Add .NET Environment.TickCount timing anti-debug rule

[aryanyk]

This PR adds a rule to detect timing-based anti-debug checks in .NET binaries that rely on repeated reads of Environment.TickCount around Thread.Sleep.

Issue #596

The technique appears in the .NET-Anti-Debug project. A minimal sample implementing the behavior was compiled, features were inspected using scripts/show-features.py, and the rule was verified to trigger correctly with capa.

Example detection:

• md5: e842958188274d5ffee7fbeffb803b2e
• function: 0x6000001

Additional rules for other techniques in the same project (e.g., WMI-based VM detection and process enumeration) will be submitted in follow-up PRs after validating samples.

[mike-hunhoff]

@aryanyk there appears to be unrelated rules included in this pull request. Please remove these unrelated rules. Also, please build the referenced anti-debug .NET project and open a pull request to https://github.com/mandiant/capa-testfiles for the resulting binary so we can ground all related rules, thank you.

[aryanyk]

Thanks for the feedback @mike-hunhoff

I've removed the unrelated rules from this PR.

I have also created a minimal .NET sample implementing the timing-based anti-debug technique and opened a PR to capa-testfiles to include this sample: mandiant/capa-testfiles#304 .

Please let me know if any further adjustments are needed.

[aryanyk]

Thanks for the detailed feedback @mike-hunhoff

I've addressed the requested changes:

• updated the rule name
• replaced the author field with my GitHub handle
• removed the issue reference
• added a clarification comment for why dynamic analysis is unsupported

Additionally, I’ve updated the capa-testfiles PR to fix the filename lint issue.
mandiant/capa-testfiles#304

Please let me know if any further adjustments are needed.

[mike-hunhoff]

@aryanyk lints are failing - please ensure all lints pass locally before submitting another review.

[aryanyk]

@mike-hunhoff

Thanks for the feedback!

I tracked down the lint failure to the sample filename and updated it to follow the capa-testfiles convention (MD5-based filename with the appropriate .dll_ extension). I verified locally by running .github/check_sample_filenames.py on the sample, which now passes.

The PR has been updated accordingly. Please let me know if any further changes are needed.

[mike-hunhoff]

@aryanyk lints for the rule are failing now. Please ensure all tests pass locally before requesting another review. Due to limited resources on the maintainers side, if lints fail again we'll need to close this issue without merging.