dynamic vverbose rendering should use process name

[mr-tz]

this is much clearer than for example:

thread @ process ppid: 1264, process pid: 1312, thread id: 2544 in process process ppid: 1264, process pid: 1312

[williballenthin]

today:

some things of note:

• process ppid: 2456, process pid: 3052, thread id: 2792, call: 828 doesn't really have much meaning to a human. would be nicer to see:
  • process name instead of/with PID, and
  • rendered API call instead of/with call index
• there are many call entries with the same thread, so most of the metadata is repeated multiple times. would be better to show pid, tid once and only the differing call data.

[williballenthin]

today:

write file on Windows
namespace  host-interaction/file-system/write
author     [email protected], [email protected]
scope      Scope.PROCESS
mbc        File System::Writes File [C0052]
Scope.PROCESS @ process ppid: 2456, process pid: 3052
  or:
    and:
      os: windows
      optional:
        or:
          thread:
            or:
              number: 0x2 = FILE_WRITE_DATA @ process ppid: 2456, process pid: 3052, thread id: 2792, call: 828, process ppid: 2456, process pid: 3052, thread id: 2792, call: 834, process ppid: 2456, process pid: 3052, thread id: 2792, call: 850, process ppid: 2456, process pid: 3052, thread id: 2792, call: 866

proposal 1:

write file on Windows
namespace  host-interaction/file-system/write
author     [email protected], [email protected]
scope      Scope.PROCESS
mbc        File System::Writes File [C0052]
Scope.PROCESS @ process ppid: 2456, process pid: 3052
  or:
    and:
      os: windows
      optional:
        or:
          thread:
            or:
              number: 0x2 = FILE_WRITE_DATA @ explorer.exe[3052:2792], WriteFile[828](2, bar), WriteFile[834](2, baz), WriteFile[850](2, woo), WriteFile[866](2, hoo)

proposal 2:

write file on Windows
namespace  host-interaction/file-system/write
author     [email protected], [email protected]
scope      Scope.PROCESS
mbc        File System::Writes File [C0052]
Scope.PROCESS @ process ppid: 2456, process pid: 3052
  or:
    and:
      os: windows
      optional:
        or:
          thread:
            or:
              number: 0x2 = FILE_WRITE_DATA @ explorer.exe[3052:2792]:
                @ WriteFile[828](2, bar), 
                @ WriteFile[834](2, baz), 
                @ WriteFile[850](2, woo), 
                @ WriteFile[866](2, hoo)

proposal 3:

write file on Windows
namespace  host-interaction/file-system/write
author     [email protected], [email protected]
scope      Scope.PROCESS
mbc        File System::Writes File [C0052]
Scope.PROCESS @ process ppid: 2456, process pid: 3052
  or:
    and:
      os: windows
      optional:
        or:
          thread:
            or:
              number: 0x2 = FILE_WRITE_DATA @ explorer.exe[3052:2792]: WriteFile[828](2, bar), and 3 more...

[mr-tz]

check https://github.com/mandiant/capa-testfiles/blob/dynamic-feature-extractor/dynamic/cape/v2.4/capesandbox_com/0a0882b8da225406cc838991b5f67d11.json.gz as a potential good test candidate (with many processes and repeated calls)

[mr-tz]

On first glance I like proposal 2 the most.

[williballenthin]

work in progress:

[williballenthin]

closed in #1825