentation, then inspect create-thread.yml to understand the existing rule structure. Determine how synchronized callback execution should be represented there and confirm the expected rule behavior before making a change; the issue provides no tests or more specific completion criteria.
Written by the indexing model from the issue text.
Assessment
- Domain
- operating-systems
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100