debug-build-capa-false-positives
When capa analyzes .NET assemblies compiled in Debug configuration, several compiler-generated attributes trigger ATT&CK technique matches that are semantically incorrect. The most common false-positive pattern is T1620 (Reflective Code Loading) triggered by DebuggerNonUserCodeAttribute, DebuggableAttribute, and DebuggerBrowsableState — attributes the C# compiler emits automatically for Debug builds to support IDE debugging.
Affected Techniques
| Technique | Trigger | Why It's False |
|---|---|---|
| T1620 (Reflective Code Loading) | DebuggerNonUserCodeAttribute, DebuggableAttribute, DebuggerBrowsableState |
Compiler-generated debug metadata, not dynamic assembly loading |
| T1213 (Data from Information Repositories) | System.Data.SQLite, System.Data.SqlClient |
Local database usage for app data, not credential harvesting |
| T1083 (File and Directory Discovery) | System.IO.Path, OpenFileDialog, SaveFileDialog |
Standard file-dialog UI elements, not reconnaissance |
| C0021.003 (Generate Pseudo-random Sequence) | System.Random |
Benign game logic, shuffle algorithms, UI animations |
| B0013.001 (Analysis Tool Discovery) | DebuggerBrowsableState / DebuggableAttribute |
Compiler attribute, not anti-analysis |
Mitigation for Analysts
- Always check
pefile'sDIRECTORY_ENTRY_DEBUGfor a PDB path — Debug PDBs confirm Debug build. - Review capa matches in context: a single T1620 hit on a .NET binary with no
Assembly.Load/MethodBase.Invoke/Activator.CreateInstanceis likely false. - Check for
System.NetandSystem.Securitynamespace references. Their absence in a .NET binary makes most "malicious" capa matches suspect. - Corroborate with
flossdecoded strings — benign coursework apps show vocabulary, game terms, and UI strings rather than C2 URLs or shell commands.
Related
- unclassified-dotnet — Cluster where these false positives are most prevalent.
- trif32-caesar-shift-23-decoder — Often co-occurs with Debug-build false positives in the same benign-app-repackaging cluster.