mandiant / mandiant/capa-rules
[obfuscated-with-litcrypt]
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 736
- Forks
- 245
- Avg merge
- 4d 53m
- Merged PRs (30d)
- 2
Description
## Prerequisites
* [X ] Put an X between the brackets on this line if you have done all of the following:
* Checked that your rule idea isn't already filed: [search](https://github.com/mandiant/capa-rules/issues?q=is%3Aissue+is%3Aopen+)
## Summary
Target = Rust Binaries
LITCRYPT encrypts strings when compiling, keeping them encrypted in both disk and memory while running, and only decrypting them when needed.
## Examples
## Features
string: "litcrypt"
string: "litcrypt::litcrypt_internal"
## Additional context
## Rule details
### Namespace
anti-analysis/obfuscation/
### References
https://github.com/anvie/litcrypt.rs
### Other rule meta information
att&ck:
- Defense Evasion::Obfuscated Files or Information [T1027]
mbc:
- Anti-Static Analysis::Executable Code Obfuscation [B0032]
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the issue's LitCrypt reference and the two listed strings, then inspect existing rules in the anti-analysis/obfuscation/ namespace for the expected rule structure. Done means adding a rule that identifies the specified LitCrypt indicators in Rust binaries and maps them to the listed ATT&CK and MBC techniques.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- reverse-engineering, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100