-
Notifications
You must be signed in to change notification settings - Fork 242
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
[encrypt data using RC4 PRGA] False positive on string validators
false positiveFalse positive rule hitFalse positive rule hitStatus: Open.#1193 In mandiant/capa-rules;- Status: Open.#1191 In mandiant/capa-rules;
- Status: Open.#1188 In mandiant/capa-rules;
- Status: Open.#1187 In mandiant/capa-rules;
FP: BeingDebugged flag due to offset by register
false negativerule expected to match but doesntrule expected to match but doesntStatus: Open.#1182 In mandiant/capa-rules;- Status: Open.#1181 In mandiant/capa-rules;
FP: check for time delay via GetTickCount
false positiveFalse positive rule hitFalse positive rule hitStatus: Open.#1180 In mandiant/capa-rules;- Status: Open.#1178 In mandiant/capa-rules;
- Status: Open.#1176 In mandiant/capa-rules;
PPID spoofing via PROC_THREAD_ATTRIBUTE_PARENT_PROCESS not detected
false negativerule expected to match but doesntrule expected to match but doesntStatus: Open.#1145 In mandiant/capa-rules;- Status: Open.#1144 In mandiant/capa-rules;
use word boundaries to reduce FPs when detecting strings using regular expressions
false positiveFalse positive rule hitFalse positive rule hitgood first issueGood for newcomersGood for newcomershelp wantedExtra attention is neededExtra attention is neededStatus: Open.#1109 In mandiant/capa-rules;