Skip to content

Rule organization for multiple file types PE and ELF #701

Answered by mr-tz
mr-tz asked this question in Q&A
Discussion options

You must be logged in to vote

Multiple OSes in one rule

This adds a few extra fields to the initially proposed rules.
Split up features block by OS, example based on get CPU information from mandiant/capa-rules#442

  meta:
    name: get CPU information
    namespace: host-interaction/hardware/cpu
    author:
      - moritz.raabe@fireeye.com
      - joakim@intezer.com
    scope: function
    att&ck:
      - Discovery::System Information Discovery [T1082]
    examples:
      - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A
  features:
    - windows:
      - or:
        - and:
          - match: query or enumerate registry value
          - string: /Hardware\\Description\\System\\CentralProcessor/i
    - linux:
      - or:
…

Replies: 7 comments 35 replies

Comment options

mr-tz
Aug 5, 2021
Maintainer Author

You must be logged in to vote
7 replies
@mike-hunhoff
Comment options

@recvfrom
Comment options

@re-fox
Comment options

@williballenthin
Comment options

@williballenthin
Comment options

Answer selected by williballenthin
Comment options

You must be logged in to vote
3 replies
@williballenthin
Comment options

@mr-tz
Comment options

mr-tz Aug 6, 2021
Maintainer Author

@mike-hunhoff
Comment options

Comment options

You must be logged in to vote
5 replies
@TcM1911
Comment options

@williballenthin
Comment options

@williballenthin
Comment options

@TcM1911
Comment options

@williballenthin
Comment options

Comment options

You must be logged in to vote
4 replies
@williballenthin
Comment options

@mr-tz
Comment options

mr-tz Aug 6, 2021
Maintainer Author

@mike-hunhoff
Comment options

@re-fox
Comment options

Comment options

You must be logged in to vote
4 replies
@williballenthin
Comment options

@mr-tz
Comment options

mr-tz Aug 6, 2021
Maintainer Author

@mike-hunhoff
Comment options

@re-fox
Comment options

Comment options

mr-tz
Aug 6, 2021
Maintainer Author

You must be logged in to vote
3 replies
@mr-tz
Comment options

mr-tz Aug 6, 2021
Maintainer Author

@mike-hunhoff
Comment options

@williballenthin
Comment options

Comment options

You must be logged in to vote
9 replies
@williballenthin
Comment options

@williballenthin
Comment options

@mike-hunhoff
Comment options

@mike-hunhoff
Comment options

@mr-tz
Comment options

mr-tz Aug 23, 2021
Maintainer Author

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
Q&A
Labels
None yet
6 participants