Merge pull request #931 from mandiant/new/20240920

rules: dotnet: adding new .NET rules

Author: mr-tz

nursery/access-unmanaged-com-objects-in-dotnet.yml

@@ -0,0 +1,12 @@
+rule:
+  meta:
+    name: access unmanaged COM objects in .NET
+    namespace: host-interaction/com
+    authors:
+      - [email protected]
+    scopes:
+      static: function
+      dynamic: unsupported  # requires .NET API feature
+  features:
+    - or:
+      - api: System.Runtime.InteropServices.Marshal::GetTypeFromCLSID

nursery/implement-ui-automation-client-in-dotnet.yml

@@ -0,0 +1,14 @@
+rule:
+  meta:
+    name: implement UI automation client in .NET
+    namespace: host-interaction/ui/automation
+    authors:
+      - [email protected]
+    scopes:
+      static: file
+      dynamic: unsupported  # requires .NET Namespace feature
+    references:
+      - https://learn.microsoft.com/en-us/dotnet/api/system.windows.automation?view=windowsdesktop-8.0
+  features:
+    - or:
+      - namespace: System.Windows.Automation

nursery/interact-with-shortcut-via-iwshshortcut-in-dotnet.yml

@@ -0,0 +1,14 @@
+rule:
+  meta:
+    name: interact with shortcut via IWshShortcut in .NET
+    namespace: host-interaction/shortcut
+    authors:
+      - [email protected]
+    scopes:
+      static: function
+      dynamic: unsupported  # requires .NET Class feature
+    references:
+      - https://stackoverflow.com/questions/4897655/create-a-shortcut-on-desktop
+  features:
+    - or:
+      - class: IWshRuntimeLibrary.IWshShortcut

nursery/interact-with-windows-scripting-host-in-dotnet.yml

@@ -0,0 +1,14 @@
+rule:
+  meta:
+    name: interact with Windows Scripting Host in .NET
+    namespace: host-interaction/wsh
+    authors:
+      - [email protected]
+    scopes:
+      static: file
+      dynamic: unsupported  # requires .NET Namespace feature
+    references:
+      - https://stackoverflow.com/questions/4897655/create-a-shortcut-on-desktop
+  features:
+    - or:
+      - namespace: IWshRuntimeLibrary

nursery/use-dotnet-library-simplejson.yml

@@ -0,0 +1,14 @@
+rule:
+  meta:
+    name: use .NET library SimpleJSON
+    namespace: data-manipulation/json
+    authors:
+      - [email protected]
+    scopes:
+      static: file
+      dynamic: unsupported  # requires .NET Class feature
+    references:
+      - https://github.com/mhallin/SimpleJSON.NET
+  features:
+    - or:
+      - class: Json.SimpleJson

nursery/use-dotnet-library-websocket-sharp.yml

@@ -0,0 +1,14 @@
+rule:
+  meta:
+    name: use .NET library websocket-sharp
+    namespace: communication/websocket
+    authors:
+      - [email protected]
+    scopes:
+      static: file
+      dynamic: unsupported  # requires .NET Namespace feature
+    references:
+      - https://github.com/sta/websocket-sharp
+  features:
+    - or:
+      - namespace: WebSocketSharp