mandiant/capa-rules
GitHub で見るconsider appending "via [insert_name] assembly" to applicable rule names
Open
#979 opened on 2025年1月8日
enhancementgood first issue
Repository metrics
- Stars
- (721 stars)
- PR merge metrics
- (PR metrics pending)
説明
As we've extended capa to process multiple architectures we should consider appending via [insert_name] assembly to applicable rule names. This should help users better distinguish capa's rules and results.
e.g. https://github.com/mandiant/capa-rules/blob/ff9db744255ecd9d5f5e64c4b93af7613a9441f2/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml can only match x86 assembly but this is not obvious based on the rule name.