add dotnet limitation rule for dynamic samples (#983)

* add dotnet limitation rule for dynamic samples

* restructure limitations rules

Signed-off-by: vibhatsu <[email protected]>

* refactor limitation rules to use 'static' namespace

Signed-off-by: vibhatsu <[email protected]>

* update internal .NET file limitation description and name

Signed-off-by: vibhatsu <[email protected]>

---------

Signed-off-by: vibhatsu <[email protected]>

internal/limitation/dynamic/internal-dotnet-file-limitation.yml

@@ -0,0 +1,23 @@
+rule:
+  meta:
+    name: (internal) .NET file limitation
+    namespace: internal/limitation/dynamic
+    authors:
+      - "@v1bh475u"
+    description: |
+      This dynamic analysis trace describes a .NET file.
+
+      capa rules are not yet tuned for the .NET runtime, 
+      so its analysis may be incomplete or misleading.
+    scopes:
+      static: unsupported
+      dynamic: file
+    examples:
+      - 2f8a79b12a7a989ac7e5f6ec65050036588a92e65aeb6841e08dc228ff0e21b4_min_archive.zip
+  features:
+    - or:
+      - format: dotnet
+      - import: mscoree._CorExeMain
+      - import: mscoree._corexemain
+      - import: mscoree._CorDllMain
+      - import: mscoree._cordllmain

internal/limitation/file/internal-autohotkey-file-limitation.yml → internal/limitation/static/internal-autohotkey-file-limitation.yml

@@ -1,7 +1,7 @@
 rule:
   meta:
     name: (internal) autohotkey file limitation
-    namespace: internal/limitation/file
+    namespace: internal/limitation/static
     authors:
       - "@mr-tz"
     description: |

internal/limitation/file/internal-autoit-file-limitation.yml → internal/limitation/static/internal-autoit-file-limitation.yml

@@ -4,7 +4,7 @@ rule:
     # capa will detect dozens of capabilities for AutoIt samples,
     # but these are due to the AutoIt runtime, not the payload script.
     # so, don't confuse the user with FP matches - bail instead
-    namespace: internal/limitation/file
+    namespace: internal/limitation/static
     authors:
       - [email protected]
     description: |

internal/limitation/file/internal-dotnet-single-file-deployment-limitation.yml → internal/limitation/static/internal-dotnet-single-file-deployment-limitation.yml

@@ -1,7 +1,7 @@
 rule:
   meta:
     name: (internal) .NET single file deployment limitation
-    namespace: internal/limitation/file
+    namespace: internal/limitation/static
     authors:
       - [email protected]
     description: |

internal/limitation/file/internal-installer-file-limitation.yml → internal/limitation/static/internal-installer-file-limitation.yml

@@ -3,7 +3,7 @@ rule:
     name: (internal) installer file limitation
     # capa will likely detect installer specific functionality.
     # this is probably not what the user wants.
-    namespace: internal/limitation/file
+    namespace: internal/limitation/static
     authors:
       - [email protected]
     description: |

internal/limitation/file/internal-packer-file-limitation.yml → internal/limitation/static/internal-packer-file-limitation.yml

@@ -1,7 +1,7 @@
 rule:
   meta:
     name: (internal) packer file limitation
-    namespace: internal/limitation/file
+    namespace: internal/limitation/static
     authors:
       - [email protected]
     description: |

internal/limitation/file/internal-visual-basic-file-limitation.yml → internal/limitation/static/internal-visual-basic-file-limitation.yml

@@ -1,7 +1,7 @@
 rule:
   meta:
     name: (internal) Visual Basic file limitation
-    namespace: internal/limitation/file
+    namespace: internal/limitation/static
     authors:
       - "@mr-tz"
     description: |