mandiant/capa-rules
在 GitHub 查看consider appending "via [insert_name] assembly" to applicable rule names
Open
#979 建立於 2025年1月8日
enhancementgood first issue
倉庫指標
- Star
- (721 star)
- PR 合併指標
- (PR 指標待抓取)
描述
As we've extended capa to process multiple architectures we should consider appending via [insert_name] assembly to applicable rule names. This should help users better distinguish capa's rules and results.
e.g. https://github.com/mandiant/capa-rules/blob/ff9db744255ecd9d5f5e64c4b93af7613a9441f2/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml can only match x86 assembly but this is not obvious based on the rule name.