Issues

• [encrypt data using RC4 PRGA] False positive on string validators

  false positive
  mandiant/capa-rules#1193 · Filter by author rdmmf opened on Aug 19, 2026

• hide graphical window from taskbar declares dynamic: call but requires a mnemonic on every path

  Bug

  mandiant/capa-rules#1191 · Filter by author williballenthin opened on Aug 15, 2026
  1

• open VM devices

  rule idea
  mandiant/capa-rules#1188 · Filter by author williballenthin opened on Aug 14, 2026

• check heap flags

  rule idea
  mandiant/capa-rules#1187 · Filter by author williballenthin opened on Aug 14, 2026

• FP: BeingDebugged flag due to offset by register

  false negative
  mandiant/capa-rules#1182 · Filter by author williballenthin opened on Aug 14, 2026
  1

• check for analysis tools listening on a local port

  rule idea
  mandiant/capa-rules#1181 · Filter by author williballenthin opened on Aug 14, 2026
  1

• FP: check for time delay via GetTickCount

  false positive
  mandiant/capa-rules#1180 · Filter by author williballenthin opened on Aug 14, 2026
  1

• triage PATCHCORD malware for new capa rules

  rule idea
  mandiant/capa-rules#1176 · Filter by author williballenthin opened on Aug 14, 2026
  1

• PPID spoofing via PROC_THREAD_ATTRIBUTE_PARENT_PROCESS not detected

  false negative
  mandiant/capa-rules#1145 · Filter by author akshat4703 opened on Mar 21, 2026
  1

• hijack DLL search order via directory manipulation + dynamic loading

  rule idea
  mandiant/capa-rules#1144 · Filter by author akshat4703 opened on Mar 21, 2026

• use word boundaries to reduce FPs when detecting strings using regular expressions

  false positivegood first issuehelp wanted
  mandiant/capa-rules#1109 · Filter by author mike-hunhoff opened on Jan 28, 2026
  9

  

• persist via Windows service

  false positivegood first issuehelp wanted
  mandiant/capa-rules#1100 · Filter by author mike-hunhoff opened on Jan 22, 2026
  2

• [64-bit execution via heavens gate] current rule misses obfuscated variants

  false negative
  mandiant/capa-rules#1096 · Filter by author devarjya27 opened on Jan 1, 2026
  2

• Document shellcode execution via ReadDirectoryChanges

  rule idea
  mandiant/capa-rules#1095 · Filter by author Still34 opened on Dec 24, 2025

• mimikatz.exe_: encrypt data using speck

  false positive
  mandiant/capa-rules#1091 · Filter by author mike-hunhoff opened on Dec 3, 2025
  6

• mimikatz.exe_: enumerate PE sections

  false positive
  mandiant/capa-rules#1090 · Filter by author mike-hunhoff opened on Dec 3, 2025

• parse credit card data

  false positive
  mandiant/capa-rules#1088 · Filter by author mr-tz opened on Dec 1, 2025

• fn: dynamic: "reference analysis tools strings"

  false negative
  mandiant/capa-rules#1083 · Filter by author mike-hunhoff opened on Nov 12, 2025
  3

  

• Capa not detecting basic meterpreter exe - no capabilities found

  mandiant/capa-rules#1057 · Filter by author crimsoncore opened on Jun 23, 2025
  3

• execute shellcode via Windows callback function

  false positive
  mandiant/capa-rules#1056 · Filter by author mike-hunhoff opened on Jun 20, 2025

• add detection(s) for CLRvoyance loading techniques

  rule idea
  mandiant/capa-rules#1053 · Filter by author mike-hunhoff opened on Jun 4, 2025

• detect mouse movement analysis for sandbox evasion

  rule idea
  mandiant/capa-rules#1050 · Filter by author tevjd opened on May 28, 2025
  1

• detect opening of services often referenced by ransomware

  good first issuehelp wantedrule idea
  mandiant/capa-rules#1048 · Filter by author mike-hunhoff opened on May 22, 2025
  1

• Support ATT&CK v17 detections for ESXi platform

  rule idea
  mandiant/capa-rules#1042 · Filter by author fariss opened on Apr 24, 2025

• detect journalctl/systemctl/systemd interactions on Linux

  rule idea
  mandiant/capa-rules#1041 · Filter by author Still34 opened on Apr 18, 2025