ctxis/CAPE issues and pull requests

#100 - oletools and olefile should be dependencies

Issue - State: closed - Opened by decalage2 about 6 years ago - 23 comments

#99 - fix missed password for doc files

Pull Request - State: closed - Opened by doomedraven about 6 years ago

#98 - try/except for graphviz

Pull Request - State: closed - Opened by doomedraven about 6 years ago - 1 comment

#97 - HAVE not HAS

Pull Request - State: closed - Opened by doomedraven about 6 years ago

#96 - sflock as new unarchiver, fallback is kept if sflock isn't installed

Pull Request - State: closed - Opened by doomedraven about 6 years ago - 2 comments

#95 - IE 11 crashes

Issue - State: open - Opened by enzok about 6 years ago - 8 comments

#94 - fixes

Pull Request - State: closed - Opened by doomedraven about 6 years ago

#93 - add vba2graph

Pull Request - State: closed - Opened by doomedraven about 6 years ago - 26 comments

#92 - VirusTotal downloads broken!

Issue - State: closed - Opened by kevoreilly about 6 years ago - 9 comments

#91 - publisher requires extension to run correctly, add it if missed

Pull Request - State: closed - Opened by doomedraven about 6 years ago

#90 - improve resubmission

Pull Request - State: closed - Opened by doomedraven about 6 years ago - 2 comments

#89 - add conf for log rotation

Pull Request - State: closed - Opened by doomedraven about 6 years ago

#88 - improved check of HAS_OLETOOLS

Pull Request - State: closed - Opened by doomedraven about 6 years ago

#87 - add pub macro extractions and visualisation, requires oletools instal…

Pull Request - State: closed - Opened by doomedraven about 6 years ago

#86 - rotate cuckoo and processing logs, keeping 30 days logs

Pull Request - State: closed - Opened by doomedraven about 6 years ago - 3 comments

#85 - improve submission views + resubmit option

Pull Request - State: closed - Opened by doomedraven about 6 years ago - 1 comment

#84 - [curtain] backport of more improvements

Pull Request - State: closed - Opened by doomedraven about 6 years ago

#83 - API failure when getting json from a request

Issue - State: closed - Opened by mjcuchillo about 6 years ago - 2 comments

#82 - [curtain] update

Pull Request - State: closed - Opened by doomedraven about 6 years ago

#81 - Powershell scripts not executing properly with Capemon enabled

Issue - State: closed - Opened by enzok about 6 years ago - 30 comments

#80 - Add in signature for CVE 2017-11882

Pull Request - State: closed - Opened by kevross33 about 6 years ago

#79 - small improvement of dist fixing missed completed_on, see long description

Pull Request - State: closed - Opened by doomedraven about 6 years ago

#78 - network activivty is off?

Issue - State: closed - Opened by berloha about 6 years ago - 7 comments

#77 - update description of vtdl

Pull Request - State: closed - Opened by doomedraven about 6 years ago - 10 comments

#76 - Compression signature error

Issue - State: closed - Opened by enzok about 6 years ago - 1 comment

#75 - bumb dist to latest version + callback module

Pull Request - State: closed - Opened by doomedraven about 6 years ago - 1 comment

#74 - Adjust config data

Pull Request - State: closed - Opened by enzok about 6 years ago

#73 - Add Cobalt Strike signature

Pull Request - State: closed - Opened by enzok about 6 years ago - 3 comments

#72 - Capture network traffic with data size = 0

Pull Request - State: closed - Opened by enzok about 6 years ago

#71 - Fix spelling mistake in getbasekerneladdress sig

Pull Request - State: closed - Opened by kevross33 about 6 years ago

#70 - Adjust scores on Cape sigs

Pull Request - State: closed - Opened by kevross33 about 6 years ago

#69 - [curtain] handle more obfs

Pull Request - State: closed - Opened by doomedraven about 6 years ago

#68 - Update cryptomining sig to match cuckoo2 sig

Pull Request - State: closed - Opened by kevross33 about 6 years ago - 1 comment

#67 - Few more sigs for CMD arguments

Pull Request - State: closed - Opened by kevross33 about 6 years ago

#66 - Add in several more "dosfuscation sigs"

Pull Request - State: closed - Opened by kevross33 about 6 years ago

#65 - Add in initial signatures for dosfuscation detection

Pull Request - State: closed - Opened by kevross33 about 6 years ago - 2 comments

#64 - Windows 10

Issue - State: closed - Opened by enzok about 6 years ago - 15 comments

#63 - [curtain] sorry had hardcoded value

Pull Request - State: closed - Opened by doomedraven about 6 years ago

#62 - [curtain] improve powershell event building from log

Pull Request - State: closed - Opened by doomedraven about 6 years ago - 1 comment

