Open source contribution: mandiant/capa

Mar 2025 → Apr 2025

Contributed to capa, Mandiant’s open-source malware detection and behavioral analysis framework.

Refactored the TCP socket rule into a generic connect-socket rule for modularity, added a previously missing UDP connect rule, and a UDP test binary to validate accurate detection during analysis.

PRs merged: capa-rules#1017 · capa-testfiles#280