mandiant / mandiant/capa-rules
resolve Microsoft.Win32.Win32Native to execute native Windows APIs in .NET
Open
rule idea
- Dominant language
- No language data
- Stars
- 736
- Forks
- 245
- Avg merge
- 4d 53m
- Merged PRs (30d)
- 2
Description
```yaml
- and:
- api: System.Reflection.Assembly::GetType
- string: "Microsoft.Win32.Win32Native"
```
Contributor guide
Research direction
Start with the YAML rule expression in the issue and locate existing rules using System.Reflection.Assembly::GetType. Compare how they represent resolved .NET types, then verify that the Microsoft.Win32.Win32Native case is recognized and covers native Windows API execution.
Written by the indexing model from the issue text.
Assessment
- Domain
- reverse-engineering, security
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100