design features that describe HBIs and NBIs extracted by sandboxes
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
many sandboxes provide a summary of the indicators extracted during runtime analysis, such as files written, registry keys opened, network connections created, etc.
it might be nice to provide a way to match on these indicators in the dynamic analysis flavor of capa. for example:
```yml
- or:
- dns: google.com
- dns: yahoo.com
```
should we do this? what are the benefits? do they outweigh the cost of implementation and documentation?
what are the features that we should add? create subissues for designing those.
- [ ] network operations
- [ ] file operations
- [ ] registry operations
- [ ] process operations
- [ ] #1558
- [ ] #1559
- [ ] #1560
- ...
Contributor guide
Research direction
Start by reviewing capa's dynamic analysis flavor and the sandbox summaries of network, file, registry, and process operations described in the issue. Compare the benefits and implementation/documentation costs for each indicator type; done means producing focused feature designs and subissues with clear scope for the proposed matches.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100