Enter debug mode rule (#1022)

* add rule for enterdebugmode in nursery Signed-off-by: vibhatsu <[email protected]> * better description for enterdebugmode Signed-off-by: vibhatsu <[email protected]> * enter-debug-mode-in-dotnet: rename, reduce static scope to basic block, format dotnet only Signed-off-by: vibhatsu <[email protected]> * enter-debug-mode-in-dotnet: fix linting error Signed-off-by: vibhatsu <[email protected]> * enter-debug-mode-in-dotnet: more specific namespace Signed-off-by: vibhatsu <[email protected]> --------- Signed-off-by: vibhatsu <[email protected]>
2026-10-12 02:18:39 +00:00 · 2025-03-14 11:41:19 -06:00
parent 7437cfeaaf
commit 740d47393e
1 changed files with 16 additions and 0 deletions
@@ -0,0 +1,16 @@
+rule:
+  meta:
+    name: enter debug mode in .NET
+    namespace: host-interaction/process/modify
+    authors:
+      - "@v1bh475u"
+    description: Often used by debuggers and malware to attach to and modify other processes.
+    scopes:
+      static: basic block
+      dynamic: call
+    references:
+      - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.process.enterdebugmode?view=net-8.0
+  features:
+    - and:
+      - api: System.Diagnostics.Process::EnterDebugMode
+      - format: dotnet