jas502n/cs_yaraفحص قواعد YARA الخاصة بـ CS
فحص قواعد Yara الخاصة بـ Cobalt Strike
https://github.com/CCob/BeaconEye
إصلاح خطأ BeaconEye: https://wbglil.gitbook.io/cobalt-strike/cobalt-strike-gong-ji-fang-yu/untitled-1
القاعدة من https://raw.githubusercontent.com/CCob/BeaconEye/master/BeaconEye.cs
rule CobaltStrike {
strings:
$cobaltStrikeRule64 = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 (00|01|02|04|08|10) 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 02 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 01 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 }
$cobaltStrikeRule32 = { 00 00 00 00 00 00 00 00 01 00 00 00 (00|01|02|04|08|10) 00 00 00 01 00 00 00 ?? ?? 00 00 02 00 00 00 ?? ?? ?? ?? 02 00 00 00 ?? ?? ?? ?? 01 00 00 00 ?? ?? 00 00 }
condition: any of them
}
https://virustotal.github.io/yara/
https://github.com/virustotal/yara/releases/latest
powershell -command "Get-Process | ForEach-Object {./yara64.exe beaconEye.yar $_.ID -s}"
