From 3b72e490b3d8dcec25fc2fe1cff32e82bc002dbe Mon Sep 17 00:00:00 2001 From: William Ballenthin Date: Wed, 27 Apr 2022 05:34:42 -0600 Subject: [PATCH] Revert "Merge pull request #550 from mandiant/remove-dotnet-limitation-rule" This reverts commit adaffca2016769b0c1562fbe76530017b41f6999, reversing changes made to bc28847dd979298684d6d3917b11245837f73ec8. --- .../file/internal-dotnet-file-limitation.yml | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 internal/limitation/file/internal-dotnet-file-limitation.yml diff --git a/internal/limitation/file/internal-dotnet-file-limitation.yml b/internal/limitation/file/internal-dotnet-file-limitation.yml new file mode 100644 index 00000000..ca648dfa --- /dev/null +++ b/internal/limitation/file/internal-dotnet-file-limitation.yml @@ -0,0 +1,20 @@ +rule: + meta: + name: (internal) dotnet file limitation + # capa won't detect much in .NET samples. + # it might match some file-level things. + # for consistency, bail on things that we don't support. + namespace: internal/limitation/file + author: william.ballenthin@mandiant.com + description: | + This sample appears to be a .NET module. + + .NET is a cross-platform framework for running managed applications. + capa cannot handle non-native files. This means that the results may be misleading or incomplete. + You may have to analyze the file manually, using a tool like the .NET decompiler dnSpy. + scope: file + examples: + - b9f5bd514485fb06da39beff051b9fdc + features: + - or: + - match: runtime/dotnet