-
Notifications
You must be signed in to change notification settings - Fork 239
Pull requests: mandiant/capa-rules
Author
Label
Projects
Milestones
Reviews
Assignee
Sort
Pull requests list
feat: strengthen spoof parent PID rule with full PPID spoofing flow
#1167
opened Jun 26, 2026 by
itxsamad1
Loading…
1 task
update screenshot rule: add display regex and GDI+ routines
#1148
opened Mar 23, 2026 by
cipherBT
Loading…
persistence: restrict registry-based service detection to service-specific values (fix #1100)
#1126
opened Feb 25, 2026 by
reyyanxahmed
Loading…
add word boundaries to regex patterns to reduce false positives
#1125
opened Feb 24, 2026 by
Shaktisinhchavda
Loading…
reduce false positives in credential manager, credit-card parsing, an…
#1123
opened Feb 23, 2026 by
akshat4703
Contributor
Loading…
Add new rule to detect ransomware disabling backup/recovery services
#1122
opened Feb 22, 2026 by
0ameyasr
Loading…
warn if latest release and rules are not compatible
#933
opened Sep 24, 2024 by
mr-tz
Collaborator
Loading…
Additional rules to support capa-scripts.
dont merge
Indicate a PR that is still being worked on
#603
opened Aug 4, 2022 by
adamstorek
Loading…
ProTip!
Updated in the last three days: updated:>2026-07-27.