vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 10:58:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

adding "packaged as single-file .NET application" (#699)

Browse source 
* adding "packaged as single-file .NET application"

Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>

* add sample binary, move from nursery
This commit is contained in:
Mike Hunhoff 2023-02-15 08:16:05 -07:00 • committed by GitHub
parent 8409d7d33d
commit 52bbc8d698
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 19 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

19
executable/installer/dotnet/packaged-as-single-file-dotnet-application.yml Normal file
View file

@ -0,0 +1,19 @@
rule:
meta:
name: packaged as single-file .NET application
namespace: executable/installer/dotnet
authors:
- michael.hunhoff@mandiant.com
description: Single binary containing target .NET application and all application-dependent files
scope: file
references:
- https://learn.microsoft.com/en-us/dotnet/core/deploying/single-file/overview?tabs=cli
examples:
- a6e9d94e286984b9e44c58df5eeb20cf5c08b9acff4af341ddecdfbe3ea9249d
features:
- and:
# the installer portion of a single-file application is native code (in the samples I have seen) so format(dotnet) does not apply here.
- string: "Failure processing application bundle; possible file corruption."
- string: "Failure processing application bundle."
- string: "Bundle header version compatibility check failed"
- string: "A fatal error was encountered. Could not extract contents of the bundle"