Missed detection of imported ELF symbols

Nobody has claimed this yet.

There's still some issues with the "`api`" feature detection. I think this issue is also due to a bug in vivisect. See this file for example.

```
md5 3db3e55b16a7b1b1afb970d5e77c5d98
sha1 bb44696c170e09b7708936ca3597002e3b8d93ff
sha256 294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc
timestamp 2021-09-17T09:37:18.042198
capa version v3.0.0-0-g5972d65
os linux
format elf
arch amd64
extractor VivisectFeatureExtractor
base address 0x400000
rules /tmp/_MEIr6ntHQ/rules
function count 242
library function count 0
total feature count 7139

receive data
namespace communication
author william.ballenthin@fireeye.com
description all known techniques for receiving data from a potential C2 server
scope function
mbc Command and Control::C2 Communication::Receive Data [B0030.002]
examples BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60
function @ 0x40D640
or:
match: receive data on socket @ 0x40D640
or:
api: recv @ 0x40D753

receive data on socket
namespace communication/socket/receive
author moritz.raabe@fireeye.com, joakim@intezer.com
scope function
mbc Communication::Socket Communication::Receive Data [C0001.006]
examples Practical Malware Analysis Lab 01-01.dll_:0x10001010
function @ 0x40D640
or:
api: recv @ 0x40D753

create UDP socket
namespace communication/socket/udp/send
author moritz.raabe@fireeye.com, joakim@intezer.com
scope basic block
mbc Communication::Socket Communication::Create UDP Socket [C0001.010]
examples 203BD48BCC18434314AD60F4C8BC21E3D3422EB0624B22B827410F9BC63B4082:0x401240
basic block @ 0x40C740
and:
count(number(0x2 = AF_INET/SOCK_DGRAM)): 2 or more = AF_INET/SOCK_DGRAM @ 0x40C745, 0x40C74F, 0x40C77B
or:
api: socket @ 0x40C767

resolve DNS
namespace host-interaction/network/dns/resolve
author william.ballenthin@fireeye.com, johnk3r, joakim@intezer.com
scope function
mbc Communication::DNS Communication::Resolve [C0011.001]
examples 17264e3126a97c319a6a0c61e6da951e:0x5FDC25D0
function @ 0x40E0D0
or:
api: gethostbyname @ 0x40E10B

create thread
namespace host-interaction/thread/create
author moritz.raabe@fireeye.com, michael.hunhoff@fireeye.com, joakim@intezer.com
scope basic block
mbc Process::Create Thread [C0038]
examples 946A99F36A46D335DEC080D9A4371940:0x10001DA0, B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x408020
basic block @ 0x409B49
or:
and:
os: linux
api: pthread_create @ 0x409B66