#61 - Word 2013 - unable to place hooks on numerous functions

Issue - State: closed - Opened by enzok about 6 years ago - 7 comments

#60 - Does not capture and process new exe from vbs payload described in link

Issue - State: closed - Opened by redsand about 6 years ago - 2 comments

#59 - avoid SSL/TLS problem with recent vSphere 6.7 release

Pull Request - State: closed - Opened by kalos about 6 years ago - 1 comment

#58 - Fixes error in recent signature

Pull Request - State: closed - Opened by redsand about 6 years ago - 1 comment

#57 - New version of Trickbot not parsing config

Issue - State: closed - Opened by enzok about 6 years ago - 4 comments

#56 - Signature Errors with latest commits

Issue - State: closed - Opened by enzok about 6 years ago - 23 comments

#55 - Adds a couple checks for kernel exploit (local priv) tricks

Pull Request - State: closed - Opened by redsand about 6 years ago - 1 comment

#54 - Curtain running on guest even if not enabled in conf

Issue - State: closed - Opened by enzok about 6 years ago - 22 comments

#53 - Anti Dbg/VM Checks and Malicious API File Behavior Checks

Pull Request - State: closed - Opened by redsand over 6 years ago - 12 comments

#52 - Merging from Development - TrID fixes, sniffer fix for running in par…

Pull Request - State: closed - Opened by redsand over 6 years ago

#51 - Generic package launching Adobe Acrobat reader

Issue - State: closed - Opened by enzok over 6 years ago - 2 comments

#50 - Adds TRiD Support (http://mark0.net/soft-trid-e.html)

Pull Request - State: closed - Opened by redsand over 6 years ago

#49 - Remote memory dump kvm

Pull Request - State: closed - Opened by redsand over 6 years ago - 3 comments

#48 - reset conf to no

Pull Request - State: closed - Opened by doomedraven over 6 years ago - 1 comment

#47 - Remote sniffer aux feature

Pull Request - State: closed - Opened by redsand over 6 years ago - 4 comments

#46 - small improvements to curtain, to handle better bad files

Pull Request - State: closed - Opened by doomedraven over 6 years ago

#45 - update yara indexes when process restart, it was don only if cuckoo w…

Pull Request - State: closed - Opened by doomedraven over 6 years ago

#44 - Curtain backport with @kartoon permission https://github.com/cuckoosa…

Pull Request - State: closed - Opened by doomedraven over 6 years ago - 2 comments

#43 - Fix missing list index value, need first value from list

Pull Request - State: closed - Opened by enzok over 6 years ago

#42 - virtualbox

Issue - State: closed - Opened by wizkidnc over 6 years ago - 5 comments

#41 - Check if tor or inetsim is enabled before checking for interface.

Pull Request - State: closed - Opened by enzok over 6 years ago

#40 - move rooter path to correct config section

Pull Request - State: closed - Opened by enzok over 6 years ago

#39 - remove .py extension from vpn config file

Pull Request - State: closed - Opened by enzok over 6 years ago

#38 - Add missing rooter.py file

Pull Request - State: closed - Opened by enzok over 6 years ago

#37 - upstream rooter

Issue - State: closed - Opened by wizkidnc over 6 years ago - 20 comments

#36 - Add upstream rooter

Pull Request - State: closed - Opened by enzok over 6 years ago - 2 comments

#35 - CAPE.py error

Issue - State: closed - Opened by Kuzuto over 6 years ago - 2 comments

#34 - Add in signature for crendential dumping

Pull Request - State: closed - Opened by kevross33 over 6 years ago - 2 comments

#33 - Some error output from agent.py command window

Issue - State: closed - Opened by Aragorn1106 over 6 years ago - 4 comments

#32 - Unable to captured the Screenshots

Issue - State: closed - Opened by seantree over 6 years ago - 1 comment

#31 - URL Analysis Problem

Issue - State: closed - Opened by seantree over 6 years ago - 15 comments

#30 - Debugger doesn't work in KVM virtual machines.

Issue - State: closed - Opened by kevoreilly over 6 years ago - 22 comments

#29 - Add signature for script storage in registry (fileless)

Pull Request - State: closed - Opened by kevross33 over 6 years ago - 2 comments

#28 - How to submit URL through web portal

Issue - State: closed - Opened by seantree over 6 years ago - 18 comments

#27 - Add more sigs to windows utilities

Pull Request - State: closed - Opened by kevross33 over 6 years ago

#26 - Fix false positive on clear logs signature

Pull Request - State: closed - Opened by kevross33 over 6 years ago

#25 - Add signature for clearing event logs

Pull Request - State: closed - Opened by kevross33 over 6 years ago - 1 comment

#24 - Add signature for use of windows utilities

Pull Request - State: closed - Opened by kevross33 over 6 years ago - 2 comments

#23 - Create signature for cryptomining

Pull Request - State: closed - Opened by kevross33 over 6 years ago - 8 comments

#22 - Add in mass file deletion into ransomware sig

Pull Request - State: closed - Opened by kevross33 over 6 years ago - 2 comments

#21 - Add download CAPE config

Pull Request - State: closed - Opened by enzok over 6 years ago

#20 - Add in suspicious office signature

Pull Request - State: closed - Opened by kevross33 over 6 years ago - 1 comment

#19 - Remove code from office macros sig to split out

Pull Request - State: closed - Opened by kevross33 over 6 years ago

#18 - Add signatures to highlight oletools macro output

Pull Request - State: closed - Opened by kevross33 over 6 years ago - 1 comment

#17 - Remove API & add missing API from injection network

Pull Request - State: closed - Opened by kevross33 over 6 years ago

#16 - Add signature for system processes generating network traffic

Pull Request - State: closed - Opened by kevross33 over 6 years ago - 2 comments

GitHub / ctxis/CAPE issues and pull requests