From 8e8a7d956c422d05e272827d90daf4a1ad8e87a6 Mon Sep 17 00:00:00 2001 From: sara-rn Date: Wed, 15 Nov 2023 13:47:54 +0100 Subject: [PATCH] added single file deployment rule to executable/installer/dotnet --- ...led-with-dotnet-single-file-deployment.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 executable/installer/dotnet/bundled-with-dotnet-single-file-deployment.yml diff --git a/executable/installer/dotnet/bundled-with-dotnet-single-file-deployment.yml b/executable/installer/dotnet/bundled-with-dotnet-single-file-deployment.yml new file mode 100644 index 000000000..6d536f9f6 --- /dev/null +++ b/executable/installer/dotnet/bundled-with-dotnet-single-file-deployment.yml @@ -0,0 +1,19 @@ +rule: + meta: + name: bundled with .NET single-file deployment + namespace: runtime/dotnet + authors: + - sara.rincon@mandiant.com + scope: file + references: + - https://learn.microsoft.com/en-us/dotnet/core/deploying/single-file/overview?tabs=cli + - https://github.com/dotnet/runtime/blob/84de9b678613675e0444b265905c82d33dae33a8/src/installer/managed/Microsoft.NET.HostModel/AppHost/HostWriter.cs + examples: + - a83339b07cf2bf1aeda192de42760c625d4b2f106260f58c902d02f4766848d5 + features: + - or: + - and: + - match: contains PDB path + - string: "singlefilehost.pdb" + - export: DotNetRuntimeInfo + - export: corehost_initialize