```
Few are detected
```
Symbol table '.dynsym'
Num: Value
0: 0000000000000000
1: 0000000000000000
2: 0000000000000000
3: 0000000000000000
4: 0000000000000000
5: 0000000000000000
6: 0000000000000000
7: 0000000000000000
8: 0000000000000000
9: 0000000000000000
10: 0000000000000000
11: 0000000000000000
12: 0000000000000000
13: 0000000000000000
14: 0000000000000000
15: 0000000000000000
16: 0000000000000000
17: 0000000000000000
18: 0000000000000000
19: 0000000000000000
20: 0000000000000000
21: 0000000000000000
22: 0000000000000000
23: 0000000000000000
24: 0000000000000000
25: 0000000000000000
26: 0000000000000000
27: 0000000000000000
28: 0000000000000000
29: 0000000000000000
30: 0000000000000000
31: 0000000000000000
32: 0000000000000000
33: 0000000000000000
34: 0000000000000000
35: 0000000000000000
36: 0000000000000000
37: 0000000000000000
38: 0000000000000000
39: 0000000000000000
40: 0000000000000000
41: 0000000000000000
42: 0000000000000000
43: 0000000000000000
44: 0000000000000000
45: 0000000000000000
46: 0000000000000000
47: 0000000000000000
48: 0000000000000000
49: 0000000000000000
50: 0000000000000000
51: 0000000000000000
52: 0000000000000000
53: 0000000000000000
54: 0000000000000000
55: 0000000000000000
56: 0000000000000000
57: 0000000000000000
58: 0000000000000000
59: 0000000000000000
60: 0000000000000000
61: 0000000000000000
62: 0000000000000000
63: 0000000000000000
64: 0000000000000000
65: 0000000000000000
66: 0000000000000000
67: 0000000000000000
68: 0000000000000000
69: 0000000000000000
70: 0000000000000000
71: 0000000000000000
72: 0000000000000000
73: 0000000000000000
74: 0000000000000000
75: 0000000000000000
76: 0000000000000000
77: 0000000000000000
78: 0000000000000000
79: 0000000000000000
80: 0000000000000000
81: 0000000000000000
82: 0000000000000000
83: 0000000000000000
84: 0000000000000000
85: 0000000000000000
86: 0000000000000000
87: 0000000000000000
88: 0000000000000000
89: 0000000000000000
90: 0000000000000000
91: 0000000000000000
92: 0000000000000000
93: 0000000000000000
94: 0000000000000000
95: 0000000000000000
96: 0000000000000000
97: 0000000000000000
98: 0000000000000000
99: 0000000000000000
100: 0000000000000000
101: 0000000000000000
102: 0000000000000000
103: 0000000000000000
104: 0000000000000000
105: 0000000000000000
106: 0000000000000000
107: 0000000000000000
108: 0000000000000000
109: 0000000000000000
110: 0000000000000000
111: 0000000000000000
112: 0000000000000000
113: 0000000000000000
114: 0000000000000000
115: 0000000000000000
116: 0000000000000000
117: 0000000000000000
118: 0000000000000000
119: 0000000000000000
120: 0000000000000000
121: 0000000000000000
122: 0000000000000000
123: 0000000000000000
124: 0000000000000000
125: 0000000000000000
126: 0000000000000000
127: 0000000000000000
128: 0000000000000000
129: 0000000000000000
130: 0000000000000000
131: 0000000000000000
132: 0000000000000000
133: 000000000040f804
134: 00000000004032b0
135: 0000000000402b50
136: 00000000006154a0
137: 00000000006159c8
138: 00000000006155e0
139: 0000000000615560
140: 0000000000403230
141: 00000000004032a0
142: 00000000006154a0
143: 00000000006154c0
144: 0000000000615640
145: 00000000006154a0
146: 000000000040e670
147: 000000000040e600
148: 00000000006154e0
149: 00000000006156c0
```
This is a snippet
```
0x00404e80 4155
│ 0x00404e82
│ 0x00404e84
│ 0x00404e87
│ 0x00404e88
│ 0x00404e89
│ 0x00404e90
│ 0x00404e95
│ 0x00404e97
│
│ 0x00404e9c
│ 0x00404ea1
│ 0x00404ea6
│ 0x00404eab
│ 0x00404eb0
│ 0x00404eb5
│ 0x00404eba
│
│ 0x00404ebf
│ 0x00404ec4
│ 0x00404ec9
```
The rule `create
```
rule:
meta:
name: create process on Linux
namespace:
author:
- joakim@intezer.com
scope: basic block
mbc:
- Process::Create
examples:
- 7351f8a40c545055
features:
- and:
- os: linux
- or:
- api: execve
- api: execl
- api: execlp
- api: execle
- api: execv
- api: execvp
- api: execvpe
- api: posix_spawn
- api: posix_spawnp
- api: popen
``` but if we check the "imports" there should be a few more rules that got triggered. We can see that the sample imports both "uname" and "popen". contains 150 entries: Size Type Bind Vis Ndx Name 0 NOTYPE LOCAL DEFAULT UND 0 FUNC GLOBAL DEFAULT UND ftell@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND d2i_RSA_PUBKEY@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND SSL_get_verify_result@libssl.so.10 (4) 0 FUNC GLOBAL DEFAULT UND ERR_load_BIO_strings@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND endmntent@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND sendto@GLIBC_2.2.5 (5) 0 FUNC GLOBAL DEFAULT UND _ZNSt8__detail15_List_nod@GLIBCXX_3.4.15 (6) 0 FUNC GLOBAL DEFAULT UND syscall@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND uname@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND rewind@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND sem_timedwait@GLIBC_2.2.5 (5) 0 FUNC GLOBAL DEFAULT UND BIO_ctrl@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND