center-for-threat-informed-defense / adversary_emulation_library

An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.
https://ctid.io/adversary-emulation
Apache License 2.0
1.6k stars 292 forks source link

(Oilrig) RDAT run error when published, only when compiled #158

Open arty-hlr opened 3 months ago

arty-hlr commented 3 months ago

Hi,

We are encountering an issue running RDAT after publishing it with the given build script, or after publishing it with Visual Studio: Pasted image 20240314135752

We tried debugging the published version with Visual Studio, but could not get more information than is displayed there, it is unclear what the path is, and why it is empty only with the published version. It is not the --path from the command line arguments as that file exists, and works with the compiled (not published) version.

Steps to reproduce:

On the other hand, running the built version that is not standalone and requires the other files, (RDAT.dll, RDAT.runtimeconfig.json, RDAT.deps.json, etc) works without that issue.