diff --git a/capa/capabilities/static.py b/capa/capabilities/static.py index 8b213fdb..08a243ab 100644 --- a/capa/capabilities/static.py +++ b/capa/capabilities/static.py @@ -182,9 +182,16 @@ def find_static_capabilities( ) t1 = time.time() - match_count = sum(len(res) for res in function_matches.values()) - match_count += sum(len(res) for res in bb_matches.values()) - match_count += sum(len(res) for res in insn_matches.values()) + match_count = 0 + for name, matches in itertools.chain( + function_matches.items(), bb_matches.items(), insn_matches.items() + ): + # in practice, most matches are derived rules, + # like "check OS version/5bf4c7f39fd4492cbed0f6dc7d596d49" + # but when we log to the human, they really care about "real" rules. + if not ruleset.rules[name].is_subscope_rule(): + match_count += len(matches) + logger.debug( "analyzed function 0x%x and extracted %d features, %d matches in %0.02fs", f.address,