sprintf@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND _ZNSs6appendEPKcm@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND _ZNSdD2Ev@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND SSL_CTX_free@libssl.so.10 (4) 0 FUNC GLOBAL DEFAULT UND _ZNSs12_M_leak_hardEv@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND __res_query@GLIBC_2.2.5 (8) 0 FUNC GLOBAL DEFAULT UND _ZNKSs4findEPKcmm@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND OPENSSL_add_all_algorithm@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND BIO_write@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND socket@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND rand@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND SSL_load_error_strings@libssl.so.10 (4) 0 FUNC GLOBAL DEFAULT UND _ZNSt8ios_baseC2Ev@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND popen@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND recv@GLIBC_2.2.5 (5) 0 FUNC GLOBAL DEFAULT UND _ZNSt8ios_baseD2Ev@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND AES_set_decrypt_key@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND _ZSt17__throw_bad_allocv@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND _ZNSo9_M_insertIxEERSoT_@GLIBCXX_3.4.9 (9) 0 FUNC GLOBAL DEFAULT UND __cxa_begin_catch@CXXABI_1.3 (10) 0 FUNC GLOBAL DEFAULT UND getprotobyname@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND strlen@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND inet_ntoa@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND _ZStrsIcSt11char_traitsIc@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND strncmp@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND RSA_public_encrypt@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND getcwd@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND SSL_CTX_new@libssl.so.10 (4) 0 FUNC GLOBAL DEFAULT UND BIO_read@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND memset@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND _ZNSsC1ERKSs@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND pthread_create@GLIBC_2.2.5 (5) 0 FUNC GLOBAL DEFAULT UND geteuid@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND EVP_sha256@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND _ZNSs4_Rep10_M_disposeERK@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND getnameinfo@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND _ZSt19__throw_logic_error@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND localtime@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND sleep@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND recvfrom@GLIBC_2.2.5 (5) 0 FUNC GLOBAL DEFAULT UND sem_post@GLIBC_2.2.5 (5) 0 FUNC GLOBAL DEFAULT UND _ZNSs7reserveEm@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND _ZNSs4_Rep10_M_destroyERK@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND memcpy@GLIBC_2.14 (11) 0 FUNC GLOBAL DEFAULT UND BIO_new_mem_buf@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND __cxa_atexit@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND AES_cbc_encrypt@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND _ZdlPv@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND srand@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND setmntent@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND fclose@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND _Znwm@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND __xstat@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND inet_addr@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND SHA256@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND BIO_new@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND _ZNSs6appendERKSs@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND fseek@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND sem_wait@GLIBC_2.2.5 (5) 0 FUNC GLOBAL DEFAULT UND _ZNSsC1EPKcRKSaIcE@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND gethostbyname@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND _ZNSsC1EmcRKSaIcE@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND getpwuid@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND fopen@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND signal@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND free@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND daemon@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND getmntent@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND BIO_f_base64@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND _ZNSs6assignERKSs@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND malloc@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND clock_gettime@GLIBC_2.2.5 (12) 0 FUNC GLOBAL DEFAULT UND _ZNSt9basic_iosIcSt11char@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND HMAC@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND _ZNKSs5rfindEcm@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND strtol@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND _ZNSt6localeD1Ev@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND pclose@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND SSLv23_client_method@libssl.so.10 (4) 0 FUNC GLOBAL DEFAULT UND _ZSt20__throw_out_of_rang@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND tolower@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND __cxa_rethrow@CXXABI_1.3 (10) 0 FUNC GLOBAL DEFAULT UND getpid@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND chdir@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND fread@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND gethostname@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND opendir@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND AES_set_encrypt_key@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND _ZNSt18basic_stringstream@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND readdir@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND feof@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND BIO_new_ssl_connect@libssl.so.10 (4) 0 FUNC GLOBAL DEFAULT UND BIO_push@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND _ZNSsC1ERKSsmm@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND strtok@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND fgets@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND closedir@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND memmove@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND _ZNSt8__detail15_List_nod@GLIBCXX_3.4.15 (6) 0 FUNC GLOBAL DEFAULT UND BIO_new_connect@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND __cxa_end_catch@CXXABI_1.3 (10) 0 FUNC GLOBAL DEFAULT UND _ZNSs4swapERSs@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND _ZNSolsEi@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND freeifaddrs@GLIBC_2.3 (13) 0 FUNC GLOBAL DEFAULT UND sem_init@GLIBC_2.2.5 (5) 0 FUNC GLOBAL DEFAULT UND _Unwind_Resume@GCC_3.0 (14) 0 FUNC GLOBAL DEFAULT UND setsockopt@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND SSL_ctrl@libssl.so.10 (4) 0 FUNC GLOBAL DEFAULT UND BIO_set_flags@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND RSA_size@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND BIO_free_all@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND __libc_start_main@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND ferror@GLIBC_2.2.5 (2) 0 NOTYPE WEAK DEFAULT UND __gmon_start__ 0 FUNC GLOBAL DEFAULT UND getifaddrs@GLIBC_2.3 (13) 0 FUNC GLOBAL DEFAULT UND _ZNSs4_Rep9_S_createEmmRK@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND fwrite@GLIBC_2.2.5 (2) 0 FUNC GLOBAL DEFAULT UND close@GLIBC_2.2.5 (5) 0 FUNC GLOBAL DEFAULT UND BIO_s_mem@libcrypto.so.10 (3) 0 FUNC GLOBAL DEFAULT UND _ZNSt6localeC1Ev@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT 14 _fini 0 FUNC WEAK DEFAULT UND __pthread_key_create@GLIBC_2.2.5 (5) 0 FUNC GLOBAL DEFAULT 11 _init 0 NOTYPE GLOBAL DEFAULT 26 __bss_start 0 NOTYPE GLOBAL DEFAULT 26 _end 88 OBJECT WEAK DEFAULT 26 _ZTVN10__cxxabiv117__clas@CXXABI_1.3 (10) 128 OBJECT WEAK DEFAULT 26 _ZTVSt15basic_streambufIc@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND _ZNSsD1Ev@GLIBCXX_3.4 (7) 0 FUNC GLOBAL DEFAULT UND __gxx_personality_v0@CXXABI_1.3 (10) 0 NOTYPE GLOBAL DEFAULT 25 _edata 32 OBJECT GLOBAL DEFAULT 26 _ZNSs4_Rep20_S_empty_rep_@GLIBCXX_3.4 (7) 128 OBJECT WEAK DEFAULT 26 _ZTVSt15basic_stringbufIc@GLIBCXX_3.4 (7) 32 OBJECT WEAK DEFAULT 26 _ZTVSt9basic_iosIcSt11cha@GLIBCXX_3.4 (7) 112 FUNC WEAK DEFAULT 13 _ZNSt15basic_stringbufIcS 104 FUNC WEAK DEFAULT 13 _ZNSt15basic_stringbufIcS 120 OBJECT WEAK DEFAULT 26 _ZTVSt18basic_stringstrea@GLIBCXX_3.4 (7) 80 OBJECT WEAK DEFAULT 26 _ZTTSt18basic_stringstrea@GLIBCXX_3.4 (7) where the function calls popen on the last line. push r13 4154 push r12 4989fc mov r12, rdi ; arg1 55 push rbp 53 push rbx 4881ec580400. sub rsp, 0x458 ; rsi ; rsi e84beaffff call fcn.threadID ;[1] 89c7 mov edi, eax e8b4a10000 call fcn.srand ;[2] ; void srand(-1) 498d7c2418 lea rdi, [r12 + 0x18] ba0c000000 mov edx, 0xc ; rdx be94f84000 mov esi, str._2_1___exit ; 0x40f894 ; " 2>&1 ; exit" e8a0ddffff call sym std::string::append(char const*, unsigned long) ;[3] ; sym.imp.std::string::ap be01000000 mov esi, 1 ; rsi bf11000000 mov edi, 0x11 ; 17 e881e1ffff call sym.imp.signal ;[4] ; void signal(int sig, void *func) ; void signal(-1, -1) 498b7c2418 mov rdi, qword [r12 + 0x18] bebdf84000 mov esi, str.r ; 0x40f8bd ; "r" e842deffff call sym.imp.popen ;[5] ; file*popen(const char *filename, const char *mode) process on Linux` is very simple and should have fired. I can't see any other reason than the symbols not being discovered correctly being at fault. host-interaction/process/create Process [C0017] 7b24622417fc478d:0x40236D

