debug-build-capa-false-positives
Recurring false-positive pattern in Mandiant capa static analysis when targeting .NET Framework binaries compiled in Debug configuration. The presence of compiler-generated attributes that are harmless in production builds triggers high-confidence ATT&CK technique matches.
Root Cause
Visual Studio's Debug configuration injects several attributes into the compiled assembly metadata:
DebuggerNonUserCodeAttribute— capa interprets this as anti-analysis / anti-debuggingDebuggableAttributewithDebuggingModesflags — capa maps to reflective-loading or obfuscation techniquesDebuggerBrowsableAttribute— capa flags as analysis-tool discovery or runtime code loading
Common False-Positive Mappings
| Capa Rule | Trigger | Actual Meaning |
|---|---|---|
| T1620 (Reflective Code Loading) | Assembly::GetTypeFromHandle, MethodBase::Invoke, DebuggableAttribute |
Standard .NET JIT and event dispatch in Debug builds |
| T1059.001 (PowerShell) | CompilationRelaxationsAttribute |
Compiler metadata, not script execution |
| B0013.001 (Analysis Tool Discovery) | DebuggerNonUserCodeAttribute |
Debug-build marker, not anti-analysis |
| T1083 (File and Directory Discovery) | OpenFileDialog + Debug attributes |
Benign file-picker dialog in coursework apps |
| T1213 (Data from Info Repositories) | SqlConnection + Debug attributes |
Database coursework with ADO.NET |
| T1497.001 (Virtualization/Sandbox Evasion) | DebuggerBrowsableState |
Debug UI hint, not VM detection |
| C0021.003 (Generate Pseudo-random Sequence) | System.Random |
Game AI, dice rolls, or student exercises |
Affected Sample Clusters
- PrimeraVentana Spanish educational apps —
c4ee3a31081d,cae7ac1dc419,a42443c8,6a53c56172ce - GoldenCity Spanish city-building game —
92de8242 - MyPaint.Editor vector drawing —
6bc4e16d - Ivanov_WF_Paint —
6d114209 - AdvWinProgHW2 calculator —
724d94aa - KarateClub CRM —
7a310c85 - Pizzaria POS/CRM —
7b3ef687,5ea6b79d,000d931f - Croatian cryptography GUI —
72c4217f|- Checkers game —4cce5506,0d3d6bb9
Mitigation
When capa flags T1620/T1059 on a .NET binary:
- Check for
DebuggableAttributein CIL metadata - Verify the flagged
Invoke/GetTypeFromHandlecalls are standard WinForms event dispatch rather thanAssembly.Load+MethodBase.Invokeon foreign bytes - Look for actual malicious APIs (
System.Net,System.Security, registry persistence) — if absent, the capa hit is likely noise
Related
- unclassified-dotnet — Umbrella entity for benign .NET samples with this pattern
- social-engineering-filename-lure — These samples are typically repackaged with deceptive filenames