mirror of
https://github.com/vee1e/capa-rules.git
synced 2026-09-01 19:07:15 +00:00
21 lines
971 B
YAML
21 lines
971 B
YAML
rule:
|
|
meta:
|
|
name: packaged as single-file .NET application
|
|
namespace: executable/dotnet-singlefile
|
|
authors:
|
|
- michael.hunhoff@mandiant.com
|
|
description: Single binary containing target .NET application and all application-dependent files
|
|
scopes:
|
|
static: file
|
|
dynamic: file
|
|
references:
|
|
- https://learn.microsoft.com/en-us/dotnet/core/deploying/single-file/overview?tabs=cli
|
|
examples:
|
|
- a6e9d94e286984b9e44c58df5eeb20cf5c08b9acff4af341ddecdfbe3ea9249d
|
|
features:
|
|
- and:
|
|
# the installer portion of a single-file application is native code (in the samples I have seen) so format(dotnet) does not apply here.
|
|
- string: "Failure processing application bundle; possible file corruption."
|
|
- string: "Failure processing application bundle."
|
|
- string: "Bundle header version compatibility check failed"
|
|
- string: "A fatal error was encountered. Could not extract contents of the bundle"
|