Skip to content

consider appending "via [insert_name] assembly" to applicable rule names #979

@mike-hunhoff

Description

@mike-hunhoff

As we've extended capa to process multiple architectures we should consider appending via [insert_name] assembly to applicable rule names. This should help users better distinguish capa's rules and results.

e.g. https://github.com/mandiant/capa-rules/blob/ff9db744255ecd9d5f5e64c4b93af7613a9441f2/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml can only match x86 assembly but this is not obvious based on the rule name.

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions