init add of Xamarin rules (#824)

* init add of Xamarin rules

* Update and rename get-system-information-in-dotnet-on-android.yml to get-os-version-in-dotnet-on-android.yml

communication/socket/tcp/create-tcp-socket.yml

@@ -6,6 +6,7 @@ rule:
       - william.ballenthin@mandiant.com
       - joakim@intezer.com
       - anushka.virgaonkar@mandiant.com
+      - michael.hunhoff@mandiant.com
     scope: basic block
     mbc:
       - Communication::Socket Communication::Create TCP Socket [C0001.011]
@@ -21,4 +22,5 @@ rule:
           - api: ws2_32.socket
           - api: ws2_32.WSASocket
           - api: socket
+          - api: System.Net.Sockets.Socket::ctor
       - property/read: System.Net.Sockets.TcpClient::Client

nursery/access-camera-in-dotnet-on-android.yml

@@ -0,0 +1,10 @@
+rule:
+  meta:
+    name: access camera in .NET on Android
+    namespace: host-interaction/hardware/camera
+    authors:
+      - michael.hunhoff@mandiant.com
+    scope: function
+  features:
+    - or:
+      - api: Android.Hardware.Camera::Open

nursery/capture-microphone-audio-in-dotnet-on-android.yml

@@ -0,0 +1,13 @@
+rule:
+  meta:
+    name: capture microphone audio in .NET on Android
+    namespace: collection/microphone
+    authors:
+      - michael.hunhoff@mandiant.com
+    scope: function
+  features:
+    - and:
+      - api: Android.Media.AudioRecord::StartRecording
+      - optional:
+        - api: Android.Media.AudioRecord::Release
+        - api: Android.Media.AudioRecord::Stop

nursery/capture-screenshot-in-dotnet-on-android.yml

@@ -0,0 +1,10 @@
+rule:
+  meta:
+    name: capture screenshot in .NET on Android
+    namespace: collection/screenshot
+    authors:
+      - michael.hunhoff@mandiant.com
+    scope: function
+  features:
+    - or:
+      - api: Android.Media.Projection.MediaProjectionManager::CreateScreenCaptureIntent

nursery/check-for-incoming-call-in-dotnet-on-android.yml

@@ -0,0 +1,12 @@
+rule:
+  meta:
+    name: check for incoming call in .NET on Android
+    namespace: host-interaction
+    authors:
+      - michael.hunhoff@mandiant.com
+    scope: function
+  features:
+    - and:
+      - property/read: Android.Content.Intent::Action
+      - string: "android.intent.action.PHONE_STATE"
+      - property/read: Android.Telephony.TelephonyManager::ExtraStateRinging

nursery/check-for-outgoing-call-in-dotnet-on-android.yml

@@ -0,0 +1,11 @@
+rule:
+  meta:
+    name: check for outgoing call in .NET on Android
+    namespace: host-interaction
+    authors:
+      - michael.hunhoff@mandiant.com
+    scope: function
+  features:
+    - and:
+      - property/read: Android.Content.Intent::Action
+      - string: "android.intent.action.NEW_OUTGOING_CALL"

nursery/compiled-with-xamarin.yml

@@ -0,0 +1,10 @@
+rule:
+  meta:
+    name: compiled with Xamarin
+    namespace: compiler/xamarin
+    authors:
+      - michael.hunhoff@mandiant.com
+    scope: file
+  features:
+    - or:
+      - namespace: Xamarin.Essentials

nursery/get-os-version-in-dotnet-on-android.yml

@@ -0,0 +1,10 @@
+rule:
+  meta:
+    name: get OS version in .NET on Android
+    namespace: host-interaction/os/info
+    authors:
+      - michael.hunhoff@mandiant.com
+    scope: function
+  features:
+    - and:
+      - class: Android.OS.Build