Add socks5 proxy capabilities rule

[ArkaprabhaChakraborty]

Fixes #971

Features Reffered: observation.txt
Binary used: mandiant/capa-testfiles#282

[ArkaprabhaChakraborty]

The rule is not yet complete. I have just made a PR as I think I'm clearly making a mistake while writing it.

cc @williballenthin @mike-hunhoff for visibility.

[mike-hunhoff]

Thanks for creating the PR @ArkaprabhaChakraborty . I'd recommend taking another took at our rule format documentation, e.g., the following syntax is not supported:

  insn: 0x20027F9: mnemonic(movzx)
  insn: 0x20027F9: offset(0x0)
  insn: 0x20027F9: operand[1].offset(0x0)
  insn: 0x20027FC: mnemonic(movzx)
  insn: 0x20027FF: mnemonic(mov)
  insn: 0x2002806: mnemonic(mov)
  insn: 0x200280D: mnemonic(add)
  insn: 0x200280D: number(0x7)
  insn: 0x200280D: operand[1].number(0x7)
  insn: 0x200280D: offset(0x7)
  insn: 0x200280D: operand[1].offset(0x7)
  insn: 0x2002811: mnemonic(mov)
  insn: 0x2002818: mnemonic(mov)
  insn: 0x200281F: mnemonic(add)
  insn: 0x200281F: number(0x7)
  insn: 0x200281F: operand[1].number(0x7)
  insn: 0x200281F: offset(0x7)
  insn: 0x200281F: operand[1].offset(0x7)
  insn: 0x2002823: mnemonic(cmp)

You can also run https://github.com/mandiant/capa/blob/master/scripts/lint.py to know if your rule is formatted correctly prior to pushing changes.

Please let us know if you have any specific questions 😄

[ArkaprabhaChakraborty]

Thanks for creating the PR @ArkaprabhaChakraborty . I'd recommend taking another took at our rule format documentation, e.g., the following syntax is not supported:

  insn: 0x20027F9: mnemonic(movzx)
  insn: 0x20027F9: offset(0x0)
  insn: 0x20027F9: operand[1].offset(0x0)
  insn: 0x20027FC: mnemonic(movzx)
  insn: 0x20027FF: mnemonic(mov)
  insn: 0x2002806: mnemonic(mov)
  insn: 0x200280D: mnemonic(add)
  insn: 0x200280D: number(0x7)
  insn: 0x200280D: operand[1].number(0x7)
  insn: 0x200280D: offset(0x7)
  insn: 0x200280D: operand[1].offset(0x7)
  insn: 0x2002811: mnemonic(mov)
  insn: 0x2002818: mnemonic(mov)
  insn: 0x200281F: mnemonic(add)
  insn: 0x200281F: number(0x7)
  insn: 0x200281F: operand[1].number(0x7)
  insn: 0x200281F: offset(0x7)
  insn: 0x200281F: operand[1].offset(0x7)
  insn: 0x2002823: mnemonic(cmp)

You can also run https://github.com/mandiant/capa/blob/master/scripts/lint.py to know if your rule is formatted correctly prior to pushing changes.

Please let us know if you have any specific questions 😄

Yes I know I have just made the PR to know If in going in the right direction. It's still a WIP.

[mr-tz]

On first glance this rule is rather confusing and doesn't quite match our philosophy. There's probably better ways to detect this and additional documentation is needed in the rule to make it easier to understand for humans.

[ArkaprabhaChakraborty]

How to add documentation blocks in the yaml?

…

On Wed, Mar 26, 2025, 1:12 PM Moritz ***@***.***> wrote: On first glance this rule is rather confusing and doesn't quite match our philosophy. There's probably better ways to detect this and additional documentation is needed in the rule to make it easier to understand for humans. — Reply to this email directly, view it on GitHub <#1038 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AN6F3GLDZ3AFDQQX2SFWAG32WJD4LAVCNFSM6AAAAABZYWMGJGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDONJTGQ4DOMBWGU> . You are receiving this because you were mentioned.Message ID: ***@***.***> [image: mr-tz]*mr-tz* left a comment (mandiant/capa-rules#1038) <#1038 (comment)> On first glance this rule is rather confusing and doesn't quite match our philosophy. There's probably better ways to detect this and additional documentation is needed in the rule to make it easier to understand for humans. — Reply to this email directly, view it on GitHub <#1038 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AN6F3GLDZ3AFDQQX2SFWAG32WJD4LAVCNFSM6AAAAABZYWMGJGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDONJTGQ4DOMBWGU> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[mr-tz]

Please see the rule documentation and existing rules.

[ArkaprabhaChakraborty]

I get this error while running lint.py on my rule. I know I'm doing almost everything wrong, so I need some help here.

ERROR    capa: invalid rule: subscope must have exactly one child statement                                  main.py:678ERROR    capa: Make sure your file directory contains properly formatted capa rules. You can download the    main.py:679         standard collection of capa rules from https://github.com/mandiant/capa-rules/releases.
ERROR    capa: Please ensure you're using the rules that correspond to your major version of capa (9)        main.py:683ERROR    capa: Or, for more details, see the rule set documentation here:                                    main.py:687         https://github.com/mandiant/capa/blob/master/doc/rules.md

[mike-hunhoff]

I get this error while running lint.py on my rule. I know I'm doing almost everything wrong, so I need some help here.

ERROR    capa: invalid rule: subscope must have exactly one child statement                                  main.py:678ERROR    capa: Make sure your file directory contains properly formatted capa rules. You can download the    main.py:679         standard collection of capa rules from https://github.com/mandiant/capa-rules/releases.
ERROR    capa: Please ensure you're using the rules that correspond to your major version of capa (9)        main.py:683ERROR    capa: Or, for more details, see the rule set documentation here:                                    main.py:687         https://github.com/mandiant/capa/blob/master/doc/rules.md

@ArkaprabhaChakraborty this error is a result of basic block subscope matching in your rule that does not contain a single child element, e.g.

- basic block
  - [feature]
  - [feature]

must be something like:

- basic block
  - and:
    - [feature]
    - [feature]

I'm happy to answer specific questions that you have about the capa rule format.