mandiant / capa-rules
active 2023-08-16 → 2026-08-14 (UTC)
Activity over time
Daily event counts in the loaded window
Line chart, 1095 days from 2023-08-16 to 2026-08-14. Pushes: 302 total, peak 17 in a day. Pull requests: 329 total, peak 8 in a day. Issues: 112 total, peak 3 in a day. Comments: 970 total, peak 81 in a day. Stars: 190 total, peak 4 in a day.
- Pushes
- Pull requests
- Issues
- Comments
- Stars
Stars, PRs, issues and forks are under-captured in the later part of this window. GH Archive progressively stopped capturing non-push events during 2026 — −95% or worse by the end of the window. Every series here except Pushes fades for that reason, so a decline above reflects the archive, not this repository. Pushes stay reliable throughout, so read them, and the contributor counts derived from them, as the real signal. Data health has the measurements.
Top contributors
Pushes, PRs, issues, reviews and comments — stars and forks excluded, so this is contribution rather than popularity
| Contributor | Contributions | Pushes | PRs | Comments |
|---|---|---|---|---|
| mr-tz | 859 | 119 | 116 | 417 |
| mike-hunhoff | 464 | 85 | 63 | 144 |
| williballenthin | 432 | 75 | 38 | 142 |
| jtothej | 60 | 0 | 20 | 20 |
| Still34 | 56 | 0 | 12 | 25 |
| akh7177 | 49 | 0 | 2 | 35 |
| jorik-utwente | 42 | 0 | 3 | 20 |
| yelhamer | 24 | 0 | 5 | 11 |
| JakePeralta7 | 22 | 0 | 8 | 11 |
| v1bh475u | 20 | 0 | 2 | 14 |
| richardweiss80 | 19 | 0 | 1 | 8 |
| 0xRavenspar | 18 | 0 | 1 | 12 |
| github-actions[bot] | 17 | 17 | 0 | 0 |
| google-cla[bot] | 17 | 0 | 0 | 17 |
| Ana06 | 15 | 2 | 5 | 3 |
| dhruvak001 | 15 | 0 | 5 | 10 |
| ArkaprabhaChakraborty | 11 | 0 | 1 | 10 |
| saniyafatima07 | 11 | 0 | 3 | 7 |
| dstepanic | 10 | 0 | 2 | 5 |
| sara-rn | 10 | 0 | 5 | 3 |
Recent activity
Latest issues, pull requests and releases
- Pull request#1179williballenthin2026-08-14 12:44
- Issue comment#1167mike-hunhoff2026-07-24 18:21feat: strengthen spoof parent PID rule with full PPID spoofing flow
- Issue comment#1161corkamig2026-05-22 14:08Warnings with reference_wmi_statements
- Issue comment#1140mike-hunhoff2026-05-15 19:01rules: add nursery rule for shellcode execution via ReadDirectoryChanges
- Issue comment#1150mike-hunhoff2026-04-03 15:38rule: reference ConfuserEx anti-profiling (fixes #602)
- Issue comment#1151mike-hunhoff2026-04-03 15:37Fix false positive in persist via Windows service rule
- Issue comment#1148cipherBT2026-03-27 22:56update screenshot rule: add display regex and GDI+ routines
- Issue comment#1146google-cla[bot]2026-03-21 22:03add rule for detecting opening of service by ransomwares
- Pull request#1146cipherBT2026-03-21 22:03
- Issue comment#1143google-cla[bot]2026-03-15 23:39feat(rules): detect ReadDirectoryChanges shellcode via callback and APC (#1095)
- Pull request#1142priyank7662026-03-15 08:14
- Issue comment#494priyank7662026-03-15 07:08rule idea: zlib fast inflate
- Pull request#1141akshat47032026-03-14 11:48
- Pull request#1137aryanyk2026-03-12 21:44
- Issue comment#998aryanyk2026-03-11 20:38Linux kernel rootkit techniques
- Pull request#1136aryanyk2026-03-11 20:36
- Pull request#1132akshat47032026-03-09 07:23
- Issue comment#1129mr-tz2026-03-02 22:20fix: escape + and / in Base64 string regex pattern
- Pull request#1129EclipseAditya2026-02-28 17:27
- Pull request#1128CosmoWorker2026-02-27 10:36
- Pull request#1127akshat47032026-02-26 06:08
- Issue comment#1117xpzhxhm2026-02-23 21:43Add new rule persist-via-shellserviceobjectdelayload-registry-key.yml
- Issue comment#1123akshat47032026-02-23 10:03reduce false positives in credential manager, credit-card parsing, an…
- Pull request#11220ameyasr2026-02-22 09:29
- Issue comment#1117xpzhxhm2026-02-18 21:00Add new rule persist-via-shellserviceobjectdelayload-registry-key.yml
Totals cover only the window loaded into ClickHouse and count events, not GitHub's lifetime totals — 190 stars here means stars gained during the window, not the repo's star count.