Dynamic call scope: add a feature for extracting repeated api calls
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
CAPE provides the number of times an api call was repeated. This might be useful for rule authors (detecting API hammering, profiling malware fa)
I propose either adding a `repeated` feature, or adding a `characteristic("api-hammering")` feature.
of the two I feel like the first would be better, since if we opt for a characteristic feature we'd need to define the minimal bound for the repeats, which I feel like would be variant across samples/families (not sure about this however).
Example rule:
```yaml
rule:
meta:
name: API hammering
scopes:
dynamic: thread
examples:
- 83e921d6368baade50bb2a1031efd6bc # Nymaim
features:
- call:
- api: EnumDisplaySettingsA
- repeated: 500 or more
```
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files or tests. Start by tracing CAPE's repeated API-call count into capa's dynamic thread scope, then compare the proposed `repeated` feature with the alternative characteristic approach. Done should include a decided design and a working API-hammering rule using the proposed behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100