internal-dotnet-single-file-deployment-limitation.yml

rule:
  meta:
    name: (internal) .NET single file deployment limitation
    namespace: internal/limitation/file
    authors:
      - sara.rincon@mandiant.com
    description: |
      This sample appears to be built with the single-file deployment in .NET.

      Single-file deployment allows all the application-dependent files to be bundled into a single binary.
      The size of the single file in a self-contained application is large since it includes the runtime and the framework libraries.
      The main application and the libraries are contained in the overlay section.
      You may need to extract the runtime configuration files such as *.deps.json and *.runtimeconfig.json files to determine the main .NET library and extract it with the tool SingleFileExtractor.
    scopes:
      static: file
      dynamic: file
    examples:
      - 0da87fccbf7687a6c7ab38087dea8b8f32c2b1fb6546101485b7167d18d9c406
  features:
    - or:
      - match: executable/dotnet-singlefile