mirror of
https://github.com/mandiant/capa.git
synced 2026-06-12 11:01:31 -07:00
Willi Ballenthin
41 lines
964 B
YAML
41 lines
964 B
YAML
- name: process-scope-basic
|
|
description: process scope matches features aggregated across threads
|
|
rules:
|
|
- name: process-apis
|
|
scopes:
|
|
dynamic: process
|
|
features:
|
|
- and:
|
|
- api: CreateFileW
|
|
- api: WriteFile
|
|
features: |
|
|
proc: sample.exe (pid=3052)
|
|
thread: 3064
|
|
call: 1: api(CreateFileW)
|
|
thread: 3065
|
|
call: 2: api(WriteFile)
|
|
expect:
|
|
matches:
|
|
process-apis:
|
|
- "process{pid:3052}"
|
|
|
|
- name: process-scope-no-match
|
|
description: process scope does not match when features are split across processes
|
|
rules:
|
|
- name: process-split
|
|
scopes:
|
|
dynamic: process
|
|
features:
|
|
- and:
|
|
- api: CreateFileW
|
|
- api: WriteFile
|
|
features: |
|
|
proc: sample.exe (pid=3052)
|
|
thread: 3064
|
|
call: 1: api(CreateFileW)
|
|
proc: other.exe (pid=3053)
|
|
thread: 4000
|
|
call: 2: api(WriteFile)
|
|
expect:
|
|
matches: {}
|