Search results

Document shellcode execution via ReadDirectoryChanges

rule idea

Status: Open.

#1095 In mandiant/capa-rules;

· Still34 opened on Dec 24, 2025

send HTTP request

false positiveFalse positive rule hitFalse positive rule hit

Status: Open.

#1093 In mandiant/capa-rules;

· mike-hunhoff opened on Dec 4, 2025

create UDP socket

false positiveFalse positive rule hitFalse positive rule hit

Status: Open.

#1092 In mandiant/capa-rules;

· mike-hunhoff opened on Dec 4, 2025

mimikatz.exe_: encrypt data using speck

false positiveFalse positive rule hitFalse positive rule hit

Status: Open.

#1091 In mandiant/capa-rules;

· mike-hunhoff opened on Dec 3, 2025

mimikatz.exe_: enumerate PE sections

false positiveFalse positive rule hitFalse positive rule hit

Status: Open.

#1090 In mandiant/capa-rules;

· mike-hunhoff opened on Dec 3, 2025

mimikatz.exe_: self delete

false positiveFalse positive rule hitFalse positive rule hit

Status: Open.

#1089 In mandiant/capa-rules;

· mike-hunhoff opened on Dec 3, 2025

parse credit card data

false positiveFalse positive rule hitFalse positive rule hit

Status: Open.

#1088 In mandiant/capa-rules;

· mr-tz opened on Dec 1, 2025

fn: dynamic: "reference analysis tools strings"

false negativerule expected to match but doesntrule expected to match but doesnt

Status: Open.

#1083 In mandiant/capa-rules;

· mike-hunhoff opened on Nov 12, 2025

Capa not detecting basic meterpreter exe - no capabilities found

Status: Open.

#1057 In mandiant/capa-rules;

· crimsoncore opened on Jun 23, 2025

execute shellcode via Windows callback function

false positiveFalse positive rule hitFalse positive rule hit

Status: Open.

#1056 In mandiant/capa-rules;

· mike-hunhoff opened on Jun 20, 2025

dotnet: load assembly via RuntimeAssembly.nLoadImage

rule idea

Status: Open.

#1054 In mandiant/capa-rules;

· mike-hunhoff opened on Jun 16, 2025

add detection(s) for CLRvoyance loading techniques

rule idea

Status: Open.

#1053 In mandiant/capa-rules;

· mike-hunhoff opened on Jun 4, 2025