mandiant / mandiant/capa

design filename HBI feature for use in dynamic analysis

Open
#1,559 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

breaking-change dynamic enhancement
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

let's discuss the requirements and sketch a design for how this feature should look and act. the idea is to represent a file name or path artifact that is manipulated during a dynamic analysis session.

this should include how the rule syntax changes, the format of the feature and properties of the feature, and at least two example rules showing how the feature would be used.

once we're happy with the design, then lets plan for opening a standalone PR with the file path feature.

open questions include:
- how to represent operations, like read/write/create/delete
- how to represent paths versus names versus volumes versus streams, etc.
- how to represent the data written/read from a file
- how to combine all the above with logic, or not. and how this affects rule syntax

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No files, tests, or entry points are named. Start by reviewing the existing rule syntax and dynamic-analysis concepts, then document decisions for operations, paths and names, streams, data, and rule logic. Done means a settled design with the feature format, syntax changes, properties, and at least two example rules.

Written by the indexing model from the issue text.

Assessment

Domain
reverse-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.