Revert "Merge pull request #550 from mandiant/remove-dotnet-limitation-rule"

This reverts commit adaffca201, reversing changes made to bc28847dd9.
2026-06-08 15:41:20 +00:00 · 2022-04-27 05:34:42 -06:00
parent d4d28596bd
commit 3b72e490b3
1 changed files with 20 additions and 0 deletions
@@ -0,0 +1,20 @@
+rule:
+  meta:
+    name: (internal) dotnet file limitation
+    # capa won't detect much in .NET samples.
+    # it might match some file-level things.
+    # for consistency, bail on things that we don't support.
+    namespace: internal/limitation/file
+    author: william.ballenthin@mandiant.com
+    description: |
+      This sample appears to be a .NET module.
+
+      .NET is a cross-platform framework for running managed applications.
+      capa cannot handle non-native files. This means that the results may be misleading or incomplete.
+      You may have to analyze the file manually, using a tool like the .NET decompiler dnSpy.
+    scope: file
+    examples:
+      - b9f5bd514485fb06da39beff051b9fdc
+  features:
+    - or:
+      - match: runtime/dotnet