It's not caused by the `os` requirement. If I modify the rule to:
```
rule:
meta:
name: create process on Linux
namespace: host-interaction/process/create
author:
- joakim@intezer.com
scope: basic block
mbc:
- Process::Create Process [C0017]
examples:
- 7351f8a40c5450557b24622417fc478d:0x40236D
features:
- or:
- api: execve
- api: execl
- api: execlp
- api: execle
- api: execv
- api: execvp
- api: execvpe
- api: posix_spawn
- api: posix_spawnp
- api: popen
```
It still doesn't fire, while working fine on other samples:
```
$ capa --rules tools/capa-rules/host-interaction/process/create/create-process-on-linux.yml path/to/vermilion/294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc.sample
loading : 100%|████████████████████████████████████████████████████████████████████████████████| 1/1 [00:00<00:00, 1339.18 rules/s]
matching: 100%|████████████████████████████████████████████| 242/242 [00:00<00:00, 258.36 functions/s, skipped 0 library functions]
+------------------------+----------------------------------------------------------------------------------------------------+
| md5 | 3db3e55b16a7b1b1afb970d5e77c5d98 |
| sha1 | bb44696c170e09b7708936ca3597002e3b8d93ff |
| sha256 | 294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc |
| os | linux |
| format | elf |
| arch | amd64 |
+------------------------+----------------------------------------------------------------------------------------------------+

no capabilities found

$ capa --rules tools/capa-rules/host-interaction/process/create/create-process-on-linux.yml path/to/redxor/po1kitd-update-k
loading : 100%|████████████████████████████████████████████████████████████████████████████████| 1/1 [00:00<00:00, 1263.73 rules/s]
matching: 100%|████████████████████████████████████████████| 143/143 [00:00<00:00, 224.15 functions/s, skipped 0 library functions]
+------------------------+------------------------------------------------------------------------------------+
| md5 | 7351f8a40c5450557b24622417fc478d |
| sha1 | 8766d7e0c943ea66ebe90030617881a899b2aa11 |
| sha256 | 0423258b94e8a9af58ad63ea493818618de2d8c60cf75ec7980edcaa34dcc919 |
| os | linux |
| format | elf |
| arch | amd64 |
+------------------------+------------------------------------------------------------------------------------+

+-----------------------------+-------------------------------------------------------------------------------+
| MBC Objective | MBC Behavior |
|-----------------------------+-------------------------------------------------------------------------------|
| PROCESS | Create Process:: [C0017] |
+-----------------------------+-------------------------------------------------------------------------------+

+------------------------------------------------------+------------------------------------------------------+
| CAPABILITY | NAMESPACE |
|------------------------------------------------------+------------------------------------------------------|
| create process on Linux (4 matches) | host-interaction/process/create |
+------------------------------------------------------+------------------------------------------------------+
```

Start at the VivisectFeatureExtractor entry point and reproduce the report against the provided ELF sample, inspecting how imported symbols such as uname and popen are exposed. Done means the relevant imported-symbol features are detected and the capability output includes the missing rules.

Written by the indexing model from the issue text.

Description

Contributor guide

First steps

Research direction

Assessment