diff --git a/internal/limitation/file/internal-dotnet-file-limitation.yml b/internal/limitation/file/internal-dotnet-file-limitation.yml new file mode 100644 index 00000000..ca648dfa --- /dev/null +++ b/internal/limitation/file/internal-dotnet-file-limitation.yml @@ -0,0 +1,20 @@ +rule: + meta: + name: (internal) dotnet file limitation + # capa won't detect much in .NET samples. + # it might match some file-level things. + # for consistency, bail on things that we don't support. + namespace: internal/limitation/file + author: william.ballenthin@mandiant.com + description: | + This sample appears to be a .NET module. + + .NET is a cross-platform framework for running managed applications. + capa cannot handle non-native files. This means that the results may be misleading or incomplete. + You may have to analyze the file manually, using a tool like the .NET decompiler dnSpy. + scope: file + examples: + - b9f5bd514485fb06da39beff051b9fdc + features: + - or: + - match: runtime/dotnet